create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/park-composer-draft.js

@@ -0,0 +1,54 @@
+'use strict';
+
+// WP-1 (docs/park-draft-truth-from-screen-2026-10-26.html §5 D-1/D-2/D-3) — the park decision's
+// draft truth is the agent's own composer row, read from the server's headless mirror, not the
+// browser's keystroke accounting. `lifecycle-draft` presence never produces a `draft` protection
+// any more (that phantom refused parks and lead model switches on an empty composer).
+//
+// The verdict reuses `composerState` (lib/terminal-composer.js) unchanged: one glyph rule for the
+// phone path and the park path alike (D-2). The verdict carries only a length, never the text.
+
+const { composerState } = require('./terminal-composer');
+
+/** @typedef {'text'|'empty'|'unknown'} ComposerDraftState */
+/** @typedef {'composer-text'|'composer-empty'|'rows-unavailable'|'no-composer-row'|'rows-error'} ComposerDraftReason */
+/** @typedef {{ state: ComposerDraftState, reason: ComposerDraftReason, chars: number, at: number }} ComposerDraftVerdict */
+
+// Same bound as server.js's Submit-current-input probe (~16548).
+const PARK_COMPOSER_READ_TIMEOUT_MS = 900;
+
+/**
+ * Pure. `rows === null|undefined` (not a row list) is unreadable; a row list with no composer row
+ * is unreadable for a different reason. Only visible, non-dim composer text is a draft.
+ * @param {Array<{text: string, wrapped: boolean, dim: boolean}>|null|undefined} rows
+ * @param {number} [now]
+ * @returns {ComposerDraftVerdict}
+ */
+function composerDraftVerdict(rows, now = Date.now()) {
+  if (!Array.isArray(rows)) return { state: 'unknown', reason: 'rows-unavailable', chars: 0, at: now };
+  const composer = composerState(rows);
+  if (composer.row === -1) return { state: 'unknown', reason: 'no-composer-row', chars: 0, at: now };
+  if (composer.empty) return { state: 'empty', reason: 'composer-empty', chars: 0, at: now };
+  return { state: 'text', reason: 'composer-text', chars: composer.text.length, at: now };
+}
+
+/**
+ * Never throws. Flushes the mirror's feed first (so text typed in the last milliseconds is in the
+ * rows) and reads them through the caller's bounded reader. Any failure — flush, worker, timeout —
+ * is the single `unknown` state, never a phantom draft.
+ * @param {{id?: string, _flushHeadlessFeed?: Function}|null|undefined} session
+ * @param {{getRows?: (sessionId: string, timeoutMs: number) => Promise<Array|null>, timeoutMs?: number, now?: () => number}} [options]
+ * @returns {Promise<ComposerDraftVerdict>}
+ */
+async function readComposerDraft(session, { getRows, timeoutMs = PARK_COMPOSER_READ_TIMEOUT_MS, now = Date.now } = {}) {
+  try {
+    if (session && typeof session._flushHeadlessFeed === 'function') session._flushHeadlessFeed();
+    const rows = await getRows(session && session.id, timeoutMs);
+    return composerDraftVerdict(rows, now());
+  } catch {
+    // HANDLE: an unreadable screen is 'unknown' (D-4) — automatic parks wait, manual parks proceed.
+    return { state: 'unknown', reason: 'rows-error', chars: 0, at: now() };
+  }
+}
+
+module.exports = { composerDraftVerdict, readComposerDraft, PARK_COMPOSER_READ_TIMEOUT_MS };

package/template/coding-task-manager/lib/park-fresh-relaunch.js

@@ -9,6 +9,10 @@
 // already acts on (lib/session-restore.js). No flags.
 
 const CLAUDE_RESUME_FORMS = new Set(['--resume', '-r', '--continue', '-c']);
+// OpenCode 1.x's own resume selectors (docs/opencode-lead-and-delegate-model-selection-2026-10-28.html
+// §9 S-7, R-2). A stored argv that already names a conversation is NOT a fresh launch: relaunching it
+// with `--model` would be ignored by TUI 1.x (the last user message wins, §5 R-4), so it is refused.
+const OPENCODE_RESUME_FORMS = new Set(['--session', '-s', '--continue', '-c']);
 
