create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/lead-model-switch.js

@@ -67,6 +67,10 @@ const NOT_RESUMABLE_PARK_CODES = new Set(['session_not_resumable']);
 // this module re-exports the history message projector so no import path changes.
 const DEFAULT_RELAUNCH_DEADLINE_MS = 180_000;
 const ACTIVE_JOURNAL_STATES = new Set(['queued', 'preparing', 'compacting', 'verified', 'handing_off', 'awaiting_turn']);
+// WP-1/D-2: provider statuses that mean "this target can never serve a turn as configured" (model
+// access, bad request, auth). Everything else -- 408/409/429/5xx/529, or no status at all -- is
+// transient, so the switch keeps waiting for a later successful turn instead of undoing the pick.
+const PERMANENT_TURN_FAILURE_STATUSES = new Set([400, 401, 403, 404, 422]);
 
 // historyPreparationMessage / parkRefusalDetail / PARK_REFUSAL_SENTENCES: see the approved helper.
 
@@ -141,6 +145,7 @@ function createLeadModelSwitch(deps) {
     revalidateHistoryBeforePark = async () => ({ ok: false, reason: 'history_revalidation_unavailable' }),
     cleanupStagedTarget = async () => true,
     prepareTargetPlan = async () => null,
+    resolveSourceHistoryMode = null, // WP-0 D-1; absent -> 'present' (pre-change behaviour)
     stageTarget = async () => null,
     getLeadRoute = () => null,
     persistLeadRoute = () => {},
@@ -386,12 +391,25 @@ function createLeadModelSwitch(deps) {
     entry.req.cancellable = false;
     entry.req.detail = 'Restoring the captured source provider lifetime.';
     emit(entry, 'recovering');
+    entry.recoveryRunning = true;
     entry.recoveryPromise = Promise.resolve().then(() => cleanupStaged(entry)).then(() => recoverSource({
       sessionId: entry.req.ctm_session_id, source: entry.sourceInfo, transition: entry.transition,
       targetStarted: !!entry.targetStarted, targetOwner: entry.targetOwner || null,
     })).then((result) => {
       entry.recovered = !!result?.ok;
-      if (!entry.recovered) {
+      if (!entry.recovered && recoveryRefusalIsTransient(result)) {
+        // Live 10-28 (textbook 3ae5a121, transition 79c30333): the target's first turn was refused
+        // and this recovery ran while the server still called the session `running` (it went idle
+        // 15 s later); the park refused it and recovery ended for good, leaving the session on a
+        // target that cannot serve a turn. A busy refusal waits for the next idle edge instead,
+        // exactly like the forward park (REQUEUE_PARK_CODES).
+        entry.recoveryPromise = null;
+        entry.recoveryAwaitingIdle = true;
+        const cause = entry.failureOutcome?.detail || 'The requested target was not applied.';
+        entry.req.detail = `${cause} The captured source provider is restored once the session is idle.`;
+        diagnostic(entry.req.ctm_session_id, 'lead-transition-source-recovery-deferred', { protections: result.protections || [] });
+        armRecoveryRetry(entry, Number(result.retryAt));
+      } else if (!entry.recovered) {
         entry.req.recovery_reason = 'source_recovery_failed';
         diagnostic(entry.req.ctm_session_id, 'lead-transition-source-recovery-failed', { reason: String(result?.reason || 'unknown').slice(0, 120) });
         const cause = entry.failureOutcome?.detail || 'The requested target was not applied.';
@@ -412,8 +430,47 @@ function createLeadModelSwitch(deps) {
       diagnostic(entry.req.ctm_session_id, 'lead-source-recovery-failed', { message: recoveryDetail });
       emit(entry, entry.req.state);
       return { ok: false, reason: 'source_recovery_failed' };
-    });
-    return entry.recoveryPromise;
+    }).finally(() => { entry.recoveryRunning = false; });
+    return entry.recoveryPromise || Promise.resolve(null);
+  }
+
+  function recoveryRefusalIsTransient(result) {
+    const protections = Array.isArray(result?.protections) ? result.protections : [];
+    return REQUEUE_PARK_CODES.has(String(result?.reason || '')) && !protections.some((p) => NON_TRANSIENT_PROTECTIONS.has(p));
+  }
+
+  function armRecoveryRetry(entry, at) {
+    if (!Number.isFinite(at) || at <= now()) return;
+    if (entry.recoveryRetryTimer) clearTimeoutFn(entry.recoveryRetryTimer);
+    entry.recoveryRetryTimer = setTimeoutFn(() => {
+      entry.recoveryRetryTimer = null;
+      void notifyStatus(entry.req.ctm_session_id);
+    }, at - now());
+    if (entry.recoveryRetryTimer && typeof entry.recoveryRetryTimer.unref === 'function') entry.recoveryRetryTimer.unref();
+  }
+
+  // A recovery waiting for idle re-runs on the next idle edge, only while its request is still the
+  // session's latest one: a new pick replaces the entry, and that pick's own park moves the target.
+  function retryRecoveryWhenIdle(entry) {
+    const id = entry.req.ctm_session_id;
+    if (entry.recoveryCheck) { entry.recoveryEdgePending = true; return entry.recoveryCheck; }
+    entry.recoveryCheck = Promise.resolve().then(async () => {
+      for (let checkCount = 0; checkCount < 2; checkCount += 1) {
+        entry.recoveryEdgePending = false;
+        let idle = false;
+        try { idle = (await isIdle(id)) === true; }
+        catch (error) { diagnostic(id, 'lead-model-idle-check-failed', { message: String(error && error.message || error).slice(0, 200) }); }
+        if (entries.get(id) !== entry || !entry.recoveryAwaitingIdle) return;
+        if (idle) {
+          entry.recoveryAwaitingIdle = false;
+          if (entry.recoveryRetryTimer) { clearTimeoutFn(entry.recoveryRetryTimer); entry.recoveryRetryTimer = null; }
+          await recoverAbandonedSource(entry);
+          return;
+        }
+        if (!entry.recoveryEdgePending) return;
+      }
+    }).finally(() => { entry.recoveryCheck = null; });
+    return entry.recoveryCheck;
   }
 
