create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/session-create/attachment.js

@@ -1027,7 +1027,7 @@ function installAttachmentRuntime(runtime) {
             createdAt: now,
           }));
         } catch (error) { void error; /* notification is best-effort */ }
-        runtime.broadcastSessionList(true);
+        runtime.broadcastSessionList(true, { reason: 'plan-decision' });
       }
     }
 
@@ -1061,7 +1061,7 @@ function installAttachmentRuntime(runtime) {
       // Always refresh the sidebar when plan state drops — the input / pty-resumed
       // callers reset the wait reason BEFORE calling here, so hadPlanWait can be
       // false even though the Needs-You chip must clear now.
-      runtime.broadcastSessionList(true);
+      runtime.broadcastSessionList(true, { reason: 'plan-decision-cleared' });
     }
 
   function _ensurePlanCardDelivered(reason) {

package/template/coding-task-manager/lib/session-create/create-phases.js

@@ -0,0 +1,118 @@
+'use strict';
+
+// WP-0a (docs/session-create-accept-then-complete-2026-11-01.html §6.1): the ONE phase clock every
+// create on this machine is measured with, and the ONE `[create]` line built from it.
+//
+// The clock is a chain of deltas, not a set of timestamps: each `mark(key)` stores the elapsed time
+// since the PREVIOUS mark (the first one measures from the clock's creation), so the eleven phases of
+// CREATE_PHASE_KEYS tile the create's wall-clock instead of overlapping. `now()` is injected and
+// defaults to `performance.now` — a monotonic timer, never a wall-clock timestamp — so a phase is
+// unaffected by clock steps, and a host that wants a deterministic clock (tests) simply supplies one.
+//
+// Nothing here reads the message, the socket, the session or the environment: this module is pure,
+// which is what makes "a create's telemetry can never change a create's behaviour" checkable.
+
+/**
+ * The phase keys, in the ORDER the `[create]` line prints them. A key that was never marked reads
+ * -1 (`UNMARKED`) in `fields()` — "not reached on this exit", never a fabricated 0.
+ */
+const CREATE_PHASE_KEYS = Object.freeze([
+  'admitMs',     // handleCreatePrepared entry -> end of the idempotency block (prepared.js)
+  'reserveMs',   // reserveSessionGeneration
+  'mkdirMs',     // createCwd mkdir; -1 when no folder was requested
+  'metaMs',      // readLaunchMetadata
+  'warmMs',      // _launchPlanWarmInputs
+  'planMs',      // _launchPlanCoordinator.prepare
+  'rungMs',      // _resolveMissingTranscriptRung + re-plan
+  'restoreMs',   // block verdict + copyBakToMissingLive
+  'codexMcpMs',  // _awaitCodexMcpReadinessForPlan
+  'estimateMs',  // _resumeReadyEstimator.estimate
+  // The awaited `handleCreate` call in prepared.js, marked the moment it returns (success or null):
+  // provider preparation, PTY spawn and the `created` send all happen inside that one call, so it is
+  // the last phase and it reaches `created`. A `handleCreate` that THROWS never returns and leaves it
+  // -1, like every other phase whose await did not resolve.
+  'providerMs',
+]);
+
+const UNMARKED = -1;
+
+/**
+ * A monotonic phase clock. Deltas are whole milliseconds (`Math.round`), so a line is stable to read
+ * and a sub-millisecond phase is 0 rather than 0.4.
+ *
+ * @param {{ now?: () => number }} [opts] `now` defaults to `performance.now`.
+ * @returns {{ mark: (key: string) => void, fields: () => Record<string, number>, totalMs: () => number }}
