@adhdev/daemon-core 0.9.82-rc.310 → 0.9.82-rc.312

package/src/commands/router.ts

@@ -40,6 +40,8 @@ import { logCommand } from '../logging/command-log.js';
 import type { CommandLogEntry } from '../logging/command-log.js';
 import * as yaml from 'js-yaml';
 import { getRecentLogs, LOG_PATH } from '../logging/logger.js';
+import { readDaemonLogTail, MAX_TAIL_BYTES } from '../logging/log-tail-reader.js';
+import { redactLogLines } from '../logging/log-redactor.js';
 import { createInteractionId, getRecentDebugTrace, recordDebugTrace } from '../logging/debug-trace.js';
 import { getSessionHostSurfaceKind, partitionSessionHostRecords } from '../session-host/runtime-surface.js';
 import { createHermesManualMeshCoordinatorSetup, resolveMeshCoordinatorSetup } from './mesh-coordinator.js';
@@ -513,6 +515,21 @@ function readInlineMeshNodeId(node: any): string {
     return normalizeMeshNodeId(node) ?? '';
 }
 
+// A local worktree node whose workspace directory has been deleted from disk.
+// The worktree was removed (or the machine pruned it) but the node still lingers
+// in the inline mesh cache. Such a node has no live truth to confirm and must
+// never be probed or counted toward direct-peer-truth — doing so blocks the
+// graph with a permanent `direct_peer_truth_unavailable`. Deliberately narrow:
+// it only fires for `isLocalWorktree === true` nodes with a recorded workspace
+// that does not exist. Remote nodes and nodes whose workspace is present on disk
+// are never matched, so a slow remote peer is still classified unavailable.
+function isDeadLocalWorktreeNode(node: any): boolean {
+    if (node?.isLocalWorktree !== true) return false;
+    const workspace = readStringValue(node?.workspace);
+    if (!workspace) return false;
+    return !fs.existsSync(workspace);
+}
+
 // Boundary normalization: reconcile a node's identity so `id` and `nodeId` both
 // carry the same canonical value (any incoming form — id / nodeId / node_id — is
 // absorbed by normalizeMeshNodeId, and the SQLite `node_id` leak is dropped).
@@ -985,6 +1002,73 @@ function readMeshTimeoutEnvMs(name: string, defaultMs: number): number {
 // (still under the P2P REQUEST_TIMEOUT of 30s) and made env-overridable.
 const MESH_DIRECT_PROBE_TIMEOUT_MS = readMeshTimeoutEnvMs('MESH_DIRECT_PROBE_TIMEOUT_MS', 25_000);
 const MESH_DIRECT_PROBE_RETRY_TIMEOUT_MS = readMeshTimeoutEnvMs('MESH_DIRECT_PROBE_RETRY_TIMEOUT_MS', 25_000);
+// How long a successful per-peer git_status probe stays fresh enough to be
+// reused instead of issuing another blocking `refreshUpstream:true` fan-out.
+// A slow (TURN-relayed) peer's probe can take 9-23s, and the dashboard's
+// auto-retry loop re-fires every few seconds; without this gate every retry
+// would start a brand new probe storm to the same peer. Within this window the
+// last successful result is reused so a refresh quiesces instead of looping.
+// Min-clamped to 1s by readMeshTimeoutEnvMs; raise via env for very slow peers.
+const MESH_DIRECT_PROBE_REUSE_MS = readMeshTimeoutEnvMs('MESH_DIRECT_PROBE_REUSE_MS', 12_000);
+
+/**
+ * De-duplicates and rate-limits per-peer git_status probes so a single mesh
+ * refresh — or a burst of refreshes from the dashboard auto-retry loop — cannot
+ * launch a storm of concurrent/back-to-back `refreshUpstream:true` commands to
+ * the same slow peer.
+ *
+ * Two gates, both keyed by `daemonId::workspace`:
+ *  - In-flight dedup: a second probe for a key with a probe already running
+ *    shares (awaits) the in-flight promise instead of issuing a second command.
+ *  - Recently-probed reuse: a successful probe younger than `reuseMs` is reused
+ *    verbatim instead of issuing a fresh probe. Failures are NOT cached (so a
+ *    transient timeout doesn't pin a peer to "no truth" for the whole window).
+ *
+ * Lives on the router instance so the gate spans separate mesh_status calls,
+ * which is exactly where the refresh storm happens.
+ */
+class MeshGitProbeCache {
+    private inflight = new Map<string, Promise<Record<string, unknown> | null>>();
+    private recent = new Map<string, { at: number; value: Record<string, unknown> }>();
+
+    constructor(private readonly reuseMs: number, private readonly now: () => number = Date.now) {}
+
+    private key(daemonId: string, workspace: string): string {
+        return `${daemonId}::${workspace}`;
+    }
+
+    /**
+     * Run `probe` for this peer, but reuse a fresh recent result or an in-flight
+     * probe for the same key when one is available. `probe` is only invoked when
+     * neither gate is satisfied.
+     */
+    async probe(
+        daemonId: string,
+        workspace: string,
+        probe: () => Promise<Record<string, unknown> | null>,
+    ): Promise<Record<string, unknown> | null> {
+        const key = this.key(daemonId, workspace);
+        const cached = this.recent.get(key);
+        if (cached && this.now() - cached.at < this.reuseMs) {
+            return cached.value;
+        }
+        const existing = this.inflight.get(key);
+        if (existing) return existing;
+        const pending = (async () => {
+            const result = await probe();
+            if (result) this.recent.set(key, { at: this.now(), value: result });
+            return result;
+        })();
+        this.inflight.set(key, pending);
+        try {
+            return await pending;
+        } finally {
+            // Only clear the slot if it is still ours — a later overlapping call
+            // would have reused this very promise, so it is safe to delete here.
+            if (this.inflight.get(key) === pending) this.inflight.delete(key);
+        }
+    }
+}
 