   function isPending(entry) {
@@ -468,8 +525,8 @@ function createLeadModelSwitch(deps) {
     if (!routeId && !effortOnly && !isSwitchableModel(info.agent, modelId)) return refuse(400, 'lead_model_not_switchable', { model_id: modelId });
     if (scope === 'session+default' && info.agent !== 'codex') return refuse(400, 'lead_default_unsupported', { agent: info.agent });
     if (info.launchEnvironment?.state !== 'captured') {
-      return refuse(409, 'lead_switch_unsupported', { reason: 'source_launch_environment_unavailable',
-        message: 'The source launch environment cannot be recovered safely, so its process was left running.' });
+      try { diagnostic(id, 'lead-model-refused', { reason: 'source_launch_environment_unavailable', cause: info.launchEnvironment?.reason ?? null }); } catch (error) { process.stderr.write(`[lead-transition] diagnostic sink failed code=${String(error?.code || 'sink_failed').slice(0, 64)}\n`); }
+      return refuse(409, 'lead_switch_unsupported', { reason: 'source_launch_environment_unavailable', cause: info.launchEnvironment?.reason ?? null, message: 'The source launch environment cannot be recovered safely, so its process was left running.' });
     }
 
     const existing = entries.get(id);
@@ -481,7 +538,10 @@ function createLeadModelSwitch(deps) {
       return refuse(409, 'client_request_conflict');
     }
     if (existing?.confirmationPromise) return refuse(409, 'lead_transition_committing', { request: publicRequest(existing.req) });
-    if (existing?.handoffStarted && (existing.sourceParked || existing.targetStarted) && !existing.recovered && ['cancelled', 'failed'].includes(existing.req.state)) {
+    // Only a recovery that is RUNNING blocks a pick. One waiting for idle is superseded by the pick
+    // (whose own park waits for idle), and one that ended without restoring the source must not
+    // refuse every later pick until a CTM restart (live 10-28, textbook 3ae5a121).
+    if (existing?.recoveryRunning && ['cancelled', 'failed'].includes(existing.req.state)) {
       return refuse(409, 'lead_switch_recovery_in_flight', { request: publicRequest(existing.req) });
     }
     if (existing?.req.state === 'awaiting_turn' && existing.handoffStarted && !existing.recovered) {
@@ -611,10 +671,22 @@ function createLeadModelSwitch(deps) {
     };
     entries.set(id, entry);
     emit(entry, 'preparing');
+    // WP-0 D-1: resolve the source history mode ONCE, before the plan, the claim and any park; both
+    // recipes carry it ('none' = never-prompted source, so a resume-less target is legitimate).
+    let historyMode = 'present';
+    if (typeof resolveSourceHistoryMode === 'function') {
+      try { historyMode = (await resolveSourceHistoryMode(id)) === 'none' ? 'none' : 'present'; }
+      catch (error) { // HANDLE: D-2 -- a broken resolver is never evidence the conversation is gone.
+        diagnostic(id, 'lead-history-mode-failed', { code: String(error?.code || 'history_mode_failed').slice(0, 64) });
+      }
+      if (!ownsRequest()) return superseded();
+      if (!sourceStillMatches()) return refuse(409, 'model_owner_changed');
+    }
+    entry.sourceInfo.historyMode = historyMode;
     try {
       targetPlan = await prepareTargetPlan({
         sessionId: id, transitionId: requestId, revision: requestRevision,
-        source: { ...info, processGeneration: sourceGeneration, providerThreadId: sourceThreadId },
+        source: { ...info, processGeneration: sourceGeneration, providerThreadId: sourceThreadId, historyMode },
         target: { agent: info.agent, routeId: routeId || null, modelId }, signal: controller.signal,
       });
     } catch (error) {
@@ -702,7 +774,7 @@ function createLeadModelSwitch(deps) {
       const pendingClaim = Promise.resolve(beginTransition({
           transitionId: requestId, revision: requestRevision, sessionId: id, agent: info.agent,
           source: { ...info, processGeneration: sourceGeneration, providerThreadId: sourceThreadId,
-            leadRoute: sourceLeadRoute },
+            leadRoute: sourceLeadRoute, historyMode },
           target: { agent: info.agent, routeId: routeId || null, modelId, deployment: routed?.deployment || null,
             profileFingerprint: routed?.profileFingerprint || null, factsRevision: routed?.deployment?.factsRevision || null,
             preparedProfile: routed?.preparedProfile || null, resolvedRoute: routed?.resolvedRoute || null },
@@ -768,7 +840,7 @@ function createLeadModelSwitch(deps) {
         return refuse(500, 'lead_transition_persist_failed', { message: String(error?.message || error).slice(0, 200) });
       }
     }
-    if (providerTransition && info.agent !== 'claude') {
+    if (providerTransition && info.agent !== 'claude' && entry.sourceInfo.historyMode !== 'none') {
       if (!entry.transition) { requestControllers.delete(id); fail(entry, 'lead_transition_owner_unavailable', 'The transition owner is not available.'); return refuse(409, 'lead_transition_owner_unavailable'); }
       try {
         historyPreparation = await prepareHistory({
@@ -1012,6 +1084,7 @@ function createLeadModelSwitch(deps) {
   function notifyStatus(sessionId) {
     const id = String(sessionId || '');
     const entry = entries.get(id);
+    if (entry?.recoveryAwaitingIdle) return retryRecoveryWhenIdle(entry);
     if (!entry || !['queued', 'relaunching'].includes(entry.req.state)) return Promise.resolve();
     if (entry.check || entry.req.state === 'relaunching') { entry.edgePending = true; return entry.check || entry.tail; }
     return tryFire(id);
@@ -1338,6 +1411,21 @@ function createLeadModelSwitch(deps) {
     }
     const at = Number(obs.observedAtMs);
     if (!Number.isFinite(at) || at <= Number(req.relaunched_at)) return { settled: false, ignored: 'not_after_relaunch' };
+    /*
+     * WP-1/D-2. A Claude first turn the API REFUSED is a positive failure the transcript already
+     * records (an `isApiErrorMessage` assistant row), so it is decided HERE -- after the owner checks
+     * and the post-relaunch check, and BEFORE `no_model`, because a refusal carries no model name by
+     * construction and used to be swallowed as "no observation yet". A permanent status ends the
+     * switch and the existing failure path restores the captured source; a transient one leaves the
+     * request in `awaiting_turn` for the next successful turn to commit.
+     */
+    if (req.agent === 'claude' && obs.outcome === 'failed') {
+      if (PERMANENT_TURN_FAILURE_STATUSES.has(Number(obs.apiErrorStatus))) {
+        fail(entry, 'turn_failed', `Claude rejected the first turn after the restart: API Error ${obs.apiErrorStatus}. Pick another model.`, { observed_source: obs.source });
+        return { settled: true, state: 'failed' };
+      }
+      return { settled: false, ignored: 'turn_failed_transient' };
+    }
     const model = String(obs.model || '').trim();
     if (!model) return { settled: false, ignored: 'no_model' };
     const observedEffort = typeof obs.effort === 'string' && obs.effort.trim() ? obs.effort.trim().toLowerCase() : null;
@@ -1466,6 +1554,21 @@ function createLeadModelSwitch(deps) {
     return !!entry && entry.req.state === 'awaiting_turn';
   }
 