 /**
  * The launch args a fresh relaunch runs, or null when today's resume path must stand.
@@ -21,6 +25,13 @@ function freshRelaunchArgs({ agentType, storedTask, sessionCmd, sessionId, resum
   const args = storedTask.args.slice();
   if (agentType === 'codex') {
     if (args[0] === 'resume') return null;
+  } else if (agentType === 'opencode') {
+    // No `--session-id` injection for OpenCode: CTM cannot mint an OpenCode session id on 1.x
+    // (probe P-10), so the stored args are copied EXACTLY.
+    for (const arg of args) {
+      const text = String(arg);
+      if (OPENCODE_RESUME_FORMS.has(text) || text.startsWith('--session=')) return null;
+    }
   } else {
     for (const arg of args) {
       if (CLAUDE_RESUME_FORMS.has(arg)) return null;
@@ -35,17 +46,41 @@ function freshRelaunchArgs({ agentType, storedTask, sessionCmd, sessionId, resum
 /**
  * Whether park should relaunch fresh: the off-thread ladder says 'fresh' when nothing exists to
  * resume. False for any other provider; for Claude an empty jsonlPath is nothing to look up.
- * @param {{ agentType: string, ctmSessionId: string, jsonlPath: string,
+ * OpenCode 1.x has no ladder to consult at all: it creates its session on the first prompt (probe
+ * P-9), so "nothing to resume" is exactly "no captured resume id".
+ * @param {{ agentType: string, ctmSessionId: string, jsonlPath: string, resumeId?: string,
  *           resolveRung: (input: { ctmSessionId: string, provider: string, jsonlPath: string }) => Promise<{ rung: string }> }} input
  * @returns {Promise<boolean>}
  */
-async function parkFindsNothingToResume({ agentType, ctmSessionId, jsonlPath, resolveRung }) {
+async function parkFindsNothingToResume({ agentType, ctmSessionId, jsonlPath, resumeId, resolveRung }) {
+  if (agentType === 'opencode') return !resumeId;
   if (agentType !== 'claude' && agentType !== 'codex') return false;
   if (agentType === 'claude' && !jsonlPath) return false;
   const result = await resolveRung({ ctmSessionId, provider: agentType, jsonlPath: jsonlPath || '' });
   return result?.rung === 'fresh';
 }
 
+/**
+ * D-5 in ONE place: the resume-evidence flag and the jsonlPath the ladder is asked about, derived
+ * from the prepared transcript/codex rollout. Shared with lib/lead-switch-history-mode.js, which
+ * must never grow a second copy of this rule (WP-0/§6 "one definition").
+ * @param {{ agentType: string, transcript?: object|null, codexRolloutPath?: string }} input
+ * @returns {{ resumeEvidence: boolean, jsonlPath: string }}
+ */
+function freshEvidenceInputs({ agentType, transcript, codexRolloutPath }) {
+  // A transcript/rollout file on disk means there is something to resume (and Claude refuses a
+  // `--session-id` whose .jsonl exists), so the ladder is consulted only when none exists.
+  // OpenCode has neither: its "something to resume" question is answered from the captured resume
+  // id alone (see parkFindsNothingToResume), so a null/undefined transcript is NOT evidence here.
+  const resumeEvidence = agentType === 'opencode'
+    ? false
+    : agentType === 'codex' ? !!codexRolloutPath : !!(transcript && transcript.missing === false);
+  const jsonlPath = agentType === 'codex'
+    ? (codexRolloutPath || '')
+    : (transcript && (transcript.filePath || (Array.isArray(transcript.candidates) ? transcript.candidates[0] : '')));
+  return { resumeEvidence, jsonlPath: jsonlPath || '' };
+}
+
 /**
  * Compose D-5 (jsonlPath from the transcript/codex rollout), the ladder check, and the fresh args.
  * Never throws: a ladder or DB error is reported through `diagnostic` and yields null.
@@ -57,13 +92,9 @@ async function parkFindsNothingToResume({ agentType, ctmSessionId, jsonlPath, re
  */
 async function planFreshRelaunch({ session, agentType, resumeId, transcript, codexRolloutPath, storedTask, resolveRung, diagnostic }) {
   try {
-    // A transcript/rollout file on disk means there is something to resume (and Claude refuses a
-    // `--session-id` whose .jsonl exists), so the ladder is consulted only when none exists.
-    if (agentType === 'codex' ? !!codexRolloutPath : !!(transcript && transcript.missing === false)) return null;
-    const jsonlPath = agentType === 'codex'
-      ? (codexRolloutPath || '')
-      : (transcript && (transcript.filePath || (Array.isArray(transcript.candidates) ? transcript.candidates[0] : '')));
-    const nothingToResume = await parkFindsNothingToResume({ agentType, ctmSessionId: session.id, jsonlPath, resolveRung });
+    const { resumeEvidence, jsonlPath } = freshEvidenceInputs({ agentType, transcript, codexRolloutPath });
+    if (resumeEvidence) return null;
+    const nothingToResume = await parkFindsNothingToResume({ agentType, ctmSessionId: session.id, jsonlPath, resumeId, resolveRung });
     if (!nothingToResume) return null;
     return freshRelaunchArgs({ agentType, storedTask, sessionCmd: session.cmd || '', sessionId: session.id, resumeId });
   } catch (err) {
@@ -73,4 +104,4 @@ async function planFreshRelaunch({ session, agentType, resumeId, transcript, cod
   }
 }
 