 async function probeRemoteMeshGitStatus(args: {
     dispatchMeshCommand?: (daemonId: string, cmd: string, args: Record<string, unknown>) => Promise<unknown>;
@@ -1074,6 +1158,10 @@ async function hydrateInlineMeshDirectTruth(args: {
     // probe was attempted. Only an explicit refresh (probeRemotePeers=true)
     // performs the fan-out and classifies an unreachable peer as unavailable.
     probeRemotePeers: boolean;
+    // Optional shared probe cache: dedups concurrent probes and reuses a
+    // recently-probed peer's result instead of re-issuing a blocking
+    // refreshUpstream probe within the reuse window.
+    probeCache?: MeshGitProbeCache;
 }): Promise<{
     directEvidenceCount: number;
     localConfirmedCount: number;
@@ -1081,6 +1169,7 @@ async function hydrateInlineMeshDirectTruth(args: {
     peerConfirmedCount: number;
     standingEvidenceCount: number;
     unavailableNodeIds: string[];
+    deadNodeIds: string[];
 }> {
     const nodes = Array.isArray(args.mesh?.nodes) ? args.mesh.nodes : [];
     if (!nodes.length) {
@@ -1091,6 +1180,7 @@ async function hydrateInlineMeshDirectTruth(args: {
             peerConfirmedCount: 0,
             standingEvidenceCount: 0,
             unavailableNodeIds: [],
+            deadNodeIds: [],
         };
     }
 
@@ -1105,6 +1195,7 @@ async function hydrateInlineMeshDirectTruth(args: {
     let peerConfirmedCount = 0;
     let standingEvidenceCount = 0;
     const unavailableNodeIds: string[] = [];
+    const deadNodeIds: string[] = [];
 
     for (const [nodeIndex, node] of nodes.entries()) {
         const nodeId = normalizeMeshNodeId(node) || `node_${nodeIndex}`;
@@ -1116,6 +1207,22 @@ async function hydrateInlineMeshDirectTruth(args: {
             daemonId && (daemonId === args.localMachineId || daemonId === args.statusInstanceId),
         ) || Boolean(args.meshSource !== 'local_config' && nodeIndex === 0);
 