+  /**
+   * WP-1/D-4 (presumed abort). A restore found a transition this controller still holds in memory in
+   * `awaiting_turn`: the target was never confirmed by a turn, so the switch is abandoned and the
+   * ordinary failure path restores the captured source. Only an in-memory `awaiting_turn` entry is a
+   * side effect; anything else is a typed no-op so the caller can fall back to the journal.
+   * @param {string} sessionId
+   * @param {string} reason
+   */
+  function abandonUnconfirmedTarget(sessionId, reason = 'target_unconfirmed_presumed_abort') {
+    const entry = entries.get(String(sessionId || ''));
+    if (!entry || entry.req.state !== 'awaiting_turn') return { ok: false, reason: 'not_awaiting' };
+    fail(entry, reason, 'The switch was never confirmed by a turn before the session stopped; the original model is restored. Pick the model again to retry.');
+    return { ok: true, state: 'failed' };
+  }
+
   // Resolves when the in-flight relaunch (if any) has finished. For tests and shutdown.
   async function settled(sessionId) {
     const entry = entries.get(String(sessionId || ''));
@@ -1495,7 +1598,8 @@ function createLeadModelSwitch(deps) {
   }
 
   return { request, get, cancel, notifyStatus, observe, observeSelection, wantsObservation, settled,
-    adoptAwaitingTransition, recoverUnownedTransition, reconcileUnownedTransition, _effortPlanCount: () => effortPlans.size };
+    abandonUnconfirmedTarget, adoptAwaitingTransition, recoverUnownedTransition, reconcileUnownedTransition,
+    _effortPlanCount: () => effortPlans.size };
 }
 
 module.exports = {

package/template/coding-task-manager/lib/lead-model-transition-runtime.js

@@ -12,8 +12,10 @@ const { rebindCodexForkLaunchPlan } = require('./launch-model-override');
 const codexPaths = require('./codex-paths');
 const { _probeVersion } = require('./harness-model-profile');
 // S-6: the receipt id and the default control-adapter id are qualified-table constants.
-const { CODEX_COMPACTION_SCHEMA_RECEIPT, CODEX_CONTROL_ADAPTER, isQualifiedCodexVersion } =
+const { CODEX_COMPACTION_SCHEMA_RECEIPT, CODEX_CONTROL_ADAPTER } =
   require('./codex-harness-qualification');
+// WP-2 S-9: the ONE versioned proxy-filter receipt the planner gates the tool-declaration kind on.
+const { CODEX_HISTORICAL_TOOLS_FILTER_RECEIPT } = require('./model-proxy/historical-tool-declarations');
 const MAX_PROFILE_CATALOG_BYTES = 1024 * 1024;
 
