@adhdev/daemon-core 0.9.82-rc.366 → 0.9.82-rc.368

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.366",
+  "version": "0.9.82-rc.368",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.366",
+    "@adhdev/mesh-shared": "0.9.82-rc.368",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/commands/chat-commands.ts

@@ -30,6 +30,7 @@ import {
 import type { ChatMessage } from '../types.js';
 import type { SessionTransport } from '../shared-types.js';
 import { filterUserFacingChatMessages, isActivityChatMessage, isUserFacingChatMessage, normalizeChatMessages } from '../providers/chat-message-normalization.js';
+import { normalizeMeshWorkspaceForCompare } from '@adhdev/mesh-shared';
 
 const RECENT_SEND_WINDOW_MS = 1200;
 export const READ_CHAT_PROVIDER_EVAL_TIMEOUT_MS = 25_000;
@@ -989,6 +990,53 @@ function normalizeComparableWorkspace(value: unknown): string {
     return path.resolve(text);
 }
 
+/**
+ * read_chat node scope verdict. One physical daemon hosts a base node plus several
+ * worktree nodes; mesh_read_chat always dispatches read_chat with the requested
+ * node's workspace (`args.workspace`). When the resolved target session actually
+ * lives in a DIFFERENT worktree, returning its transcript — or worse, letting the
+ * native-history-by-workspace fallback splice sibling worktree turns into the
+ * reply — makes the coordinator believe one session received every worktree's
+ * work. This guard refuses a CONFIRMED cross-workspace read instead of mixing.
+ *
+ * Conservative by design (mirrors the WTCLAIM fix-B "unknown → allow" rule): only
+ * a session id that resolves to a known workspace which is unequal to a known
+ * intended workspace blocks. When either side is unknown — no targetSessionId, no
+ * args.workspace, an unregistered session, the coordinator self-session, or a
+ * plain dashboard read that never passes a node workspace — the read proceeds
+ * untouched, so base-node and same-daemon coordinator reads never regress.
+ */
+export function evaluateReadChatNodeWorkspaceScope(args: {
+    targetSessionId?: string;
+    intendedWorkspace?: string;
+    sessionWorkspace?: string;
+}): { scoped: false } | { scoped: true; intended: string; actual: string } {
+    const targetSessionId = typeof args.targetSessionId === 'string' ? args.targetSessionId.trim() : '';
+    if (!targetSessionId) return { scoped: false };
+    const intended = normalizeMeshWorkspaceForCompare(args.intendedWorkspace);
+    const actual = normalizeMeshWorkspaceForCompare(args.sessionWorkspace);
+    if (!intended || !actual) return { scoped: false };
+    if (intended === actual) return { scoped: false };
+    return { scoped: true, intended, actual };
+}
+
+/**
+ * Resolve the target session's ACTUAL workspace from the most authoritative source
+ * available on this daemon: the session registry record (stamped at register
+ * time), then the live CLI adapter's working directory, then the bound instance
+ * state. Returns '' when nothing knows the session's workspace — the caller treats
+ * that as "unknown" and does not block.
+ */
+function resolveTargetSessionActualWorkspace(h: CommandHelpers, targetSessionId: string): string {
+    const registryWorkspace = (h.ctx?.sessionRegistry?.get?.(targetSessionId) as any)?.workspace;
+    if (typeof registryWorkspace === 'string' && registryWorkspace.trim()) return registryWorkspace;
+    const adapter = h.getCliAdapter?.(targetSessionId);
+    if (adapter && typeof adapter.workingDir === 'string' && adapter.workingDir.trim()) return adapter.workingDir;
+    const instanceWorkspace = (getTargetInstance(h, { targetSessionId })?.getState?.() as any)?.workspace;
+    if (typeof instanceWorkspace === 'string' && instanceWorkspace.trim()) return instanceWorkspace;
+    return '';
+}
+
 function isCurrentRuntimePtySafelyAttributed(args: {
     adapter: CliAdapter;
     helpers: CommandHelpers;
@@ -2100,6 +2148,29 @@ export async function handleChatHistory(h: CommandHelpers, args: any): Promise<C
 }
 
