@adhdev/daemon-core 0.9.82-rc.351 → 0.9.82-rc.353

package/src/mesh/mesh-events-coordinator.ts

@@ -7,6 +7,7 @@ import { LOG } from '../logging/logger.js';
 import { appendLedgerEntry, buildTaskCompletionEvidence, getSessionRecoveryContext, isIntentionalCleanupStopEntry, readLedgerEntries } from './mesh-ledger.js';
 import type { MeshLedgerKind, SessionRecoveryContext } from './mesh-ledger.js';
 import { buildMeshNodeCapabilityTags, nodeSatisfiesRequiredTags, claimNextTask, updateSessionTaskStatus, enqueueTask, updateTaskStatus, getQueue, recordTaskAutoLaunch, updateDirectDispatchStatus, cleanupTerminalDirectDispatches, getActiveDirectDispatches, hasPendingDependents } from './mesh-work-queue.js';
+import type { MeshWorkQueueEntry } from './mesh-work-queue.js';
 import { fastForwardMeshNode } from './mesh-fast-forward.js';
 import { createSessionDelivery, markSessionDeliveriesTerminal, updateSessionDeliveryStatus, recordCompletionConflict } from './mesh-delivery-policy.js';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
@@ -17,7 +18,7 @@ import { enqueueUnresolvedDelegateForward, peekUnresolvedDelegateForwards, ackUn
 import { getLastDisplayMessage } from '../status/snapshot.js';
 import { resolveDelegatedWorkerAutoApprove, resolveProviderMaxParallel, resolveNodeSchedulingPriority, normalizeMeshSchedulingStrategy } from '../repo-mesh-types.js';
 import type { RepoMeshSchedulingStrategy } from '../repo-mesh-types.js';
-import { normalizeMeshNodeId, meshNodeIdMatches, type MeshNodeIdentified } from '@adhdev/mesh-shared';
+import { normalizeMeshNodeId, meshNodeIdMatches, expandDaemonIdForms, type MeshNodeIdentified } from '@adhdev/mesh-shared';
 import {
     findRecentTerminalLedgerEvidence,
     hasDispatchAfterTerminal,
@@ -35,16 +36,16 @@ import {
 } from './mesh-events-utils.js';
 
 // The set of coordinator-daemon ids this daemon answers to when draining the
-// pending-events queue (canonical status id + bare machineId). Mirrors
-// resolveCoordinatorDaemonIds in mesh-reconcile-loop — a unicast event may be
-// stamped with either id depending on which dispatch path created the worker.
+// pending-events queue. Mirrors resolveCoordinatorDaemonIds in mesh-reconcile-loop:
+// a unicast event may be stamped with the status id, the bare machineId, OR the
+// config-form node daemonId (`daemon_<machineId>`) depending on which dispatch path
+// created the worker. We expand to EVERY equivalent form so a `daemon_<machineId>`
+// completion matches a coordinator that knows itself as bare `<machineId>` (the
+// base-node completion-surface bug) and vice versa.
 function resolveCoordinatorDrainDaemonIds(components: DaemonComponents): string[] {
-    const ids = new Set<string>();
     const statusInstanceId = readNonEmptyString((components as { statusInstanceId?: string }).statusInstanceId);
-    if (statusInstanceId) ids.add(statusInstanceId);
     const machineId = readNonEmptyString(loadConfig().machineId);
-    if (machineId) ids.add(machineId);
-    return [...ids];
+    return expandDaemonIdForms([statusInstanceId, machineId]);
 }
 
 // ---------------------------------------------------------------------------
@@ -304,6 +305,95 @@ function resolveActiveDirectDispatchTaskId(meshId: string, sessionId: string): s
 // Queue assignment
 // ---------------------------------------------------------------------------
 