 // WP-2A (generation-zero review): the canonical SOURCE generation is the SAME injected canonical
@@ -167,6 +169,16 @@ function createLeadModelTransitionRuntime(host = {}) {
       factsRevision: target.factsRevision || target.deployment.factsRevision,
       origin: 'routed-proxy',
       controlAdapterVersion: transitionControlAdapterVersion,
+      // WP-2 D-4: the planner is handed the receipt the DURABLE target recipe carried -- read back
+      // from the store on a restart exactly as on the first pass -- and nothing else: any value that
+      // is not the one exact constant is normalized to null before the portability gate sees it, so a
+      // forged/foreign spelling can never qualify the historical tool-declaration kind. A recipe that
+      // never carried the key (a row written before this receipt existed) keeps its exact shape and is
+      // therefore treated as having no receipt proof at all, never as an implicit one.
+      ...(targetRecipe && Object.hasOwn(targetRecipe, 'historyToolFilterReceipt')
+        ? { historyToolFilterReceipt: targetRecipe.historyToolFilterReceipt === CODEX_HISTORICAL_TOOLS_FILTER_RECEIPT
+          ? CODEX_HISTORICAL_TOOLS_FILTER_RECEIPT : null }
+        : {}),
       // S-7: the measured binary's version, never a constant. A null profile already refuses in
       // validateTargetCatalogCompactionProfile before this recipe is built.
       harnessVersion: target.preparedProfile?.cliVersion,
@@ -535,7 +547,7 @@ async function validateTargetCatalogCompactionProfile({ profile, modelId, profil
     && profile.compactionHash === null;
   const present = profile?.compactionHashStatus === 'known-present-with-native-schema-receipt'
     && typeof profile.compactionHash === 'string' && profile.compactionHash.length > 0;
-  if (!profile || profile.harness !== 'codex-cli' || !isQualifiedCodexVersion(profile.cliVersion)
+  if (!profile || profile.harness !== 'codex-cli' || !nonempty(profile.cliVersion)
       || profileFingerprint !== profile.fingerprint || factsRevision !== profile.factsRevision
       || (!absent && !present)
       || profile.compactionHashSchemaReceipt !== CODEX_COMPACTION_SCHEMA_RECEIPT