 export async function handleReadChat(h: CommandHelpers, args: any): Promise<CommandResult> {
+    // Node scope guard: a daemon hosting a base node + several worktree nodes must
+    // not serve worktree A's transcript (or splice sibling worktree turns via the
+    // native-history-by-workspace fallback) when a coordinator scoped the read to
+    // worktree B. mesh_read_chat always passes the requested node's workspace as
+    // args.workspace; refuse a CONFIRMED cross-workspace read rather than mix.
+    {
+        const guardSessionId = typeof args?.targetSessionId === 'string' ? args.targetSessionId.trim() : '';
+        if (guardSessionId && typeof args?.workspace === 'string' && args.workspace.trim()) {
+            const verdict = evaluateReadChatNodeWorkspaceScope({
+                targetSessionId: guardSessionId,
+                intendedWorkspace: args.workspace,
+                sessionWorkspace: resolveTargetSessionActualWorkspace(h, guardSessionId),
+            });
+            if (verdict.scoped) {
+                LOG.info('Command', `[read_chat] node scope mismatch: session ${guardSessionId} workspace "${verdict.actual}" ≠ requested node workspace "${verdict.intended}" — refusing cross-worktree transcript`);
+                return {
+                    success: false,
+                    code: 'read_chat_session_node_scope_mismatch',
+                    error: `Session ${guardSessionId} belongs to a different worktree (workspace "${verdict.actual}") than the requested node (workspace "${verdict.intended}"). Refusing to return a cross-worktree transcript — target the node that owns this session.`,
+                };
+            }
+        }
+    }
     // Resolve provider in order: explicit agentType/providerType > registered session.
     // Without this fallback, callers that only have a sessionId (e.g. a chat tail
     // controller that just got handed a session ID over WS) get an empty result
@@ -2649,10 +2720,33 @@ export async function handleReadChat(h: CommandHelpers, args: any): Promise<Comm
             });
 
             if (supportsNative && !decision.nativeSelected) {
+                // Dead-end: we are in the history-only path (no live PTY/ACP
+                // adapter was found for this target session) AND provider-native
+                // history is not safely mappable to the requested session
+                // (no historySessionId stamp / workspace mismatch). Previously
+                // this returned `success:false`, which the command logger emits
+                // at warn level on EVERY poll (handler.ts logCommandEnd) —
+                // mesh coordinators poll read_chat continuously, so a worker whose
+                // transcript can never be safely mapped produced a 100% warn-log
+                // storm with no recovery. Switch to a SOFT response: success with
+                // empty messages + pending:true so the coordinator treats it as
+                // "no live messages readable yet" rather than a hard failure, and
+                // carry the machine-readable reason for debuggability. The normal
+                // live-adapter path (above) and the safe-native return (below) are
+                // unaffected — this is strictly the both-absent dead end.
+                LOG.debug('Command', `[read_chat] soft pending: no live adapter and native history not safely mappable target=${String(args?.targetSessionId || '')} provider=${agentStr} reason=native_history_not_safely_available`);
                 return {
-                    success: false,
+                    success: true,
+                    pending: true,
+                    // Both signals are true here: we reached the history-only path
+                    // because no live adapter was found (`live_adapter_not_found`),
+                    // and native history is not safely mappable
+                    // (`native_history_not_safely_available`).
+                    reason: 'native_history_not_safely_available',
+                    reasons: ['live_adapter_not_found', 'native_history_not_safely_available'],
                     code: 'native_history_not_safely_available',
-                    error: 'Provider-native history was not safely available for the requested CLI session.',
+                    messages: [],
+                    status: 'idle',
                     providerSessionId: historyProviderSessionId,
                     messageSource: decision.messageSource,
                     transcriptProvenance: decision.messageSource,

package/src/commands/cli-manager.ts

@@ -706,6 +706,28 @@ export class DaemonCliManager {
         }
 
         this.adapters.set(key, cliInstance.getAdapter());
+
+        // WTDISPATCH (no_node_binding): a coordinator-launched worker carries its mesh node
+        // binding on the CLI-instance settings, but the session-host RECORD meta was never
+        // stamped with it — `updateRuntimeSettings` only mutates in-memory runtime settings and
+        // `updateRuntimeMeta` was only ever called with providerSessionId. So mesh_cleanup_sessions
+        // matched these worker sessions to a node by workspace ALONE
+        // (`live_session_matched_by_workspace_only_no_node_binding`), which on a daemon hosting
+        // sibling worktree nodes cannot tell two co-located clones apart. Push the launch-time node
+        // binding to the record meta so the record is 1:1 bound to its node (the spawned pty exists
+        // by now, so updateMeta reaches the session-host store). Best-effort; guarded.
+        const launchMeshNodeId = typeof settings?.meshNodeId === 'string' ? settings.meshNodeId.trim() : '';
+        const launchMeshNodeFor = typeof settings?.meshNodeFor === 'string' ? settings.meshNodeFor.trim() : '';
+        if (launchMeshNodeId || launchMeshNodeFor) {
+            try {
+                cliInstance.getAdapter().updateRuntimeMeta?.({
+                    ...(launchMeshNodeId ? { meshNodeId: launchMeshNodeId } : {}),
+                    ...(launchMeshNodeFor ? { meshNodeFor: launchMeshNodeFor } : {}),
+                    ...(settings?.launchedByCoordinator === true ? { launchedByCoordinator: true } : {}),
+                });
+            } catch { /* best-effort — record-meta stamp is cleanup hygiene, not on the dispatch path */ }
+        }
+
         this.startCliExitMonitor(key, cliType);
     }
 