+        // A dead local worktree owned by this coordinator (isLocalWorktree, the
+        // node's daemon is us, workspace path gone) has no live truth and cannot
+        // be probed — the directory it would self-probe no longer exists. Exclude
+        // it entirely from direct-peer-truth accounting: do not probe it, do not
+        // attempt it, do not push it to unavailableNodeIds (which would otherwise
+        // wedge the graph in a permanent direct_peer_truth_unavailable). This is
+        // strictly self + isLocalWorktree + absent-path; remote peers and nodes
+        // whose workspace still exists are unaffected and stay classifiable.
+        const isSelfDaemonNode = Boolean(
+            daemonId && (daemonId === args.localMachineId || daemonId === args.statusInstanceId),
+        );
+        if ((isSelfNode || isSelfDaemonNode) && isDeadLocalWorktreeNode(node)) {
+            deadNodeIds.push(nodeId);
+            continue;
+        }
+
         if (!workspace) {
             if (!isSelfNode && daemonId) unavailableNodeIds.push(nodeId);
             continue;
@@ -1162,8 +1269,10 @@ async function hydrateInlineMeshDirectTruth(args: {
         // Bounded retry, gated on the peer staying `connected`: a slow
         // (TURN-relayed) peer that just exceeds one probe window is recovered
         // instead of being hard-failed. The connection is re-checked before each
-        // retry so a peer that actually dropped is abandoned promptly.
-        const remoteGit = await probeRemoteMeshGitStatusWithRetry({
+        // retry so a peer that actually dropped is abandoned promptly. Routed
+        // through the shared probe cache so a refresh burst reuses a recent
+        // result / shares an in-flight probe instead of storming the peer.
+        const runProbe = () => probeRemoteMeshGitStatusWithRetry({
             dispatchMeshCommand: args.dispatchMeshCommand,
             daemonId,
             workspace,
@@ -1171,6 +1280,9 @@ async function hydrateInlineMeshDirectTruth(args: {
             retryTimeoutMs: MESH_DIRECT_PROBE_RETRY_TIMEOUT_MS,
             getConnection: args.getMeshPeerConnectionStatus,
         });
+        const remoteGit = args.probeCache
+            ? await args.probeCache.probe(daemonId, workspace, runProbe)
+            : await runProbe();
         if (remoteGit) {
             recordInlineMeshDirectGitTruth(node, remoteGit, 'selected_coordinator_mesh_p2p_git');
             peerConfirmedCount += 1;
@@ -1193,6 +1305,7 @@ async function hydrateInlineMeshDirectTruth(args: {
         peerConfirmedCount,
         standingEvidenceCount,
         unavailableNodeIds,
+        deadNodeIds,
     };
 }
 
@@ -3157,8 +3270,21 @@ export class DaemonCommandRouter {
      *  Allows the MCP server to query mesh data via get_mesh even when
      *  the mesh doesn't exist in the local meshes.json file. */
     private inlineMeshCache = new Map<string, any>();
+    /** Tombstones for inline mesh nodes removed via remove_mesh_node, keyed by
+     *  meshId → set of removed nodeIds. The dashboard keeps echoing the removed
+     *  node in the inlineMesh it attaches to every command; without a tombstone,
+     *  reconcileInlineMeshCache MERGEs it straight back (resurrection). A
+     *  tombstoned node is skipped during reconcile only while its workspace is
+     *  absent from disk — a genuine re-registration (same nodeId, workspace back
+     *  on disk) clears the tombstone and merges normally, preserving clone
+     *  worktree visibility and legitimate node re-creation. */
+    private removedInlineMeshNodeIds = new Map<string, Set<string>>();
     /** Coordinator-owned whole-mesh aggregate status snapshots. Browser callers read this by default. */
     private aggregateMeshStatusCache = new Map<string, { builtAt: number; snapshot: any; queueRevision: string }>();
+    /** Shared per-peer git_status probe dedup + recently-probed reuse gate.
+     *  Spans separate mesh_status/get_mesh calls so the dashboard auto-retry
+     *  loop cannot storm a slow peer with back-to-back refreshUpstream probes. */
+    private meshGitProbeCache = new MeshGitProbeCache(MESH_DIRECT_PROBE_REUSE_MS);
     /** In-memory async Refinery jobs keyed by meshId:nodeId to reject/return duplicate in-flight requests. */
     private runningRefineJobs = new Map<string, MeshRefineJobHandle>();
     /** Terminal async Refinery jobs preserve a clear answer after the worktree node has been removed. */
@@ -3190,10 +3316,33 @@ export class DaemonCommandRouter {
         const unavailableNodeIds = new Set<string>();
         const sourceOfTruth = readObjectRecord(snapshot.sourceOfTruth);
         const directPeerTruth = readObjectRecord(sourceOfTruth.directPeerTruth);
+        // Dead local worktree nodes (isLocalWorktree, workspace deleted from disk)
+        // carry no live truth and must never gate the aggregate as unavailable.
+        // A cached snapshot built before the worktree was removed can still list
+        // such a node in unavailableNodeIds, which would wedge the graph in a
+        // permanent direct_peer_truth_unavailable; drop them here so the held
+        // standing-state truth for the surviving nodes satisfies the aggregate.
+        const deadNodeIds = new Set<string>();
+        for (const node of mesh.nodes) {
+            if (!isDeadLocalWorktreeNode(node)) continue;
+            const deadId = readInlineMeshNodeId(node);
+            if (deadId) deadNodeIds.add(deadId);
+        }
+        let droppedDeadUnavailable = false;
         for (const entry of Array.isArray(directPeerTruth.unavailableNodeIds) ? directPeerTruth.unavailableNodeIds : []) {
             const nodeId = readStringValue(entry);
-            if (nodeId) unavailableNodeIds.add(nodeId);
+            if (!nodeId) continue;
+            if (deadNodeIds.has(nodeId)) {
+                droppedDeadUnavailable = true;
+                continue;
+            }
+            unavailableNodeIds.add(nodeId);
         }
+        // Force a rewrite when a dead worktree was filtered out of a previously
+        // built unavailable set, even if no live git was re-hydrated this pass —
+        // otherwise the early-return below would hand back the stale snapshot that
+        // still says direct_peer_truth_unavailable.
+        if (droppedDeadUnavailable) changed = true;
 