package/template/coding-task-manager/lib/lead-model-transition-store.js

@@ -15,8 +15,13 @@ const REVISION_CHANGED_CODE = 'model_revision_changed';
 const OWNER_CHANGED_CODE = 'model_owner_changed';
 const EFFORT_CHANGED_CODE = 'model_effort_changed';
 // S-9: the receipt id is one qualified-table constant, never a local literal.
-const { CODEX_COMPACTION_SCHEMA_RECEIPT, isQualifiedCodexVersion } = require('./codex-harness-qualification');
-const RECIPE_KEYS = new Set(['id', 'sessionId', 'providerThreadId', 'harness', 'providerId', 'routeId', 'wireModelId', 'sourceModelId', 'processGeneration', 'profileFingerprint', 'authReference', 'approvalPolicyReference', 'compactHash', 'compactHashStatus', 'compactHashSchemaReceipt', 'catalogSha256', 'factsRevision', 'metadataRevision', 'origin', 'controlAdapterVersion', 'programVersion', 'cyberAccessProgram', 'contextTokens', 'usableContextTokens', 'nativeCompactThresholdTokens', 'inputTokens', 'plannedRequestOutputTokens', 'outputCapSource', 'approvalPolicy', 'sandboxPolicy', 'harnessVersion', 'routeTransitionId', 'sourceEffort', 'sourceEnvironmentReference']);
+const { CODEX_COMPACTION_SCHEMA_RECEIPT } = require('./codex-harness-qualification');
+// S-9/WP-2: the SAME one versioned proxy-filter receipt the proxy filter and the planner use.
+const { CODEX_HISTORICAL_TOOLS_FILTER_RECEIPT } = require('./model-proxy/historical-tool-declarations');
+// WP-0 D-1: the journaled history mode's two spellings come from the ONE history-mode module, so the
+// store can never accept a third one the gates would read as 'present'.
+const { HISTORY_MODES, MODEL_ORIGINS } = require('./lead-switch-history-mode');
+const RECIPE_KEYS = new Set(['id', 'sessionId', 'providerThreadId', 'harness', 'providerId', 'routeId', 'wireModelId', 'sourceModelId', 'processGeneration', 'profileFingerprint', 'authReference', 'approvalPolicyReference', 'compactHash', 'compactHashStatus', 'compactHashSchemaReceipt', 'catalogSha256', 'factsRevision', 'metadataRevision', 'origin', 'controlAdapterVersion', 'programVersion', 'cyberAccessProgram', 'contextTokens', 'usableContextTokens', 'nativeCompactThresholdTokens', 'inputTokens', 'plannedRequestOutputTokens', 'outputCapSource', 'approvalPolicy', 'sandboxPolicy', 'harnessVersion', 'routeTransitionId', 'sourceEffort', 'sourceEnvironmentReference', 'historyToolFilterReceipt', 'historyMode', 'modelOrigin']);
 const PHASE_EDGES = new Map([
   ['queued', new Set(['preparing', 'failed', 'cancelled'])],
   ['preparing', new Set(['compacting', 'verified', 'failed', 'cancelled'])],
@@ -55,13 +60,27 @@ function validateRecipe(value, sessionId, generation, label) {
   if (!copy.id || !copy.sessionId || copy.sessionId !== sessionId || !copy.providerThreadId) throw new TypeError(`${label} is missing its session/thread reference`);
   if (!Number.isSafeInteger(copy.processGeneration) || copy.processGeneration !== generation) throw new TypeError(`${label} generation mismatch`);
   if (copy.profileFingerprint != null && !/^[a-f0-9]{64}$/.test(copy.profileFingerprint)) throw new TypeError(`${label} profile fingerprint is invalid`);
-  if (copy.sourceModelId != null && !/^[A-Za-z0-9@][A-Za-z0-9@._:/+-]{0,255}$/.test(copy.sourceModelId)) throw new TypeError(`${label} source model id is invalid`);
+  if (copy.sourceModelId != null && !isValidOverrideModel(copy.sourceModelId)) throw new TypeError(`${label} source model id is invalid`);
   if (copy.sourceEffort != null && (typeof copy.sourceEffort !== 'string' || !/^[a-z]{2,12}$/.test(copy.sourceEffort))) throw new TypeError(`${label} source effort is invalid`);
   if (copy.sourceEnvironmentReference != null && !['captured-empty', 'private-owner-required'].includes(copy.sourceEnvironmentReference)) {
     throw new TypeError(`${label} source environment reference is invalid`);
   }
+  // WP-2: the filter receipt is a fixed, versioned capability claim, never free text. It is either
+  // absent/null (no such proof) or EXACTLY the one constant the local proxy filter issues; any other
+  // value or shape is refused here so a persisted row can never invent one.
+  if (copy.historyToolFilterReceipt != null && copy.historyToolFilterReceipt !== CODEX_HISTORICAL_TOOLS_FILTER_RECEIPT) {
+    throw new TypeError(`${label}.historyToolFilterReceipt is not a known receipt`);
+  }
   if (copy.approvalPolicy != null && !['never', 'on-request', 'on-failure', 'untrusted'].includes(copy.approvalPolicy)) throw new TypeError(`${label}.approvalPolicy is invalid`);
   if (copy.origin != null && !['native-codex', 'native-claude', 'routed-proxy', 'portable-transcript', 'unknown'].includes(copy.origin)) throw new TypeError(`${label}.origin is invalid`);
+  // WP-0 D-1: the journaled history mode is one of exactly two spellings. ABSENT is valid and reads
+  // as 'present' (openHistoryMode), so every recipe written before this change stays loadable; an
+  // unknown spelling is refused here rather than being silently read back as 'present'.
+  if (copy.historyMode != null && !HISTORY_MODES.includes(copy.historyMode)) throw new TypeError(`${label}.historyMode is invalid`);
+  // WP-2 D-6 (§5/§6): the source recipe records WHERE the source model came from, in exactly two
+  // spellings. ABSENT stays valid (a recipe written before this change reads as 'observed'); a third
+  // spelling is refused here rather than being read back as 'observed'.
+  if (copy.modelOrigin != null && !MODEL_ORIGINS.includes(copy.modelOrigin)) throw new TypeError(`${label}.modelOrigin is invalid`);
   if (copy.routeTransitionId != null && !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(copy.routeTransitionId)) throw new TypeError(`${label}.routeTransitionId is invalid`);
   if (copy.cyberAccessProgram != null && (typeof copy.cyberAccessProgram !== 'string' || copy.cyberAccessProgram.length > 128)) throw new TypeError(`${label}.cyberAccessProgram is invalid`);
   for (const key of ['factsRevision', 'metadataRevision']) {
@@ -79,7 +98,7 @@ function validateRecipe(value, sessionId, generation, label) {
   if (compactionMetadataPresent && (!qualifiedCompactionValue
       || copy.compactHashSchemaReceipt !== CODEX_COMPACTION_SCHEMA_RECEIPT
       || !/^[a-f0-9]{64}$/.test(String(copy.catalogSha256 || ''))
-      || copy.harness !== 'codex-cli' || !isQualifiedCodexVersion(copy.harnessVersion)
+      || copy.harness !== 'codex-cli' || !(typeof copy.harnessVersion === 'string' && copy.harnessVersion.trim())
       || !/^[a-f0-9]{64}$/.test(String(copy.profileFingerprint || '')))) {
     throw new TypeError(`${label} compaction absence lacks a qualified generated-catalog receipt`);
   }
@@ -116,8 +135,7 @@ function validateTransitionRequest(value) {
   }
   const modelId = value.modelId;
   const effort = value.effort;
-  if (typeof modelId !== 'string' || modelId.length < 1 || modelId.length > 200
-      || !/^[A-Za-z0-9][A-Za-z0-9._:/@+\-\[\]]*$/.test(modelId)) throw new TypeError('transition request modelId is invalid');
+  if (!isValidOverrideModel(modelId)) throw new TypeError('transition request modelId is invalid');
   if (effort !== null && effort !== undefined && effort !== ''
       && (typeof effort !== 'string' || !/^[a-z]{2,12}$/.test(effort))) throw new TypeError('transition request effort is invalid');
   if (!['session', 'session+default'].includes(value.scope) || typeof value.effortOnly !== 'boolean') {

