create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/lead-model-switch-runtime.js

@@ -25,6 +25,9 @@
 const { createLeadModelSwitch } = require('./lead-model-switch');
 const { writeCodexDefaultModel, writeCodexDefaultEffort, listCodexModels } = require('./codex-default-model');
 const { createLeadModelOptions, claudeEfforts } = require('./lead-model-options');
+const { createOpencodeLaunchModel } = require('./opencode-launch-model');
+const { createDshLaunchModel } = require('./acp/dsh-launch-model');
+const opencodeCli = require('./opencode-cli');
 const { requestWalleAllPages } = require('./walle-paged-read');
 const { modelsMatch, CLAUDE_ALIASES } = require('./lead-model-switch');
 const leadModelObserver = require('./lead-model-observer');
@@ -33,15 +36,28 @@ const { ADAPTER_VERSION } = require('./harness-model-profile');
 const { CODEX_CONTROL_ADAPTER } = require('./codex-harness-qualification');
 const { summarizeRestartGuard } = require('./restart-guard');
 const { getLeadRouteReadiness } = require('./session-create/proxy-route-readiness');
+// WP-1 (docs/lead-route-model-invocability-preflight-2026-10-28.html §5 D-1/D-2, §6.2): the routed
+// switch proves the pair can generate BEFORE the session is parked.
+const { createLeadRoutePreflight } = require('./lead-route-preflight');
 const { workerCapabilityForModel } = require('./model-proxy/routes');
 const { effectiveOutputCap } = require('./model-proxy/output-cap');
 const { modelExecutionRecipeMetadata } = require('./model-execution-recipe-metadata');
 const { capturePrivateSourceEnvironment, attachPrivateSourceRecoveryEnvironment } = require('./lead-model-restore-reconciliation');
 const { createLeadModelTransitionRuntime } = require('./lead-model-transition-runtime');
+// R-1: the ONE wire mapping. An OpenCode lead (and its routed workers) speaks the claude wire, so
+// route servability and the harness profile are asked of 'claude' -- never of 'opencode'.
+const { leadWireAgent } = require('./lead-wire-agent');
 const {
   readSessionModelActionIntent, projectSessionModelConflictContext, sameCoreOwner, coreOwnerTuple,
 } = require('./session-model-action-preconditions');
 const { validateRecipe } = require('./lead-model-transition-store');
+// WP-0/WP-1 (§6/§7): the ONE history-mode module. The planner's pre-park thread check and the
+// restore receipt call the SAME clause, and the recipes carry the SAME mode the controller resolved.
+const { resolveSourceHistoryMode, recipeHistoryMode, sourceModelOrigin, claudeSessionIdArg,
+  targetThreadClause } = require('./lead-switch-history-mode');
+const { freshEvidenceInputs, freshRelaunchArgs } = require('./park-fresh-relaunch');
+// WP-2 S-9: the ONE versioned proxy-filter receipt this launch path stamps onto its own recipe.
+const { CODEX_HISTORICAL_TOOLS_FILTER_RECEIPT } = require('./model-proxy/historical-tool-declarations');
 const { validateSessionModelIntentRequest } = require('./session-model-intent-contract');
 const { canonicalJson } = require('../../shared/coding-model-deployment');
 const { findCatalogRoute } = require('./coding-catalog-route');
@@ -306,12 +322,49 @@ function createLeadTransitionTargetPlanner(deps = {}) {
         return { ok: false, reason: 'lead_target_resume_changed' };
       }
     }
+    // WP-1 D-4 (§7): the SAME thread clause the restore receipt will run, evaluated here so a plan the
+    // receipt would refuse is never allowed to park the source. The recipe pair this planner's
+    // transition will be written with is exactly (source thread, resolved mode), so the clause is
+    // asked of that pair. A 'present' source REQUIRES the plan to resume its own thread -- a
+    // both-absent plan under 'present' is the drift this refuses (the never-prompted source is
+    // declared 'none' by the controller instead); a 'none' source requires a plan with no resume
+    // target at all.
+    const historyMode = recipeHistoryMode(source);
+    if (!targetThreadClause({ source: { historyMode }, target: { historyMode, providerThreadId: canonicalThreadId },
+      launchPlan: result.plan })) {
+      return { ok: false, reason: 'lead_target_resume_inconsistent' };
+    }
     noteLaunchPlanReadinessGeneration(result.plan);
     return { ok: true, generation, launchPlan: result.plan, sourceGeneration };
   };
 
 }
 
+/**
+ * WP-0 D-1/D-2 (§6): the SOURCE history-mode resolver the switch asks BEFORE it claims a transition.
+ * It composes the SAME inputs park already injects (`prepareLifecycleTranscript` + the off-thread
+ * resume ladder), so the switch and park can never disagree about whether a source has history. The
+ * composition lives here; server.js only supplies the two inputs.
