@adhdev/daemon-core 0.9.82-rc.351 → 0.9.82-rc.352

package/dist/logging/logger.d.ts

@@ -7,7 +7,7 @@
  * 1. daemonLog(category, msg, level) — explicit per-category logging
  * 2. installGlobalInterceptor() — Auto-intercept console.log (once on daemon start)
  * 3. Recent log ring buffer — for remote transmission via P2P/WS
- * 4. File logging — ~/Library/Logs/adhdev/daemon.log (10MB rolling)
+ * 4. File logging — ~/.adhdev/logs/daemon-YYYY-MM-DD.log (date-based rolling)
  *
  * use:
  * import { daemonLog, LOG } from './daemon-logger';

package/dist/mesh/mesh-ledger.d.ts

@@ -14,7 +14,7 @@
  */
 import { EventEmitter } from 'events';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
-export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned' | 'event_held';
+export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned' | 'event_held' | 'task_reclaimed';
 export interface MeshLedgerEntry {
     id: string;
     meshId: string;

package/dist/mesh/mesh-runtime-store.d.ts

@@ -191,6 +191,15 @@ export declare class MeshRuntimeStore {
         createdAt: string;
         updatedAt: string;
     }>;
+    /**
+     * Bug B watchdog support: true when at least one delivery record for the task has
+     * reached a confirmed-handed-off status (delivered / acked / completed). The
+     * assigned-stranded watchdog uses this to distinguish a dispatch that was never
+     * confirmed (reclaimable) from one that WAS handed to the worker (a genuinely
+     * in-flight or completion-lost task, which is PHASE 4's responsibility, not this
+     * watchdog's). Indexed by (mesh_id, task_id).
+     */
+    taskHasConfirmedDelivery(meshId: string, taskId: string): boolean;
     expireStaleSessionDeliveries(meshId: string): void;
     deleteSessionDeliveries(meshId: string): void;
     recordCompletionConflict(entry: {

package/dist/mesh/mesh-work-queue.d.ts

@@ -60,6 +60,14 @@ export interface MeshWorkQueueEntry {
     requeueCount?: number;
     /** Max automatic requeue attempts. When requeueCount reaches this, task is auto-failed. */
     maxRetries?: number;
+    /**
+     * Bug B: number of times the reconcile assigned-stranded watchdog has reclaimed this
+     * row from 'assigned' back to 'pending' because its dispatch was never confirmed
+     * delivered. Separate from requeueCount (operator/execution retries) and bounded by
+     * MAX_STRANDED_RECLAIMS so a permanently-undeliverable target auto-fails rather than
+     * cycling reclaim→re-dispatch→strand forever.
+     */
+    strandedReclaimCount?: number;
     /** Last automatic queue session spin-up attempt, for mesh_view_queue/debug visibility. */
     autoLaunch?: {
         status: 'skipped' | 'started' | 'failed' | 'completed';
@@ -230,6 +238,26 @@ export declare function requeueTask(meshId: string, taskId: string, opts?: {
     /** Per-task retry cap override. Falls back to mesh policy maxTaskRetries (default 1). */
     maxRetries?: number;
 } & MeshQueueMutationOptions): MeshWorkQueueEntry | null;
+/**
+ * Bug B: reclaim a task stuck in 'assigned' because its dispatch was never confirmed.
+ *
+ * claimNextTask atomically marks a row 'assigned' BEFORE the fire-and-forget dispatch
+ * runs. If that dispatch neither rejects (→ no .catch requeue) nor is confirmed
+ * delivered — a relay that hangs without acking, or a confirm timer lost across a
+ * daemon restart — the row stays 'assigned' forever, contributing 0 pending so PHASE 3
+ * reconcile never re-examines it. This returns such a row to 'pending' and clears its
+ * dead assignment ownership (node / session / provider / dispatchTimestamp) — the same
+ * ownership-clear requeueTask applies — so PHASE 3 can re-dispatch it onto a fresh idle
+ * session.
+ *
+ * Guarded to 'assigned' rows only (a completion/cancel that already moved the row off
+ * 'assigned' must never be resurrected) and bounded by MAX_STRANDED_RECLAIMS (beyond
+ * which the task is failed so dependents unblock).
+ */
+export declare function reclaimStrandedAssignedTask(meshId: string, taskId: string, opts?: {
+    reason?: string;
+    ageMs?: number;
+} & MeshQueueMutationOptions): MeshWorkQueueEntry | null;
 /**
  * Update the status of the task currently assigned to a specific session.
  */

