@adhdev/daemon-core 0.9.82-rc.342 → 0.9.82-rc.344

package/dist/mesh/mesh-events-pending.d.ts

@@ -13,6 +13,16 @@ export interface PendingMeshCoordinatorEvent {
      * Absent on legacy events — treated as broadcast to any coordinator.
      */
     targetCoordinatorDaemonId?: string;
+    /**
+     * When set, this event is intended for a specific coordinator SESSION on the
+     * target daemon (the session that originally dispatched the work). PHASE 2 inject
+     * strict-matches the live coordinator by this session id so a sibling coordinator
+     * session on the same daemon does not receive another coordinator's completion.
+     * Absent on legacy / version-skewed events → daemon-level broadcast (no regression).
+     * Rides inside the event payload, so it survives the SQLite payload round-trip and
+     * the JSONL file without a dedicated column; it is NOT a drain-scoping key.
+     */
+    targetCoordinatorSessionId?: string;
 }
 export declare function readRefineJobId(event: {
     metadataEvent?: Record<string, unknown>;

package/dist/mesh/mesh-events-utils.d.ts

@@ -15,6 +15,7 @@ export interface MeshWorkerRelayStamp {
     meshNodeFor?: string;
     meshNodeId?: string;
     meshCoordinatorDaemonId?: string;
+    meshCoordinatorSessionId?: string;
     launchedByCoordinator?: boolean;
 }
 /**
@@ -33,12 +34,21 @@ export declare function buildMeshWorkerRelayStamp(currentSettings: Record<string
     meshId?: unknown;
     nodeId?: unknown;
     coordinatorDaemonId?: unknown;
+    coordinatorSessionId?: unknown;
 } | undefined): MeshWorkerRelayStamp | undefined;
 export declare function resolveEventSessionId(event: Record<string, unknown>, fallback?: unknown): string;
 export declare function readRefineJobId(event: {
     metadataEvent?: Record<string, unknown>;
 } | Record<string, unknown>): string;
 export declare function readWorkerResultMetadata(event: Record<string, unknown>): Record<string, unknown> | undefined;
+/**
+ * The worker's final assistant text carried on a completion event — read from
+ * `finalSummary` (and the `workerResult.summary` / `result.summary` fallbacks some
+ * paths use). Returns '' when the event carries no assistant text (lifecycle events
+ * without a summary). Shared by the coordinator chat surface (buildMeshSystemMessage)
+ * and the held-event ledger audit record so both read the summary the same way.
+ */
+export declare function readMeshCompletionSummary(metadataEvent: Record<string, unknown>): string;
 /**
  * A coordinator that surfaces a REMOTE worker's mesh session has no local instance for
  * it, so the status snapshot's getLastDisplayMessage has nothing to read and the only

package/dist/mesh/mesh-ledger.d.ts

@@ -14,7 +14,7 @@
  */
 import { EventEmitter } from 'events';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
-export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned';
+export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned' | 'event_held';
 export interface MeshLedgerEntry {
     id: string;
     meshId: string;

package/dist/mesh/mesh-runtime-store.d.ts

@@ -9,6 +9,7 @@ export declare class MeshRuntimeStore {
     private static readonly WAL_CHECK_INTERVAL;
     private static readonly WAL_MAX_BYTES;
     private constructor();
+    private static loggedGetInstanceFailure;
     static getInstance(): MeshRuntimeStore;
     static resetForTests(): void;
     close(): void;