+ *   `mark(key)` stores `round(now() - previousMark)` under `key` (the first mark measures from
+ *   creation) and throws a `TypeError` for a key outside CREATE_PHASE_KEYS; a key never marked reads
+ *   -1 in `fields()`; `totalMs()` is the elapsed time since creation.
+ */
+function createPhaseClock(opts) {
+  const source = opts && typeof opts === 'object' ? opts : {};
+  const now = typeof source.now === 'function' ? source.now : () => performance.now();
+  const startedAt = now();
+  const marks = new Map();
+  let previous = startedAt;
+  return {
+    mark(key) {
+      if (!CREATE_PHASE_KEYS.includes(key)) throw new TypeError(`Unknown create phase key: ${String(key)}`);
+      const at = now();
+      marks.set(key, Math.round(at - previous));
+      previous = at;
+    },
+    fields() {
+      const fields = {};
+      for (const key of CREATE_PHASE_KEYS) fields[key] = marks.has(key) ? marks.get(key) : UNMARKED;
+      return fields;
+    },
+    totalMs() {
+      return Math.round(now() - startedAt);
+    },
+  };
+}
+
+/** A number or -1. Never throws: a written field is the only way a phase value reaches the line. */
+function _number(value) {
+  return typeof value === 'number' && Number.isFinite(value) ? value : UNMARKED;
+}
+
+/** A scalar as text; anything else (a missing field, an object, a function) reads ''. Never throws. */
+function _text(value) {
+  const type = typeof value;
+  if (type === 'string') return value;
+  if (type === 'number' || type === 'boolean' || type === 'bigint') return String(value);
+  return '';
+}
+
+/**
+ * The ONE `[create]` line: the fixed prefix, then the eleven CREATE_PHASE_KEYS in order, then
+ * load1/cores. NEVER throws — a line that cannot be built is still a line, because this is the only
+ * record that a create happened at all (a bad argument degrades a field to '' or -1, never the
+ * caller's create). Every value is coerced through {@link _text}/{@link _number}, and `clock` is used
+ * only through the two methods this module itself defines.
+ *
+ * @param {{ id?: string, agent?: string, forwardedBy?: string,
+ *           outcome?: 'created'|'duplicate'|'refused'|'failed', code?: string,
+ *           clock?: ReturnType<typeof createPhaseClock>, load1?: number, cores?: number }} [r]
+ * @returns {string} e.g.
+ *   "[create] id=f9edf6cf agent=claude forwardedBy=ctm-3456-1a2c9c outcome=created code=- totalMs=16912
+ *    admitMs=2 reserveMs=41 mkdirMs=-1 metaMs=12 warmMs=0 planMs=11 rungMs=3 restoreMs=0 codexMcpMs=-1
+ *    estimateMs=4 providerMs=15020 load1=76.9 cores=16"
+ */
+function formatCreateLine(r) {
+  const source = r && typeof r === 'object' ? r : {};
+  const clock = source.clock && typeof source.clock.fields === 'function' ? source.clock : null;
+  const fields = clock ? clock.fields() : null;
+  const values = fields && typeof fields === 'object' ? fields : {};
+  const totalMs = clock && typeof clock.totalMs === 'function' ? clock.totalMs() : UNMARKED;
+  let line = '[create]'
+    + ` id=${_text(source.id).slice(0, 8)}`
+    + ` agent=${_text(source.agent) || '-'}`
+    + ` forwardedBy=${_text(source.forwardedBy)}`
+    + ` outcome=${_text(source.outcome) || 'failed'}`
+    + ` code=${_text(source.code) || '-'}`
+    + ` totalMs=${_number(totalMs)}`;
+  for (const key of CREATE_PHASE_KEYS) line += ` ${key}=${_number(values[key])}`;
+  return `${line} load1=${_number(source.load1)} cores=${_number(source.cores)}`;
+}
+
+module.exports = { CREATE_PHASE_KEYS, createPhaseClock, formatCreateLine };