package/dist/providers/approval-utils.d.ts

@@ -1,4 +1,11 @@
 import type { ProviderModule } from './contracts.js';
+/**
+ * True when any of the given button labels reads as a decline/negative option
+ * (No / Deny / Cancel / Skip / …). Used as the second half of an approval-modal
+ * structural anchor: a real approval modal offers BOTH an affirmative and a
+ * decline, which distinguishes it from a generic numbered menu or prose list.
+ */
+export declare function hasNegativeApprovalOption(buttons: string[] | null | undefined): boolean;
 export declare function getApprovalPositiveHints(provider?: Pick<ProviderModule, 'approvalPositiveHints'> | null): string[];
 export declare function pickApprovalButton(buttons: string[] | null | undefined, provider?: Pick<ProviderModule, 'approvalPositiveHints'> | null): {
     index: number;

package/dist/providers/cli-provider-instance.d.ts

@@ -48,6 +48,20 @@ export declare class CliProviderInstance implements ProviderInstance {
      * keystroke until the modal *content* has settled.
      */
     private static readonly AUTO_APPROVE_SETTLE_MS;
+    /**
+     * Busy-side hysteresis for the settle gate. A momentary `generating` flip
+     * while the SAME approval modal's button block is still on screen (its
+     * question line scrolled out of the captured frame, only the buttons + a
+     * residual `esc to interrupt` spinner remain) briefly reports
+     * status!=waiting_approval. Without hysteresis that flip wipes the settle
+     * clock, and the modal→generating→modal flap restarts the 600ms window
+     * every time so auto-approve never fires. We keep the in-progress settle
+     * gate warm across an inactive blip up to this bound; only once the modal
+     * has genuinely stayed gone this long (a real resolution → idle) is the
+     * gate cleared. Bounded so a genuinely new, later approval still re-settles
+     * from scratch rather than firing on a stale timestamp.
+     */
+    private static readonly AUTO_APPROVE_GATE_HYSTERESIS_MS;
     private adapter;
     private context;
     private events;
@@ -64,6 +78,7 @@ export declare class CliProviderInstance implements ProviderInstance {
     private pendingAutoApprovalSignature;
     private pendingAutoApprovalSince;
     private autoApproveSettleTimer;
+    private autoApproveInactiveSince;
     private controlValues;
     private summaryMetadata;
     private appliedEffectKeys;

package/dist/providers/sdk/v1/builders/cli/detect-status.d.ts

@@ -57,6 +57,7 @@ interface ModalSpec {
     }>;
     buttonPattern: string;
     buttonFlags?: string;
+    buttonLabelGroup?: number;
 }
 export type DispatchGroup = 'spinner' | 'modal' | 'settled-prompt' | 'cue-ordering' | 'error-detection' | 'approval-stitching';
 export interface DispatchOrderSpec {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.351",
+  "version": "0.9.82-rc.352",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.351",
+    "@adhdev/mesh-shared": "0.9.82-rc.352",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/commands/upgrade-helper.ts

@@ -292,13 +292,14 @@ async function waitForPidExit(pid: number, timeoutMs: number): Promise<void> {
   }
 }
 