+ */
+function createSourceHistoryModeResolver({ getSession, detectAgentType, lifecycleResumeTarget, prepareLifecycleTranscript, resolveRung } = {}) {
+  return async function resolveSourceHistoryModeForSession(sessionId) {
+    try {
+      const session = getSession(String(sessionId || ''));
+      if (!session) return 'present';
+      const agentType = detectAgentType(String(session.cmd || ''));
+      const resumeId = lifecycleResumeTarget(session, agentType) || '';
+      const prepared = typeof prepareLifecycleTranscript === 'function' ? await prepareLifecycleTranscript(session) : null;
+      const { resumeEvidence, jsonlPath } = freshEvidenceInputs({ agentType,
+        transcript: prepared?.transcript || null, codexRolloutPath: prepared?.codexRolloutPath || '' });
+      return await resolveSourceHistoryMode({ agentType, ctmSessionId: String(sessionId), jsonlPath, resumeId, resumeEvidence, resolveRung });
+    } catch {
+      // HANDLE: D-2 -- a missing session, an unreadable transcript or a failed ladder read is never
+      // evidence that the conversation is gone, so the switch keeps today's 'present' path.
+      return 'present';
+    }
+  };
+}
+
 function createLeadModelSwitchRuntime(host) {
   const {
     getSession, detectAgentType, lifecycleResumeTarget, extractResumeTarget,
@@ -335,6 +388,41 @@ function createLeadModelSwitchRuntime(host) {
     finalizeHistoryHandoff: typeof host.finalizeHistoryHandoff === 'function'
       ? host.finalizeHistoryHandoff : async () => ({ ok: false, reason: 'history_runtime_unavailable' }) };
 
+  // WP-0 D-1: an INJECTED resolver wins (tests drive the mode directly); otherwise it is composed
+  // here from the two park inputs the server already injects. A host with neither keeps the
+  // controller's own 'present' default rather than failing the switch.
+  const resolveSourceHistoryModeForSession = typeof host.resolveSourceHistoryMode === 'function'
+    ? host.resolveSourceHistoryMode
+    : createSourceHistoryModeResolver({ getSession, detectAgentType, lifecycleResumeTarget,
+      prepareLifecycleTranscript: host.prepareLifecycleTranscript, resolveRung: host.resolveSourceRung });
+
+  // WP-2 D-6 (§5/§6): the captured launch argv a source lifetime was started with. `getSessionInfo`
+  // already exposes it as `launchContext`; a session with no capture has no argv to read.
+  function capturedLaunchArgs(session) {
+    const args = session?._modelTransitionLaunchContext?.args;
+    return Array.isArray(args) ? args : null;
+  }
+
+  // D-6: an argv that names a model of its own is never a CLI default. `--model=x` is the same flag
+  // as `--model x` for the Claude CLI, so both spellings are matched here (and `-m`).
+  function argvNamesModel(args) {
+    return args.some((arg) => {
+      const text = String(arg);
+      return text === '--model' || text === '-m' || text.startsWith('--model=');
+    });
+  }
+
+  // D-6: CTM's own record of an explicit lead-model choice for this session (`session_lead_model`).
+  // The read is deliberately three-valued: a missing getter or a THROWN read is 'unknown', never
+  // 'absent' — "an unreadable store is not evidence that the conversation is gone" applied to the pin,
+  // so an unreadable row can never be read as proof of a CLI default (AC-2a: a pin READ ERROR records
+  // modelOrigin 'observed').
+  function leadModelPinEvidence(sessionId) {
+    if (!dbModule || typeof dbModule.getSessionLeadModel !== 'function') return 'unknown';
+    try { return dbModule.getSessionLeadModel(sessionId) ? 'present' : 'absent'; }
+    catch { return 'unknown'; } // REPORT: the caller reads 'unknown' as "a pin may exist", not as absence
+  }
+
   function getSessionInfo(sessionId) {
     const session = getSession(sessionId);
     if (!session) return null;
@@ -350,17 +438,27 @@ function createLeadModelSwitchRuntime(host) {
       ? session._modelProcessGeneration : Number(session._launchPlanGeneration || 0);
     const executionRecipe = modelExecutionRecipeMetadata(session._modelExecutionRecipe,
       { sessionId, processGeneration: actualGeneration }).modelExecutionRecipe || null;
+    // §5 D-6: the projector names WHY an uncapturable environment is uncapturable, so the gate's refusal
+    // (WP-3) and the client sentence can say it. 'no_capture' is the only reason 'unknown' can mean.
     const launchEnvironment = session._launchEnvOverridesCaptureState === 'unavailable'
-      ? Object.freeze({ state: 'unavailable', values: null })
+      ? Object.freeze({ state: 'unavailable', values: null, reason: session._launchEnvUnavailableReason || null })
       : session._launchEnvOverridesCaptureState === 'unknown' || !Object.hasOwn(session, '_launchEnvOverrides')
-        ? Object.freeze({ state: 'unknown', values: null })
+        ? Object.freeze({ state: 'unknown', values: null, reason: 'no_capture' })
         : session._launchEnvOverridesCaptureState === 'captured-empty'
-          ? Object.freeze({ state: 'captured', values: Object.freeze({}) })
-          : capturePrivateSourceEnvironment(session._launchEnvOverrides);
+          ? Object.freeze({ state: 'captured', values: Object.freeze({}), reason: null })
+          : Object.freeze({ ...capturePrivateSourceEnvironment(session._launchEnvOverrides), reason: null });
+    // D-6: the source model's ORIGIN, captured where the facts are. True only when every proof of a
+    // real model choice is absent: no session model_id, a captured argv that names no `--model`/`-m`
+    // (and must exist at all to be evidence), and no readable `session_lead_model` pin row.
