@adhdev/daemon-core 0.9.82-rc.368 → 0.9.82-rc.369

package/dist/mesh/mesh-warmup-deadline.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Await `work` under a warmup-aware deadline so a cold-open DataChannel handshake
+ * is NOT charged against the command response budget — the root cause of the
+ * "first mesh dispatch to a cold peer false-times-out, the warm retry succeeds"
+ * signature. Two budgets, switched by the live peer connection state:
+ *
+ *  - While `isConnected()` returns false the peer's channel is still opening; the
+ *    cold-open `connectTimeoutMs` budget applies. This phase is deliberately
+ *    generous because a TURN-relayed cross-machine handshake legitimately needs
+ *    many seconds — but a genuine connect *failure* is surfaced by `work`
+ *    rejecting on its own (the mesh manager fails the peer the instant its
+ *    PeerConnection state goes terminal), so a real failure is never masked for
+ *    the whole window.
+ *  - The first time `isConnected()` returns true the channel is warm; from that
+ *    instant the tight `responseTimeoutMs` governs how long the handler may take.
+ *    Warm-channel callers therefore see behavior identical to the old single
+ *    `Promise.race(work, responseTimeoutMs)`.
+ *
+ * Rejects with `Error('timeout')` when either budget is exhausted, mirroring the
+ * previous single-race contract. When no connection getter is wired callers must
+ * NOT pass `() => true` ("always warm") — that re-introduces the cold-open
+ * false-timeout. Use {@link resolveWarmupDeadlineOpts} which degrades conservatively.
+ */
+export declare function awaitWithWarmupDeadline<T>(work: Promise<T>, opts: {
+    isConnected: () => boolean;
+    connectTimeoutMs: number;
+    responseTimeoutMs: number;
+    pollIntervalMs?: number;
+}): Promise<T>;
+/** Minimal connection-state reader: a mesh peer snapshot stamps its live state on `.state`. */
+export declare function readWarmupConnectionState(connection: Record<string, unknown> | null | undefined): string | undefined;
+export interface ResolvedWarmupDeadlineOpts {
+    isConnected: () => boolean;
+    connectTimeoutMs: number;
+    responseTimeoutMs: number;
+}
+/**
+ * Build {@link awaitWithWarmupDeadline} opts from an OPTIONAL live peer-connection
+ * probe, handling the missing-getter case fail-loud instead of silently degrading.
+ *
+ * When `getConnection` is wired the normal cold-open/warm split applies: the probe
+ * is consulted live and the channel is "warm" only once it reports `connected`.
+ *
+ * When `getConnection` is ABSENT the old call sites fell back to `() => true`
+ * ("always warm"), which charges a still-opening cold channel against the response
+ * budget and silently re-introduces the exact cold-open false-timeout the warmup
+ * deadline exists to prevent. Instead we degrade CONSERVATIVELY and FAIL LOUD:
+ *   - `onMissingGetter` is invoked so the caller can warn (the degrade is visible,
+ *     never silent) — keyed/throttled by the caller as it sees fit.
+ *   - the channel is treated as NOT observably warm (`isConnected: () => false`),
+ *     so the response deadline never arms early on an unobservable channel.
+ *   - the cold peer is granted the COMBINED connect+response window as one deadline,
+ *     so a slow-but-live cold open is never false-timed at the shorter response
+ *     budget. A genuinely hung dispatch still rejects when the combined window
+ *     lapses, and `work` rejecting on its own (a real transport failure) still
+ *     settles immediately.
+ *
+ * Note: a present getter that returns a non-`connected` snapshot (or `null` for an
+ * unknown peer) correctly yields `isConnected() === false` — i.e. the generous
+ * connect budget, never "always warm". Only a wholly absent getter degrades.
+ */
+export declare function resolveWarmupDeadlineOpts(opts: {
+    getConnection?: ((daemonId: string) => Record<string, unknown> | null) | undefined;
+    daemonId: string;
+    connectTimeoutMs: number;
+    responseTimeoutMs: number;
+    onMissingGetter?: (daemonId: string) => void;
+}): ResolvedWarmupDeadlineOpts;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.368",
+  "version": "0.9.82-rc.369",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.368",
+    "@adhdev/mesh-shared": "0.9.82-rc.369",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/boot/daemon-lifecycle.ts