-export function stopSessionHostProcesses(appName: string): void {
+export async function stopSessionHostProcesses(appName: string): Promise<void> {
   const pidFile = path.join(os.homedir(), '.adhdev', `${appName}-session-host.pid`);
+  let killedPid: number | null = null;
   try {
     if (fs.existsSync(pidFile)) {
       const pid = Number.parseInt(fs.readFileSync(pidFile, 'utf8').trim(), 10);
       if (Number.isFinite(pid) && pid !== process.pid && isManagedSessionHostPid(pid)) {
-        killPid(pid);
+        if (killPid(pid)) killedPid = pid;
       }
     }
   } catch {
@@ -310,6 +311,31 @@ export function stopSessionHostProcesses(appName: string): void {
       // noop
     }
   }
+
+  // The session-host process keeps node-pty's `conpty.node` memory-mapped. On
+  // Windows a mapped native addon stays EXCLUSIVELY locked until the process
+  // fully exits and tears down the mapping — and that teardown lags `taskkill`
+  // by an indeterminate interval. `taskkill` only *requests* termination, so
+  // returning immediately lets the caller run `npm install` while conpty.node
+  // is still locked, which makes npm's copy-to-staging fail with EBUSY (the
+  // intermittent Windows upgrade failure). Wait for the killed process to
+  // actually disappear — like we already do for the parent daemon pid — so the
+  // file handle is released before the install runs. (POSIX can replace an open
+  // file freely, so the wait is harmless there.)
+  if (killedPid !== null) {
+    await waitForPidExit(killedPid, 15000);
+  }
+}
+
+// npm copies the current install's files into a staging dir before swapping in
+// the new version. On Windows that copy of `conpty.node` can still race a
+// just-killed session-host whose mapping hasn't been released yet, surfacing as
+// EBUSY/EPERM. Treat those as transient and retry with backoff.
+function isRetriableInstallLockError(error: any): boolean {
+  const code = error?.code;
+  if (code === 'EBUSY' || code === 'EPERM') return true;
+  const text = `${error?.message || ''} ${error?.stderr || ''}`;
+  return /\bEBUSY\b|\bEPERM\b|resource busy or locked/i.test(text);
 }
 
 function removeDaemonPidFile(): void {
@@ -412,23 +438,40 @@ async function runDaemonUpgradeHelper(payload: DaemonUpgradeHelperPayload): Prom
     await waitForPidExit(payload.parentPid, 15000);
   }
 
-  stopSessionHostProcesses(sessionHostAppName);
+  await stopSessionHostProcesses(sessionHostAppName);
   removeDaemonPidFile();
   cleanupStaleGlobalInstallDirs(payload.packageName, installCommand.surface);
 
   const spec = `${payload.packageName}@${payload.targetVersion || 'latest'}`;
   appendUpgradeLog(`Installing ${spec}`);
-  const installOutput = execFileSync(
-    installCommand.command,
-    installCommand.args,
-    {
-      encoding: 'utf8',
-      stdio: 'pipe',
-      maxBuffer: 20 * 1024 * 1024,
-      env: buildInstallEnvWithNodeOnPath(),
-      ...installCommand.execOptions,
-    },
-  );
+  // Windows can still race a lingering conpty.node mapping even after the
+  // session-host exits, so retry the install on transient lock errors there.
+  const maxInstallAttempts = process.platform === 'win32' ? 3 : 1;
+  let installOutput = '';
+  for (let attempt = 1; attempt <= maxInstallAttempts; attempt++) {
+    try {
+      installOutput = String(execFileSync(
+        installCommand.command,
+        installCommand.args,
+        {
+          encoding: 'utf8',
+          stdio: 'pipe',
+          maxBuffer: 20 * 1024 * 1024,
+          env: buildInstallEnvWithNodeOnPath(),
+          ...installCommand.execOptions,
+        },
+      ));
+      break;
+    } catch (error: any) {
+      if (attempt < maxInstallAttempts && isRetriableInstallLockError(error)) {
+        appendUpgradeLog(`Install attempt ${attempt} hit a file lock (${error?.code || 'lock'}); cleaning staging and retrying after backoff`);
+        cleanupStaleGlobalInstallDirs(payload.packageName, installCommand.surface);
+        await new Promise((resolve) => setTimeout(resolve, attempt * 1500));
+        continue;
+      }
+      throw error;
+    }
+  }
   if (installOutput.trim()) {
     appendUpgradeLog(installOutput.trim());
   }

package/src/logging/command-log.ts

@@ -15,11 +15,13 @@ import * as path from 'path';
 import * as os from 'os';
 