+    const launchArgs = capturedLaunchArgs(session);
+    const cliDefaultModel = (typeof session.model_id !== 'string' || session.model_id === '')
+      && launchArgs !== null && !argvNamesModel(launchArgs)
+      && leadModelPinEvidence(sessionId) === 'absent';
     return {
       type: session.type || 'pty',
       agent,
       modelId: typeof session.model_id === 'string' ? session.model_id : '',
+      cliDefaultModel,
       resumeId,
       processGeneration: executionRecipe?.processGeneration || actualGeneration || 0,
       providerThreadId: executionRecipe?.providerThreadId || resumeId || session.agentSessionId || session._claudeSessionId || session._providerResumeId || '',
@@ -488,6 +586,22 @@ function createLeadModelSwitchRuntime(host) {
     return await requestOwner('getSessionModelIntent', { ctmSessionId: String(sessionId || '') });
   }
 
+  // WP-1 (§6.2): the ONE preflight, built once per runtime. It reuses the SAME readiness the
+  // resolver already reads (`host.leadRouteDeps?.readiness`, else the configured singleton) and the
+  // SAME proxy supervisor the launch path uses; `host.leadRouteDeps.preflight` is the test seam.
+  // The report is a fire-and-forget health hint for Wall-E's per-pair circuit — it never changes
+  // the switch (REPORT disposition inside the preflight).
+  const leadRoutePreflight = typeof host.leadRouteDeps?.preflight === 'function'
+    ? host.leadRouteDeps.preflight
+    : createLeadRoutePreflight({
+      // Production injects no leadRouteDeps and uses the real supervisor. An injected leadRouteDeps
+      // (tests) without an `oauthProxySupervisor` probes nothing, so no test can start a real proxy.
+      getSupervisor: () => (host.leadRouteDeps ? host.leadRouteDeps.oauthProxySupervisor || null : require('./oauth-proxy-supervisor')),
+      getReadiness: () => host.leadRouteDeps?.readiness || getLeadRouteReadiness(),
+      report: (body) => requestWalleData('/api/models/route-health', { method: 'POST', body }, 5000),
+      diagnostic: recordSessionDiagnostic,
+    });
+
   // D-2 (§6.5): the routed-lead resolver. Every refusal carries a SPECIFIC reason AND a specific
   // sentence (never the generic "The target route is unavailable." that pointed at a healthy route).
   // The service entry below is the ONE refusal-logging seam, so a refused switch is diagnosable from
@@ -508,9 +622,13 @@ function createLeadModelSwitchRuntime(host) {
     }
     const readiness = host.leadRouteDeps?.readiness || getLeadRouteReadiness();
     if (!readiness) return refusal('proxy_unconfigured');
+    // R-1/S-8: an OpenCode lead dials the claude wire -- the route must be servable to 'claude', and
+    // the harness profile below is the claude-code one. `agent` itself still decides the native
+    // shortcut above (isNativeLeadModel, codex's model/list), so Claude/Codex stay byte-identical.
+    const wire = leadWireAgent(agent);
     let readinessResult;
     try {
-      readinessResult = await readiness.resolveRoute({ route: routeId, model: modelId, agent, signal });
+      readinessResult = await readiness.resolveRoute({ route: routeId, model: modelId, agent: wire, signal });
     } catch (err) {
       return refusal(err && err.code ? err.code : 'route_invalid', String(err && err.message || err).slice(0, 200));
     }
@@ -527,12 +645,21 @@ function createLeadModelSwitchRuntime(host) {
     const deployment = readinessResult?.deployment || null;
     if (!deployment || readinessResult.metadataUnavailable) return refusal('model_metadata_unavailable');
     if (!Number.isSafeInteger(deployment.contextTokens) || deployment.contextTokens <= 0) return refusal('model_context_unknown');
+    // WP-1 D-1: prove the pair can generate BEFORE anything touches the session. This runs after
+    // every existence/metadata check (so a probe is never spent on a pair that cannot be prepared
+    // anyway) and before `prepareLeadProfile`/park. Its refusal already has the
+    // `{ ok:false, reason, message }` shape the resolver returns everywhere else.
+    // §12a rule 1: probe the wire THIS harness will dial. Codex reads the Responses face, Claude (and
+    // an OpenCode lead, R-1) the Anthropic Messages face; without it the probe would dial its own
+    // preferred wire and could refuse a pair the lead's harness runs perfectly well.
+    const pre = await leadRoutePreflight({ routeId, modelId, sessionId, signal, face: wire === 'codex' ? 'responses' : 'anthropic' });
+    if (pre && pre.refusal) return pre.refusal;
     let preparedProfile;
     try {
       if (typeof prepareLeadProfile !== 'function' || typeof getDataDir !== 'function') return refusal('model_profile_unavailable');
       const session = getSession(sessionId);
       preparedProfile = await prepareLeadProfile({
-        deployment, harness: agent === 'codex' ? 'codex-cli' : 'claude-code',
+        deployment, harness: wire === 'codex' ? 'codex-cli' : 'claude-code',
         binaryPath: session?.cmd || '', adapterVersion: ADAPTER_VERSION,
         routeId, providerId: readinessResult.providerId || routeId, wireModelId: modelId,
         artifactRoot: path.join(getDataDir(), 'model-profiles'), signal,
@@ -561,40 +688,71 @@ function createLeadModelSwitchRuntime(host) {
     };
   }
 
+  // The ONE park and the ONE restore, defined once. The journaled Claude/Codex machine and the
+  // OpenCode launch controller (WP-1) receive these EXACT lambdas: a relaunch has one implementation,
+  // so the private restore intent, the one-shot override and the deferred-restore handoff cannot
+  // drift between the two controllers.