         const nodes = snapshot.nodes.map((statusNode: any) => {
             const nodeId = normalizeMeshNodeId(statusNode);
@@ -3327,7 +3476,10 @@ export class DaemonCommandRouter {
         // Save-boundary node-id normalization: reconcile each node's identity so
         // `id` and `nodeId` agree before it enters the cache, so reconcile keys
         // and the round-trip through the status serializer stay form-stable.
-        const sanitizedInlineMesh = sanitizeInlineMesh(normalizeInlineMeshNodeIdentity(inlineMesh as any));
+        const sanitizedInlineMesh = this.applyInlineMeshNodeTombstones(
+            meshId,
+            sanitizeInlineMesh(normalizeInlineMeshNodeIdentity(inlineMesh as any)),
+        );
         const cached = this.inlineMeshCache.get(meshId);
         if (cached) {
             const merged = reconcileInlineMeshCache(cached, sanitizedInlineMesh);
@@ -3348,7 +3500,10 @@ export class DaemonCommandRouter {
             const cached = this.getCachedInlineMesh(meshId);
             if (cached) {
                 if (inlineMeshCarriesTransientNodeTruth(inlineMesh)) {
-                    const merged = reconcileInlineMeshCache(cached, inlineMesh as any);
+                    const merged = reconcileInlineMeshCache(
+                        cached,
+                        this.applyInlineMeshNodeTombstones(meshId, inlineMesh as any),
+                    );
                     this.inlineMeshCache.set(meshId, sanitizeInlineMesh(normalizeInlineMeshNodeIdentity(merged)));
                     return { mesh: merged, inline: true, source: 'inline_cache' };
                 }
@@ -3408,13 +3563,56 @@ export class DaemonCommandRouter {
         if (!mesh || !Array.isArray(mesh.nodes)) return false;
         const idx = mesh.nodes.findIndex((entry: any) => meshNodeIdMatches(entry, nodeId));
         if (idx === -1) return false;
+        const canonicalNodeId = readInlineMeshNodeId(mesh.nodes[idx]) || nodeId;
         mesh.nodes.splice(idx, 1);
         mesh.updatedAt = new Date().toISOString();
         this.inlineMeshCache.set(meshId, mesh);
+        // Tombstone the removed node so the dashboard's stale inlineMesh echo does
+        // not MERGE it back on the next command (see removedInlineMeshNodeIds).
+        this.tombstoneRemovedInlineMeshNode(meshId, canonicalNodeId);
+        if (canonicalNodeId !== nodeId) this.tombstoneRemovedInlineMeshNode(meshId, nodeId);
         this.invalidateAggregateMeshStatus(meshId);
         return true;
     }
 