package/dist/mesh/mesh-work-queue.d.ts

@@ -71,6 +71,14 @@ export interface MeshWorkQueueEntry {
     };
     /** ISO timestamp when the task was dispatched (assigned) to a node/session. Used for precise matching on completion. */
     dispatchTimestamp?: string;
+    /**
+     * (3) The ORIGINATING coordinator session that enqueued this task. Stamped onto the
+     * worker at dispatch (meshCoordinatorSessionId) so the task's completion routes back to
+     * the exact coordinator session — even when several coordinator sessions share one
+     * daemon. Rides in the queue payload JSON (no column migration); absent on legacy rows
+     * → daemon-level routing fallback (backward + version-skew safe).
+     */
+    sourceCoordinatorSessionId?: string;
     createdAt: string;
     updatedAt: string;
 }
@@ -131,6 +139,8 @@ export declare function enqueueTask(meshId: string, message: string, opts?: {
     missionId?: string;
     /** Explicit task id for batch/template flows (M5). Random UUID when omitted. */
     id?: string;
+    /** (3) Originating coordinator session id (for session-anchored completion routing). */
+    sourceCoordinatorSessionId?: string;
 } & MeshQueueMutationOptions): MeshWorkQueueEntry;
 /**
  * Record a direct-dispatch task (mesh_send_task) as an already-assigned queue

package/dist/providers/cli-provider-instance.d.ts

@@ -126,6 +126,7 @@ export declare class CliProviderInstance implements ProviderInstance {
         nodeId?: string;
         taskId?: string;
         coordinatorDaemonId?: string;
+        coordinatorSessionId?: string;
     }): void;
     /**
      * Clear a previously-attached mesh assignment after the task reaches a

package/dist/providers/provider-instance-manager.d.ts

@@ -91,6 +91,7 @@ export declare class ProviderInstanceManager {
         nodeId?: string;
         taskId?: string;
         coordinatorDaemonId?: string;
+        coordinatorSessionId?: string;
     }): boolean;
     /** Clear a mesh assignment after the dispatched task reaches a terminal
      *  state (generating_completed / stopped / failed). */

package/dist/providers/provider-instance.d.ts

@@ -188,6 +188,8 @@ export interface ProviderInstance {
         meshId: string;
         nodeId?: string;
         taskId?: string;
+        coordinatorDaemonId?: string;
+        coordinatorSessionId?: string;
     }): void;
     detachMeshAssignment?(): void;
     /** Refresh static provider definition/scripts without restarting the live runtime. */

package/dist/providers/spec/fsm-driver.d.ts

@@ -177,6 +177,10 @@ export declare class FsmDriver implements ISpecDriver {
      *  after a re-prime we don't re-inject until the screen changes (which
      *  resets the stall reference) or another full stall window lapses. */
     private lastRefocusAt;
+    /** Timer driving the win32 verification-based submit resend loop (see
+     *  WIN32_SUBMIT_* and scheduleWin32Submit). Re-arms itself until the FSM
+     *  leaves idle (submitted) or the resend budget is spent. */
+    private win32SubmitTimer;
     private currentEval;
     private stateHistory;
     private prevStateAt;
@@ -294,6 +298,18 @@ export declare class FsmDriver implements ISpecDriver {
     private fireDelegate;
     private handleSendMessage;
     private actuallySendMessage;
+    /** The agent's current coarse status, derived from the FSM node we're in. */
+    private currentStatus;
+    /**
+     * win32 verification-based submit. Sends the submit key, waits a gap, and if
+     * the FSM is still 'idle' (the prompt did not submit — the CR was absorbed as
+     * a multiline-paste newline) resends, up to WIN32_SUBMIT_MAX_RESENDS. The
+     * first CR always fires (so a stale/edge status never suppresses the submit);
+     * subsequent resends are gated on still being idle, and stop the instant the
+     * agent leaves idle (submitted → generating / approval). This converges the
+     * nondeterministic multiline window without spamming Enter into the next turn.
+     */
+    private scheduleWin32Submit;
     private handleClickControl;
     private handleClickModalButton;
     private handleAttachImage;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.342",
+  "version": "0.9.82-rc.344",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.342",
+    "@adhdev/mesh-shared": "0.9.82-rc.344",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/commands/cli-manager.ts