-module.exports = { freshRelaunchArgs, parkFindsNothingToResume, planFreshRelaunch };
+module.exports = { freshRelaunchArgs, parkFindsNothingToResume, freshEvidenceInputs, planFreshRelaunch };

package/template/coding-task-manager/lib/perf-phase-trace.js

@@ -0,0 +1,72 @@
+'use strict';
+
+// Phase trace for one synchronous scan run (WP-0 / M-3, measurement only —
+// docs/hub-local-cpu-memory-burn-2026-10-31.html §7). Used by session-integrity.js
+// (detectMismatches) and lib/relink-audit.js (auditRelink): on the hub the
+// sessionIntegrityDetect op outlives its caller's timeout and the result is discarded, so the
+// `[session-integrity] phases {...}` line each scan logs at its end is the only record.
+//
+// Gated by CTM_PERF_ATTRIBUTION (on by default; '0'/'false'/'no'/'off' → createPerfTrace()
+// returns null and callers record nothing). Cost: one performance.now() per lap. Memory is
+// bounded by the caller's fixed set of phase/counter names, never by row count.
+
+const { boolFlag } = require('./env-flags');
+
+const NOOP_LAP = () => {};
+
+function perfNow() {
+  return performance.now();
+}
+
+function createPerfTrace() {
+  if (!boolFlag('CTM_PERF_ATTRIBUTION', true)) return null;
+  const start = perfNow();
+  const trace = { t0: start, t: start, phases: Object.create(null), counters: Object.create(null) };
+  // lap(name, n): closes the open segment and charges it to `name`, then opens the next one —
+  // so the laps of a run partition its wall time and sum(phases.ms) == totalMs.
+  trace.lap = (name, n = 1) => {
+    const now = perfNow();
+    const phase = trace.phases[name] || (trace.phases[name] = { ms: 0, n: 0 });
+    phase.ms += now - trace.t;
+    phase.n += n;
+    trace.t = now;
+  };
+  // count(name, ms, n): an overlapping sub-measurement of a call already inside a lap
+  // (e.g. findCodexSessionFiles). Kept apart so it can never distort the phase sum.
+  trace.count = (name, ms, n = 1) => {
+    const counter = trace.counters[name] || (trace.counters[name] = { ms: 0, n: 0 });
+    counter.ms += ms;
+    counter.n += n;
+  };
+  // timed(name, fn): runs fn and records it under counters[name].
+  trace.timed = (name, fn) => {
+    const started = perfNow();
+    try {
+      return fn();
+    } finally {
+      trace.count(name, perfNow() - started, 1);
+    }
+  };
+  return trace;
+}
+
+function _round(value) {
+  return Math.round(value * 10) / 10;
+}
+
+function _roundMap(map) {
+  const out = {};
+  for (const [name, entry] of Object.entries(map)) out[name] = { ms: _round(entry.ms), n: entry.n };
+  return out;
+}
+
+function perfPhasesJson(scope, trace) {
+  return JSON.stringify({
+    scope,
+    totalMs: _round(perfNow() - trace.t0),
+    phases: _roundMap(trace.phases),
+    counters: _roundMap(trace.counters),
+  });
+}
+
+module.exports = { NOOP_LAP, createPerfTrace, perfPhasesJson };