 // ─── Config ──────────────────────────────────
-const LOG_DIR = process.platform === 'win32'
-    ? path.join(process.env.LOCALAPPDATA || process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'adhdev', 'logs')
-    : process.platform === 'darwin'
-        ? path.join(os.homedir(), 'Library', 'Logs', 'adhdev')
-        : path.join(os.homedir(), '.local', 'share', 'adhdev', 'logs');
+// Command history lives under the unified ADHDev home (~/.adhdev/logs/) next to
+// the daemon log, on every platform. Honor ADHDEV_CONFIG_DIR for isolated homes.
+// Keep this in sync with logger.ts LOG_DIR.
+const ADHDEV_HOME = process.env.ADHDEV_CONFIG_DIR && process.env.ADHDEV_CONFIG_DIR.trim()
+    ? process.env.ADHDEV_CONFIG_DIR.trim()
+    : path.join(os.homedir(), '.adhdev');
+const LOG_DIR = path.join(ADHDEV_HOME, 'logs');
 
 const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5MB
 const MAX_DAYS = 7;

package/src/logging/logger.ts

@@ -7,7 +7,7 @@
  * 1. daemonLog(category, msg, level) — explicit per-category logging
  * 2. installGlobalInterceptor() — Auto-intercept console.log (once on daemon start)
  * 3. Recent log ring buffer — for remote transmission via P2P/WS
- * 4. File logging — ~/Library/Logs/adhdev/daemon.log (10MB rolling)
+ * 4. File logging — ~/.adhdev/logs/daemon-YYYY-MM-DD.log (date-based rolling)
  * 
  * use:
  * import { daemonLog, LOG } from './daemon-logger';
@@ -37,11 +37,17 @@ export function setLogLevel(level: LogLevel): void {
 
 export function getLogLevel(): LogLevel { return currentLevel; }
 // ─── File logging (date-based rolling) ──────────────────────────────
-const LOG_DIR = process.platform === 'win32'
-    ? path.join(process.env.LOCALAPPDATA || process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'adhdev', 'logs')
-    : process.platform === 'darwin'
-        ? path.join(os.homedir(), 'Library', 'Logs', 'adhdev')
-        : path.join(os.homedir(), '.local', 'share', 'adhdev', 'logs');
+// Logs live under the unified ADHDev home (~/.adhdev/logs/) on every platform,
+// alongside config.json, providers/, history/, daemon.pid and session-host.log.
+// Earlier builds wrote to OS-specific dirs (~/Library/Logs/adhdev on macOS,
+// ~/.local/share/adhdev/logs on Linux, %LOCALAPPDATA%/adhdev/logs on Windows),
+// which made the daemon log undiscoverable next to everything else under
+// ~/.adhdev and inconsistent with session-host.log. Honor ADHDEV_CONFIG_DIR so
+// isolated/standalone namespaces keep their logs in their own home.
+const ADHDEV_HOME = process.env.ADHDEV_CONFIG_DIR && process.env.ADHDEV_CONFIG_DIR.trim()
+    ? process.env.ADHDEV_CONFIG_DIR.trim()
+    : path.join(os.homedir(), '.adhdev');
+const LOG_DIR = path.join(ADHDEV_HOME, 'logs');
 
 const MAX_LOG_SIZE = 5 * 1024 * 1024; // 5MB per day
 const MAX_LOG_DAYS = 7; // 7-day retention