@@ -725,6 +725,24 @@ export class DaemonCliManager {
 
  // Create UUID-based key (allows separate instances even for same type+dir)
         const key = crypto.randomUUID();
+
+        // (3) Session-anchored mesh routing: when launching a mesh COORDINATOR session
+        // (settings.meshCoordinatorFor set), expose this session's OWN runtime id to its MCP
+        // server via env. The MCP server is spawned by the CLI as a child and inherits this
+        // env, so the MCP layer can stamp ADHDEV_COORDINATOR_SESSION_ID as the originating
+        // coordinator on every dispatch (→ MeshContext.coordinatorSessionId → worker
+        // meshCoordinatorSessionId → completion targetCoordinatorSessionId → strict route).
+        // `key` IS the instance id findLiveCoordinators matches on, so the stamp and the live
+        // session agree. Re-applied on every (re)launch, so it always reflects the current id;
+        // a stale value only survives if the CLI process outlives a daemon restart, in which
+        // case routing falls back to the daemon level (no wedge — see mesh-reconcile-loop).
+        {
+            const coordinatorMeshId = (options?.settingsOverride as Record<string, unknown> | undefined)?.meshCoordinatorFor;
+            if (typeof coordinatorMeshId === 'string' && coordinatorMeshId.trim()) {
+                options = { ...options, extraEnv: { ...(options?.extraEnv || {}), ADHDEV_COORDINATOR_SESSION_ID: key } };
+            }
+        }
+
         const sessionRegistry = this.deps.getSessionRegistry?.() || null;
 
  // ─── ACP category handle ───

package/src/commands/router.ts

@@ -954,6 +954,55 @@ function readCachedInlineMeshActiveSessions(node: any): string[] {
     return sessionId ? [sessionId] : [];
 }
 