package/template/coding-task-manager/lib/session-create/delegate-worker.js

@@ -284,6 +284,13 @@ async function createWorkerSession(opts = {}) {
   }
 
   const { agent, harness, workerProfile } = _normalizeWorkerRequest(opts);
+  // WP-14 (design D-21, rev 4): the worker TABLE names a dsh worker's harness `'dsh-acp'`, but every
+  // proxy-facing decision below (route servability/execution profile, worker-capability records, the
+  // minted token's binding) is keyed by the WIRE FACE the child speaks. A dsh child speaks
+  // `/v1/messages`, exactly a routed Claude lead's face, so the proxy side is `'claude-code'`;
+  // an `'dsh-acp'` capability/binding could never match it (lib/acp/dsh-route-patch.js DSH_HARNESS is
+  // the same literal for the same reason). The worker table and the launch recipe keep `'dsh-acp'`.
+  const proxyHarness = agent === 'dsh' ? 'claude-code' : harness;
   if (opts.effort !== undefined && !EFFORT_VALUES.has(opts.effort)) {
     throw new DelegateError('effort_invalid', 400, `effort must be one of low|medium|high|xhigh, got "${opts.effort}"`);
   }
@@ -345,17 +352,17 @@ async function createWorkerSession(opts = {}) {
   }
   const settingSources = inheritUserSettings === true ? ['user', 'project', 'local'] : ['project', 'local'];
   const routeStartedAt = Date.now();
-  const { alias, model, baseUrl, upstreamApis, workerCapabilities, executionProfile: routeProfile, maxOutputTokensFact, routeConfiguredMaxOutput } = await _resolveRoute({ route: opts.route, model: opts.model, agent, harness });
+  const { alias, model, baseUrl, upstreamApis, workerCapabilities, executionProfile: routeProfile, maxOutputTokensFact, routeConfiguredMaxOutput } = await _resolveRoute({ route: opts.route, model: opts.model, agent, harness: proxyHarness });
   // D-7 (routed-worker-visibility-and-review-workers-2026-10-16.html): a review worker is
   // budgeted like an implementation worker -- the request policy is proxied for BOTH; only the
   // profile name on the budget sentence and the (later) launch argv differ.
   const budgeted = workerProfile === 'implementation' || workerProfile === 'review';
-  const proxied = workerBudgetSetup.isProxiedRecipe({ requestPolicy: budgeted, route: alias }); let exec; try { exec = resolveExecutionProfile({ request: opts, routeProfile, projectConfig: cfg?.data?.worker, harness, proxied }); } catch (err) { throw new DelegateError('execution_profile_invalid', 400, err.message); }
+  const proxied = workerBudgetSetup.isProxiedRecipe({ requestPolicy: budgeted, route: alias }); let exec; try { exec = resolveExecutionProfile({ request: opts, routeProfile, projectConfig: cfg?.data?.worker, harness: proxyHarness, proxied }); } catch (err) { throw new DelegateError('execution_profile_invalid', 400, err.message); }
   const maxTurns = cliMaxTurns(exec.values, proxied);
   renderedBrief = renderedBriefWithBudget(renderedBrief, exec.values, { proxied, profile: workerProfile });
   const requestPolicy = budgeted ? policyFromValues(exec.values) : null;
-  const selection = workerCapabilitySelection.forLaunch({ workerProfile, callerEffort: opts.effort, capabilities: workerCapabilities, modelId: model, harness });
-  if (selection.error) throw new DelegateError(selection.error, 400, `route "${alias}" has an unsafe capability record for model "${model}" and harness "${harness}"`);
+  const selection = workerCapabilitySelection.forLaunch({ workerProfile, callerEffort: opts.effort, capabilities: workerCapabilities, modelId: model, harness: proxyHarness });
+  if (selection.error) throw new DelegateError(selection.error, 400, `route "${alias}" has an unsafe capability record for model "${model}" and harness "${proxyHarness}"`);
   const effectiveEffort = selection.effort, capabilityRevision = selection.revision, executionProfile = { ...exec, ...(proxied ? { lease: { current: 1, ceiling: require('../model-proxy/request-budget').LEASE_CEILING } } : {}), maxOutputTokensFact, outputCapSource: require('../model-proxy/output-cap').effectiveOutputCap({ capabilityMaxOutput: selection.capability?.max_output_tokens, factMaxOutput: maxOutputTokensFact, routeConfiguredMaxOutput }).source };
   // Admission gates the LAUNCH, right after the route alias is known and before any
   // proxy/token work happens for it -- never a retry, never a queue, never a concurrency cap:
@@ -426,7 +433,7 @@ async function createWorkerSession(opts = {}) {
     }
 