+// Per-dispatch confirmation timeout (Bug B). A dispatch promise that never settles —
+// a saturated remote P2P relay that hangs, or a transport that resolves only after
+// the worker acks — would otherwise leave the just-claimed queue row 'assigned' with
+// its delivery stuck 'delivering' forever: the .catch that requeues never fires, and
+// PHASE 3 reconcile skips the row (it counts 0 pending). Racing the dispatch against
+// this timeout guarantees a hung dispatch deterministically returns the task to
+// 'pending' for re-dispatch. Generous so a merely-slow-but-live dispatch (a cold
+// remote relay) is never reclaimed early; the reconcile assigned-stranded watchdog is
+// the durable cross-restart backstop for a timer lost to a daemon restart.
+const DISPATCH_CONFIRM_TIMEOUT_MS = 120_000;
+
+interface DeliverTaskContext {
+    meshId: string;
+    nodeId: string;
+    sessionId: string;
+    providerType: string;
+    task: MeshWorkQueueEntry;
+    transport: 'remote' | 'local';
+    sourceCoordinatorSessionId?: string;
+    sourceCoordinatorDaemonId?: string;
+}
+
+// CONS scope 3: the SINGLE source of truth for dispatching a claimed task to its
+// session. The remote (P2P dispatchMeshCommand) and local (cliManager.handleCliCommand)
+// branches differ ONLY in the transport call — the delivery record, the delivered/failed
+// transitions, the pending-requeue-on-failure, the dispatch_failed ledger entry, AND the
+// Bug B hang timeout are identical and live here once so a future change to the dispatch
+// lifecycle cannot drift between the two paths. The caller passes a `dispatchThunk` that
+// performs only the transport-specific send and returns its promise.
+function deliverTaskToSession(dispatchThunk: () => Promise<unknown>, ctx: DeliverTaskContext): void {
+    const delivery = createSessionDelivery({
+        meshId: ctx.meshId,
+        nodeId: ctx.nodeId,
+        sessionId: ctx.sessionId,
+        providerType: ctx.providerType,
+        taskId: ctx.task.id,
+        kind: 'task',
+        message: ctx.task.message,
+        status: 'delivering',
+        ...(ctx.sourceCoordinatorSessionId ? { sourceCoordinatorSessionId: ctx.sourceCoordinatorSessionId } : {}),
+        ...(ctx.sourceCoordinatorDaemonId ? { sourceCoordinatorDaemonId: ctx.sourceCoordinatorDaemonId } : {}),
+    });
+
+    // Invoke the transport synchronously (preserves the prior fire-and-forget timing,
+    // and lets a synchronous throw fall into the same failure path as a rejection).
+    let dispatchPromise: Promise<unknown>;
+    try {
+        dispatchPromise = Promise.resolve(dispatchThunk());
+    } catch (e) {
+        dispatchPromise = Promise.reject(e);
+    }
+
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const guarded = Promise.race([
+        dispatchPromise,
+        new Promise<never>((_, reject) => {
+            timer = setTimeout(
+                () => reject(new Error(`dispatch_confirm_timeout after ${DISPATCH_CONFIRM_TIMEOUT_MS}ms`)),
+                DISPATCH_CONFIRM_TIMEOUT_MS,
+            );
+            // Never keep the process alive solely for this confirm-timeout timer.
+            if (typeof (timer as { unref?: () => void })?.unref === 'function') (timer as { unref: () => void }).unref();
+        }),
+    ]);
+
+    guarded.then(() => {
+        if (timer) clearTimeout(timer);
+        updateSessionDeliveryStatus(delivery.id, 'delivered');
+    }).catch((e: any) => {
+        if (timer) clearTimeout(timer);
+        // A dispatch failure (transport reject OR hang timeout) is most often transient —
+        // a busy/refusing adapter, or a relay that never acked — not a permanent task
+        // failure. Marking the task terminal here would permanently kill tasks a later
+        // tick delivers fine. Return it to 'pending' and record a retryable dispatch_failed
+        // ledger entry so the reconcile loop re-dispatches it. Identical for both transports.
+        LOG.error('MeshQueue', `Failed to dispatch task via ${ctx.transport} to node ${ctx.nodeId}: ${e?.message}`);
+        updateSessionDeliveryStatus(delivery.id, 'failed', { lastError: e?.message, incrementAttempt: true });
+        updateTaskStatus(ctx.meshId, ctx.task.id, 'pending');
+        try {
+            appendLedgerEntry(ctx.meshId, {
+                kind: 'dispatch_failed' as any,
+                nodeId: ctx.nodeId,
+                sessionId: ctx.sessionId,
+                payload: { taskId: ctx.task.id, deliveryId: delivery.id, error: e?.message, retryable: true, transport: ctx.transport },
+            });
+        } catch { /* ledger write is best-effort */ }
+    });
+}
+
 export function tryAssignQueueTask(
     components: DaemonComponents,
     meshId: string,
@@ -337,45 +427,36 @@ export function tryAssignQueueTask(
             // completion back to that exact session (multi-coordinator). Carried over P2P
             // to the remote worker, which echoes it on its completion event.
             const sourceCoordinatorSessionId = readNonEmptyString(task.sourceCoordinatorSessionId) || undefined;
-            const delivery = createSessionDelivery({
-                meshId,
-                nodeId,
-                sessionId,
-                providerType,
-                taskId: task.id,
-                kind: 'task',
-                message: task.message,
-                status: 'delivering',
-                ...(sourceCoordinatorSessionId ? { sourceCoordinatorSessionId } : {}),
-                ...(localDaemonIdForDispatch ? { sourceCoordinatorDaemonId: localDaemonIdForDispatch } : {}),
-            });
-            components.dispatchMeshCommand(node.daemonId, 'agent_command', {
-                targetSessionId: sessionId,
-                cliType: providerType,
-                action: 'send_chat',
-                message: task.message,
-                meshContext: {
+            const dispatchMeshCommand = components.dispatchMeshCommand;
+            const remoteDaemonId = node.daemonId;
+            // CONS3: only the transport call differs — everything else (delivery record,
+            // status transitions, requeue-on-failure, ledger, Bug B hang timeout) is in
+            // the shared deliverTaskToSession helper.
+            deliverTaskToSession(
+                () => dispatchMeshCommand(remoteDaemonId, 'agent_command', {
+                    targetSessionId: sessionId,
+                    cliType: providerType,
+                    action: 'send_chat',
+                    message: task.message,
+                    meshContext: {
+                        meshId,
+                        nodeId,
+                        taskId: task.id,
+                        ...(localDaemonIdForDispatch ? { coordinatorDaemonId: localDaemonIdForDispatch } : {}),
+                        ...(sourceCoordinatorSessionId ? { coordinatorSessionId: sourceCoordinatorSessionId } : {}),
+                    },
+                }),
+                {
                     meshId,
                     nodeId,
-                    taskId: task.id,
-                    ...(localDaemonIdForDispatch ? { coordinatorDaemonId: localDaemonIdForDispatch } : {}),
-                    ...(sourceCoordinatorSessionId ? { coordinatorSessionId: sourceCoordinatorSessionId } : {}),
+                    sessionId,
+                    providerType,
+                    task,
+                    transport: 'remote',
+                    ...(sourceCoordinatorSessionId ? { sourceCoordinatorSessionId } : {}),
+                    ...(localDaemonIdForDispatch ? { sourceCoordinatorDaemonId: localDaemonIdForDispatch } : {}),
                 },
-            }).then(() => {
-                updateSessionDeliveryStatus(delivery.id, 'delivered');
-            }).catch((e: any) => {
-                LOG.error('MeshQueue', `Failed to dispatch task via P2P to remote node ${nodeId}: ${e?.message}`);
-                updateSessionDeliveryStatus(delivery.id, 'failed', { lastError: e?.message, incrementAttempt: true });
-                updateTaskStatus(meshId, task.id, 'pending');
-                try {
-                    appendLedgerEntry(meshId, {
-                        kind: 'dispatch_failed' as any,
-                        nodeId,
-                        sessionId,
-                        payload: { taskId: task.id, deliveryId: delivery.id, error: e?.message, retryable: true },
-                    });
-                } catch { /* ledger write is best-effort */ }
-            });
+            );
             return true;
         }
     }
@@ -412,44 +493,26 @@ export function tryAssignQueueTask(
         }
     } catch { /* best-effort — dispatch still proceeds */ }
 