package/src/commands/router.ts

@@ -47,6 +47,7 @@ import {
     normalizeMeshNodeId,
     meshNodeIdMatches,
     daemonIdsEquivalent,
+    meshWorkspacesEquivalent,
 } from '@adhdev/mesh-shared';
 import { SessionRegistry } from '../sessions/registry.js';
 import { LOG } from '../logging/logger.js';
@@ -1130,6 +1131,21 @@ function readMeshTimeoutEnvMs(name: string, defaultMs: number): number {
 // (still under the P2P REQUEST_TIMEOUT of 30s) and made env-overridable.
 export const MESH_DIRECT_PROBE_TIMEOUT_MS = readMeshTimeoutEnvMs('MESH_DIRECT_PROBE_TIMEOUT_MS', 25_000);
 export const MESH_DIRECT_PROBE_RETRY_TIMEOUT_MS = readMeshTimeoutEnvMs('MESH_DIRECT_PROBE_RETRY_TIMEOUT_MS', 25_000);
+// Cold-open warmup budget for the FIRST direct-peer probe to a peer whose mesh
+// DataChannel is not open yet. A fresh cross-machine, TURN-relayed handshake
+// (ICE gather + TURN allocation + DTLS across two residential networks) routinely
+// needs many seconds. Charging that warmup against the response deadline
+// (MESH_DIRECT_PROBE_TIMEOUT_MS) made the very first git_status to a cold peer
+// false-timeout, after which the warm retry — reusing the now-open channel —
+// succeeded: the classic cold-open signature. This budget bounds ONLY the
+// "channel not open yet" phase; once the channel opens the response deadline
+// governs the round trip. A genuine connect failure still rejects immediately —
+// the mesh manager fails the peer the instant its PeerConnection state goes
+// terminal, and isMeshConnectionDefinitivelyDown pre-gates an already-dead peer —
+// so this never masks a real failure for the whole window; it only grants a
+// still-handshaking peer the time it legitimately needs. Matches the daemon-cloud
+// DaemonMeshManager CONNECT_TIMEOUT_MS (45s). Env-overridable for very slow links.
+export const MESH_DIRECT_PROBE_CONNECT_TIMEOUT_MS = readMeshTimeoutEnvMs('MESH_DIRECT_PROBE_CONNECT_TIMEOUT_MS', 45_000);
 // How long a successful per-peer git_status probe stays fresh enough to be
 // reused instead of issuing another blocking `refreshUpstream:true` fan-out.
 // A slow (TURN-relayed) peer's probe can take 9-23s, and the dashboard's
@@ -1198,17 +1214,120 @@ export class MeshGitProbeCache {
     }
 }
 