+  const parkForLeadSwitch = (sessionId, opts) => parkSession(sessionId, opts);
+  const restoreForLeadSwitch = async (sessionId, opts) => {
+    const placeholder = getSession(sessionId);
+    // A wake already in flight (or a session that already woke) started WITHOUT the override:
+    // starting again would dedupe onto it and lose the flag, so report "not restarted on the
+    // requested model" instead of pretending.
+    if (!placeholder || placeholder._restoreDeferred !== true || placeholder._activationStartPromise) return false;
+    const restoreOptions = {
+      // Preserve the controller's trusted private restore intent across this wrapper. The
+      // server later normalizes activation priority but uses the original options to forward
+      // the non-enumerable transition claim into its exact target-owner authorization boundary.
+      source: opts.source === 'lead-model' && opts.leadModelTransition ? 'lead-model' : 'remote-activate',
+      clientKind: 'api',
+      launchModelOverride: opts.launchModelOverride,
+      launchEffortOverride: opts.launchEffortOverride,
+      // D-6: the routed launch plan rides this ONE restore (an object = routed, null = explicitly
+      // native so the stored route row does not re-apply). Absent = the stored row applies.
+      ...(Object.hasOwn(opts, 'launchLeadRoute') ? { launchLeadRoute: opts.launchLeadRoute } : {}),
+      transitionSignal: opts.signal,
+      preparedLaunchPlan: opts.preparedLaunchPlan,
+      expectedProviderThreadId: opts.expectedProviderThreadId || null,
+      expectedSourceGeneration: opts.expectedSourceGeneration || null,
+    };
+    if (opts.leadModelTransition) Object.defineProperty(restoreOptions, 'leadModelTransition', {
+      value: opts.leadModelTransition, enumerable: false,
+    });
+    const started = await startDeferredRestoreSession(placeholder, restoreOptions);
+    return started === true;
+  };
+
+  // A routed lead switch is validated against the SAME readiness the delegate path uses (WP-1b):
+  // the route must resolve (exist/enabled/routable/servable) for this agent, and the model must be
+  // in Wall-E's coding catalog (that is where its display name and context window come from).
+  // D-2: the ONE refusal-logging seam. The specific reason reaches ctm.log, and the message it
+  // returns (never generic) is what the caller stores as the request's detail. It is a named lambda
+  // because the OpenCode launch adapter (WP-3) is handed the SAME one -- no second resolver.
+  const resolveLeadRoute = async (agent, routeId, modelId, sessionId, opts) => {
+    const v = await resolveLeadRouteChecked(agent, routeId, modelId, sessionId, opts);
+    if (!v.ok) {
+      process.stderr.write(`[lead-model] route refused session=${String(sessionId).slice(0, 8)} route=${routeId} model=${modelId} reason=${v.reason}\n`);
+    }
+    return v;
+  };
+  // WP-3: the session_lead_route reader/writer the journaled machine already uses. Named lambdas so
+  // the OpenCode launch adapter gets the EXACT same persistence -- one row, one agent encoding.
+  const getLeadRoute = (sessionId) => {
+    try { return dbModule.getSessionLeadRoute(sessionId); }
+    catch (error) { recordSessionDiagnostic(sessionId, 'lead-route-read-failed', { message: String(error && error.message || error).slice(0, 200) }); /* REPORT: treated as no stored route, so a native switch adds no explicit null */ return null; }
+  };
+  const persistLeadRoute = async (sessionId, agent, route) => {
+    if (route) return await dbModule.setSessionLeadRoute({ ctmSessionId: sessionId, agent, routeId: route.routeId, model: route.model, display: route.display, contextWindow: route.contextWindow, profileFingerprint: route.profileFingerprint, factsRevision: route.factsRevision, processGeneration: route.processGeneration, transitionId: route.transitionId });
+    return await dbModule.deleteSessionLeadRoute(sessionId);
+  };
+
   const service = createLeadModelSwitch({
     getSessionInfo,
     isIdle,
     captureActionContext,
     readModelIntent,
-    park: (sessionId, opts) => parkSession(sessionId, opts),
-    restore: async (sessionId, opts) => {
-      const placeholder = getSession(sessionId);
-      // A wake already in flight (or a session that already woke) started WITHOUT the override:
-      // starting again would dedupe onto it and lose the flag, so report "not restarted on the
-      // requested model" instead of pretending.
-      if (!placeholder || placeholder._restoreDeferred !== true || placeholder._activationStartPromise) return false;
-      const restoreOptions = {
-        // Preserve the controller's trusted private restore intent across this wrapper. The
-        // server later normalizes activation priority but uses the original options to forward
-        // the non-enumerable transition claim into its exact target-owner authorization boundary.
-        source: opts.source === 'lead-model' && opts.leadModelTransition ? 'lead-model' : 'remote-activate',
-        clientKind: 'api',
-        launchModelOverride: opts.launchModelOverride,
-        launchEffortOverride: opts.launchEffortOverride,
-        // D-6: the routed launch plan rides this ONE restore (an object = routed, null = explicitly
-        // native so the stored route row does not re-apply). Absent = the stored row applies.