+/**
+ * Wider session-ownership scan used ONLY by resolveRemoteMeshSessionOwnerDaemonId: collect
+ * EVERY session id a mesh node currently hosts. readCachedInlineMeshActiveSessions above only
+ * surfaces the node's single primary session (cachedStatus.activeSession) — other consumers
+ * depend on that one-session semantics, so it is left untouched. A worker hosting more than one
+ * session exposes its non-primary sessions only through the plural live-session arrays the
+ * coordinator carries: status.activeSessions / activeSessionDetails (built from live records on
+ * the aggregate snapshot, see get_mesh_status), or a worker's merged session report. A
+ * controlbar/modal command (invoke_provider_script / resolve_action / set_mode / …) targeting a
+ * non-primary remote session resolves its owner daemon only when those plural shapes are scanned
+ * too. Mirrors sessionStatusFromNodes' shape tolerance (mesh-active-work.ts): plural arrays of
+ * string ids OR objects keyed by id/sessionId/session_id/runtimeSessionId/instanceId, on both
+ * camelCase and snake_case, at the node root and under cachedStatus / lastProbe.
+ */
+function collectMeshNodeHostedSessionIds(node: any): Set<string> {
+    const ids = new Set<string>();
+    for (const id of readCachedInlineMeshActiveSessions(node)) ids.add(id);
+    const cachedStatus = readObjectRecord(node?.cachedStatus);
+    for (const value of [
+        node?.activeSessions,
+        node?.active_sessions,
+        node?.activeSessionDetails,
+        node?.active_session_details,
+        node?.sessions,
+        node?.sessionDetails,
+        node?.session_details,
+        readObjectRecord(node?.lastProbe).sessions,
+        readObjectRecord(node?.last_probe).sessions,
+        cachedStatus.activeSessions,
+        cachedStatus.active_sessions,
+        cachedStatus.activeSessionDetails,
+        cachedStatus.active_session_details,
+        cachedStatus.sessions,
+    ]) {
+        if (!Array.isArray(value)) continue;
+        for (const item of value) {
+            if (typeof item === 'string') {
+                const id = readStringValue(item);
+                if (id) ids.add(id);
+                continue;
+            }
+            const record = readObjectRecord(item);
+            const id = readStringValue(record.id, record.sessionId, record.session_id, record.runtimeSessionId, record.instanceId);
+            if (id) ids.add(id);
+        }
+    }
+    return ids;
+}
+
 /**
  * Resolve the owning-node attribution for a mesh node record so a coordinator can
  * stamp the TRUE owner onto a synthetic session entry instead of letting the
@@ -3825,20 +3874,31 @@ export class DaemonCommandRouter {
      * controlbar commands do not — so the controlbar buttons appear to do nothing.
      *
      * Mirror the existing node-level remote-forward pattern (fast_forward_mesh_node etc.):
-     * scan the cached inline-mesh nodes for the one whose active session matches the
-     * targetSessionId, and return its daemonId when that daemonId is a remote daemon (i.e.
-     * not this coordinator's own statusInstanceId). Returns undefined for a locally-hosted
-     * session (no forward — execute locally as before) or when ownership can't be resolved.
+     * scan the candidate mesh nodes for the one hosting the targetSessionId, and return its
+     * daemonId when that daemonId is a remote daemon (i.e. not this coordinator's own
+     * statusInstanceId). Returns undefined for a locally-hosted session (no forward — execute
+     * locally as before) or when ownership can't be resolved.
+     *
+     * The candidate set spans BOTH the cached inline-mesh nodes and the live aggregate
+     * mesh-status snapshots. The inline cache reliably carries only each node's single primary
+     * session (cachedStatus.activeSession), so a worker hosting more than one session exposes its
+     * non-primary sessions only on the aggregate snapshot nodes (status.activeSessions /
+     * activeSessionDetails, built from live session records). collectMeshNodeHostedSessionIds does
+     * the wider plural-shape scan so a controlbar/modal command targeting a non-primary remote
+     * session still resolves its owner — the singular readCachedInlineMeshActiveSessions semantics
+     * other consumers depend on stay untouched.
      */
     public resolveRemoteMeshSessionOwnerDaemonId(sessionId: string): string | undefined {
         const trimmed = typeof sessionId === 'string' ? sessionId.trim() : '';
         if (!trimmed) return undefined;
         const selfDaemonId = this.deps.statusInstanceId;
-        for (const node of this.getCachedInlineMeshNodes()) {
-            const nodeSessions = readCachedInlineMeshActiveSessions(node);
-            if (!nodeSessions.includes(trimmed)) continue;
+        for (const node of this.collectMeshSessionOwnerCandidateNodes()) {
+            if (!collectMeshNodeHostedSessionIds(node).has(trimmed)) continue;
             const nodeDaemonId = readMeshNodeDaemonId(readObjectRecord(node));
-            if (!nodeDaemonId) return undefined;
+            // A matching node with no readable daemonId can't be attributed — keep scanning
+            // the remaining candidates (e.g. the same session on an aggregate node that does
+            // carry the daemonId) rather than bailing on the whole resolution.
+            if (!nodeDaemonId) continue;
             // Only forward to a genuinely remote daemon. When the owning node is this
             // coordinator itself (locally hosted worker), fall through to local handling.
             if (selfDaemonId && nodeDaemonId === selfDaemonId) return undefined;
@@ -3847,6 +3907,21 @@ export class DaemonCommandRouter {
         return undefined;
     }
 