-    const delivery = createSessionDelivery({
-        meshId,
-        nodeId,
-        sessionId,
-        providerType,
-        taskId: task.id,
-        kind: 'task',
-        message: task.message,
-        status: 'delivering',
-        ...(readNonEmptyString(task.sourceCoordinatorSessionId) ? { sourceCoordinatorSessionId: readNonEmptyString(task.sourceCoordinatorSessionId) } : {}),
-        ...(readNonEmptyString(loadConfig().machineId) ? { sourceCoordinatorDaemonId: readNonEmptyString(loadConfig().machineId) } : {}),
-    });
-    components.cliManager.handleCliCommand('agent_command', {
-        targetSessionId: sessionId,
-        cliType: providerType,
-        action: 'send_chat',
-        message: task.message,
-    }).then(() => {
-        updateSessionDeliveryStatus(delivery.id, 'delivered');
-    }).catch((e: any) => {
-        // Mirror the remote-dispatch catch above: a local dispatch failure is most often a
-        // transient busy/refusal (e.g. the adapter rejected send_chat while mid-generation),
-        // not a permanent task failure. Marking the task terminal 'failed' here with no ledger
-        // and no retry permanently killed tasks that a later tick would have delivered fine.
-        // Return the task to 'pending' and record a retryable dispatch_failed ledger entry so
-        // the reconcile loop re-dispatches it, exactly as the remote branch does.
-        LOG.error('MeshQueue', `Failed to dispatch task locally to node ${nodeId}: ${e?.message}`);
-        updateSessionDeliveryStatus(delivery.id, 'failed', { lastError: e?.message, incrementAttempt: true });
-        updateTaskStatus(meshId, task.id, 'pending');
-        try {
-            appendLedgerEntry(meshId, {
-                kind: 'dispatch_failed' as any,
-                nodeId,
-                sessionId,
-                payload: { taskId: task.id, deliveryId: delivery.id, error: e?.message, retryable: true },
-            });
-        } catch { /* ledger write is best-effort */ }
-    });
+    // CONS3: same shared dispatch lifecycle as the remote branch — only the transport
+    // (cliManager.handleCliCommand) differs.
+    deliverTaskToSession(
+        () => components.cliManager.handleCliCommand('agent_command', {
+            targetSessionId: sessionId,
+            cliType: providerType,
+            action: 'send_chat',
+            message: task.message,
+        }),
+        {
+            meshId,
+            nodeId,
+            sessionId,
+            providerType,
+            task,
+            transport: 'local',
+            ...(readNonEmptyString(task.sourceCoordinatorSessionId) ? { sourceCoordinatorSessionId: readNonEmptyString(task.sourceCoordinatorSessionId) } : {}),
+            ...(readNonEmptyString(loadConfig().machineId) ? { sourceCoordinatorDaemonId: readNonEmptyString(loadConfig().machineId) } : {}),
+        },
+    );
 