-        ...(Object.hasOwn(opts, 'launchLeadRoute') ? { launchLeadRoute: opts.launchLeadRoute } : {}),
-        transitionSignal: opts.signal,
-        preparedLaunchPlan: opts.preparedLaunchPlan,
-        expectedProviderThreadId: opts.expectedProviderThreadId || null,
-        expectedSourceGeneration: opts.expectedSourceGeneration || null,
-      };
-      if (opts.leadModelTransition) Object.defineProperty(restoreOptions, 'leadModelTransition', {
-        value: opts.leadModelTransition, enumerable: false,
-      });
-      const started = await startDeferredRestoreSession(placeholder, restoreOptions);
-      return started === true;
-    },
+    park: parkForLeadSwitch,
+    restore: restoreForLeadSwitch,
     writeCodexDefault: (model) => writeCodexDefaultModel({ model }),
     writeCodexDefaultEffort: (effort) => writeCodexDefaultEffort({ effort }),
     // The efforts the Lead options row of the target model supports (a Claude model the rows do not
@@ -611,22 +769,13 @@ function createLeadModelSwitchRuntime(host) {
       if (effort) return await dbModule.setSessionLeadEffort(sessionId, agent, effort);
       return await dbModule.deleteSessionLeadEffort(sessionId);
     },
-    // A routed lead switch is validated against the SAME readiness the delegate path uses (WP-1b):
-    // the route must resolve (exist/enabled/routable/servable) for this agent, and the model must be
-    // in Wall-E's coding catalog (that is where its display name and context window come from).
-    // D-2: the ONE refusal-logging seam. The specific reason reaches ctm.log, and the message it
-    // returns (never generic) is what the caller stores as the request's detail.
-    resolveLeadRoute: async (agent, routeId, modelId, sessionId, opts) => {
-      const v = await resolveLeadRouteChecked(agent, routeId, modelId, sessionId, opts);
-      if (!v.ok) {
-        process.stderr.write(`[lead-model] route refused session=${String(sessionId).slice(0, 8)} route=${routeId} model=${modelId} reason=${v.reason}\n`);
-      }
-      return v;
-    },
+    resolveLeadRoute,
     prepareHistory: historyRuntime.prepareHistoryTransition,
     revalidateHistoryBeforePark: historyRuntime.revalidateHistoryBeforePark,
     finalizeHistoryHandoff: historyRuntime.finalizeHistoryHandoff,
     prepareTargetPlan: host.prepareTargetPlan,
+    // WP-0 D-1: resolved ONCE per request, before the claim, and journaled on both recipes.
+    resolveSourceHistoryMode: resolveSourceHistoryModeForSession,
     stageTarget: host.stageLeadTarget || (async ({ sessionId, transitionId, journal, expectedRevision, source, targetPlan, route, signal }) => {
       if (!journal || !Number.isSafeInteger(targetPlan?.generation) || !route?.preparedProfile) return { ok: false, reason: 'lead_transition_owner_unavailable' };
       const session = getSession(sessionId);
@@ -641,14 +790,8 @@ function createLeadModelSwitchRuntime(host) {
       }, { ...(leadRouteDeps || {}), profileLoader: async () => route.preparedProfile });
       return result.ok ? { ok: true, preparedLeadRoute: result } : result;
     }),
-    getLeadRoute: (sessionId) => {
-      try { return dbModule.getSessionLeadRoute(sessionId); }
-      catch (error) { recordSessionDiagnostic(sessionId, 'lead-route-read-failed', { message: String(error && error.message || error).slice(0, 200) }); /* REPORT: treated as no stored route, so a native switch adds no explicit null */ return null; }
-    },
-    persistLeadRoute: async (sessionId, agent, route) => {
-      if (route) return await dbModule.setSessionLeadRoute({ ctmSessionId: sessionId, agent, routeId: route.routeId, model: route.model, display: route.display, contextWindow: route.contextWindow, profileFingerprint: route.profileFingerprint, factsRevision: route.factsRevision, processGeneration: route.processGeneration, transitionId: route.transitionId });
-      return await dbModule.deleteSessionLeadRoute(sessionId);
-    },
+    getLeadRoute,
+    persistLeadRoute,
     beginTransition: async ({ transitionId, sessionId, source, target, targetPlan, request, actionContext = null }) => {
       // WP-2A: a NEW action always needs the durable journal. A runtime whose db module has none
       // refuses the action outright rather than falling back to a direct effort/route write.
@@ -687,8 +830,16 @@ function createLeadModelSwitchRuntime(host) {
       const targetProfile = target.preparedProfile || null;
       const sourceRecipeId = `${transitionId}:source`;
       const targetRecipeId = `${transitionId}:target`;
+      // WP-0 D-1/S-2-S-3: ONE mode per transition, resolved by the controller BEFORE this claim and
+      // written on BOTH recipes. Absent reads as 'present' (the pre-change behaviour), so only a
+      // deliberately resolved 'none' ever takes the resume-less path.
+      const historyMode = recipeHistoryMode(source);
+      // WP-2 D-6: beside the mode, the ONE other fact rollback needs — where the source model came
+      // from. 'cli-default' is the only spelling that lets a resume-less recovery omit the one-shot
+      // model override; everything else is 'observed'.