package/template/coding-task-manager/lib/perf-summary.js

@@ -194,6 +194,13 @@ function buildPerfSummary(input = {}) {
     syncIo,
     wal: input.wal || null,
     workers: { dbOwner, readPool },
+    // WP-0 M-1 (§7): CPU per main-thread timer, { [namedInterval]: { count, userMs, systemMs } }.
+    // Empty object when CTM_PERF_ATTRIBUTION=0 or no named timer has ticked yet.
+    mainTimers: { cpuByTimer: input.mainTimers?.cpuByTimer || {} },
+    // WP-0 M-2 (§3.2/§7): per-reason session-list broadcast counters, { [reason]: { calls,
+    // suppressed, coalesced, flushes, serialized, elided } } — see lib/broadcast-reason-stats.js.
+    // Empty object when CTM_PERF_ATTRIBUTION=0.
+    broadcast: { byReason: input.broadcast?.byReason || {} },
     insertChunkHoldMs: dbOwner?.insertChunkHoldMs || null,
     writeLock: input.writeLock || null,
     mainWriteEscapes: input.mainWriteEscapes || null,

package/template/coding-task-manager/lib/perf-tracker.js

@@ -2,6 +2,7 @@
 
 const { AsyncLocalStorage } = require('node:async_hooks');
 const path = require('node:path');
+const { boolFlag } = require('./env-flags');
 
 // Tiny shared module for tagging the current synchronous operation. The
 // always-on event-loop lag detector reads `getOp()` to identify what was
@@ -296,6 +297,11 @@ function _hostCores() {
 
 function buildEventLoopBlockEvidence(previous = {}, current = {}, options = {}) {
   const blockedMs = Math.max(1, Number(options.blockedMs) || 1);
+  // WP-2 (design §5 D-6 / §9 S-5..S-7): the watchdog worker's own measured suspension
+  // overlap. It is the one observation a suspended process cannot fake — the worker thread
+  // keeps ticking on its own scheduler while the whole process is frozen — so when most of
+  // the block is suspension, that is the label, not an inference from CPU or run queue.
+  const suspendedMs = Math.max(0, Number(options.suspendedMs) || 0);
   const mainThreadCpuMs = Math.max(0, Number(options.mainThreadCpuDeltaMs ?? options.cpuDeltaMs) || 0);
   const processCpuMs = Math.max(0, Number(options.processCpuDeltaMs ?? options.cpuDeltaMs) || 0);
   let memory = options.memory;
@@ -369,6 +375,13 @@ function buildEventLoopBlockEvidence(previous = {}, current = {}, options = {})
   else if (mainThreadCpuPct >= 50) signal = 'main_cpu';
   else if (loadPerCore !== null && loadPerCore >= _OVERSUBSCRIBED_LOAD_PER_CORE) signal = 'host-oversubscribed';
 
+  // WP-2 (D-6): the watchdog's measured suspension beats every inferential host signal. A
+  // system sleep or task_suspend freezes the whole process, so CPU, sync-I/O and run-queue
+  // evidence all read "nothing ran" and the honest label is the suspension itself. The
+  // 1000 ms floor keeps a short tick stall from being restated as machine sleep, and the
+  // 50% majority keeps a suspension that merely overlapped a real block from relabelling it.
+  if (blockedMs >= 1000 && suspendedMs >= 0.5 * blockedMs) signal = 'process-suspended';
+
   return {
     signal,
     // D-2: append the sampler's last per-worker/zstd numbers (null/absent provider adds nothing) so
@@ -405,6 +418,8 @@ function buildEventLoopBlockEvidence(previous = {}, current = {}, options = {})
     offCpuMs,
     offCpuUnexplainedMs,
     offCpuUnexplainedPct,
+    // WP-2: the measured suspension this verdict was made from (0 when nothing was measured).
+    suspendedMs,
     hostFreeBytes,
     hostTotalBytes,
     freePagesPct,
@@ -866,11 +881,57 @@ function _callerOwner() {
   return 'unknown';
 }
 