     return true;
 }
@@ -929,7 +992,12 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
 
         const candidateNodes = Array.isArray(mesh?.nodes)
             ? mesh.nodes.filter((node: any) => {
-                if (task.targetNodeId && readMeshNodeId(node) !== task.targetNodeId) return false;
+                // Bug A: match the target pin with the shared 3-form (id / nodeId / node_id)
+                // normalizer, mirroring the remote-idle drain (meshNodeIdMatches at the
+                // getRemoteIdleSessions filter). A strict `readMeshNodeId(node) !== targetNodeId`
+                // dropped a target node whose identity arrived under a different form (a freshly
+                // mesh_clone_node'd worktree), emptying candidateNodes and mislabelling the skip.
+                if (task.targetNodeId && !meshNodeIdMatches(node, task.targetNodeId)) return false;
                 // Skip nodes that can never satisfy requiredTags regardless of which provider
                 // from providerPriority is selected. A node satisfies tags if at least one
                 // provider in its priority list would produce matching capability tags.
@@ -944,7 +1012,20 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
             })
             : [];
         if (!candidateNodes.length) {
-            markAutoLaunch(meshId, task.id, { status: 'skipped', reason: 'no_node_satisfies_required_tags', nodeId: task.targetNodeId });
+            // Bug A: distinguish the two ways the candidate set empties. A task pinned to a
+            // targetNodeId whose node is absent from the mesh (or whose id arrived under a
+            // different form) is a ROUTING miss — report it as `target_node_id_unmatched`, not
+            // the hard-coded `no_node_satisfies_required_tags`, which mislabelled a 3-form
+            // node-id mismatch as a capability failure and sent diagnosis down the wrong path.
+            // Only fall back to the tag reason when no target pin is in play, or the pin DID
+            // match a node but its tags excluded it (a genuine capability miss).
+            const targetPinUnmatched = !!task.targetNodeId
+                && !(Array.isArray(mesh?.nodes) && mesh.nodes.some((n: any) => meshNodeIdMatches(n, task.targetNodeId)));
+            markAutoLaunch(meshId, task.id, {
+                status: 'skipped',
+                reason: targetPinUnmatched ? 'target_node_id_unmatched' : 'no_node_satisfies_required_tags',
+                nodeId: task.targetNodeId,
+            });
             continue;
         }
 

package/src/mesh/mesh-events-pending.ts

@@ -5,6 +5,7 @@ import { LOG } from '../logging/logger.js';
 import { getLedgerDir, readLedgerEntries, appendLedgerEntry } from './mesh-ledger.js';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
 import { buildMeshSystemMessage, readNonEmptyString, readRecord, resolveEventSessionId, readMeshCompletionSummary } from './mesh-events-utils.js';
+import { expandDaemonIdForms } from '@adhdev/mesh-shared';
 