+/**
+ * Await `work` under a warmup-aware deadline so a cold-open DataChannel handshake
+ * is NOT charged against the command response budget — the root cause of the
+ * "first mesh probe to a cold peer false-times-out, the warm retry succeeds"
+ * signature. Two budgets, switched by the live peer connection state:
+ *
+ *  - While `isConnected()` returns false the peer's channel is still opening; the
+ *    cold-open `connectTimeoutMs` budget applies. This phase is deliberately
+ *    generous because a TURN-relayed cross-machine handshake legitimately needs
+ *    many seconds — but a genuine connect *failure* is surfaced by `work`
+ *    rejecting on its own (the mesh manager fails the peer the instant its
+ *    PeerConnection state goes terminal), so a real failure is never masked for
+ *    the whole window.
+ *  - The first time `isConnected()` returns true the channel is warm; from that
+ *    instant the tight `responseTimeoutMs` governs how long the handler may take.
+ *    Warm-channel callers therefore see behavior identical to the old single
+ *    `Promise.race(work, responseTimeoutMs)`.
+ *
+ * Rejects with `Error('timeout')` when either budget is exhausted, mirroring the
+ * previous single-race contract. Pure except for timers + the injected
+ * `isConnected` probe, so it is unit-testable under fake timers without any real
+ * WebRTC. When no connection getter is wired `isConnected` should be `() => true`
+ * (the caller's choice) so the response deadline governs from t0 — the legacy
+ * single-budget behavior, never a combined connect+response window.
+ */
+export function awaitWithWarmupDeadline<T>(
+    work: Promise<T>,
+    opts: {
+        isConnected: () => boolean;
+        connectTimeoutMs: number;
+        responseTimeoutMs: number;
+        pollIntervalMs?: number;
+    },
+): Promise<T> {
+    const pollMs = Math.max(1, Math.min(opts.pollIntervalMs ?? 200, opts.connectTimeoutMs));
+    return new Promise<T>((resolve, reject) => {
+        let done = false;
+        let poll: ReturnType<typeof setInterval> | undefined;
+        let responseTimer: ReturnType<typeof setTimeout> | undefined;
+        const startedAt = Date.now();
+        const cleanup = () => {
+            if (poll) { clearInterval(poll); poll = undefined; }
+            if (responseTimer) { clearTimeout(responseTimer); responseTimer = undefined; }
+        };
+        const settle = (fn: () => void) => {
+            if (done) return;
+            done = true;
+            cleanup();
+            fn();
+        };
+        // Arm the response deadline exactly once, the moment the channel is warm.
+        const armResponse = () => {
+            if (responseTimer || done) return;
+            responseTimer = setTimeout(
+                () => settle(() => reject(new Error('timeout'))),
+                opts.responseTimeoutMs,
+            );
+            if (typeof responseTimer.unref === 'function') responseTimer.unref();
+        };
+        const onPoll = () => {
+            if (done) return;
+            if (opts.isConnected()) {
+                if (poll) { clearInterval(poll); poll = undefined; }
+                armResponse();
+                return;
+            }
+            if (Date.now() - startedAt >= opts.connectTimeoutMs) {
+                settle(() => reject(new Error('timeout')));
+            }
+        };
+        if (opts.isConnected()) {
+            // Already warm (e.g. a retry over an open channel) — skip the warmup
+            // phase entirely and let the response deadline govern from t0.
+            armResponse();
+        } else {
+            poll = setInterval(onPoll, pollMs);
+            if (typeof poll.unref === 'function') poll.unref();
+        }
+        work.then(
+            (val) => settle(() => resolve(val)),
+            (err) => settle(() => reject(err)),
+        );
+    });
+}
+
 async function probeRemoteMeshGitStatus(args: {
     dispatchMeshCommand?: (daemonId: string, cmd: string, args: Record<string, unknown>) => Promise<unknown>;
     daemonId: string;
     workspace: string;
-    timeoutMs: number;
+    // Response deadline — applies only once the peer's DataChannel is open (warm).
+    responseTimeoutMs: number;
+    // Cold-open warmup budget — applies only while the channel is still opening.
+    connectTimeoutMs: number;
+    // Live peer connection snapshot getter; lets the deadline tell "still warming
+    // up" apart from "warm but slow". Absent → behave as if always warm (the
+    // response deadline governs from t0, i.e. the legacy single-budget behavior).
+    getConnection?: (daemonId: string) => Record<string, unknown> | null;
 }): Promise<Record<string, unknown> | null> {
     if (!args.dispatchMeshCommand) return null;
-    const remoteResult = await Promise.race([
-        args.dispatchMeshCommand(args.daemonId, 'git_status', { workspace: args.workspace, refreshUpstream: true }),
-        new Promise<never>((_, reject) => setTimeout(() => reject(new Error('timeout')), args.timeoutMs)),
-    ]) as any;
+    // Fire the dispatch first — this is what drives the mesh manager to ensure /
+    // open the peer connection. The warmup-aware deadline then charges the
+    // cold-open handshake to the connect budget and only the warm round trip to
+    // the response budget, so the first probe to a cold peer is no longer
+    // false-timed-out before its channel has even opened.
+    const dispatch = args.dispatchMeshCommand(args.daemonId, 'git_status', { workspace: args.workspace, refreshUpstream: true });
+    const getConnection = args.getConnection;
+    const isConnected = getConnection
+        ? () => readMeshConnectionState(getConnection(args.daemonId)) === 'connected'
+        : () => true;
+    const remoteResult = await awaitWithWarmupDeadline(dispatch, {
+        isConnected,
+        connectTimeoutMs: args.connectTimeoutMs,
+        responseTimeoutMs: args.responseTimeoutMs,
+    }) as any;
     const remoteGit = remoteResult?.status ?? remoteResult?.git ?? remoteResult;
     if (!remoteGit || typeof remoteGit !== 'object' || typeof remoteGit.isGitRepo !== 'boolean') return null;
     // The member daemon stamps its own platform/arch onto the git_status result
@@ -1269,6 +1388,8 @@ export async function probeRemoteMeshGitStatusWithRetry(args: {
     timeoutMs: number;
     /** Per-attempt timeout for retries (attempts > 0); defaults to timeoutMs. */
     retryTimeoutMs?: number;
+    /** Cold-open warmup budget per attempt; defaults to MESH_DIRECT_PROBE_CONNECT_TIMEOUT_MS. */
+    connectTimeoutMs?: number;
     getConnection?: (daemonId: string) => Record<string, unknown> | null;
     onConnection?: (connection: Record<string, unknown>) => void;
 }): Promise<Record<string, unknown> | null> {
@@ -1300,7 +1421,9 @@ export async function probeRemoteMeshGitStatusWithRetry(args: {
                 dispatchMeshCommand: args.dispatchMeshCommand,
                 daemonId: args.daemonId,
                 workspace: args.workspace,
-                timeoutMs: attempt === 0 ? args.timeoutMs : (args.retryTimeoutMs ?? args.timeoutMs),
+                responseTimeoutMs: attempt === 0 ? args.timeoutMs : (args.retryTimeoutMs ?? args.timeoutMs),
+                connectTimeoutMs: args.connectTimeoutMs ?? MESH_DIRECT_PROBE_CONNECT_TIMEOUT_MS,
+                getConnection: args.getConnection,
             });
             if (remoteGit) return remoteGit;
         } catch {
@@ -1447,6 +1570,7 @@ export async function hydrateInlineMeshDirectTruth(args: {
             workspace,
             timeoutMs: MESH_DIRECT_PROBE_TIMEOUT_MS,
             retryTimeoutMs: MESH_DIRECT_PROBE_RETRY_TIMEOUT_MS,
+            connectTimeoutMs: MESH_DIRECT_PROBE_CONNECT_TIMEOUT_MS,
             getConnection: args.getMeshPeerConnectionStatus,
         });
         const remoteGit = args.probeCache
@@ -1512,14 +1636,17 @@ function liveSessionRecordMatchesMeshNode(record: any, meshId: string, nodeId: s
     if (!recordNodeId || recordNodeId !== nodeId) return false;
     if (nodeIsMissingLocalWorktree) return false;
     const recordWorkspace = readStringValue(record?.workspace);
-    if (nodeWorkspace && recordWorkspace && recordWorkspace !== nodeWorkspace) return false;
+    // Normalized compare (shared WTCLAIM rule): a base node and a co-located worktree
+    // clone differ ONLY by workspace root, so a separator/case-skewed exact compare
+    // could wrongly keep a sibling worktree's session attached to this node.
+    if (nodeWorkspace && recordWorkspace && !meshWorkspacesEquivalent(recordWorkspace, nodeWorkspace)) return false;
     const recordMeshId = readStringValue(record?.meta?.meshNodeFor);
     return !recordMeshId || recordMeshId === meshId;
 }
 