+// WP-0 M-1 (docs/hub-local-cpu-memory-burn-2026-10-31.html §7): per-timer CPU attribution for
+// the main-thread intervals, so a boot-time CPU burn in the 3 s / 30 s / 60 s sweeps can be
+// named instead of guessed. Same gate as the read-pool side (CTM_PERF_ATTRIBUTION, on in
+// source): when off, nothing is sampled and getTimerCpuStats() is an empty object.
+const _timerCpu = new Map(); // name -> { count, userUs, systemUs }; bounded by the named timers
+const _perfAttributionOn = () => boolFlag('CTM_PERF_ATTRIBUTION', true);
+const _threadCpu = typeof process.threadCpuUsage === 'function'
+  ? () => process.threadCpuUsage()
+  : () => ({ user: 0, system: 0 });
+
+// Only the SYNCHRONOUS part of a tick is measured: the sample is taken around the fn.apply()
+// call and computed in `finally`, so a callback that returns a promise reports the CPU its
+// synchronous prefix spent and nothing that happens after it returns. Nothing is awaited here --
+// the timer's own behaviour (return value, thrown error, cadence) is unchanged.
+function _timedIntervalCallback(key, fn) {
+  return function timedIntervalTick(...args) {
+    if (!_perfAttributionOn()) return fn.apply(this, args);
+    const cpu0 = _threadCpu();
+    try {
+      return fn.apply(this, args);
+    } finally {
+      const cpu = _threadCpu();
+      const totals = _timerCpu.get(key) || { count: 0, userUs: 0, systemUs: 0 };
+      totals.count += 1;
+      totals.userUs += Math.max(0, cpu.user - cpu0.user);
+      totals.systemUs += Math.max(0, cpu.system - cpu0.system);
+      _timerCpu.set(key, totals);
+    }
+  };
+}
+
+// { [timer]: { count, userMs, systemMs } } -- ms rounded to 0.1, summed from µs so repeated
+// reads cannot drift. Read by perf-summary (mainTimers.cpuByTimer).
+function getTimerCpuStats() {
+  if (!_perfAttributionOn()) return {};
+  const out = {};
+  for (const [name, totals] of _timerCpu) {
+    out[name] = {
+      count: totals.count,
+      userMs: Math.round((totals.userUs / 1000) * 10) / 10,
+      systemMs: Math.round((totals.systemUs / 1000) * 10) / 10,
+    };
+  }
+  return out;
+}
+
 function namedInterval(name, fn, ms, ...args) {
   if (typeof fn !== 'function') throw new TypeError('namedInterval requires a function');
   const key = String(name || 'timer');
   _namedIntervalRegistry.set(key, { name: key, ms, owner: _callerOwner(), registeredAt: Date.now() });
-  return setInterval(wrap(key, fn), ms, ...args);
+  return setInterval(_timedIntervalCallback(key, wrap(key, fn)), ms, ...args);
 }
 
 // Exposed for GET /api/diagnostics/main-watchdog (AC-5b) and tests. A registration-time
@@ -1030,4 +1091,4 @@ function loadPerCore() {
   } catch { return null; }
 }
 
-module.exports = { eventLoopBlockMs, getOp, getActiveOpName, getAttributionState, getRecentSpans, getRecentEventLoopBlocks, eventLoopBlockOverlap, _EVENT_LOOP_BLOCK_RING_MAX, recordCompletedSpan, recordExternalSpan, recordSyncIoCall, recordMainDbCall, recordEventLoopBlock, recordEventLoopLagSample, eventLoopLagProfileSuffix, getEventLoopStats, captureEventLoopEvidenceBaseline, buildEventLoopBlockEvidence, shouldReportLag, wrap, wrapAsync, namedInterval, listNamedIntervals, runSync, runSyncProbed, findRecentSynchronousBlockEvidence, isSuspectedSleepBlock, isOffCpuSpan, loadPerCore, setMemoryExtrasProvider, hostCores: _hostCores, OVERSUBSCRIBED_LOAD_PER_CORE: _OVERSUBSCRIBED_LOAD_PER_CORE, SLEEP_BLOCK_MS: _SLEEP_BLOCK_MS, FREEZE_PROBE_MS, perfLogsEnabled, shouldLogPerf, PERF_CRITICAL_MS, isWorkerThread: _isWorkerThread, MAINLOOP_DESCHED_LOAD, MAINLOOP_DESCHED_INVOLCTX, runOutsideAttributionForTests };
+module.exports = { eventLoopBlockMs, getOp, getActiveOpName, getAttributionState, getRecentSpans, getRecentEventLoopBlocks, eventLoopBlockOverlap, _EVENT_LOOP_BLOCK_RING_MAX, recordCompletedSpan, recordExternalSpan, recordSyncIoCall, recordMainDbCall, recordEventLoopBlock, recordEventLoopLagSample, eventLoopLagProfileSuffix, getEventLoopStats, captureEventLoopEvidenceBaseline, buildEventLoopBlockEvidence, shouldReportLag, wrap, wrapAsync, namedInterval, listNamedIntervals, getTimerCpuStats, runSync, runSyncProbed, findRecentSynchronousBlockEvidence, isSuspectedSleepBlock, isOffCpuSpan, loadPerCore, setMemoryExtrasProvider, hostCores: _hostCores, OVERSUBSCRIBED_LOAD_PER_CORE: _OVERSUBSCRIBED_LOAD_PER_CORE, SLEEP_BLOCK_MS: _SLEEP_BLOCK_MS, FREEZE_PROBE_MS, perfLogsEnabled, shouldLogPerf, PERF_CRITICAL_MS, isWorkerThread: _isWorkerThread, MAINLOOP_DESCHED_LOAD, MAINLOOP_DESCHED_INVOLCTX, runOutsideAttributionForTests };