package/src/mesh/mesh-events-coordinator.ts

@@ -7,6 +7,7 @@ import { LOG } from '../logging/logger.js';
 import { appendLedgerEntry, buildTaskCompletionEvidence, getSessionRecoveryContext, isIntentionalCleanupStopEntry, readLedgerEntries } from './mesh-ledger.js';
 import type { MeshLedgerKind, SessionRecoveryContext } from './mesh-ledger.js';
 import { buildMeshNodeCapabilityTags, nodeSatisfiesRequiredTags, claimNextTask, updateSessionTaskStatus, enqueueTask, updateTaskStatus, getQueue, recordTaskAutoLaunch, updateDirectDispatchStatus, cleanupTerminalDirectDispatches, getActiveDirectDispatches, hasPendingDependents } from './mesh-work-queue.js';
+import type { MeshWorkQueueEntry } from './mesh-work-queue.js';
 import { fastForwardMeshNode } from './mesh-fast-forward.js';
 import { createSessionDelivery, markSessionDeliveriesTerminal, updateSessionDeliveryStatus, recordCompletionConflict } from './mesh-delivery-policy.js';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
@@ -17,7 +18,7 @@ import { enqueueUnresolvedDelegateForward, peekUnresolvedDelegateForwards, ackUn
 import { getLastDisplayMessage } from '../status/snapshot.js';
 import { resolveDelegatedWorkerAutoApprove, resolveProviderMaxParallel, resolveNodeSchedulingPriority, normalizeMeshSchedulingStrategy } from '../repo-mesh-types.js';
 import type { RepoMeshSchedulingStrategy } from '../repo-mesh-types.js';
-import { normalizeMeshNodeId, meshNodeIdMatches, type MeshNodeIdentified } from '@adhdev/mesh-shared';
+import { normalizeMeshNodeId, meshNodeIdMatches, expandDaemonIdForms, type MeshNodeIdentified } from '@adhdev/mesh-shared';
 import {
     findRecentTerminalLedgerEvidence,
     hasDispatchAfterTerminal,
@@ -35,16 +36,16 @@ import {
 } from './mesh-events-utils.js';
 
 // The set of coordinator-daemon ids this daemon answers to when draining the
-// pending-events queue (canonical status id + bare machineId). Mirrors
-// resolveCoordinatorDaemonIds in mesh-reconcile-loop — a unicast event may be
-// stamped with either id depending on which dispatch path created the worker.
+// pending-events queue. Mirrors resolveCoordinatorDaemonIds in mesh-reconcile-loop:
+// a unicast event may be stamped with the status id, the bare machineId, OR the
+// config-form node daemonId (`daemon_<machineId>`) depending on which dispatch path
+// created the worker. We expand to EVERY equivalent form so a `daemon_<machineId>`
+// completion matches a coordinator that knows itself as bare `<machineId>` (the
+// base-node completion-surface bug) and vice versa.
 function resolveCoordinatorDrainDaemonIds(components: DaemonComponents): string[] {
-    const ids = new Set<string>();
     const statusInstanceId = readNonEmptyString((components as { statusInstanceId?: string }).statusInstanceId);
-    if (statusInstanceId) ids.add(statusInstanceId);
     const machineId = readNonEmptyString(loadConfig().machineId);
-    if (machineId) ids.add(machineId);
-    return [...ids];
+    return expandDaemonIdForms([statusInstanceId, machineId]);
 }
 
 // ---------------------------------------------------------------------------
@@ -304,6 +305,95 @@ function resolveActiveDirectDispatchTaskId(meshId: string, sessionId: string): s
 // Queue assignment
 // ---------------------------------------------------------------------------
 