+    private tombstoneRemovedInlineMeshNode(meshId: string, nodeId: string): void {
+        if (!nodeId) return;
+        let set = this.removedInlineMeshNodeIds.get(meshId);
+        if (!set) {
+            set = new Set<string>();
+            this.removedInlineMeshNodeIds.set(meshId, set);
+        }
+        set.add(nodeId);
+    }
+
+    /** Filter an incoming inline mesh against this mesh's tombstones before it is
+     *  reconciled into the cache. A tombstoned node is dropped only while its
+     *  workspace is still absent from disk; if the workspace is back (genuine
+     *  re-registration), the tombstone is cleared and the node merges normally. */
+    private applyInlineMeshNodeTombstones(meshId: string, incoming: any): any {
+        const tombstones = this.removedInlineMeshNodeIds.get(meshId);
+        if (!tombstones?.size || !incoming || typeof incoming !== 'object' || !Array.isArray(incoming.nodes)) {
+            return incoming;
+        }
+        let dropped = false;
+        const nodes = incoming.nodes.filter((node: any) => {
+            const nodeId = readInlineMeshNodeId(node);
+            if (!nodeId || !tombstones.has(nodeId)) return true;
+            const workspace = readStringValue(node?.workspace);
+            // Genuine re-registration: same nodeId, workspace back on disk →
+            // clear the tombstone and let the node merge normally.
+            if (workspace && fs.existsSync(workspace)) {
+                tombstones.delete(nodeId);
+                return true;
+            }
+            dropped = true;
+            return false;
+        });
+        if (tombstones.size === 0) this.removedInlineMeshNodeIds.delete(meshId);
+        if (!dropped) return incoming;
+        return { ...incoming, nodes };
+    }
+
     private normalizeMeshSessionCleanupMode(value: unknown): RepoMeshSessionCleanupMode {
         return value === 'stop'
             || value === 'delete_stopped'
@@ -6611,6 +6809,7 @@ export class DaemonCommandRouter {
                     statusInstanceId: this.deps.statusInstanceId,
                     localMachineId: loadConfig().machineId || '',
                     probeRemotePeers,
+                    probeCache: this.meshGitProbeCache,
                 });
                 const directTruthSatisfied = meshRecord.source !== 'inline_bootstrap' || directTruth.directEvidenceCount > 0;
                 const sourceOfTruth = {
@@ -7289,10 +7488,115 @@ export class DaemonCommandRouter {
                 return result as CommandRouterResult;
             }
 