 function liveSessionRecordMatchesMeshWorkspace(record: any, meshId: string, workspace: string): boolean {
     const recordWorkspace = readStringValue(record?.workspace);
-    if (!recordWorkspace || !workspace || recordWorkspace !== workspace) return false;
+    if (!recordWorkspace || !workspace || !meshWorkspacesEquivalent(recordWorkspace, workspace)) return false;
 
     const recordMeshId = readStringValue(record?.meta?.meshNodeFor);
     if (recordMeshId) return recordMeshId === meshId;

package/src/mesh/mesh-events-coordinator.ts

@@ -19,7 +19,7 @@ import { traceMeshEventStage, traceMeshEventDrop } from './mesh-event-trace.js';
 import { getLastDisplayMessage } from '../status/snapshot.js';
 import { resolveDelegatedWorkerAutoApprove, resolveProviderMaxParallel, resolveNodeSchedulingPriority, normalizeMeshSchedulingStrategy } from '../repo-mesh-types.js';
 import type { RepoMeshSchedulingStrategy } from '../repo-mesh-types.js';
-import { normalizeMeshNodeId, meshNodeIdMatches, daemonIdsEquivalent, expandDaemonIdForms, type MeshNodeIdentified } from '@adhdev/mesh-shared';
+import { normalizeMeshNodeId, meshNodeIdMatches, daemonIdsEquivalent, expandDaemonIdForms, normalizeMeshWorkspaceForCompare, meshWorkspacesEquivalent, type MeshNodeIdentified } from '@adhdev/mesh-shared';
 import {
     findRecentTerminalLedgerEvidence,
     hasDispatchAfterTerminal,
@@ -457,16 +457,10 @@ function deliverTaskToSession(dispatchThunk: () => Promise<unknown>, ctx: Delive
     });
 }
 
-// WTCLAIM: normalize a workspace path for base-vs-worktree comparison. Mirrors
-// cli-manager.ts normalizeDirForCompare (fix-B) — folds separator style, trailing
-// slashes, and case (Windows paths are case-insensitive) so a base node and a worktree
-// clone, whose only structural difference is their distinct workspace roots, are still
-// told apart. Kept local (the cli-manager copy is module-private) so the comparison rule
-// stays identical to the one fix-B already uses on the worker side.
-function normalizeMeshWorkspaceForCompare(dir?: string): string {
-    if (typeof dir !== 'string') return '';
-    return dir.trim().replace(/[\\/]+/g, '/').replace(/\/+$/, '').toLowerCase();
-}
+// WTCLAIM: workspace normalization for base-vs-worktree comparison now lives in
+// @adhdev/mesh-shared (normalizeMeshWorkspaceForCompare) so the enqueue→claim path,
+// the mesh_status per-node session filter, and the read_chat node scope guard all
+// share one comparison rule instead of drifting module-private copies.
 