+// Per-dispatch confirmation timeout (Bug B). A dispatch promise that never settles —
+// a saturated remote P2P relay that hangs, or a transport that resolves only after
+// the worker acks — would otherwise leave the just-claimed queue row 'assigned' with
+// its delivery stuck 'delivering' forever: the .catch that requeues never fires, and
+// PHASE 3 reconcile skips the row (it counts 0 pending). Racing the dispatch against
+// this timeout guarantees a hung dispatch deterministically returns the task to
+// 'pending' for re-dispatch. Generous so a merely-slow-but-live dispatch (a cold
+// remote relay) is never reclaimed early; the reconcile assigned-stranded watchdog is
+// the durable cross-restart backstop for a timer lost to a daemon restart.
+const DISPATCH_CONFIRM_TIMEOUT_MS = 120_000;
+
+interface DeliverTaskContext {
+    meshId: string;
+    nodeId: string;
+    sessionId: string;
+    providerType: string;
+    task: MeshWorkQueueEntry;
+    transport: 'remote' | 'local';
+    sourceCoordinatorSessionId?: string;
+    sourceCoordinatorDaemonId?: string;
+}
+
+// CONS scope 3: the SINGLE source of truth for dispatching a claimed task to its
+// session. The remote (P2P dispatchMeshCommand) and local (cliManager.handleCliCommand)
+// branches differ ONLY in the transport call — the delivery record, the delivered/failed
+// transitions, the pending-requeue-on-failure, the dispatch_failed ledger entry, AND the
+// Bug B hang timeout are identical and live here once so a future change to the dispatch
+// lifecycle cannot drift between the two paths. The caller passes a `dispatchThunk` that
+// performs only the transport-specific send and returns its promise.
+function deliverTaskToSession(dispatchThunk: () => Promise<unknown>, ctx: DeliverTaskContext): void {
+    const delivery = createSessionDelivery({
+        meshId: ctx.meshId,
+        nodeId: ctx.nodeId,
+        sessionId: ctx.sessionId,
+        providerType: ctx.providerType,
+        taskId: ctx.task.id,
+        kind: 'task',
+        message: ctx.task.message,
+        status: 'delivering',
+        ...(ctx.sourceCoordinatorSessionId ? { sourceCoordinatorSessionId: ctx.sourceCoordinatorSessionId } : {}),
+        ...(ctx.sourceCoordinatorDaemonId ? { sourceCoordinatorDaemonId: ctx.sourceCoordinatorDaemonId } : {}),
+    });
+
+    // Invoke the transport synchronously (preserves the prior fire-and-forget timing,
+    // and lets a synchronous throw fall into the same failure path as a rejection).
+    let dispatchPromise: Promise<unknown>;
+    try {
+        dispatchPromise = Promise.resolve(dispatchThunk());
+    } catch (e) {
+        dispatchPromise = Promise.reject(e);
+    }
+
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const guarded = Promise.race([
+        dispatchPromise,
+        new Promise<never>((_, reject) => {
+            timer = setTimeout(
+                () => reject(new Error(`dispatch_confirm_timeout after ${DISPATCH_CONFIRM_TIMEOUT_MS}ms`)),
+                DISPATCH_CONFIRM_TIMEOUT_MS,
+            );
+            // Never keep the process alive solely for this confirm-timeout timer.
+            if (typeof (timer as { unref?: () => void })?.unref === 'function') (timer as { unref: () => void }).unref();
+        }),
+    ]);
+
+    guarded.then(() => {
+        if (timer) clearTimeout(timer);
+        updateSessionDeliveryStatus(delivery.id, 'delivered');
+    }).catch((e: any) => {
+        if (timer) clearTimeout(timer);
+        // A dispatch failure (transport reject OR hang timeout) is most often transient —
+        // a busy/refusing adapter, or a relay that never acked — not a permanent task
+        // failure. Marking the task terminal here would permanently kill tasks a later
+        // tick delivers fine. Return it to 'pending' and record a retryable dispatch_failed
+        // ledger entry so the reconcile loop re-dispatches it. Identical for both transports.
+        LOG.error('MeshQueue', `Failed to dispatch task via ${ctx.transport} to node ${ctx.nodeId}: ${e?.message}`);
+        updateSessionDeliveryStatus(delivery.id, 'failed', { lastError: e?.message, incrementAttempt: true });
+        updateTaskStatus(ctx.meshId, ctx.task.id, 'pending');
+        try {
+            appendLedgerEntry(ctx.meshId, {
+                kind: 'dispatch_failed' as any,
+                nodeId: ctx.nodeId,
+                sessionId: ctx.sessionId,
+                payload: { taskId: ctx.task.id, deliveryId: delivery.id, error: e?.message, retryable: true, transport: ctx.transport },
+            });
+        } catch { /* ledger write is best-effort */ }
+    });
+}
+
 export function tryAssignQueueTask(
     components: DaemonComponents,
     meshId: string,
@@ -337,45 +427,36 @@ export function tryAssignQueueTask(
             // completion back to that exact session (multi-coordinator). Carried over P2P
             // to the remote worker, which echoes it on its completion event.
             const sourceCoordinatorSessionId = readNonEmptyString(task.sourceCoordinatorSessionId) || undefined;
-            const delivery = createSessionDelivery({
-                meshId,
-                nodeId,
-                sessionId,
-                providerType,
-                taskId: task.id,
-                kind: 'task',
-                message: task.message,
-                status: 'delivering',
-                ...(sourceCoordinatorSessionId ? { sourceCoordinatorSessionId } : {}),
-                ...(localDaemonIdForDispatch ? { sourceCoordinatorDaemonId: localDaemonIdForDispatch } : {}),
-            });
-            components.dispatchMeshCommand(node.daemonId, 'agent_command', {
-                targetSessionId: sessionId,
-                cliType: providerType,
-                action: 'send_chat',
-                message: task.message,
-                meshContext: {
+            const dispatchMeshCommand = components.dispatchMeshCommand;
+            const remoteDaemonId = node.daemonId;
+            // CONS3: only the transport call differs — everything else (delivery record,
+            // status transitions, requeue-on-failure, ledger, Bug B hang timeout) is in
+            // the shared deliverTaskToSession helper.
+            deliverTaskToSession(
+                () => dispatchMeshCommand(remoteDaemonId, 'agent_command', {
+                    targetSessionId: sessionId,
+                    cliType: providerType,
+                    action: 'send_chat',
+                    message: task.message,
+                    meshContext: {
+                        meshId,
+                        nodeId,
+                        taskId: task.id,
+                        ...(localDaemonIdForDispatch ? { coordinatorDaemonId: localDaemonIdForDispatch } : {}),
+                        ...(sourceCoordinatorSessionId ? { coordinatorSessionId: sourceCoordinatorSessionId } : {}),
+                    },
+                }),
+                {
                     meshId,
                     nodeId,
-                    taskId: task.id,
-                    ...(localDaemonIdForDispatch ? { coordinatorDaemonId: localDaemonIdForDispatch } : {}),
-                    ...(sourceCoordinatorSessionId ? { coordinatorSessionId: sourceCoordinatorSessionId } : {}),
+                    sessionId,
+                    providerType,
+                    task,
+                    transport: 'remote',
+                    ...(sourceCoordinatorSessionId ? { sourceCoordinatorSessionId } : {}),
+                    ...(localDaemonIdForDispatch ? { sourceCoordinatorDaemonId: localDaemonIdForDispatch } : {}),
                 },
-            }).then(() => {
-                updateSessionDeliveryStatus(delivery.id, 'delivered');
-            }).catch((e: any) => {
-                LOG.error('MeshQueue', `Failed to dispatch task via P2P to remote node ${nodeId}: ${e?.message}`);
-                updateSessionDeliveryStatus(delivery.id, 'failed', { lastError: e?.message, incrementAttempt: true });
-                updateTaskStatus(meshId, task.id, 'pending');
-                try {
-                    appendLedgerEntry(meshId, {
-                        kind: 'dispatch_failed' as any,
-                        nodeId,
-                        sessionId,
-                        payload: { taskId: task.id, deliveryId: delivery.id, error: e?.message, retryable: true },
-                    });
-                } catch { /* ledger write is best-effort */ }
-            });
+            );
             return true;
         }
     }
@@ -412,44 +493,26 @@ export function tryAssignQueueTask(
         }
     } catch { /* best-effort — dispatch still proceeds */ }
 