+    /**
+     * Candidate nodes for remote-session owner resolution: the cached inline-mesh nodes (which
+     * carry each node's primary session) plus the nodes from every cached aggregate mesh-status
+     * snapshot (which carry each node's full live session list). getCachedInlineMeshNodes()
+     * returns a fresh array, so appending the aggregate nodes never mutates cached state.
+     */
+    private collectMeshSessionOwnerCandidateNodes(): any[] {
+        const nodes: any[] = this.getCachedInlineMeshNodes();
+        for (const cached of this.aggregateMeshStatusCache.values()) {
+            const snapshotNodes = cached?.snapshot?.nodes;
+            if (Array.isArray(snapshotNodes)) nodes.push(...snapshotNodes);
+        }
+        return nodes;
+    }
+
     public getCachedInlineMesh(meshId: string, inlineMesh?: unknown): any | undefined {
         if (inlineMesh && typeof inlineMesh === 'object') {
             return this.warmInlineMeshCache(meshId, inlineMesh);
@@ -6305,6 +6380,9 @@ export class DaemonCommandRouter {
                                         meshId: dispatchMeshContext.meshId,
                                         nodeId: dispatchMeshContext.nodeId,
                                         coordinatorDaemonId: dispatchMeshContext.coordinatorDaemonId,
+                                        // Session-level anchor: preserved across the P2P dispatch to a
+                                        // remote worker so its completion echoes back to the right session.
+                                        coordinatorSessionId: dispatchMeshContext.coordinatorSessionId,
                                     },
                                 );
                                 if (stamp) inst.updateSettings(stamp);

package/src/mesh/mesh-events-coordinator.ts

@@ -282,6 +282,11 @@ export function tryAssignQueueTask(
     if (node?.daemonId && components.dispatchMeshCommand) {
         const isLocalNode = components.cliManager.adapters.has(sessionId);
         if (!isLocalNode) {
+            const localDaemonIdForDispatch = readNonEmptyString(loadConfig().machineId) || undefined;
+            // (3) Originating coordinator session that enqueued this task — route its
+            // completion back to that exact session (multi-coordinator). Carried over P2P
+            // to the remote worker, which echoes it on its completion event.
+            const sourceCoordinatorSessionId = readNonEmptyString(task.sourceCoordinatorSessionId) || undefined;
             const delivery = createSessionDelivery({
                 meshId,
                 nodeId,
@@ -291,8 +296,9 @@ export function tryAssignQueueTask(
                 kind: 'task',
                 message: task.message,
                 status: 'delivering',
+                ...(sourceCoordinatorSessionId ? { sourceCoordinatorSessionId } : {}),
+                ...(localDaemonIdForDispatch ? { sourceCoordinatorDaemonId: localDaemonIdForDispatch } : {}),
             });
-            const localDaemonIdForDispatch = readNonEmptyString(loadConfig().machineId) || undefined;
             components.dispatchMeshCommand(node.daemonId, 'agent_command', {
                 targetSessionId: sessionId,
                 cliType: providerType,
@@ -303,6 +309,7 @@ export function tryAssignQueueTask(
                     nodeId,
                     taskId: task.id,