     token = await workerBudgetSetup.mintInitialToken(deps.oauthProxySupervisor, {
-      sessionId: id, alias, model, harness, ttlMs: DEFAULT_TOKEN_TTL_MS, policy: requestPolicy, capabilityRevision, capabilityBasis: selection.basis,
+      sessionId: id, alias, model, harness: proxyHarness, ttlMs: DEFAULT_TOKEN_TTL_MS, policy: requestPolicy, capabilityRevision, capabilityBasis: selection.basis,
       delegationInvocationId,
     }, (err) => new DelegateError('proxy_unready', 503, `could not mint worker token: ${err.message}`));
 
@@ -535,6 +542,13 @@ async function createWorkerSession(opts = {}) {
         createCwd: false,
         _isRestore: false, agentRole: 'worker',
         workerRow,
+        // WP-14 (§9b W-2/W-3): the SAME create path every other worker uses -- deps.createSession is
+        // server.js's handleCreatePrepared -> handleCreate, whose structured-session dispatcher
+        // (lib/session-create/structured-session.js -> dsh-session.js) owns a non-PTY create. A dsh
+        // worker is routed there by its agentType, and its ACP start params (the brief as the first
+        // prompt, the routed pick, the MCP set, the report path) ride the launch spec the dsh branch
+        // of resolveWorkerLaunchParams built. No other agent ever carries `agentType`/`acp`.
+        ...(agent === 'dsh' && launch.acp ? { agentType: 'dsh', routeAlias: launch.acp.routeAlias || null, model: model || null, acp: launch.acp } : {}),
       });
     } catch (err) {
       await _revokeQuietly(token);
@@ -601,7 +615,7 @@ async function createWorkerSession(opts = {}) {
     bash_calls: 0,
   });
   if (typeof deps.broadcastSessionList === 'function') {
-    try { deps.broadcastSessionList(true); } catch { /* expected: a stale socket/list update cannot invalidate a launched worker */ }
+    try { deps.broadcastSessionList(true, { reason: 'worker-launched' }); } catch { /* expected: a stale socket/list update cannot invalidate a launched worker */ }
   }
 
   // Fix round 6: the identity write above is DEFERRED off the create's critical path
@@ -704,6 +718,19 @@ const _computeExitFailure = computeExitFailure;
 const workerAdmissionExit = createWorkerAdmissionExit({ admission, computeExitFailure, getSupervisor: () => _deps && _deps.oauthProxySupervisor });
 const { releaseAdmissionOnExit, resetIgnoredConfigWarningsForTest: _resetIgnoredConfigWarningsForTest } = workerAdmissionExit;
 