package/template/coding-task-manager/lib/lead-route-preflight.js

@@ -0,0 +1,179 @@
+'use strict';
+
+// WP-1 (docs/lead-route-model-invocability-preflight-2026-10-28.html §5 D-1/D-2, §6.2).
+//
+// A routed Lead switch used to validate only that the route resolves and the model is in the
+// catalog, then parked the running session and relaunched it — learning on the FIRST turn that the
+// route cannot run the model (live 10-28: proxy log
+// `upstream_outcome=model_not_invocable upstream_status=400 retryable=0`). This module runs the
+// proxy's EXISTING one-message generation probe against (route, model) while the switch is still
+// being validated, before any park, and refuses the switch on a non-retryable verdict.
+//
+// The readiness steps mirror lib/session-create/worker-continuation.js's probeWorkerRoute (health
+// wait, route push, then the probe) because that is the one proven order: a freshly-(re)started
+// proxy has an empty route table, so the route push has to precede the probe.
+//
+// Fail-open by construction (D-2): a transport failure, a timeout, a retryable verdict, an
+// admin-channel error, a thrown probe or an unready proxy all return `{ refusal: null }` and the
+// switch proceeds exactly as today — the existing first-turn path still guards it.
+//
+// Dependency-injected, like the other *-runtime factories: nothing is looked up by name at module
+// load, so requiring this module stays inert and a test can supply its own stubs.
+
+const { normalizeUpstreamOutcome, SAFE_MESSAGES } = require('./model-proxy/upstream-outcome');
+const { READINESS_BUDGET_MS } = require('./session-create/proxy-route-readiness');
+
+const PROBE_TIMEOUT_MS = 30_000;
+// One bounded diagnostic vocabulary: every string a diagnostic carries is capped here, so a
+// provider-supplied value can never grow the diagnostic sink.
+const DIAGNOSTIC_TEXT_MAX = 120;
+const REPORT_ERROR_MAX = 200;
+const PICK_ANOTHER = ' Pick another route or model.';
+
+// The switch's reason vocabulary (§6.2). Every non-retryable kind maps to a reason; only an access
+// denial gets its own (the user's fix differs: ask the account owner, not "try a different id").
+const REFUSAL_REASONS = Object.freeze({
+  model_access_denied: 'target_model_access_denied',
+  model_not_invocable: 'target_model_not_invocable',
+  model_not_found: 'target_model_not_invocable',
+});
+
+// §12a rule 3: refuse ONLY on a kind that proves the pair cannot run the model. Every other kind --
+// `invalid_prompt` above all -- is refused by nothing, because the probe's own fixed 16-token
+// request can be what the upstream disliked; the live first turn is the authority for those.
+const REFUSING_KINDS = new Set(Object.keys(REFUSAL_REASONS));
+
+function _bound(value) {
+  return String(value == null ? '' : value).slice(0, DIAGNOSTIC_TEXT_MAX);
+}
+
+function createLeadRoutePreflight({ getSupervisor, getReadiness, report, diagnostic, now = Date.now } = {}) {
+  // The D-3 report is FIRE-AND-FORGET by contract: it is a health hint for the picker, never an
+  // input to the switch. It is never awaited, a synchronous throw is swallowed the same way as a
+  // rejection, and a failure is DIAGNOSED (REPORT disposition) rather than raised.
+  function reportHealth(sessionId, body) {
+    if (typeof report !== 'function') return;
+    const failed = (error) => {
+      try {
+        if (typeof diagnostic !== 'function') return;
+        diagnostic(sessionId, 'lead-route-health-report-failed', {
+          message: String((error && error.message) || error).slice(0, REPORT_ERROR_MAX),
+        });
+      } catch { /* expected: a diagnostic sink failure must never change the switch outcome */ }
+    };
+    let pending;
+    try {
+      pending = report(body);
+    } catch (error) {
+      failed(error);
+      return;
+    }
+    if (pending && typeof pending.then === 'function') Promise.resolve(pending).catch(failed);
+  }
+
+  // Exactly ONE diagnostic per invocation, with the bounded vocabulary §6.2 names.
+  function recordDiagnostic(sessionId, detail) {
+    try {
+      if (typeof diagnostic !== 'function') return;
+      diagnostic(sessionId, 'lead-route-preflight', {
+        route_id: _bound(detail.routeId),
+        model: _bound(detail.modelId),
+        ok: detail.ok === true,
+        kind: detail.kind == null ? null : _bound(detail.kind),
+        // §12a rule 1: which wire the verdict is about -- a verdict on the wrong wire is not a
+        // verdict, and the one line has to say which one it was taken on.
+        wire: detail.wire == null ? null : _bound(detail.wire),
+        http_status: Number.isInteger(detail.httpStatus) ? detail.httpStatus : null,
+        probe_ms: Number.isFinite(detail.probeMs) ? Math.max(0, Math.round(detail.probeMs)) : null,
+        ...(detail.skipped ? { skipped: _bound(detail.skipped) } : {}),
+      });