 // ---------------------------------------------------------------------------
 // MCP coordinator pending-event queue — FILE-BASED PERSISTENCE
@@ -48,24 +49,22 @@ export interface PendingMeshCoordinatorEvent {
 const REFINE_TERMINAL_EVENTS = new Set(['refine:completed', 'refine:failed']);
 
 /** Normalise a coordinator-daemon-id argument (single id, list, or undefined) into a
- *  de-duplicated list of non-empty strings. The first entry is treated as primary for
- *  per-daemon JSONL file naming; all entries are accepted by drain/peek targeting. */
+ *  de-duplicated list of non-empty strings, EXPANDED to every equivalent daemon-id
+ *  form (bare `mach_X` ≡ `daemon_mach_X` ≡ `standalone_mach_X`).
+ *
+ *  A coordinator resolves its own id through one path (status instanceId, the config-
+ *  form node daemonId, or the bare machineId) but a worker stamps a completion's
+ *  `coordinator_daemon_id` through another, so the two are routinely in DIFFERENT
+ *  forms of the SAME machine. The scope filter is an exact-string match, so without
+ *  expansion a `daemon_mach_X`-scoped completion is silently skipped by a coordinator
+ *  that only knows itself as bare `mach_X` (the base-node completion-surface bug).
+ *  Expanding here fixes every drain/peek/surface caller uniformly. The first ORIGINAL
+ *  id stays at [0] so per-daemon JSONL file naming keeps its primary; expansion stays
+ *  within one machine core so a different coordinator's events are never claimed. */
 function normalizeCoordinatorDaemonIds(
     coordinatorDaemonId?: string | null | ReadonlyArray<string>,
 ): string[] {
-    const raw = Array.isArray(coordinatorDaemonId)
-        ? coordinatorDaemonId
-        : coordinatorDaemonId != null ? [coordinatorDaemonId] : [];
-    const seen = new Set<string>();
-    const out: string[] = [];
-    for (const id of raw) {
-        if (typeof id !== 'string') continue;
-        const trimmed = id.trim();
-        if (!trimmed || seen.has(trimmed)) continue;
-        seen.add(trimmed);
-        out.push(trimmed);
-    }
-    return out;
+    return expandDaemonIdForms(coordinatorDaemonId);
 }
 
 export function readRefineJobId(event: { metadataEvent?: Record<string, unknown> } | Record<string, unknown>): string {

package/src/mesh/mesh-ledger.ts

@@ -43,6 +43,7 @@ export type MeshLedgerKind =
     | 'delivery_unroutable'
     | 'direct_dispatch_pruned'
     | 'event_held'
+    | 'task_reclaimed'
     ;
 
 export interface MeshLedgerEntry {

package/src/mesh/mesh-reconcile-loop.ts

@@ -56,7 +56,8 @@ import {
     expireStaleUnresolvedDelegateForwards,
 } from './mesh-unresolved-forward-outbox.js';
 import { readNonEmptyString, readMeshCompletionSummary } from './mesh-events-utils.js';
-import { getActiveDirectDispatches, getQueue } from './mesh-work-queue.js';
+import { expandDaemonIdForms } from '@adhdev/mesh-shared';
+import { getActiveDirectDispatches, getQueue, reclaimStrandedAssignedTask } from './mesh-work-queue.js';
 import { readLedgerEntries } from './mesh-ledger.js';
 import { pruneStaleDirectDispatches } from './mesh-active-work.js';
 import { reconcileDirectDispatchCompletionFromTranscript } from './mesh-events-stale.js';
@@ -119,16 +120,19 @@ interface LiveCoordinator {
 //   - the daemon's canonical status id (`standalone_<machineId>` / `daemon_<machineId>`),
 //     stamped by the MCP layer via ctx.localDaemonId (= getStatus().status.instanceId), or
 //   - the bare machineId, stamped by the local queue-assignment path (loadConfig().machineId).
+//   - the config-form node daemonId (`daemon_<machineId>`), which the MCP layer's
+//     resolveCoordinatorDaemonId prefers and stamps onto direct-dispatch workers.
 // Draining with only one of these silently misses events stamped with the other —
-// the exact reason a generating coordinator never self-received local completions.
-// We accept BOTH so the drain matches regardless of which path stamped the event.
+// the exact reason a generating coordinator never self-received local completions,
+// and the base-node completion-surface bug (base completions land full-form
+// `daemon_<machineId>` while a coordinator that only knows itself as bare
+// `<machineId>` never matches them). We expand to EVERY equivalent form so the
+// scope match (host gate, self-node detection, and the drain IN-filter downstream)
+// succeeds regardless of which path stamped the event.
 function resolveCoordinatorDaemonIds(components: DaemonComponents): string[] {
-    const ids = new Set<string>();
     const statusInstanceId = readNonEmptyString((components as { statusInstanceId?: string }).statusInstanceId);
-    if (statusInstanceId) ids.add(statusInstanceId);
     const machineId = readNonEmptyString(loadConfig().machineId);
-    if (machineId) ids.add(machineId);
-    return [...ids];
+    return expandDaemonIdForms([statusInstanceId, machineId]);
 }
 