+// WP-14 (docs/deepseek-harness-acp-agent-2026-10-28.html §9b W-3, D-21): a dsh worker is not a PTY
+// worker, so `session._workerTurnCounter` (the WorkerStreamObserver) never exists for it and
+// `observer.finalText` is always empty. Its brief turn travels over ACP instead, and its report is
+// the LAST assistant text of that turn: lib/acp/dsh-session-runtime.js accumulates it per
+// `agent_message_chunk` and lib/session-create/dsh-session.js publishes it on the live session as a
+// non-enumerable `_dshFinalText` accessor. The exit path (retireNow below) stamps the same text into
+// runtime_json.finalText, so a status read AFTER the session is gone still reports it.
+function _dshFinalTextFor(session) {
+  if (!session) return '';
+  const value = session._dshFinalText;
+  return typeof value === 'string' ? value : '';
+}
+
 function _probeWorkerFiles(session, reportPath, lastMessagePath, now) {
   return probeCachedFileState(session, now, () => {
     const reportPresent = fs.existsSync(reportPath);
@@ -753,7 +780,7 @@ function getWorkerStatus(ctmSessionId, { now = Date.now } = {}) {
   let failure = null;
   let reportSource = null;
   let reportText = '';
-  const successfulFinalText = boundedWorkerText(observer?.finalText || runtime?.finalText || '');
+  const successfulFinalText = boundedWorkerText(observer?.finalText || runtime?.finalText || _dshFinalTextFor(session) || '');
   if ((failure = workerBudgetSetup.failureForGeneration(runtime, workerRow?.generation || 1))) status = 'failed';
   else if (reportPresent) {
     status = 'report_ready';
@@ -861,7 +888,7 @@ function getWorkerStatus(ctmSessionId, { now = Date.now } = {}) {
     write_tool_calls: observer && Number.isInteger(observer.writerActions) ? observer.writerActions : 0,
     read_tool_calls: observer ? (Number.isInteger(observer.readToolCalls) ? observer.readToolCalls : 0) : null,
     bash_calls: observer ? (Number.isInteger(observer.bashCalls) ? observer.bashCalls : 0) : null,
-    harness: launchRecipe.harness || (workerRow?.agent === 'codex' ? 'codex-cli' : workerRow?.agent === 'claude' ? 'claude-code' : null),
+    harness: launchRecipe.harness || (workerRow?.agent === 'codex' ? 'codex-cli' : workerRow?.agent === 'dsh' ? 'dsh-acp' : workerRow?.agent === 'claude' ? 'claude-code' : null),
     worker_profile: launchRecipe.workerProfile || 'legacy',
     original_brief_sha256: launchRecipe.originalBriefSha256 || null,
     rendered_brief_sha256: launchRecipe.renderedBriefSha256 || null,
@@ -1056,7 +1083,7 @@ async function _hideWorker(ctmSessionId, { now = Date.now } = {}) {
   }
   _hideFailures.delete(ctmSessionId);
   console.log(workerHideLogLine(ctmSessionId, deps.dbModule, retireReason, hiddenAtIso));
-  if (typeof deps.broadcastSessionList === 'function') deps.broadcastSessionList(true);
+  if (typeof deps.broadcastSessionList === 'function') deps.broadcastSessionList(true, { reason: 'worker-hidden' });
 }
 
 // Lifecycle WP-5 (§5 D-10, §9 S-13): stamps consumed_at exactly once -- called by
@@ -1129,13 +1156,30 @@ function _invalidateWorkerFailureCache(deps, ctmSessionId) {
   session._workerFailure = null;
 }
 