package/template/coding-task-manager/lib/project-config.js

@@ -114,6 +114,13 @@ function _normalize(data) {
     }
     if (Object.keys(worker).length) out.worker = worker;
   }
+  // WP-0 (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1, §6.1): the
+  // landing queue's configuration object. _normalize only passes a plain object through — the
+  // landing validator (lib/landing/config.js) owns its contents, including the rejection of
+  // unknown keys, so nothing is whitelisted or rewritten here. Never merged with the keys above.
+  if (data.landing && typeof data.landing === 'object' && !Array.isArray(data.landing)) {
+    out.landing = data.landing;
+  }
   return out;
 }
 

package/template/coding-task-manager/lib/prompt-purge-v2.js

@@ -41,6 +41,13 @@ function purgeConversationV2(db, sessionId, sourceIds, eventKeys, nowMs = Date.n
     .map((row) => row.stable_key);
   let deleted = 0;
   let canonicalChanges = 0;
+  // WP-5 (shared-memory-every-machine §5 D-3, §6.8): a purge must stay addressable on the wire —
+  // stamp a tombstone (deleted=1, fresh local seq) for every purged key BEFORE the row goes, so
+  // the conversation clock feed can tell a peer to delete it too. No outbox row: the delete feed
+  // (conversation_projection_deletes_v2, below) is the local Wall-E subscriber's channel.
+  if (stableKeys.length && _tableExists(db, 'conversation_item_clock')) {
+    require('./conversation-item-clock').stampConversationTombstonesV2(db, { sessionId, stableKeys, nowMs });
+  }
   // WP-0 (one-transcript-ingestor §6.2, D-6b): the deletes below remove the purged
   // keys' outbox rows, so the change feed must FIRST learn exactly which stable
   // keys are going away — same transaction, before the deletes, best-effort when
@@ -99,4 +106,48 @@ function purgeConversationV2(db, sessionId, sourceIds, eventKeys, nowMs = Date.n
   return deleted;
 }
 
-module.exports = { purgeConversationV2 };
+// WP-5 §6.8 (shared-memory-every-machine-2026-10-31.html §5 D-3): the replica RECEIVER's delete —
+// the same work purgeConversationV2 does per key, but scoped to an explicit stable-key list the sync
+// feed handed over (a peer's tombstone). One transaction, and the caller (`db.transaction` around it)
+// may already be inside one, so this uses `.immediate()` like the purge path. It lives here rather
+// than in lib/conversation-item-clock.js because it IS a writer of the conversation item tables, and
+// this module is already the pinned writer (tests/conversation-store-v2.test.js's writer gate).
+function deleteConversationItemsByStableKeyV2(db, { sessionId, stableKeys = [], nowMs = Date.now() } = {}) {
+  const requested = [...new Set((Array.isArray(stableKeys) ? stableKeys : []).map((k) => String(k)).filter(Boolean))];
+  if (!requested.length) return 0;
+  return db.transaction(() => {
+    // Only keys this store actually still holds count: a re-offered tombstone (or one for an item
+    // this node never had) must leave NO second projection-delete row — the subscriber's delete feed
+    // is a log, and replaying a delete into it would grow it without bound.
+    const marks = _marks(requested);
+    const present = new Set(db.prepare(`SELECT stable_key FROM conversation_text_items_v2
+      WHERE session_id=? AND stable_key IN (${marks})`).all(sessionId, ...requested).map((r) => r.stable_key));
+    if (_tableExists(db, 'conversation_item_placement_v2')) {
+      for (const row of db.prepare(`SELECT stable_key FROM conversation_item_placement_v2
+        WHERE session_id=? AND stable_key IN (${marks})`).all(sessionId, ...requested)) {
+        present.add(row.stable_key);
+      }
+    }
+    const keys = requested.filter((key) => present.has(key));
+    if (!keys.length) return 0;
+    const mark = _marks(keys);
+    let deleted = 0;
+    if (_tableExists(db, 'conversation_projection_deletes_v2')) {
+      recordProjectionDeletes(db, { sessionId, stableKeys: keys, nowMs });
+    }
+    if (_tableExists(db, 'conversation_projection_outbox_v2')) {
+      deleted += Number(db.prepare(`DELETE FROM conversation_projection_outbox_v2
+        WHERE session_id=? AND stable_key IN (${mark})`).run(sessionId, ...keys).changes || 0);
+    }
+    if (_tableExists(db, 'conversation_item_placement_v2')) {
+      deleted += Number(db.prepare(`DELETE FROM conversation_item_placement_v2
+        WHERE session_id=? AND stable_key IN (${mark})`).run(sessionId, ...keys).changes || 0);
+    }
+    deleted += Number(db.prepare(`DELETE FROM conversation_text_items_v2
+      WHERE session_id=? AND stable_key IN (${mark})`).run(sessionId, ...keys).changes || 0);
+    rebuildTurnIndexForSessions(db, [sessionId], { nowMs });
+    return deleted;
+  }).immediate();
+}
+
+module.exports = { purgeConversationV2, deleteConversationItemsByStableKeyV2 };