                     ...(localDaemonIdForDispatch ? { coordinatorDaemonId: localDaemonIdForDispatch } : {}),
+                    ...(sourceCoordinatorSessionId ? { coordinatorSessionId: sourceCoordinatorSessionId } : {}),
                 },
             }).then(() => {
                 updateSessionDeliveryStatus(delivery.id, 'delivered');
@@ -341,12 +348,16 @@ export function tryAssignQueueTask(
             // the node identity so the session is fully relay-safe (meshCoordinatorDaemonId is
             // the anchor the forwarder keys on), matching what mesh_launch_session stamps.
             const localDaemonId = readNonEmptyString(loadConfig().machineId);
+            const localSourceCoordinatorSessionId = readNonEmptyString(task.sourceCoordinatorSessionId);
             inst.updateSettings({
                 meshNodeFor: meshId,
                 meshNodeId: nodeId,
                 launchedByCoordinator: true,
                 autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
                 ...(localDaemonId ? { meshCoordinatorDaemonId: localDaemonId } : {}),
+                // (3) Stamp the originating coordinator session for session-anchored routing
+                // of this co-located worker's completion. Absent → daemon-level fallback.
+                ...(localSourceCoordinatorSessionId ? { meshCoordinatorSessionId: localSourceCoordinatorSessionId } : {}),
             });
         }
     } catch { /* best-effort — dispatch still proceeds */ }
@@ -360,6 +371,8 @@ export function tryAssignQueueTask(
         kind: 'task',
         message: task.message,
         status: 'delivering',
+        ...(readNonEmptyString(task.sourceCoordinatorSessionId) ? { sourceCoordinatorSessionId: readNonEmptyString(task.sourceCoordinatorSessionId) } : {}),
+        ...(readNonEmptyString(loadConfig().machineId) ? { sourceCoordinatorDaemonId: readNonEmptyString(loadConfig().machineId) } : {}),
     });
     components.cliManager.handleCliCommand('agent_command', {
         targetSessionId: sessionId,
@@ -369,9 +382,23 @@ export function tryAssignQueueTask(
     }).then(() => {
         updateSessionDeliveryStatus(delivery.id, 'delivered');
     }).catch((e: any) => {
+        // Mirror the remote-dispatch catch above: a local dispatch failure is most often a
+        // transient busy/refusal (e.g. the adapter rejected send_chat while mid-generation),
+        // not a permanent task failure. Marking the task terminal 'failed' here with no ledger
+        // and no retry permanently killed tasks that a later tick would have delivered fine.
+        // Return the task to 'pending' and record a retryable dispatch_failed ledger entry so
+        // the reconcile loop re-dispatches it, exactly as the remote branch does.
         LOG.error('MeshQueue', `Failed to dispatch task locally to node ${nodeId}: ${e?.message}`);
         updateSessionDeliveryStatus(delivery.id, 'failed', { lastError: e?.message, incrementAttempt: true });
-        updateTaskStatus(meshId, task.id, 'failed');
+        updateTaskStatus(meshId, task.id, 'pending');
+        try {
+            appendLedgerEntry(meshId, {
+                kind: 'dispatch_failed' as any,
+                nodeId,
+                sessionId,
+                payload: { taskId: task.id, deliveryId: delivery.id, error: e?.message, retryable: true },
+            });
+        } catch { /* ledger write is best-effort */ }
     });
 