+      const modelOrigin = sourceModelOrigin(source);
       const sourceRecipe = {
-        id: sourceRecipeId, sessionId, providerThreadId: source.providerThreadId, harness,
+        id: sourceRecipeId, sessionId, providerThreadId: source.providerThreadId, harness, historyMode, modelOrigin,
         providerId: source.routeId || source.modelExecutionRecipe?.routeId || source.modelProvider || 'unknown',
         origin: source.routeId ? 'routed-proxy' : (source.agent === 'codex' ? 'native-codex' : 'native-claude'),
         controlAdapterVersion: source.agent === 'codex' ? CODEX_CONTROL_ADAPTER : null,
@@ -707,12 +858,18 @@ function createLeadModelSwitchRuntime(host) {
         approvalPolicyReference: 'host:session-policy', compactHash: null,
       };
       const targetRecipe = {
-        id: targetRecipeId, sessionId, providerThreadId: source.providerThreadId, harness,
+        id: targetRecipeId, sessionId, providerThreadId: source.providerThreadId, harness, historyMode,
         providerId: target.routeId || 'unknown', origin: target.routeId ? 'routed-proxy' : 'unknown',
         // The marker names the Codex app-server conversion adapter. A Claude target -- routed or
         // native -- has no conversion adapter at all, so recording the Codex one there would claim a
         // conversion this operation never performs (same-harness native resume).
         controlAdapterVersion: harness === 'codex-cli' && target.routeId ? CODEX_CONTROL_ADAPTER : null,
+        // WP-2 D-4: the versioned historical-tool filter receipt is a claim about THIS launch path
+        // only -- a server-built Codex target launched through the local authenticated CTM proxy
+        // route. A native/no-route target, a non-Codex target, a source recipe and any client input
+        // never carry it (the store validator rejects every value but null or the exact constant).
+        historyToolFilterReceipt: harness === 'codex-cli' && target.routeId
+          ? CODEX_HISTORICAL_TOOLS_FILTER_RECEIPT : null,
         programVersion: null, cyberAccessProgram: null,
         routeId: target.routeId || null,
         wireModelId: target.routeId ? (target.modelId || null) : null, processGeneration: targetPlan.generation,
@@ -778,7 +935,12 @@ function createLeadModelSwitchRuntime(host) {
           || (source.agent === 'codex' && (!sourceContext.homeDir || !sourceContext.codexHome))) {
         return { ok: false, reason: 'source_launch_context_unavailable' };
       }
-      if (!source?.modelId) return { ok: false, reason: 'source_model_unknown' };
+      // WP-2 D-6 (S-7): WHERE this source's model came from decides how it is restored. An empty
+      // model_id is only legitimate for a source whose recipe recorded the explicit 'cli-default'
+      // origin (nothing was ever chosen, so the original launch argv IS the model); every other empty
+      // model stays today's `source_model_unknown` refusal.
+      const sourceOrigin = sourceModelOrigin(source);
+      if (!source?.modelId && sourceOrigin !== 'cli-default') return { ok: false, reason: 'source_model_unknown' };
       let route = source?.leadRoute || null;
       if (!route) {
         try { route = dbModule.getSessionLeadRoute(sessionId) || null; } catch { route = null; }
@@ -795,8 +957,37 @@ function createLeadModelSwitchRuntime(host) {
         factsRevision: route.facts_revision || route.factsRevision || null,
         providerThreadId: source.providerThreadId,
       } : null;
+      // WP-2 D-5 (§5/§6, S-7): a 'none' source has nothing to resume, so a rollback relaunches the
+      // ORIGINAL captured argv instead of forcing `--resume` on a conversation that was never written.
+      // The mode is RE-READ here through the same host function WP-0 added, because the user may have
+      // typed while the switch was in flight (R-1): the moment a transcript exists, today's `--resume`
+      // path is the right one again. Any other answer -- including a thrown or non-committal one --
+      // keeps that path (D-2: an unreadable store is never evidence of absence).
+      let freshRelaunch = false;
+      if (recipeHistoryMode(source) === 'none') {
+        let modeNow = 'present';
+        try { modeNow = await resolveSourceHistoryModeForSession(sessionId); }
+        catch { modeNow = 'present'; } // HANDLE: D-2 -- a broken re-check is not proof the transcript is gone
+        freshRelaunch = modeNow === 'none';
+      }
       let recoveryArgs = sourceContext.args;
-      if (source.agent === 'codex') {
+      if (freshRelaunch) {
+        // The fresh argv is the launch args MINUS resume forms (lib/park-fresh-relaunch.js): the
+        // captured startup argv names its own thread through `--session-id`, which is exactly the
+        // identity this source owns, so no `--resume <thread>` is ever issued for it.
+        const fresh = freshRelaunchArgs({ agentType: source.agent,
+          storedTask: { cmd: sourceContext.executablePath, args: sourceContext.args },
+          sessionCmd: sourceContext.executablePath, sessionId, resumeId: source.providerThreadId });
+        if (!fresh) return { ok: false, reason: 'source_launch_context_unavailable' };
+        recoveryArgs = fresh.args;
+        // Asserted, not assumed: the fresh relaunch must hand the process the SOURCE's own thread. The
+        // captured argv normally already carries it from launch; when it does not, it is added here.