package/template/coding-task-manager/lib/provider-login-broker.js

@@ -134,6 +134,10 @@ class ProviderLoginBroker {
     // WP-1: the login tab is a real CTM terminal session, created through the
     // server's own prepared-create entry point (server.js wires both in).
     this.createSession = options.createSession || null;
+    // WP-1 (D-2): has the session restore finished? Until it has, a persisted open flow whose
+    // session is not in the registry may simply not be restored yet, and settling it then would
+    // kill a live sign-in. server.js wires `() => _restoreCompletedAt > 0`.
+    this.sessionsRestored = options.sessionsRestored || (() => true);
     this.getSession = options.getSession || ((sessionId) => {
       try {
         return require('../server-state').getSession(sessionId) || null;
@@ -316,9 +320,13 @@ class ProviderLoginBroker {
   // stat is information only — on macOS Claude keeps its credential in the Keychain and
   // Codex may keep it in the keyring, so a present/absent file proves nothing.
   async getState() {
+    const accounts = await this._probeAccounts();
+    // WP-1 (D-1): a restart ADOPTS an open flow's tab, but the exit watcher and the capture
+    // lived only in memory — reconcile them before answering, so THIS read reflects a settle
+    // the reconcile just made (the card's 2 s poll is the only reader a stuck flow has).
+    this._reconcileOpenFlows(accounts);
     const state = this._readState();
     const browserUrls = this._latestBrowserUrls();
-    const accounts = await this._probeAccounts();
     const providers = {};
     for (const id of Object.keys(DEFAULT_PROVIDERS)) {
       const provider = this._provider(id);
@@ -369,6 +377,68 @@ class ProviderLoginBroker {
     }
   }
 