+            case 'get_mesh_node_logs': {
+                // Coordinator-driven remote log fetch: read a (possibly remote)
+                // daemon's recent log tail over P2P instead of opening a session
+                // and grepping the file by hand. Mirrors fast_forward_mesh_node's
+                // forward pattern — resolve the node, forward to its owning daemon
+                // when remote, otherwise read locally. The reply tail is HARD
+                // byte-bounded and secret-redacted before it leaves the machine.
+                const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
+                const nodeId = typeof args?.nodeId === 'string' ? args.nodeId.trim() : '';
+                let nodeDaemonId: string | undefined;
+                if (meshId && nodeId) {
+                    const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh, { preferInline: true });
+                    const node = meshRecord?.mesh?.nodes?.find((n: any) => meshNodeIdMatches(n, nodeId));
+                    nodeDaemonId = typeof node?.daemonId === 'string' ? node.daemonId.trim() : undefined;
+                }
+                // _meshDirectDispatch prevents re-forwarding (and P2P self-dial)
+                // once the call lands on the owning daemon — that daemon then reads
+                // its own logs even if the stored daemonId uses a legacy form.
+                const selfDaemonId = this.deps.statusInstanceId;
+                const isRemote = nodeDaemonId && selfDaemonId && nodeDaemonId !== selfDaemonId;
+                if (isRemote && this.deps.dispatchMeshCommand && !args?._meshDirectDispatch) {
+                    const forwarded = await this.deps.dispatchMeshCommand(nodeDaemonId!, 'get_mesh_node_logs', {
+                        ...(typeof args === 'object' && args !== null ? args as Record<string, unknown> : {}),
+                        _meshDirectDispatch: true,
+                    });
+                    return (forwarded ?? { success: false, error: 'no response from remote node' }) as CommandRouterResult;
+                }
+
+                // Local read on the owning daemon.
+                const rawTailBytes = Number(args?.tailBytes);
+                const tail = readDaemonLogTail({
+                    date: typeof args?.date === 'string' ? args.date : undefined,
+                    tailBytes: Number.isFinite(rawTailBytes) ? Math.min(rawTailBytes, MAX_TAIL_BYTES) : undefined,
+                    grep: typeof args?.grep === 'string' ? args.grep : undefined,
+                    sinceMs: Number.isFinite(Number(args?.sinceMs)) ? Number(args?.sinceMs) : undefined,
+                });
+                if (!tail.success) {
+                    return {
+                        success: false,
+                        error: tail.error || 'failed to read daemon log tail',
+                        nodeId,
+                        logPath: tail.logPath,
+                        platform: tail.platform,
+                    } as CommandRouterResult;
+                }
+                // SECURITY: redact secrets from every line before returning over P2P.
+                const redactedLines = redactLogLines(tail.lines);
+                return {
+                    success: true,
+                    nodeId,
+                    daemonId: selfDaemonId,
+                    logPath: tail.logPath,
+                    platform: tail.platform,
+                    lines: redactedLines,
+                    lineCount: redactedLines.length,
+                    truncated: tail.truncated,
+                    filtered: tail.filtered,
+                    bytesReturned: tail.bytesReturned,
+                    ...(tail.grep ? { grep: tail.grep } : {}),
+                } as CommandRouterResult;
+            }
+
             case 'refine_mesh_node': {
                 const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
                 const nodeId = typeof args?.nodeId === 'string' ? args.nodeId.trim() : '';
                 if (!meshId || !nodeId) return { success: false, error: 'meshId and nodeId required' };
+
+                // Remote forward: a worktree node lives on its OWN daemon's machine, so the
+                // refine (cd into node.workspace, merge → push → cleanup) must run on THAT
+                // daemon — not the coordinator, whose filesystem has no such path. The sibling
+                // fast_forward_mesh_node / clone_mesh_node handlers already forward to the
+                // node's daemon; refine_mesh_node was the gap (the coordinator would cd into a
+                // non-existent local path and fail), so remote-machine worktrees could not be
+                // converged at all. Forward both dry-run (plan reads the worktree git state)
+                // and execute (async merge job) so the same machine that owns the worktree
+                // resolves it.
+                //
+                // coordinatorDaemonId: refine is ASYNC — the completed/failed event is queued
+                // on the executing daemon's pending-events queue scoped to a coordinator id and
+                // recovered by the coordinator's reconcile loop (pullRemoteNodeQueues →
+                // get_pending_mesh_events). Without stamping our own status id, the remote
+                // daemon would fall back to ITS OWN statusInstanceId as the coordinator
+                // (startMeshRefineJob), scoping the terminal event to the wrong inbox where the
+                // real coordinator never pulls it. Stamp the canonical status id (which is in
+                // the coordinator's self-identity set used to scope the remote drain) so the
+                // event routes back here. Preserve any caller-supplied coordinatorDaemonId.
+                //
+                // _meshDirectDispatch prevents re-forwarding (and P2P self-dial) once the call
+                // has landed on the owning daemon — that daemon then executes locally even if
+                // the stored daemonId uses a legacy form that doesn't match its own identity.
+                {
+                    const meshRecordForForward = await this.getMeshForCommand(meshId, args?.inlineMesh, { preferInline: true });
+                    const forwardNode = meshRecordForForward?.mesh?.nodes?.find((n: any) => meshNodeIdMatches(n, nodeId));
+                    const nodeDaemonId = typeof forwardNode?.daemonId === 'string' ? forwardNode.daemonId.trim() : undefined;
+                    const selfDaemonId = this.deps.statusInstanceId;
+                    const isRemote = nodeDaemonId && selfDaemonId && nodeDaemonId !== selfDaemonId;
+                    if (isRemote && this.deps.dispatchMeshCommand && !args?._meshDirectDispatch) {
+                        const callerCoordinatorDaemonId = typeof args?.coordinatorDaemonId === 'string' && args.coordinatorDaemonId.trim()
+                            ? args.coordinatorDaemonId.trim()
+                            : undefined;
+                        const forwarded = await this.deps.dispatchMeshCommand(nodeDaemonId!, 'refine_mesh_node', {
+                            ...(typeof args === 'object' && args !== null ? args as Record<string, unknown> : {}),
+                            coordinatorDaemonId: callerCoordinatorDaemonId || selfDaemonId,
+                            _meshDirectDispatch: true,
+                        });
+                        return (forwarded ?? { success: false, error: 'no response from remote node' }) as CommandRouterResult;
+                    }
+                }
+
                 // Dry-run (plan-only) is the default and stays synchronous: it does no
                 // validation/merge/push and returns the plan instantly. Only execute=true
                 // (and not dry_run) goes through the async refine job that actually
@@ -8492,6 +8796,11 @@ export class DaemonCommandRouter {
 