-function markWorkerTerminal(ctmSessionId, { terminalStatus, failure = null, runtime = null, now = Date.now, retry = 0, firstAttemptMs = null } = {}) {
+function markWorkerTerminal(ctmSessionId, options = {}) {
+  // C7-B1 (worker-terminal-retry-generation-fence-2026-10-27.html §3.2): the options object is
+  // destructured from a named binding (not inline) so the OWN presence of expectedGeneration can
+  // tell "this retry chain carried the generation it began in" apart from "not provided"; a
+  // present-but-invalid target is refused rather than silently treated as unfenced. Every other
+  // option keeps its exact default, and the legacy `|| 1` row interpretation is unchanged.
+  const { terminalStatus, failure = null, runtime = null, now = Date.now, retry = 0, firstAttemptMs = null } = options;
+  const hasExpectedGeneration = Object.prototype.hasOwnProperty.call(options, 'expectedGeneration');
   const deps = _requireDeps();
   let row;
   try { row = deps.dbModule.getWorkerSession(ctmSessionId); } catch { row = null; /* expected: an unreadable row is treated as no worker row, so nothing is stamped or scheduled -- a later exit-path call or the boot reload retries */ }
   // WP-1: a row that no longer exists, or that another path already hid (hidden_at stamped =
   // the worker is retired and its row is out of every listing), ends the retry chain here.
   if (!row || row.hidden_at) return;
+  // C7-B1 (§3.2): the generation this stamp BEGAN in -- captured once on the first entry and
+  // carried verbatim through every retry, never resampled and never taken from runtime.generation
+  // (absent on a boot retirement, possibly stale telemetry). A resume legitimately reopens the
+  // empty-terminal window for its successor generation (worker-continuation.js); this operation
+  // must not spend that window, so a row that has moved on is left with no mutation and no
+  // terminal side effect at all.
+  const observedGeneration = Number(row.generation || 1);
+  const targetGeneration = hasExpectedGeneration ? options.expectedGeneration : observedGeneration;
+  if (!Number.isSafeInteger(targetGeneration) || targetGeneration <= 0) return;
+  if (observedGeneration !== targetGeneration) return;
   const nowMs = typeof now === 'function' ? now() : Number(now);
   const nowIso = new Date(nowMs).toISOString();
   const patch = {};
@@ -1167,8 +1211,12 @@ function markWorkerTerminal(ctmSessionId, { terminalStatus, failure = null, runt
     });
   }
   if (Object.keys(patch).length) {
+    let accepted;
     try {
-      deps.dbModule.updateWorkerSession(ctmSessionId, patch);
+      // C7-B1 (§3.2): the write goes through the existing helper with the generation fence
+      // bound out-of-band (never inside the patch), so a row that advanced since the read above
+      // matches zero rows instead of being stamped by a stale operation.
+      accepted = deps.dbModule.updateWorkerSession(ctmSessionId, patch, { expectedGeneration: targetGeneration });
     } catch (err) {
       // WP-7 live finding: a busy write lock fails FAST and the old early return also dropped the wait wake + terminal sentinel -- disposition is now REPORT + retry of the whole stamp.
       // WP-1: that retry has NO attempt ceiling -- a transient lock error is not the stamp's
@@ -1181,10 +1229,17 @@ function markWorkerTerminal(ctmSessionId, { terminalStatus, failure = null, runt
       if (['SQLITE_WRITE_LOCK_BUSY', 'SQLITE_BUSY', 'SQLITE_LOCKED'].includes(err && err.code)) {
         const firstAtMs = firstAttemptMs ?? nowMs;
         if (retry === 5) console.warn(`[delegate-worker] terminal stamp still busy after 6 attempts (${String((err && err.code) || 'write_failed').slice(0, 48)}); retrying every ${TERMINAL_STAMP_RETRY_CAP_MS} ms`);
-        return void workerLedger.trackTerminalWork(new Promise((resolve) => setTimeout(() => { try { markWorkerTerminal(ctmSessionId, { terminalStatus, failure, runtime, now, retry: retry + 1, firstAttemptMs: firstAtMs }); } finally { resolve(); } }, Math.min(100 * (retry + 1), TERMINAL_STAMP_RETRY_CAP_MS)).unref?.()));
+        // The retry carries the SAME captured generation, so the fence is re-applied against
+        // whatever the row says when it fires rather than re-derived from a newer row.
+        return void workerLedger.trackTerminalWork(new Promise((resolve) => setTimeout(() => { try { markWorkerTerminal(ctmSessionId, { terminalStatus, failure, runtime, now, retry: retry + 1, firstAttemptMs: firstAtMs, expectedGeneration: targetGeneration }); } finally { resolve(); } }, Math.min(100 * (retry + 1), TERMINAL_STAMP_RETRY_CAP_MS)).unref?.()));
       }
       console.warn(`[delegate-worker] terminal stamp failed (${String((err && err.code) || "write_failed").slice(0, 48)})`); return;
     }
+    // C7-B1 (§3.2): a refused write is not a hint -- a definite false exits here, BEFORE the
+    // local row merge, the failure-cache invalidation, the terminal publication/ledger, the
+    // sentinel/journal and the retention arm. Legacy producers that return undefined keep their
+    // existing behavior; the production helper always returns a boolean.
+    if (accepted === false) return;
     row = { ...row, ...patch };
     if (retry > 0) console.log(`[delegate-worker] terminal stamp landed for ${ctmSessionId} after ${retry + 1} attempts in ${nowMs - (firstAttemptMs ?? nowMs)} ms`);
     _invalidateWorkerFailureCache(deps, ctmSessionId);
@@ -1228,13 +1283,20 @@ const _TERMINAL_STATUSES = new Set(['report_ready', 'exited', 'failed']);
 