 export function tryAssignQueueTask(
     components: DaemonComponents,
@@ -493,14 +487,52 @@ export function tryAssignQueueTask(
     // getRemoteIdleSessions). Conservative by design: when either workspace is unknown we do NOT
     // skip, so a node with no declared workspace keeps its prior behavior and no legitimate claim
     // is starved.
+    // WTDISPATCH (residual of WTCLAIM): the cross-node claim guard must reach EVERY claiming
+    // session this daemon can observe — not only those whose adapter happens to be in
+    // cliManager.adapters. An auto-launched worker session can carry its node binding on the
+    // CLI-instance settings while its session-host record shows no_node_binding, and the
+    // event-driven / remote-idle drain (agent:ready → setRemoteIdleSession → tryAssignQueueTask)
+    // can pass a nodeId that does NOT belong to the claiming session — a sibling worktree node
+    // on the SAME daemon. The adapter-only WTCLAIM check (rc.361/4c5b30b1) never engaged for a
+    // session observed solely via instanceManager, so session A could pull node B's task and
+    // node A's task was left with no session to claim it (no task_dispatched — it never dispatches).
+    //
+    // Resolve the claiming session's REAL identity from the adapter workingDir, then fall back to
+    // the live CLI instance's workspace + its stamped meshNodeId, and refuse a claim that
+    // contradicts EITHER (fail-closed). Reuses the shared meshWorkspacesEquivalent / meshNodeIdMatches
+    // comparators — no new comparison logic. Conservative: when neither the workspace NOR the stamp
+    // is resolvable we do NOT refuse, so a node with no declared workspace keeps prior behavior and
+    // a genuinely remote (cross-daemon) candidate stays nodeId-matched from getRemoteIdleSessions.
     const localClaimAdapter = components.cliManager?.adapters?.get(sessionId) as { workingDir?: string } | undefined;
-    if (localClaimAdapter) {
-        const sessionWorkspace = normalizeMeshWorkspaceForCompare(localClaimAdapter.workingDir);
-        const nodeWorkspace = normalizeMeshWorkspaceForCompare(readNonEmptyString(node?.workspace));
-        if (sessionWorkspace && nodeWorkspace && sessionWorkspace !== nodeWorkspace) {
-            LOG.info('MeshQueue', `WTCLAIM: refusing claim for node ${nodeId} (${sessionId}) — session workspace "${sessionWorkspace}" ≠ node workspace "${nodeWorkspace}" (cross-workspace dispatch blocked)`);
+    let claimInstanceWorkspace = '';
+    let claimStampedNodeId = '';
+    try {
+        const claimState = components.instanceManager?.getInstance?.(sessionId)?.getState?.();
+        claimInstanceWorkspace = readNonEmptyString(claimState?.workspace);
+        const claimSettings = (claimState?.settings as Record<string, unknown>) || {};
+        claimStampedNodeId = readNonEmptyString(claimSettings.meshNodeId);
+    } catch { /* best-effort — fall through to the conservative (no refuse) path */ }
+
+    const nodeWorkspaceRaw = readNonEmptyString(node?.workspace);
+    const sessionWorkspaceRaw = readNonEmptyString(localClaimAdapter?.workingDir) || claimInstanceWorkspace;
+
+    if (claimStampedNodeId && nodeId) {
+        // The session carries its OWN meshNodeId stamp — its authoritative node identity, set when
+        // the coordinator launched/dispatched it (mesh-routing trusts this stamp FIRST). When it
+        // matches the claim target the session genuinely belongs to this node, so the stamp settles
+        // it and the workspace heuristic is skipped (a base/worktree pair can legitimately share a
+        // workspace). When it does NOT match, the claim is a cross-node leak — refuse, fail-closed.
+        if (!meshNodeIdMatches({ id: claimStampedNodeId } as MeshNodeIdentified, nodeId)) {
+            LOG.info('MeshQueue', `WTDISPATCH: refusing claim for node ${nodeId} (${sessionId}) — session is bound to node "${claimStampedNodeId}" (cross-node claim blocked)`);
             return false;
         }
+    } else if (sessionWorkspaceRaw && nodeWorkspaceRaw && !meshWorkspacesEquivalent(sessionWorkspaceRaw, nodeWorkspaceRaw)) {
+        // No stamp (the no_node_binding worker) — fall back to the workspace to tell two co-located
+        // sibling worktree sessions apart. WTCLAIM, now reaching instanceManager-observable sessions
+        // too. Conservative: unknown workspace on either side → do NOT refuse (no legitimate claim
+        // starved; a genuinely remote cross-daemon candidate stays nodeId-matched as before).
+        LOG.info('MeshQueue', `WTCLAIM: refusing claim for node ${nodeId} (${sessionId}) — session workspace "${normalizeMeshWorkspaceForCompare(sessionWorkspaceRaw)}" ≠ node workspace "${normalizeMeshWorkspaceForCompare(nodeWorkspaceRaw)}" (cross-workspace dispatch blocked)`);
+        return false;
     }
 