     return true;
@@ -1388,6 +1415,14 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
     const workerCoordinatorDaemonId = readNonEmptyString(
         (sourceSession?.getState()?.settings as Record<string, unknown>)?.meshCoordinatorDaemonId,
     );
+    // Session-level routing anchor (multi-coordinator). Prefer the LIVE worker session's
+    // stamp; fall back to a relayed value carried in metadataEvent.meshCoordinatorSessionId
+    // (a remote worker's completion arrives via handleMeshForwardEvent with no local
+    // sourceSession, so the stamp can only ride in the relayed metadata). Empty on legacy /
+    // version-skewed dispatches → the event stays daemon-broadcast (no regression).
+    const workerCoordinatorSessionId = readNonEmptyString(
+        (sourceSession?.getState()?.settings as Record<string, unknown>)?.meshCoordinatorSessionId,
+    ) || readNonEmptyString(args.metadataEvent.meshCoordinatorSessionId);
 
     // R2: cloud P2P dashboard metadata sync. The cloud daemon used to do this from its own
     // relay listener; now the single core forwarder invokes the injected hook (no-op on
@@ -1844,6 +1879,11 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
         metadataEvent: {
             ...args.metadataEvent,
             ...(recoveryContext ? { recoveryContext } : {}),
+            // Stash the coordinator session id INSIDE metadataEvent too, so it survives the
+            // P2P relay serialization (buildForwardPayloadFromPending spreads metadata; the
+            // handleMeshForwardEvent whitelist reads it back) — a top-level field alone would
+            // be dropped when the event crosses a machine boundary.
+            ...(workerCoordinatorSessionId ? { meshCoordinatorSessionId: workerCoordinatorSessionId } : {}),
         },
         // Silent lifecycle events (agent:ready / agent:generating_started) carry no
         // coordinator message; they are queued only so the coordinator re-runs the
@@ -1852,9 +1892,12 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
         ...(messageText ? { coordinatorMessage: messageText } : {}),
         queuedAt: Date.now(),
         ...(workerCoordinatorDaemonId ? { targetCoordinatorDaemonId: workerCoordinatorDaemonId } : {}),
+        // Top-level session anchor for the local PHASE 2 strict-match on the coordinator
+        // daemon. Absent → daemon-level broadcast (legacy / single-coordinator path).
+        ...(workerCoordinatorSessionId ? { targetCoordinatorSessionId: workerCoordinatorSessionId } : {}),
     };
     if (queuePendingMeshCoordinatorEvent(pendingEvent)) {
-        LOG.info('MeshEvents', `Queued ${args.event} for coordinator (mesh ${args.meshId}${workerCoordinatorDaemonId ? `, coordinator daemon ${workerCoordinatorDaemonId}` : ''})`);
+        LOG.info('MeshEvents', `Queued ${args.event} for coordinator (mesh ${args.meshId}${workerCoordinatorDaemonId ? `, coordinator daemon ${workerCoordinatorDaemonId}` : ''}${workerCoordinatorSessionId ? `, coordinator session ${workerCoordinatorSessionId}` : ''})`);
     }
     return { success: true, forwarded: 0 };
 }
@@ -1889,6 +1932,13 @@ export function handleMeshForwardEvent(components: DaemonComponents, payload: Re
             targetSessionId: readNonEmptyString(payload.targetSessionId) || readNonEmptyString(payload.sessionId) || readNonEmptyString(payload.instanceId),
             providerType: readNonEmptyString(payload.providerType),
             providerSessionId: readNonEmptyString(payload.providerSessionId),
+            // Preserve the originating coordinator SESSION id across the machine boundary so
+            // the completion routes back to the exact coordinator session (multi-coordinator).
+            // buildForwardPayloadFromPending spreads the worker event's metadata, so the id
+            // arrives as payload.meshCoordinatorSessionId; the top-level targetCoordinatorSessionId
+            // is also accepted as a fallback. injectMeshSystemMessage re-derives the routing
+            // anchors from this. Absent → daemon-level fallback (version-skew safe).
+            meshCoordinatorSessionId: readNonEmptyString(payload.meshCoordinatorSessionId) || readNonEmptyString(payload.targetCoordinatorSessionId),
             // Carry the session identity fields the worker provider event emits so the
             // coordinator's mirror (updateMeshOwnedSession) gets a real workspace/title/
             // settings. Without these the remote-relay hop reconstructs metadataEvent with

package/src/mesh/mesh-events-pending.ts

@@ -2,9 +2,9 @@ import { appendFileSync, existsSync, readFileSync, renameSync, statSync, unlinkS
 import { join } from 'path';
 import { randomUUID } from 'crypto';
 import { LOG } from '../logging/logger.js';
-import { getLedgerDir, readLedgerEntries } from './mesh-ledger.js';
+import { getLedgerDir, readLedgerEntries, appendLedgerEntry } from './mesh-ledger.js';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
-import { buildMeshSystemMessage, readNonEmptyString, readRecord, resolveEventSessionId } from './mesh-events-utils.js';
+import { buildMeshSystemMessage, readNonEmptyString, readRecord, resolveEventSessionId, readMeshCompletionSummary } from './mesh-events-utils.js';
 
 // ---------------------------------------------------------------------------
 // MCP coordinator pending-event queue — FILE-BASED PERSISTENCE
@@ -33,6 +33,16 @@ export interface PendingMeshCoordinatorEvent {
      * Absent on legacy events — treated as broadcast to any coordinator.
      */
     targetCoordinatorDaemonId?: string;
+    /**
+     * When set, this event is intended for a specific coordinator SESSION on the
+     * target daemon (the session that originally dispatched the work). PHASE 2 inject
+     * strict-matches the live coordinator by this session id so a sibling coordinator
+     * session on the same daemon does not receive another coordinator's completion.
+     * Absent on legacy / version-skewed events → daemon-level broadcast (no regression).
+     * Rides inside the event payload, so it survives the SQLite payload round-trip and
+     * the JSONL file without a dedicated column; it is NOT a drain-scoping key.
+     */
+    targetCoordinatorSessionId?: string;
 }
 