 // Whether THIS daemon is the coordinator/host for a mesh — i.e. the daemon that
@@ -316,6 +320,47 @@ function recordHeldTerminalEventsToLedger(
 //   PHASE 2 — Live CLI inject. For each mesh that has a live CLI coordinator on
 //     THIS daemon, drain the local queue and inject pending events into the PTY.
 //     Unchanged from before.
+// Bug B: how long a row may sit 'assigned' with an unconfirmed dispatch before the
+// watchdog reclaims it. Must be comfortably larger than the per-dispatch confirm
+// timeout (DISPATCH_CONFIRM_TIMEOUT_MS in mesh-events-coordinator) so a slow-but-live
+// dispatch still inside its normal confirm window is never reclaimed early — this is
+// the durable backstop for the case the in-process confirm timer can't cover (a timer
+// lost to a daemon restart between claim and confirm).
+const ASSIGNED_STRANDED_DEADLINE_MS = 5 * 60_000;
+
+// PHASE 2.5 — assigned-stranded dispatch watchdog (Bug B). claimNextTask atomically
+// flips a row to 'assigned' BEFORE the fire-and-forget dispatch runs. If that dispatch
+// neither rejects (→ no .catch requeue) nor is confirmed delivered — a relay that hangs
+// without acking, or a confirm timer lost across a restart — the row stays 'assigned'
+// forever: it contributes 0 pending, so PHASE 3 (gated on pendingQueueTaskCount>0) never
+// re-examines it, and nothing but a manual requeue clears it. This is that missing net.
+//
+// Regression guard: a row whose delivery IS confirmed (delivered/acked/completed) is a
+// genuinely in-flight (or completion-lost) task — left to PHASE 4's completion reconcile,
+// never reclaimed here. And the deadline is generous so a slow-but-live dispatch still in
+// its normal confirm window is never reclaimed early. Reclaimed rows return to 'pending'
+// with ownership cleared, so the PHASE 3 trigger below re-dispatches them this same tick.
+function recoverStrandedAssignedDispatches(meshId: string, store: MeshRuntimeStore): void {
+    const assigned = getQueue(meshId, { status: ['assigned'] });
+    if (!assigned.length) return;
+    const nowMs = Date.now();
+    for (const row of assigned) {
+        const dispatchedAtMs = Date.parse(row.dispatchTimestamp ?? '');
+        if (!Number.isFinite(dispatchedAtMs)) continue;              // no dispatch ts → can't age it
+        if (nowMs - dispatchedAtMs < ASSIGNED_STRANDED_DEADLINE_MS) continue;  // still in confirm window
+        if (store.taskHasConfirmedDelivery(meshId, row.id)) continue;          // dispatched → PHASE 4's job
+        const reclaimed = reclaimStrandedAssignedTask(meshId, row.id, {
+            reason: 'assigned_stranded_dispatch_unconfirmed',
+            ageMs: nowMs - dispatchedAtMs,
+        });
+        if (reclaimed) {
+            LOG.warn('MeshReconcile', `Reclaimed stranded assigned task ${row.id} on mesh ${meshId} `
+                + `(node=${row.assignedNodeId ?? '?'} session=${row.assignedSessionId ?? '?'}, dispatched `
+                + `${Math.round((nowMs - dispatchedAtMs) / 1000)}s ago, never confirmed delivered → ${reclaimed.status})`);
+        }
+    }
+}
+
 export async function runMeshReconcileTick(components: DaemonComponents): Promise<void> {
     const localDaemonId = readNonEmptyString(loadConfig().machineId) || undefined;
     // The id-set used to scope the local queue drain (status id + machineId). See
@@ -360,6 +405,21 @@ export async function runMeshReconcileTick(components: DaemonComponents): Promis
         }
     }
 