     const capabilityTags = buildMeshNodeCapabilityTags(node, providerType);
@@ -1844,7 +1876,26 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
             // re-attributed to the latest task (the normal task_completed path below).
             const supersedesWeakTerminal = isWeakTerminalLedgerPayload(terminal.payload)
                 && isGenuineCompletionEvidence(args.metadataEvent);
-            if (!newDispatchAfterTerminal && !supersedesWeakTerminal) {
+            // CANON-B (direct-dispatch completion race): a FAST direct dispatch (mesh_send_task)
+            // to an already-idle, previously-used session can have its genuine completion reach
+            // this coordinator handler BEFORE the dispatching side records the new task's dispatch
+            // row / task_dispatched ledger entry — insertDirectDispatch + appendLedgerEntry both run
+            // AFTER the agent_command await resolves, while the worker may already be done. In that
+            // window sessionHasActiveAssignment is false (no active dispatch row, no unterminal
+            // ledger entry yet), so this prior-terminal dedup engages; and because providerSessionId
+            // is STABLE across a reused session's turns, the providerSessionId/finalSummary match
+            // below would suppress the NEW task's completion as a duplicate of the PRIOR task —
+            // silently losing it (the observed intermittent miss; fresh enqueue/autoLaunch is immune
+            // because a fresh session has no prior same-providerSessionId terminal and the queue row
+            // is claimed atomically before dispatch). The echoed taskId is the authoritative
+            // discriminator: when the completion names a DIFFERENT task than the recorded terminal,
+            // it is a genuinely new task's completion, never a duplicate — let it through so it is
+            // attributed to its own taskId. A same-task re-arrival (taskId equal) or a taskId-less
+            // legacy event still falls through to the providerSessionId/finalSummary dedup.
+            const terminalTaskId = readNonEmptyString(terminal.payload.taskId);
+            const eventTaskId = readNonEmptyString(args.metadataEvent.taskId);
+            const distinctTaskCompletion = !!eventTaskId && !!terminalTaskId && eventTaskId !== terminalTaskId;
+            if (!newDispatchAfterTerminal && !supersedesWeakTerminal && !distinctTaskCompletion) {
                 const terminalProviderSessionId = readNonEmptyString(terminal.payload.providerSessionId);
                 const terminalFinalSummary = readNonEmptyString(terminal.payload.finalSummary);
                 const eventProviderSessionId = readNonEmptyString(args.metadataEvent.providerSessionId);
@@ -2408,6 +2459,43 @@ export function handleMeshForwardEvent(components: DaemonComponents, payload: Re
     });
 }
 
+// ---------------------------------------------------------------------------
+// Per-coordinator forward serialization (P2P send-backpressure relief).
+//
+// When several workers finish at once, each completion runs forwardUnresolvedDelegate
+// Event and fires its own `mesh_forward_event` push. Firing the whole burst
+// concurrently dumps it into the single per-peer P2P DataChannel buffer in one tick,
+// which starves the rpc_ack/rpc_res replies the same channel must carry — a
+// coordinator's inbound `git_status` then times out even though the worker's own
+// forward acks return in ~1s. To cap the concurrent burst we serialize the immediate
+// pushes per coordinator: at most one push is in flight to a given coordinator at a
+// time, the rest run in arrival order behind it. A lone event (idle lane) still
+// dispatches immediately — only a genuine burst is paced. Durability is unchanged:
+// every event is already persisted to the outbox before the push runs, so serializing
+// only delays the best-effort fast path; PHASE 0 retry still covers any gap. This pairs
+// with the DataChannel send-buffer gate in daemon-cloud's mesh manager (writeRequest),
+// which is the hard guarantee; this throttle keeps the burst from piling up there.
+interface CoordinatorForwardLane { tail: Promise<unknown>; depth: number; }
+const coordinatorForwardLanes = new Map<string, CoordinatorForwardLane>();
+function enqueueCoordinatorForwardPush(coordinatorDaemonId: string, run: () => Promise<unknown>): void {
+    let lane = coordinatorForwardLanes.get(coordinatorDaemonId);
+    if (!lane) { lane = { tail: Promise.resolve(), depth: 0 }; coordinatorForwardLanes.set(coordinatorDaemonId, lane); }
+    const wasIdle = lane.depth === 0;
+    lane.depth += 1;
+    const dec = (): void => { lane!.depth -= 1; };
+    if (wasIdle) {
+        // Idle lane → dispatch synchronously, so a lone completion (the common case) has
+        // ZERO added latency and the push call happens in-line. Only a genuine burst —
+        // events arriving while a push is still in flight — is paced (else branch).
+        lane.tail = Promise.resolve(run()).catch(() => {}).then(dec, dec);
+    } else {
+        // Burst: queue behind the in-flight push(es) in arrival order so the whole burst
+        // is not dumped into the shared DataChannel buffer at once. The tail is guarded
+        // so one rejecting push never wedges the lane for the next.
+        lane.tail = lane.tail.then(() => run()).catch(() => {}).then(dec, dec);
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Worker-side fallback forward for unresolved-mesh delegates.
 //
@@ -2467,6 +2555,24 @@ function forwardUnresolvedDelegateEvent(
         workspace: readNonEmptyString(routing.workspace) || readNonEmptyString(event.workspace) || undefined,
     };
 