                     const localMachineId = loadConfig().machineId || '';
                     const requireDirectPeerTruth = args?.requireDirectPeerTruth === true;
+                    // Shared probe gate for this mesh_status call: the bootstrap
+                    // hydrate below and the per-node render loop further down both
+                    // probe the same peers — route both through this cache so they
+                    // dedup within the call and reuse recent results across calls.
+                    const meshGitProbeCache = this.meshGitProbeCache;
                     const directTruth = requireDirectPeerTruth
                         ? await hydrateInlineMeshDirectTruth({
                             mesh,
@@ -8504,6 +8813,7 @@ export class DaemonCommandRouter {
                             // out a blocking peer git probe. Default loads return
                             // held truth so one slow peer can't block the graph.
                             probeRemotePeers: refreshRequested,
+                            probeCache: meshGitProbeCache,
                         })
                         : {
                             directEvidenceCount: 0,
@@ -8512,6 +8822,7 @@ export class DaemonCommandRouter {
                             peerConfirmedCount: 0,
                             standingEvidenceCount: 0,
                             unavailableNodeIds: [] as string[],
+                            deadNodeIds: [] as string[],
                         };
                     // Default/cached loads may not attempt a remote peer probe yet; do not surface that as
                     // a direct mesh truth failure until an explicit probe attempt actually fails.
@@ -8710,7 +9021,7 @@ export class DaemonCommandRouter {
                                     // path), gated on the peer staying connected, so a
                                     // slow TURN-relayed peer is recovered rather than
                                     // dropped after a single timeout.
-                                    const remoteGit = await probeRemoteMeshGitStatusWithRetry({
+                                    const runNodeProbe = () => probeRemoteMeshGitStatusWithRetry({
                                         dispatchMeshCommand: this.deps.dispatchMeshCommand,
                                         daemonId,
                                         workspace,
@@ -8719,6 +9030,12 @@ export class DaemonCommandRouter {
                                         getConnection: this.deps.getMeshPeerConnectionStatus,
                                         onConnection: connection => { status.connection = connection; },
                                     });
+                                    // Same shared cache as the bootstrap hydrate path: within one
+                                    // mesh_status call this dedups the bootstrap probe against this
+                                    // per-node probe for the same peer, and across calls it reuses a
+                                    // recent result so the dashboard auto-retry loop can't restart a
+                                    // fresh refreshUpstream probe seconds apart.
+                                    const remoteGit = await meshGitProbeCache.probe(daemonId, workspace, runNodeProbe);
                                     if (remoteGit) {
                                         status.git = remoteGit;
                                         status.health = remoteGit.isGitRepo

package/src/commands/stream-commands.ts

@@ -245,6 +245,14 @@ export function normalizeProviderScriptArgs(args: any, scriptName?: string): Rec
 function buildControlScriptResult(scriptName: string, payload: any): Record<string, unknown> {
     if (!payload || typeof payload !== 'object') return {};
 
+    // The spec-driven control adapter (open_picker LIST/SELECT) already
+    // produced a structured controlResult by parsing the live screen. Honour
+    // it verbatim instead of re-deriving one from legacy payload shapes —
+    // otherwise the screen-parsed options/currentValue get clobbered.
+    if (payload.controlResult && typeof payload.controlResult === 'object') {
+        return { controlResult: payload.controlResult };
+    }
+
     const legacyListPayload = (() => {
         if (Array.isArray(payload.options)) return payload;
         if (/^listmodels$/i.test(scriptName) && Array.isArray(payload.models)) {

package/src/config/chat-history.ts

@@ -172,6 +172,15 @@ function collapseReplayAssistantTurns(messages: HistoryMessage[], historyBehavio
         }
 
         if (message.role === 'assistant') {
+            // Tool / activity bubbles are distinct events, not replayed prose —
+            // collapsing them would erase every tool call and result after the
+            // turn's first assistant message. Only consecutive *prose* assistant
+            // turns are the replay-dedup target this collapse exists for.
+            const isActivity = message.kind === 'tool' || message.kind === 'terminal' || message.kind === 'thought';
+            if (isActivity) {
+                collapsed.push(message);
+                continue;
+            }
             if (sawAssistantSinceLastUser) continue;
             sawAssistantSinceLastUser = true;
             collapsed.push(message);

package/src/config/mesh-config.ts

@@ -21,7 +21,7 @@ import type {
     RepoMeshHostMetadata,
     RepoMeshDaemonRole,
 } from '../repo-mesh-types.js';
-import { DEFAULT_MESH_POLICY } from '../repo-mesh-types.js';
+import { DEFAULT_MESH_POLICY, normalizeMeshSchedulingStrategy } from '../repo-mesh-types.js';
 import { createDefaultMeshHostMetadata } from '../mesh/mesh-host-ownership.js';
 
 // ─── Persistence ────────────────────────────────
@@ -118,6 +118,22 @@ function mergeMeshPolicy(base: RepoMeshPolicy | undefined, patch: Partial<RepoMe
     if (!SPAWNED_SESSION_VISIBILITY_MODES.has(String(policy.spawnedSessionVisibility))) {
         policy.spawnedSessionVisibility = 'visible';
     }
+    // Load-balancing: normalize the scheduling strategy so an invalid/blank value
+    // falls back to 'first_eligible' (strict no-change). Only persist the field when
+    // it is explicitly a non-default value to keep existing meshes.json untouched.
+    const normalizedStrategy = normalizeMeshSchedulingStrategy(policy.schedulingStrategy);
+    if (normalizedStrategy === 'first_eligible') {
+        delete policy.schedulingStrategy;
+    } else {
+        policy.schedulingStrategy = normalizedStrategy;
+    }
+    // Convergence routing: strict opt-in (default false). Only persist when explicitly
+    // enabled so existing meshes.json stays byte-for-byte untouched.
+    if (policy.autoConvergeCodeChange === true) {
+        policy.autoConvergeCodeChange = true;
+    } else {
+        delete policy.autoConvergeCodeChange;
+    }
     return policy;
 }
 