 // Callers don't await: a PROXIED worker is first stamped with the proxy's journaled stop record (one async read),
 // so that deferred stamp is tracked by the terminal settle (its sentinel/journal writes start only after the read).
+// C7-B2-P1 (docs/worker-deferred-stop-record-generation-2026-10-27.html §5 D2, §6): the helper's captured
+// numeric generation is forwarded verbatim into the deferred retirement, so the callback retires the
+// generation the exit began in rather than whatever the row says once the awaited read resolves. The
+// proxyless/unreadable-row path calls run() with no argument and keeps its synchronous legacy behavior.
 function retireWorkerOnExit(session, { now = Date.now } = {}) {
   if (!session || session.agentRole !== 'worker' || !session.id) return undefined;
-  const result = workerBudgetSetup.retireAfterStopRecord(() => _requireDeps().dbModule, session.id, _readWorkerLaunchRecipe, () => retireNow(session, now));
+  const result = workerBudgetSetup.retireAfterStopRecord(() => _requireDeps().dbModule, session.id, _readWorkerLaunchRecipe, (expectedGeneration) => retireNow(session, now, expectedGeneration));
   return result && typeof result.then === 'function' ? workerLedger.trackTerminalWork(result) : result;
 }
 
-function retireNow(session, now) {
+// C7-B2-P1 (§5 D2, §6): `expectedGeneration` is an INTERNAL continuation argument -- the numeric
+// generation captured before the deferred stop-record read. undefined means the legacy proxyless /
+// unreadable-row path, which keeps its exact behavior.
+function retireNow(session, now, expectedGeneration) {
   let result;
   try {
     result = getWorkerStatus(session.id, { now });
@@ -1242,6 +1304,9 @@ function retireNow(session, now) {
     /* expected: a status derivation that throws at exit (deps not configured, db closing during shutdown) cannot name a terminal status, so the row is left un-stamped and retention degrades to "never auto-hidden" rather than stamping a guess */
     return;
   }
+  // A provided target differing from current-row status exits before terminal side effects.
+  // Omission retains the legacy proxyless/unreadable-row path.
+  if (expectedGeneration !== undefined && result.generation !== expectedGeneration) return;
   if (!_TERMINAL_STATUSES.has(result.status)) return;
   // F1: invalidate unconditionally here too -- markWorkerTerminal only invalidates on the
   // branch that actually writes failure_json (row.terminal_at was empty); a racing/duplicate
@@ -1257,10 +1322,15 @@ function retireNow(session, now) {
     contextTokens: observer ? observer.contextTokens : null,
     peakContextTokens: observer ? observer.peakContextTokens : null,
     compactions: observer ? observer.compactions : [],
-    finalText: observer ? observer.finalText : '', cliReportedCostUsd: observer ? observer.cliReportedCostUsd : null,
+    finalText: observer ? observer.finalText : _dshFinalTextFor(session), cliReportedCostUsd: observer ? observer.cliReportedCostUsd : null,
     providerThreadId: observer ? observer.providerThreadId : '',
   };
-  markWorkerTerminal(session.id, { terminalStatus: result.status, failure: result.failure, runtime, now });
+  // The target is spread in ONLY when this call actually carries one: B1 rejects a present-but-invalid
+  // guard (a present `undefined` key is invalid), so the legacy path must omit the key, not pass undefined.
+  markWorkerTerminal(session.id, {
+    terminalStatus: result.status, failure: result.failure, runtime, now,
+    ...(expectedGeneration === undefined ? {} : { expectedGeneration }),
+  });
 }
 
 // WP-2 (worker-terminal-stamp-durable-2026-10-26 D-2/D-3): one idempotent read repair for a