+    // Self-addressed fallback: the resolved coordinator IS this daemon (a self-
+    // coordinating / single-node mesh, or a delegate whose coordinator anchor resolved
+    // to our own id). A cross-daemon mesh_forward_event to our own id is REFUSED by the
+    // dispatch self-dial guard ("route via the local router instead"), so persisting it
+    // to the outbox would only loop forever in PHASE 0's retry, never acked. Honour the
+    // guard's advice: route the event straight through the local receiver — the exact
+    // path the coordinator runs on receiving a remote push — and skip the outbox entirely.
+    const selfDaemonIds = resolveCoordinatorDrainDaemonIds(components);
+    if (selfDaemonIds.some(self => daemonIdsEquivalent(self, coordinatorDaemonId))) {
+        try {
+            handleMeshForwardEvent(components, payload);
+            LOG.info('MeshEvents', `Self-addressed unresolved-delegate ${eventName} routed via local router (coordinator ${coordinatorDaemonId} is self) — outbox skipped`);
+        } catch (e: any) {
+            LOG.warn('MeshEvents', `Local route of self-addressed unresolved-delegate ${eventName} failed: ${e?.message || e}`);
+        }
+        return true;
+    }
+
     // 1) Persist durably FIRST. Idempotent on fingerprint, so a re-fired completion
     //    does not duplicate the outbox row. If persistence fails we still attempt the
     //    push below (degrades to the old at-most-once behaviour rather than dropping
@@ -2485,21 +2591,27 @@ function forwardUnresolvedDelegateEvent(
     // 2) Best-effort immediate push for low latency. On success, ack the outbox row so
     //    the retry loop won't re-send it. On failure, leave it queued — PHASE 0 retries.
     traceMeshEventStage('forward_send', fwdTraceCtx, 'immediate push');
-    Promise.resolve(components.dispatchMeshCommand(coordinatorDaemonId, 'mesh_forward_event', payload))
-        .then((result: any) => {
-            if (result && result.success === false) {
-                LOG.warn('MeshEvents', `Immediate forward of ${eventName} to coordinator ${coordinatorDaemonId} rejected (${readNonEmptyString(result.error) || 'no reason'}) — left queued for retry`);
-                traceMeshEventDrop('immediate_forward_rejected', fwdTraceCtx, readNonEmptyString(result.error) || 'no reason');
-                return;
-            }
-            // Acked. Mark the durable copy delivered so the retry loop skips it.
-            if (persisted) ackUnresolvedDelegateForwardByFingerprint(coordinatorDaemonId, eventName, payload);
-        })
-        .catch((e: any) => {
-            // Coordinator momentarily unreachable; the durable row stays queued and the
-            // reconcile loop retries it. Trace so the relay attempt is visible.
-            LOG.warn('MeshEvents', `Immediate forward of ${eventName} to coordinator ${coordinatorDaemonId} failed: ${e?.message || e} — left queued for retry`);
-        });
+    // Serialize per coordinator so a multi-worker completion burst is paced rather than
+    // dumped concurrently into the shared P2P DataChannel buffer (see coordinator
+    // ForwardLanes). dispatchMeshCommand was null-checked above; capture it for the
+    // deferred closure.
+    const dispatchMeshCommand = components.dispatchMeshCommand;
+    enqueueCoordinatorForwardPush(coordinatorDaemonId, () =>
+        Promise.resolve(dispatchMeshCommand(coordinatorDaemonId, 'mesh_forward_event', payload))
+            .then((result: any) => {
+                if (result && result.success === false) {
+                    LOG.warn('MeshEvents', `Immediate forward of ${eventName} to coordinator ${coordinatorDaemonId} rejected (${readNonEmptyString(result.error) || 'no reason'}) — left queued for retry`);
+                    traceMeshEventDrop('immediate_forward_rejected', fwdTraceCtx, readNonEmptyString(result.error) || 'no reason');
+                    return;
+                }
+                // Acked. Mark the durable copy delivered so the retry loop skips it.
+                if (persisted) ackUnresolvedDelegateForwardByFingerprint(coordinatorDaemonId, eventName, payload);
+            })
+            .catch((e: any) => {
+                // Coordinator momentarily unreachable; the durable row stays queued and the
+                // reconcile loop retries it. Trace so the relay attempt is visible.
+                LOG.warn('MeshEvents', `Immediate forward of ${eventName} to coordinator ${coordinatorDaemonId} failed: ${e?.message || e} — left queued for retry`);
+            }));
     LOG.info('MeshEvents', `Durably forwarded ${eventName} for unresolved-mesh worker at ${routing.workspace || '(no workspace)'} to coordinator daemon ${coordinatorDaemonId}`);
     return true;
 }