-    const delivery = createSessionDelivery({
-        meshId,
-        nodeId,
-        sessionId,
-        providerType,
-        taskId: task.id,
-        kind: 'task',
-        message: task.message,
-        status: 'delivering',
-        ...(readNonEmptyString(task.sourceCoordinatorSessionId) ? { sourceCoordinatorSessionId: readNonEmptyString(task.sourceCoordinatorSessionId) } : {}),
-        ...(readNonEmptyString(loadConfig().machineId) ? { sourceCoordinatorDaemonId: readNonEmptyString(loadConfig().machineId) } : {}),
-    });
-    components.cliManager.handleCliCommand('agent_command', {
-        targetSessionId: sessionId,
-        cliType: providerType,
-        action: 'send_chat',
-        message: task.message,
-    }).then(() => {
-        updateSessionDeliveryStatus(delivery.id, 'delivered');
-    }).catch((e: any) => {
-        // Mirror the remote-dispatch catch above: a local dispatch failure is most often a
-        // transient busy/refusal (e.g. the adapter rejected send_chat while mid-generation),
-        // not a permanent task failure. Marking the task terminal 'failed' here with no ledger
-        // and no retry permanently killed tasks that a later tick would have delivered fine.
-        // Return the task to 'pending' and record a retryable dispatch_failed ledger entry so
-        // the reconcile loop re-dispatches it, exactly as the remote branch does.
-        LOG.error('MeshQueue', `Failed to dispatch task locally to node ${nodeId}: ${e?.message}`);
-        updateSessionDeliveryStatus(delivery.id, 'failed', { lastError: e?.message, incrementAttempt: true });
-        updateTaskStatus(meshId, task.id, 'pending');
-        try {
-            appendLedgerEntry(meshId, {
-                kind: 'dispatch_failed' as any,
-                nodeId,
-                sessionId,
-                payload: { taskId: task.id, deliveryId: delivery.id, error: e?.message, retryable: true },
-            });
-        } catch { /* ledger write is best-effort */ }
-    });
+    // CONS3: same shared dispatch lifecycle as the remote branch — only the transport
+    // (cliManager.handleCliCommand) differs.
+    deliverTaskToSession(
+        () => components.cliManager.handleCliCommand('agent_command', {
+            targetSessionId: sessionId,
+            cliType: providerType,
+            action: 'send_chat',
+            message: task.message,
+        }),
+        {
+            meshId,
+            nodeId,
+            sessionId,
+            providerType,
+            task,
+            transport: 'local',
+            ...(readNonEmptyString(task.sourceCoordinatorSessionId) ? { sourceCoordinatorSessionId: readNonEmptyString(task.sourceCoordinatorSessionId) } : {}),
+            ...(readNonEmptyString(loadConfig().machineId) ? { sourceCoordinatorDaemonId: readNonEmptyString(loadConfig().machineId) } : {}),
+        },
+    );
 