 const REFINE_TERMINAL_EVENTS = new Set(['refine:completed', 'refine:failed']);
@@ -239,6 +249,42 @@ function trimPendingEventsIfNeeded(path: string): void {
         if (statSync(path).size <= MAX_PENDING_EVENTS_BYTES) return;
         const lines = readFileSync(path, 'utf-8').split('\n').filter(Boolean);
         if (lines.length <= MAX_PENDING_EVENTS_KEEP) return;
+        // C1 (data safety): this trim discards the OLDEST queued lines to keep the file
+        // bounded. An undelivered terminal completion among them would otherwise lose its
+        // worker summary silently (the JSONL is the only copy when the SQLite dual-write
+        // failed). Before dropping, mirror any meaningful (coordinator-facing / summary-
+        // bearing) dropped event into the ledger so it stays auditable and recoverable,
+        // and LOG.warn so the drop is observable instead of silent.
+        const dropped = lines.slice(0, lines.length - MAX_PENDING_EVENTS_KEEP);
+        for (const line of dropped) {
+            let event: PendingMeshCoordinatorEvent | undefined;
+            try { event = JSON.parse(line) as PendingMeshCoordinatorEvent; } catch { continue; }
+            if (!event || !event.meshId) continue;
+            const finalSummary = readMeshCompletionSummary(event.metadataEvent || {});
+            // "Meaningful" = would have been delivered to a coordinator (carries a message)
+            // or carries worker output worth preserving. Silent lifecycle events are not
+            // logged — losing them on trim is harmless (they re-drive nothing once stale).
+            if (!readNonEmptyString(event.coordinatorMessage) && !finalSummary) continue;
+            try {
+                appendLedgerEntry(event.meshId, {
+                    kind: 'event_held',
+                    ...(event.nodeId ? { nodeId: event.nodeId } : {}),
+                    payload: {
+                        event: event.event,
+                        reason: 'pending_trim_dropped',
+                        recoverable: true,
+                        nodeLabel: event.nodeLabel,
+                        ...(event.workspace ? { workspace: event.workspace } : {}),
+                        targetCoordinatorDaemonId: event.targetCoordinatorDaemonId ?? null,
+                        queuedAt: event.queuedAt,
+                        ...(finalSummary ? { finalSummary } : {}),
+                    },
+                });
+                LOG.warn('MeshEvents', `Pending-events trim dropping undelivered ${event.event} for mesh ${event.meshId} — recorded to ledger (recoverable)`);
+            } catch (e: any) {
+                LOG.warn('MeshEvents', `Failed to ledger-record trim-dropped ${event.event} for mesh ${event.meshId}: ${e?.message || e}`);
+            }
+        }
         writeFileSync(path, lines.slice(-MAX_PENDING_EVENTS_KEEP).join('\n') + '\n', 'utf-8');
     } catch { /* best-effort; if trim fails, append still proceeds */ }
 }
@@ -403,8 +449,12 @@ export function drainPendingMeshCoordinatorEvents(
                 if (event) pushUnique(event);
             }
         }
-    } catch {
-        // SQLite drain failed — JSONL below still drains
+    } catch (e: any) {
+        // SQLite drain failed — JSONL below still drains. Surface it: a silent
+        // failure here means the JSONL copy is emptied while the SQLite rows
+        // survive undrained, so the next drain re-delivers the same events to the
+        // coordinator (duplicate refine:completed etc.) with no diagnostic trail.
+        LOG.warn('MeshEvents', `SQLite pending-event drain failed for mesh ${meshId}; JSONL fallback only: ${e?.message || e}`);
     }
 
     // JSONL (legacy / migration path) — always drained alongside SQLite.