+    // ── PHASE 2.5: assigned-stranded dispatch watchdog (Bug B) ─────────────────
+    // Runs before PHASE 3 so any row it returns to 'pending' is re-dispatched by the
+    // PHASE 3 trigger in this same tick. See recoverStrandedAssignedDispatches.
+    if (store) {
+        for (const mesh of listMeshes()) {
+            const selfIds = resolveCoordinatorSelfIds(mesh, drainDaemonIds);
+            if (!daemonHostsMesh(mesh, selfIds)) continue;
+            try {
+                recoverStrandedAssignedDispatches(mesh.id, store);
+            } catch (e: any) {
+                LOG.warn('MeshReconcile', `Assigned-stranded watchdog failed for mesh ${mesh.id}: ${e?.message || e}`);
+            }
+        }
+    }
+
     // ── PHASE 3: recover pending queue claims for newly-idle sessions ──────────
     // The event-driven claim paths (agent:ready / agent:generating_completed in
     // mesh-events-coordinator) re-claim the queue the moment a session goes idle,

package/src/mesh/mesh-runtime-store.ts

@@ -1075,6 +1075,23 @@ export class MeshRuntimeStore {
         }));
     }
 
+    /**
+     * Bug B watchdog support: true when at least one delivery record for the task has
+     * reached a confirmed-handed-off status (delivered / acked / completed). The
+     * assigned-stranded watchdog uses this to distinguish a dispatch that was never
+     * confirmed (reclaimable) from one that WAS handed to the worker (a genuinely
+     * in-flight or completion-lost task, which is PHASE 4's responsibility, not this
+     * watchdog's). Indexed by (mesh_id, task_id).
+     */
+    taskHasConfirmedDelivery(meshId: string, taskId: string): boolean {
+        const row = this.db.prepare(`
+            SELECT 1 FROM mesh_session_delivery
+            WHERE mesh_id = ? AND task_id = ? AND status IN ('delivered','acked','completed')
+            LIMIT 1
+        `).get(meshId, taskId) as { 1: number } | undefined;
+        return !!row;
+    }
+
     expireStaleSessionDeliveries(meshId: string): void {
         const now = new Date().toISOString();
         this.db.prepare(`

package/src/mesh/mesh-work-queue.ts

@@ -5,6 +5,8 @@ import { MESH_CONVERGE_REFINE_TAG, resolveAutoConvergeCodeChange } from '../repo
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
 import { getMesh } from '../config/mesh-config.js';
 import { LOG } from '../logging/logger.js';
+import { appendLedgerEntry } from './mesh-ledger.js';
+import type { MeshLedgerKind } from './mesh-ledger.js';
 
 export type MeshTaskStatus = 'pending' | 'assigned' | 'completed' | 'failed' | 'cancelled';
 export type MeshActiveTaskStatus = Extract<MeshTaskStatus, 'pending' | 'assigned'>;
@@ -339,6 +341,14 @@ export interface MeshWorkQueueEntry {
     requeueCount?: number;
     /** Max automatic requeue attempts. When requeueCount reaches this, task is auto-failed. */
     maxRetries?: number;
+    /**
+     * Bug B: number of times the reconcile assigned-stranded watchdog has reclaimed this
+     * row from 'assigned' back to 'pending' because its dispatch was never confirmed
+     * delivered. Separate from requeueCount (operator/execution retries) and bounded by
+     * MAX_STRANDED_RECLAIMS so a permanently-undeliverable target auto-fails rather than
+     * cycling reclaim→re-dispatch→strand forever.
+     */
+    strandedReclaimCount?: number;
     /** Last automatic queue session spin-up attempt, for mesh_view_queue/debug visibility. */
     autoLaunch?: {
         status: 'skipped' | 'started' | 'failed' | 'completed';
@@ -887,6 +897,85 @@ export function requeueTask(
     });
 }
 