+    } catch { /* expected: a diagnostic sink failure must never change the switch outcome */ }
+  }
+
+  // A skipped preflight is not a verdict: the switch proceeds and the skip is diagnosed so the
+  // missing evidence is visible (the same disposition the delegate path gives an unready proxy).
+  function skip(sessionId, routeId, modelId, skipped) {
+    recordDiagnostic(sessionId, { routeId, modelId, ok: false, skipped, probeMs: null });
+    return { refusal: null };
+  }
+
+  return async function preflight({ routeId, modelId, sessionId, signal, face } = {}) {
+    // 1. The proxy supervisor is the only process that can run the probe (it holds the route's
+    //    credentials and CA). A host without one has no probe to run and no verdict to give.
+    let supervisor = null;
+    try {
+      supervisor = typeof getSupervisor === 'function' ? getSupervisor() : null;
+    } catch { return { refusal: null }; /* expected: an unreadable supervisor is no probe */ }
+    if (!supervisor || typeof supervisor.probeRouteGeneration !== 'function') return { refusal: null };
+
+    // 2/3. The same readiness order the delegate path uses: healthy proxy, then route push.
+    try {
+      if (typeof supervisor.isRunning === 'function' && !supervisor.isRunning()) {
+        const started = supervisor.start();
+        if (!started || started.ok === false) return skip(sessionId, routeId, modelId, 'proxy_unready');
+      }
+      const readiness = typeof getReadiness === 'function' ? getReadiness() : null;
+      await readiness.waitForProxyHealth(READINESS_BUDGET_MS, signal);
+      await readiness.pushRoutesIfNeeded(routeId, signal);
+    } catch { return skip(sessionId, routeId, modelId, 'proxy_unready'); }
+
+    // 4. The probe itself, honouring the request's own cancellation.
+    const startedAt = now();
+    let result;
+    try {
+      result = await supervisor.probeRouteGeneration(routeId, { model: modelId, timeoutMs: PROBE_TIMEOUT_MS, face });
+    } catch { return skip(sessionId, routeId, modelId, 'probe_threw'); }
+    const probeMs = now() - startedAt;
+    const httpStatus = Number.isInteger(result && result.http_status) ? result.http_status : null;
+    const succeeded = !!(result && result.generation_succeeded === true);
+    const outcome = (result && result.failure && result.failure.upstream_outcome) || null;
+    const kind = outcome ? outcome.kind : null;
+    const wire = (result && typeof result.probe_wire === 'string') ? result.probe_wire : null;
+    const diagnostic = { routeId, modelId, ok: succeeded, kind, wire, httpStatus, probeMs };
+    // §12a rule 4: a verdict is only wire-independent when the route offers exactly one wire -- on a
+    // multi-wire route the same pair can be invocable on the wire the probe dialled and dead on the
+    // one another harness uses, so this switch keeps the refusal local and reports nothing.
+    const reportable = !!result && result.route_wire_count === 1;
+
+    // A superseded request is the caller's to refuse: this path never reports and never refuses on its
+    // own. The probe DID run and DID produce a verdict, so the one diagnostic is still recorded (D-2
+    // "always record ONE diagnostic") — the verdict is evidence even when nothing acts on it.
+    if (signal && signal.aborted) {
+      recordDiagnostic(sessionId, diagnostic);
+      return { refusal: null };
+    }
+
+    if (succeeded) {
+      if (reportable) reportHealth(sessionId, { route_id: routeId, model: modelId, ok: true, outcome: null, http_status: httpStatus });
+      recordDiagnostic(sessionId, diagnostic);
+      return { refusal: null };
+    }
+
+    if (kind && REFUSING_KINDS.has(kind)) {
+      // §12a rule 3: only a kind that proves the pair cannot run the model refuses. A non-retryable
+      // `invalid_prompt` (the probe's own 16-token shape, an upstream that dislikes it) does NOT:
+      // it falls through to the proceed path below.
+      if (reportable) {
+        // §12a rule 4: the pair-class verdict is recorded with the status and the kind, exactly as
+        // before -- but only when it holds for every harness the route serves.
+        reportHealth(sessionId, { route_id: routeId, model: modelId, ok: false, outcome: _bound(kind), http_status: httpStatus });
+      }
+      recordDiagnostic(sessionId, diagnostic);
+      return {
+        refusal: {
+          ok: false,
+          reason: REFUSAL_REASONS[kind],
+          message: (SAFE_MESSAGES[kind] || SAFE_MESSAGES.invalid_prompt) + PICK_ANOTHER,
+        },
+      };
+    }
+
+    // Retryable, no upstream outcome, `http_status: null`, an HTTP-level admin error
+    // ({error:'route_unknown'}), or a non-retryable kind that only indicts the probe's own request:
+    // no report (a probe is not a load signal) and no refusal.
+    recordDiagnostic(sessionId, diagnostic);
+    return { refusal: null };
+  };
+}
+
+module.exports = { createLeadRoutePreflight };