+        if (source.agent === 'claude') {
+          const argvThread = claudeSessionIdArg(recoveryArgs);
+          if (!argvThread) recoveryArgs = [...recoveryArgs, '--session-id', source.providerThreadId];
+          else if (argvThread !== sourceThreadId) return { ok: false, reason: 'source_launch_context_unavailable' };
+        }
+      } else if (source.agent === 'codex') {
         const rebound = require('./launch-model-override').ensureCodexResumeTarget(recoveryArgs, source.providerThreadId);
         if (!rebound.ok) return { ok: false, reason: rebound.reason };
         recoveryArgs = rebound.args;
@@ -813,10 +1004,17 @@ function createLeadModelSwitchRuntime(host) {
         recoveryArgs = rebound.args;
       }
       const selectedSourceThread = extractResumeTarget(source.agent, recoveryArgs)?.sessionId || '';
-      if (selectedSourceThread !== sourceThreadId) return { ok: false, reason: 'source_launch_context_unavailable' };
+      // The fresh branch carries no resume selector AT ALL, so '' is its only acceptable answer; the
+      // resume path keeps today's exact-source-thread requirement.
+      if (selectedSourceThread !== (freshRelaunch ? '' : sourceThreadId)) {
+        return { ok: false, reason: 'source_launch_context_unavailable' };
+      }
       const restoreOptions = {
         source: 'remote-activate', clientKind: 'api',
-        launchModelOverride: source.modelId,
+        // D-5/D-6: a 'cli-default' source's rollback passes NO `launchModelOverride` key at all, so
+        // the relaunched process lands on the CLI's own default by construction; every other source
+        // keeps today's one-shot override.
+        ...(sourceOrigin === 'cli-default' ? {} : { launchModelOverride: source.modelId }),
         ...(typeof source.effort === 'string' ? { launchEffortOverride: source.effort } : {}),
         launchLeadRoute,
         expectedProviderThreadId: source.providerThreadId,
@@ -834,7 +1032,8 @@ function createLeadModelSwitchRuntime(host) {
       };
       if (!attachPrivateSourceRecoveryEnvironment(restoreOptions, { ctmSessionId: sessionId,
             agent: source.agent, modelId: source.modelId, providerThreadId: source.providerThreadId,
-            routeId: source.routeId || null, environment: source.launchEnvironment })) {
+            routeId: source.routeId || null, environment: source.launchEnvironment,
+            modelOrigin: sourceOrigin, freshRelaunch })) {
         return { ok: false, reason: 'source_launch_environment_unavailable' };
       }
       const currentOwner = () => {
@@ -876,7 +1075,9 @@ function createLeadModelSwitchRuntime(host) {
         const parkedFrom = session;
         const parked = await parkSession(sessionId, { manual: true, reason: 'model-transition-source-recovery',
           sourceGeneration: expectedAbandoned.processGeneration });
-        if (!parked || (parked.ok !== true && parked.alreadyParked !== true)) return { ok: false, reason: parked?.code || 'source_recovery_park_failed' };
+        if (!parked || (parked.ok !== true && parked.alreadyParked !== true)) {
+          return { ok: false, reason: parked?.code || 'source_recovery_park_failed', protections: parked?.protections || [], retryAt: parked?.retryAt ?? null };
+        }
         const placeholder = getSession(sessionId);
         if (!placeholder || placeholder._restoreDeferred !== true || placeholder.ptyProcess) {
           return { ok: false, reason: 'recovery_owner_changed_after_park' };
@@ -1022,14 +1223,90 @@ function createLeadModelSwitchRuntime(host) {
     diagnostic: recordSessionDiagnostic,
   });
 
+  // WP-1 (docs/opencode-lead-and-delegate-model-selection-2026-10-28.html §5 R-2..R-9, §6.3):
+  // the never-prompted OpenCode 1.x switch is its own small controller (no owner tuple, no provider
+  // thread, no journal). It is handed the SAME park/restore lambdas the journaled machine uses, so a
+  // relaunch has one implementation. `opencodeVersion`/`listOpencodeModels` are overridable host DI in
+  // the same way `listCodexModels` is (a test never spawns the real CLI).
+  const opencodeLaunchModel = createOpencodeLaunchModel({
+    getSessionInfo,
+    getSession,
+    opencodeVersion: typeof host.opencodeVersion === 'function' ? host.opencodeVersion : opencodeCli.opencodeVersion,
+    listModels: typeof host.listOpencodeModels === 'function' ? host.listOpencodeModels : opencodeCli.opencodeCatalog,
+    // WP-3 (S-9): the SAME shared pieces the journaled machine uses -- the one route resolver (D-2,
+    // which logs refusals) and the one session_lead_route row reader/writer. A routed OpenCode target
+    // is validated, persisted and re-adopted exactly like a Claude/Codex one; only the relaunch step
+    // differs (R-3).
+    resolveLeadRoute,
+    getLeadRoute,
+    persistLeadRoute,
+    park: parkForLeadSwitch,
+    restore: restoreForLeadSwitch,
+    isIdle,
+    broadcast,
+    diagnostic: recordSessionDiagnostic,
+  });
+
+  // WP-8 step 3 (docs/deepseek-harness-acp-agent-2026-10-28.html §6.7, §9b M-15): the DeepSeek
+  // Harness live switch. dsh is an ACP child, so the switch is `session/set_config_option` on the
+  // SAME child (one route) or one intentional stop + the existing restore path (another route) — no
+  // park/argv machinery and no journal. Its public request shape is OpenCode's byte for byte, so the
+  // picker renders both with one code path; `dshRuntime`/`dshSession` are the server's own instances.
+  const dshLaunchModel = createDshLaunchModel({
+    getSessionInfo,
+    getSession,
+    dshRuntime: host.dshRuntime,
+    dshSession: host.dshSession,
+    broadcast,
+    diagnostic: recordSessionDiagnostic,
+  });
+
+  // WP-6a: warm the spawn-free OpenCode line (package.json of the resolved binary) at boot, so the
+  // synchronous launch path's peekOpencodeLine() already knows whether `--model` is safe to pass.