+/**
+ * Max times the assigned-stranded watchdog will reclaim a single task before giving
+ * up and failing it. Bounds the reclaim→re-dispatch→strand cycle so a permanently
+ * undeliverable target (e.g. a node whose transport is wedged) eventually fails and
+ * unblocks its dependents instead of looping every reconcile tick.
+ */
+const MAX_STRANDED_RECLAIMS = 3;
+
+/**
+ * Bug B: reclaim a task stuck in 'assigned' because its dispatch was never confirmed.
+ *
+ * claimNextTask atomically marks a row 'assigned' BEFORE the fire-and-forget dispatch
+ * runs. If that dispatch neither rejects (→ no .catch requeue) nor is confirmed
+ * delivered — a relay that hangs without acking, or a confirm timer lost across a
+ * daemon restart — the row stays 'assigned' forever, contributing 0 pending so PHASE 3
+ * reconcile never re-examines it. This returns such a row to 'pending' and clears its
+ * dead assignment ownership (node / session / provider / dispatchTimestamp) — the same
+ * ownership-clear requeueTask applies — so PHASE 3 can re-dispatch it onto a fresh idle
+ * session.
+ *
+ * Guarded to 'assigned' rows only (a completion/cancel that already moved the row off
+ * 'assigned' must never be resurrected) and bounded by MAX_STRANDED_RECLAIMS (beyond
+ * which the task is failed so dependents unblock).
+ */
+export function reclaimStrandedAssignedTask(
+    meshId: string,
+    taskId: string,
+    opts?: { reason?: string; ageMs?: number } & MeshQueueMutationOptions,
+): MeshWorkQueueEntry | null {
+    requireMeshHostQueueOwner(opts);
+    return withQueueLock(meshId, () => {
+        const entry = MeshRuntimeStore.getInstance().findQueueEntryById(meshId, taskId);
+        if (!entry) return null;
+        // Only a still-assigned row is stranded. If a completion/cancel already moved it
+        // off 'assigned', there is nothing to reclaim — never resurrect a terminal row.
+        if (entry.status !== 'assigned') return null;
+        const now = new Date().toISOString();
+        const reason = opts?.reason || 'assigned_stranded_dispatch_unconfirmed';
+        const reclaims = (entry.strandedReclaimCount || 0) + 1;
+        const prevNode = entry.assignedNodeId;
+        const prevSession = entry.assignedSessionId;
+        // Always clear the dead assignment ownership so a re-claim starts clean and the
+        // assigned-counters (which filter status==='assigned') stop counting this row.
+        delete entry.assignedNodeId;
+        delete entry.assignedSessionId;
+        delete entry.assignedProviderType;
+        delete entry.dispatchTimestamp;
+        entry.strandedReclaimCount = reclaims;
+        entry.updatedAt = now;
+        if (reclaims > MAX_STRANDED_RECLAIMS) {
+            // Repeatedly undeliverable — stop cycling and fail it so dependents unblock.
+            entry.status = 'failed';
+            entry.cancelReason = `stranded_dispatch_unrecovered: reclaimed ${reclaims - 1} time(s) without a confirmed dispatch`;
+            MeshRuntimeStore.getInstance().updateQueueEntry(entry);
+            propagateDependencyFailure(meshId, taskId);
+        } else {
+            entry.status = 'pending';
+            entry.requeuedAt = now;
+            entry.requeueReason = reason;
+            MeshRuntimeStore.getInstance().updateQueueEntry(entry);
+        }
+        try {
+            appendLedgerEntry(meshId, {
+                kind: 'task_reclaimed' as MeshLedgerKind,
+                nodeId: prevNode,
+                sessionId: prevSession,
+                payload: {
+                    taskId,
+                    reason,
+                    ...(typeof opts?.ageMs === 'number' ? { ageMs: opts.ageMs } : {}),
+                    reclaimCount: reclaims,
+                    outcome: entry.status,
+                },
+            });
+        } catch { /* ledger write is best-effort */ }
+        return entry;
+    });
+}
+
 /**
  * Update the status of the task currently assigned to a specific session.
  */

package/src/providers/approval-utils.d.ts

@@ -8,4 +8,5 @@ export declare function pickAutoApprovalButton(buttons: string[] | null | undefi
     index: number;
     label: string;
 };
+export declare function hasNegativeApprovalOption(buttons: string[] | null | undefined): boolean;
 export declare function formatAutoApprovalMessage(modalMessage?: string, buttonLabel?: string): string;

package/src/providers/approval-utils.ts

@@ -31,6 +31,16 @@ function isNegativeApprovalLabel(value: string): boolean {
         || /\bdo not\b/.test(label);
 }
 
+/**
+ * True when any of the given button labels reads as a decline/negative option
+ * (No / Deny / Cancel / Skip / …). Used as the second half of an approval-modal
+ * structural anchor: a real approval modal offers BOTH an affirmative and a
+ * decline, which distinguishes it from a generic numbered menu or prose list.
+ */
+export function hasNegativeApprovalOption(buttons: string[] | null | undefined): boolean {
+    return (buttons || []).some((button) => isNegativeApprovalLabel(String(button || '')));
+}
+
 export function getApprovalPositiveHints(provider?: Pick<ProviderModule, 'approvalPositiveHints'> | null): string[] {
     const customHints = Array.isArray(provider?.approvalPositiveHints)
         ? provider.approvalPositiveHints