+  // WP-1 (D-1): the ONE state transition that ends a flow — the exit watcher and the
+  // login-state reconcile both come here. `status` overrides the exit-code derivation for a
+  // tab the restore can no longer find (its account probe decides). Pure with respect to the
+  // in-memory maps: the caller owns the latch and the watcher/capture disposal.
+  _settleFlow(provider, sessionId, { exitCode = null, signal = '', error = '', status = null } = {}) {
+    const next = this._readState();
+    const current = next[provider.id]?.flow;
+    // Superseded (a newer flow for this provider) or already final: nothing to say.
+    if (!current || current.sessionId !== sessionId) return;
+    if (current.status === 'completed' || current.status === 'failed') return;
+    const code = typeof exitCode === 'number' ? exitCode : null;
+    current.status = status || (code === 0 ? 'completed' : 'failed');
+    current.exitCode = code;
+    current.signal = signal || '';
+    // An empty error keeps whatever the flow already carried (the exit path says nothing new).
+    if (error) current.error = error;
+    current.exitedAt = _nowIso();
+    current.updatedAt = current.exitedAt;
+    next[provider.id] = { flow: current, status: current.status };
+    this._writeState(next);
+    this._invalidate(provider.agentId);
+  }
+
+  // WP-1 (D-1..D-3): the persisted open flows are reconciled against the live session
+  // registry on every login-state read, because a restart ADOPTS a login tab (its PTY host
+  // survives) while the watcher/capture that end the flow were attached only inside start().
+  // Idempotent: a flow already watched and captured attaches nothing more.
+  _reconcileOpenFlows(accounts) {
+    const state = this._readState();
+    for (const id of Object.keys(DEFAULT_PROVIDERS)) {
+      const saved = state[id];
+      const flow = saved && saved.flow;
+      if (!flow || !OPEN_FLOW_STATUSES.includes(flow.status) || !flow.sessionId) continue;
+      const provider = this._provider(id);
+      const sessionId = flow.sessionId;
+      const session = this.getSession ? this.getSession(sessionId) : null;
+      if (loginTabAlive(session)) {
+        if (!this.subscriptions.has(sessionId)) this._watchLoginTab(provider, session, sessionId);
+        if (!this.captures.has(sessionId)) this._attachCapture(provider, session, flow);
+        continue;
+      }
+      // The tab is gone: its own exit stamp (when the host still holds it) is the truth.
+      if (loginTabExited(session)) {
+        this._settleFlow(provider, sessionId, {
+          exitCode: loginTabExitCode(session),
+          signal: (session && session._exitSignal) || '',
+        });
+        continue;
+      }
+      // No session at all: only a FINISHED restore may read that as "the tab is gone" —
+      // before it, the session simply may not be restored yet and the flow must stay open.
+      if (!session && this.sessionsRestored()) {
+        const account = provider.agentId ? (accounts || {})[provider.agentId] : null;
+        this._settleFlow(provider, sessionId, {
+          exitCode: null,
+          error: 'login_tab_gone',
+          status: account && account.signedIn === true ? 'completed' : 'failed',
+        });
+      }
+    }
+  }
+
   // Records the exit outcome once the tab is gone, and drops the cached probe so
   // the next login-state read re-runs `claude auth status` / `codex login status`.
   _watchLoginTab(provider, session, sessionId) {
@@ -382,20 +452,7 @@ class ProviderLoginBroker {
         if (typeof capture.dispose === 'function') capture.dispose();
         this.captures.delete(sessionId);
       }
-      const next = this._readState();
-      const current = next[provider.id]?.flow;
-      // Superseded (a newer flow for this provider) or already final: nothing to say.
-      if (!current || current.sessionId !== sessionId) return;
-      if (current.status === 'completed' || current.status === 'failed') return;
-      const code = typeof exitCode === 'number' ? exitCode : null;
-      current.status = code === 0 ? 'completed' : 'failed';
-      current.exitCode = code;
-      current.signal = signal || '';
-      current.exitedAt = _nowIso();
-      current.updatedAt = current.exitedAt;
-      next[provider.id] = { flow: current, status: current.status };
-      this._writeState(next);
-      this._invalidate(provider.agentId);
+      this._settleFlow(provider, sessionId, { exitCode, signal });
     };
     const stamp = () => settle({ exitCode: loginTabExitCode(session), signal: (session && session._exitSignal) || '' });
     // A tab that died between createSession() and this line would never reach a fresh

package/template/coding-task-manager/lib/provider-login-tab.js

@@ -23,6 +23,7 @@
 // A login shell that `exec`s the resolved CLI keeps the agent type `shell` and
 // hands the CLI the login argv byte-exact.
 
+const os = require('os');
 const path = require('path');
 
 const BROWSER_SHIM_PATH = path.resolve(__dirname, '..', '..', 'bin', 'open-url-headless.sh');
@@ -74,9 +75,16 @@ function loginTabArgs(spec, cliPath) {
   return ['-l', '-c', loginTabExecLine(spec, cliPath)];
 }
 
-function loginTabShell(env = process.env) {
+// SHELL is often unset for a service-launched CTM (and is in the hermetic test env); then the
+// user's login shell comes from the passwd record, never a hard-coded /bin/zsh -- which does not
+// exist on a default Ubuntu host, where the tab died with exit 1 and no output (design
+// nightly-linux-host-portability-2026-10-27 U-7). /bin/zsh stays the last resort (macOS default).
+function loginTabShell(env = process.env, { userShell = () => os.userInfo().shell } = {}) {
   const shell = String((env && env.SHELL) || '').trim();
-  return shell || '/bin/zsh';
+  if (shell) return shell;
+  let account = '';
+  try { account = String(userShell() || '').trim(); } catch { /* expected: no passwd entry (some containers) -- fall through */ }
+  return account || '/bin/zsh';
 }
 
 function loginTabEnv({ env = process.env, providerId, urlSink }) {