     return true;
 }
@@ -929,7 +992,12 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
 
         const candidateNodes = Array.isArray(mesh?.nodes)
             ? mesh.nodes.filter((node: any) => {
-                if (task.targetNodeId && readMeshNodeId(node) !== task.targetNodeId) return false;
+                // Bug A: match the target pin with the shared 3-form (id / nodeId / node_id)
+                // normalizer, mirroring the remote-idle drain (meshNodeIdMatches at the
+                // getRemoteIdleSessions filter). A strict `readMeshNodeId(node) !== targetNodeId`
+                // dropped a target node whose identity arrived under a different form (a freshly
+                // mesh_clone_node'd worktree), emptying candidateNodes and mislabelling the skip.
+                if (task.targetNodeId && !meshNodeIdMatches(node, task.targetNodeId)) return false;
                 // Skip nodes that can never satisfy requiredTags regardless of which provider
                 // from providerPriority is selected. A node satisfies tags if at least one
                 // provider in its priority list would produce matching capability tags.
@@ -944,7 +1012,20 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
             })
             : [];
         if (!candidateNodes.length) {
-            markAutoLaunch(meshId, task.id, { status: 'skipped', reason: 'no_node_satisfies_required_tags', nodeId: task.targetNodeId });
+            // Bug A: distinguish the two ways the candidate set empties. A task pinned to a
+            // targetNodeId whose node is absent from the mesh (or whose id arrived under a
+            // different form) is a ROUTING miss — report it as `target_node_id_unmatched`, not
+            // the hard-coded `no_node_satisfies_required_tags`, which mislabelled a 3-form
+            // node-id mismatch as a capability failure and sent diagnosis down the wrong path.
+            // Only fall back to the tag reason when no target pin is in play, or the pin DID
+            // match a node but its tags excluded it (a genuine capability miss).
+            const targetPinUnmatched = !!task.targetNodeId
+                && !(Array.isArray(mesh?.nodes) && mesh.nodes.some((n: any) => meshNodeIdMatches(n, task.targetNodeId)));
+            markAutoLaunch(meshId, task.id, {
+                status: 'skipped',
+                reason: targetPinUnmatched ? 'target_node_id_unmatched' : 'no_node_satisfies_required_tags',
+                nodeId: task.targetNodeId,
+            });
             continue;
         }