package/src/index.ts

@@ -122,6 +122,9 @@ export type {
   LocalMeshNodeEntry,
   RepoMeshStatus,
   RepoMeshNodeStatus,
+  RepoMeshPeerConnectionStatus,
+  RepoMeshPeerConnectionState,
+  RepoMeshPeerConnectionTransport,
   RepoMeshSessionStatus,
   RepoMeshQueueTask,
   RepoMeshQueueTaskStatus,
@@ -131,8 +134,19 @@ export type {
   RepoMeshLedgerSummaryStatus,
   RepoMeshLedgerStatus,
   MeshAsyncJobLifecycle,
+  RepoMeshSchedulingStrategy,
+} from './repo-mesh-types.js';
+export {
+  DEFAULT_MESH_POLICY,
+  resolveDelegatedWorkerAutoApprove,
+  MESH_SCHEDULING_STRATEGIES,
+  DEFAULT_MESH_SCHEDULING_STRATEGY,
+  normalizeMeshSchedulingStrategy,
+  resolveNodeSchedulingPriority,
+  MESH_CONVERGE_REFINE_TAG,
+  MESH_CONVERGE_FAST_FORWARD_TAG,
+  resolveAutoConvergeCodeChange,
 } from './repo-mesh-types.js';
-export { DEFAULT_MESH_POLICY, resolveDelegatedWorkerAutoApprove } from './repo-mesh-types.js';
 
 // ── Git Surface ──
 export * from './git/index.js';
@@ -217,7 +231,7 @@ export { buildMeshLedgerReconciliationEvidence, buildMeshLedgerReplicaEvidence }
 export type { AnyLedgerSlice, MeshLedgerReconciliationEvidence, MeshLedgerReplicaEvidence, MeshLedgerReplicaStatus } from './mesh/mesh-ledger-reconciliation.js';
 
 // ── Mesh Work Queue (GUPP) ──
-export { enqueueTask, recordDirectDispatchTask, getQueue, claimNextTask, updateTaskStatus, updateSessionTaskStatus, cancelTask, requeueTask, getMeshQueueStats, getMeshQueueRevision, normalizeMeshTaskMode, validateMeshTaskModeRequest, buildMeshNodeCapabilityTags, nodeSatisfiesRequiredTags, normalizeMeshCapabilityTags, insertDirectDispatch, getActiveDirectDispatches, updateDirectDispatchStatus, cleanupTerminalDirectDispatches, markStaleDirectDispatches, deleteDirectDispatchesByTaskId, recordMeshToolCall, assertNoDependencyCycle, hasPendingDependents, describeTaskDependencyState } from './mesh/mesh-work-queue.js';
+export { enqueueTask, recordDirectDispatchTask, getQueue, claimNextTask, updateTaskStatus, updateSessionTaskStatus, cancelTask, requeueTask, getMeshQueueStats, getMeshQueueRevision, normalizeMeshTaskMode, validateMeshTaskModeRequest, buildMeshNodeCapabilityTags, nodeSatisfiesRequiredTags, normalizeMeshCapabilityTags, resolveConvergeRequiredTags, insertDirectDispatch, getActiveDirectDispatches, updateDirectDispatchStatus, cleanupTerminalDirectDispatches, markStaleDirectDispatches, deleteDirectDispatchesByTaskId, recordMeshToolCall, assertNoDependencyCycle, hasPendingDependents, describeTaskDependencyState } from './mesh/mesh-work-queue.js';
 export type { MeshWorkQueueEntry, MeshTaskStatus, MeshTaskMode, MeshWorkQueueStats, MeshQueueMutationOptions, MeshTaskModeValidationResult, DirectDispatchRecord, MeshToolCallRateResult } from './mesh/mesh-work-queue.js';
 export { buildCompactStaleDirectWorkSummary, buildMeshActiveWork, buildMeshActiveWorkSummary, classifyStaleDirectForPrune, PRUNABLE_ORPHAN_STALE_REASONS } from './mesh/mesh-active-work.js';
 export type { StaleDirectPruneClassification } from './mesh/mesh-active-work.js';