+  if (host.warmOpencodeLine !== false) {
+    void opencodeCli.opencodeLine().catch(() => { /* expected: an undetected line keeps today's launch args */ });
+  }
+
+  // One owner per agent: an OpenCode tab is answered by the launch controller, a dsh tab by the ACP
+  // controller, everything else by the journaled machine, byte-for-byte unchanged.
+  const isOpencodeSession = (sessionId) => {
+    const info = getSessionInfo(String(sessionId || ''));
+    return !!info && info.agent === 'opencode';
+  };
+  const isDshSession = (sessionId) => {
+    const info = getSessionInfo(String(sessionId || ''));
+    return !!info && info.agent === 'dsh';
+  };
+  const routeLeadModelCall = (name) => {
+    const base = service[name].bind(service);
+    return (sessionId, ...rest) => {
+      if (isOpencodeSession(sessionId)) return opencodeLaunchModel[name](sessionId, ...rest);
+      if (isDshSession(sessionId)) return dshLaunchModel[name](sessionId, ...rest);
+      return base(sessionId, ...rest);
+    };
+  };
+  service.request = routeLeadModelCall('request');
+  service.get = routeLeadModelCall('get');
+  service.cancel = routeLeadModelCall('cancel');
+
   leadModelObserver.attach({
     wants: (sessionId) => service.wantsObservation(sessionId),
-    observe: (sessionId, obs) => service.observe(sessionId, obs),
+    observe: (sessionId, obs) => {
+      const verdict = service.observe(sessionId, obs);
+      // OpenCode settles from the session's own `opencode:message` observation fields (R-7); the
+      // lead-model observer knows only Claude/Codex turn sources, so the controller is told directly.
+      opencodeLaunchModel.notifyObservation(sessionId);
+      return verdict;
+    },
     observeSelection: (sessionId, obs) => service.observeSelection(sessionId, obs),
   });
 
   statusBus.on('verdict', (ev) => {
-    if (ev && ev.sessionId && ev.status !== 'running' && ev.status !== 'stalled') void service.notifyStatus(ev.sessionId);
+    if (ev && ev.sessionId && ev.status !== 'running' && ev.status !== 'stalled') {
+      void service.notifyStatus(ev.sessionId);
+      // A turn that just ended is when an OpenCode observation lands: settle without waiting for a poll.
+      opencodeLaunchModel.notifyObservation(ev.sessionId);
+    }
   });
 
   // The Lead tab's rows (GET /api/sessions/:id/lead-model/options): what this CLI can switch to.
@@ -1041,8 +1318,11 @@ function createLeadModelSwitchRuntime(host) {
     getSessionInfo,
     loadCatalog: () => loadCatalogItems(),
     listCodexModels: typeof host.listCodexModels === 'function' ? host.listCodexModels : () => listCodexModels(),
+    ...(typeof host.listOpencodeModels === 'function' ? { listOpencodeModels: host.listOpencodeModels } : {}),
     ...(typeof host.readClaudeSettings === 'function' ? { readClaudeSettings: host.readClaudeSettings } : {}),
     ...(typeof host.readCodexConfigToml === 'function' ? { readCodexConfigToml: host.readCodexConfigToml } : {}),
+    // WP-8 step 4: a dsh tab's in-route rows and efforts come from its live ACP child's configOptions.
+    getDshConfigOptions: (id) => { const live = host.dshRuntime && host.dshRuntime.get(id); return live && Array.isArray(live.configOptions) ? live.configOptions : null; },
   });
   // D-7 (picker design WP-4): Wall-E's registry-changed notify routes here, so the Lead tab never
   // serves a catalog that predates the change.
@@ -1096,9 +1376,13 @@ function createLeadModelSwitchRuntime(host) {
         return superseded();
       }
       if (!intent.ok) return { status: intent.status, body: { ok: false, code: intent.code } };
-      return { status: out.status, body: { ...out.body, stored_effort: stored, lead_route: leadRoute,
+      const body = { ...out.body, stored_effort: stored, lead_route: leadRoute,
         expected_owner: capture.owner, intent_revision: intent.revision, intent: intent.intent,
-        action_state: capture.owner ? 'ready' : 'owner_not_ready' } };
+        action_state: capture.owner ? 'ready' : 'owner_not_ready' };
+      // WP-1 (§6.2): ONE added field, for an OpenCode tab only. Every existing field stays exactly as
+      // it is for Claude/Codex, so no client has to learn a second response shape.
+      if (isOpencodeSession(sessionId)) body.opencode = await opencodeLaunchModel.sessionMode(sessionId);
+      return { status: out.status, body };
     }
   };
 
@@ -1107,4 +1391,4 @@ function createLeadModelSwitchRuntime(host) {
 
 // WP-5 (F-1): `refusal` is exported so its own fallback contract (never an inherited
 // Object.prototype member) has a direct unit test; it is the same function every route refusal uses.
-module.exports = { createLeadModelSwitchRuntime, createLeadTransitionTargetPlanner, ROUTE_REFUSAL_MESSAGES, refusal };
+module.exports = { createLeadModelSwitchRuntime, createLeadTransitionTargetPlanner, createSourceHistoryModeResolver, ROUTE_REFUSAL_MESSAGES, refusal };