package/template/coding-task-manager/lib/lead-switch-history-mode.js

@@ -0,0 +1,110 @@
+'use strict';
+
+// WP-0/WP-1 (docs/lead-switch-never-prompted-session-2026-10-30.html §5 D-1..D-4, §6): ONE history
+// mode per transition — 'none' (this source lifetime has nothing to carry) or 'present' (today's
+// behaviour) — decided ONCE before the switch claims its transition, carried on both recipes, and
+// read back by every gate that used to re-derive (or silently assume) the answer.
+//
+// D-2, the rule that keeps this safe: 'none' is returned ONLY for a DEFINITE absence. The oracle is
+// the same off-thread resume ladder park already consults (lib/park-fresh-relaunch.js
+// `parkFindsNothingToResume`); a false answer, a thrown error, a timeout or an agent with no ladder
+// all mean 'present'. "An unreadable store is not evidence that the conversation is gone"
+// (superset-sh/superset#7144, adopted in §3 P-3), so a flaky ladder can only cost a refusal, never a
+// lost conversation. A recipe written before this change carries no `historyMode` key and reads as
+// 'present' — byte-for-byte today's path.
+
+const { extractResumeTarget } = require('./session-history');
+const { parkFindsNothingToResume } = require('./park-fresh-relaunch');
+
+const HISTORY_MODES = Object.freeze(['none', 'present']);
+// WP-2 D-6 (§5/§6): the only two spellings a source recipe's `modelOrigin` may carry.
+const MODEL_ORIGINS = Object.freeze(['observed', 'cli-default']);
+
+/**
+ * Resolve the SOURCE lifetime's history mode. NEVER throws (D-2): any error, rejection or timeout is
+ * 'present'.
+ *
+ * @param {object} input
+ * @param {'claude'|'codex'|string} input.agentType
+ * @param {string} input.ctmSessionId
+ * @param {string} input.jsonlPath        claude: the transcript path park would stat; codex: the rollout path or ''
+ * @param {string} [input.resumeId]       the source provider thread id
+ * @param {boolean} [input.resumeEvidence] true when park's own inputs already found a transcript/rollout ON DISK
+ * @param {(query: object) => Promise<{ rung?: string }>} input.resolveRung  resolveResumeRungOffThread bound to dbPath
+ * @returns {Promise<'none'|'present'>}
+ */
+async function resolveSourceHistoryMode({ agentType, ctmSessionId, jsonlPath, resumeId, resumeEvidence = false, resolveRung } = {}) {
+  try {
+    // A transcript/rollout file already on disk is proof there IS something to resume, so the ladder
+    // is never consulted for it (park short-circuits the same way, lib/park-fresh-relaunch.js).
+    if (resumeEvidence === true) return 'present';
+    const nothingToResume = await parkFindsNothingToResume({ agentType, ctmSessionId, jsonlPath, resumeId, resolveRung });
+    return nothingToResume === true ? 'none' : 'present';
+  } catch {
+    // HANDLE: D-2 — an unreadable store, a rejected ladder or a timeout is never evidence of absence,
+    // so the refusal side of every gate keeps today's behaviour.
+    return 'present';
+  }
+}
+
+/** Recipe read with the D-2 default: a missing or unknown key is 'present'. */
+function recipeHistoryMode(recipe) {
+  return recipe?.historyMode === 'none' ? 'none' : 'present';
+}
+
+/**
+ * WP-2 D-6 (§5/§6): WHERE the source lifetime's model came from — recorded, never guessed.
+ *
+ * 'cli-default' means this source never named a model of its own: the mode is 'none' (nothing was
+ * ever prompted) AND `cliDefaultModel` (captured by the runtime's `getSessionInfo`) proved an empty
+ * `session.model_id`, no `--model`/`-m`/`--model=` in the captured launch argv and no
+ * `session_lead_model` pin row. Rolling such a source back must relaunch the ORIGINAL argv and pass
+ * NO one-shot model override at all, so the CLI's own default applies by construction (D-6 rejected
+ * both substituting `cli_default` as `--model` and re-reading the CLI's config file).
+ *
+ * Everything else is 'observed' — today's meaning: the model was read from the session/argv, and a
+ * rollback passes it as the one-shot override exactly as before. A recipe written before this change
+ * carries no `cliDefaultModel`, so it reads 'observed'.
+ */
+function sourceModelOrigin(source) {
+  return recipeHistoryMode(source) === 'none' && source?.cliDefaultModel === true ? 'cli-default' : 'observed';
+}
+
+/** The value of a Claude argv's `--session-id <id>` / `--session-id=<id>`, or '' when absent. */
+function claudeSessionIdArg(args) {
+  const list = Array.isArray(args) ? args.map(String) : [];
+  for (let i = 0; i < list.length; i += 1) {
+    if (list[i] === '--session-id') return String(list[i + 1] || '');
+    if (list[i].startsWith('--session-id=')) return list[i].slice('--session-id='.length);
+  }
+  return '';
+}
+
+/**
+ * The single thread clause shared by the pre-park planner check (D-4) and authorizeLiveTargetRestore
+ * (D-3) — one definition, so the two gates can never drift apart (§7).
+ *
+ * For 'present' it is EXACTLY the historical conjunct: the plan must resume the target recipe's own
+ * provider thread. For 'none' the plan must carry no resume selector at all, and a Claude plan's own
+ * `--session-id` must name the target recipe's thread: that argv is what the fresh process is given,
+ * so it is the thread its canonical owner will report.
+ *
+ * @returns {boolean}
+ */
+function targetThreadClause({ source, target, launchPlan } = {}) {
+  const planThread = String(launchPlan?.resume?.sessionId || '');
+  const targetThread = String(target?.providerThreadId || '');
+  if (recipeHistoryMode(target) === 'present') return targetThread.length > 0 && planThread === targetThread;
+  // A 'none' target recipe is only meaningful with a 'none' SOURCE: the mode is one fact per
+  // transition, recorded twice.
+  if (recipeHistoryMode(source) !== 'none') return false;
+  if (planThread !== '') return false;
+  if (extractResumeTarget(launchPlan?.agentType, launchPlan?.args || [])) return false;
+  if (launchPlan?.agentType === 'claude') return targetThread.length > 0 && claudeSessionIdArg(launchPlan.args) === targetThread;
+  // codex: the new thread id is unknown until the thread links, so the owner check after launch
+  // binds it instead.
+  return true;
+}
+
+module.exports = { HISTORY_MODES, MODEL_ORIGINS, resolveSourceHistoryMode, recipeHistoryMode,
+  sourceModelOrigin, claudeSessionIdArg, targetThreadClause };

package/template/coding-task-manager/lib/lead-wire-agent.js

@@ -0,0 +1,7 @@
+'use strict';
+// The CLI wire a lead agent speaks to CTM's model proxy. OpenCode leads and OpenCode's routed
+// workers both use the Anthropic Messages face, so route servability is asked of 'claude'.
+// This is the ONE rule: public/js/session-model-picker.js mirrors it as `leadWireAgent` for the
+// Lead AND Delegate tabs, and tests pin the two bodies equal (docs/opencode-model-selection-round-2-shared-route-logic-2026-10-30.html §5 R-1, §6.1, §7).
+function leadWireAgent(agent) { return agent === 'opencode' ? 'claude' : agent; }
+module.exports = { leadWireAgent };