@@ -113,6 +113,13 @@ export interface DaemonComponents {
     detectedIdes: { value: IDEInfo[] };
     refreshProviderAvailability: (providerType?: string) => Promise<void>;
     dispatchMeshCommand?: (daemonId: string, command: string, args: Record<string, unknown>) => Promise<any>;
+    // Cloud-only: live selected-coordinator mesh peer telemetry for a target daemon.
+    // Lets the remote task-dispatch path (mesh-events-coordinator deliverTaskToSession)
+    // tell a still-opening DataChannel ("cold") apart from an open one ("warm") so a
+    // cold-open handshake is charged to the connect budget, not the response budget.
+    // Injected by daemon-cloud; absent on standalone (no P2P mesh), where the remote
+    // dispatch path is unused.
+    getMeshPeerConnectionStatus?: (daemonId: string) => Record<string, unknown> | null;
     // Cloud-only hook: after the single core forwarder handles a mesh coordinator event, cloud
     // uses this to keep its P2P dashboard view in sync (mesh-owned session metadata + flush
     // subscriptions). Injected by daemon-cloud; absent/no-op on standalone. Replaces cloud's
@@ -369,6 +376,7 @@ export async function initDaemonComponents(config: DaemonInitConfig): Promise<Da
         detectedIdes: detectedIdesRef,
         refreshProviderAvailability,
         dispatchMeshCommand: config.dispatchMeshCommand,
+        getMeshPeerConnectionStatus: config.getMeshPeerConnectionStatus,
         onMeshCoordinatorEventForwarded: config.onMeshCoordinatorEventForwarded,
         statusInstanceId: config.statusInstanceId,
     };

package/src/commands/cli-manager.ts

@@ -1044,6 +1044,29 @@ export class DaemonCliManager {
         const restoredBindings = new Set<string>();
         const managerTag = this.deps.hostedRuntimeManagerTag;
 
+        // CORDBADGE worker-overbind guard pre-pass: the workspace-scoped coordinator
+        // rebind fallback (below) recovers a coordinator's mark when its runtimeId
+        // changed across restart. But a delegated WORKER session that shares the
+        // coordinator's workspace+cliType ALSO misses the exact by-id lookup, so the
+        // fallback would wrongly stamp it with the lone registered coordinator's mesh
+        // mark (the reported bug: a worker shown with role:coordinator after restart).
+        // Two batch-level signals let the fallback refuse to mark a worker:
+        //   - restoredRuntimeIds: every runtimeId in this restore batch. If a
+        //     registered coordinator's own sessionId appears here, that coordinator is
+        //     being restored under its known id (the exact match binds it), so ANY
+        //     other same-workspace session is a worker — not the renamed coordinator.
+        //   - workspaceTypeCounts: how many sessions in the batch share a
+        //     workspace+cliType. >1 means we cannot tell the coordinator from a worker
+        //     even if the coordinator's id changed, so we stay unbound (ambiguous).
+        const restoredRuntimeIds = new Set<string>();
+        const workspaceTypeCounts = new Map<string, number>();
+        for (const r of sessions) {
+            if (!r?.runtimeId || !r?.cliType || !r?.workspace) continue;
+            restoredRuntimeIds.add(r.runtimeId);
+            const key = `${r.workspace}::${r.cliType}`;
+            workspaceTypeCounts.set(key, (workspaceTypeCounts.get(key) || 0) + 1);
+        }
+
         for (const record of sessions) {
             if (!record?.runtimeId || !record?.cliType || !record?.workspace) continue;
             if (!shouldRestoreHostedRuntime(record, managerTag)) {
@@ -1102,20 +1125,44 @@ export class DaemonCliManager {
             // PTY, and the only recovery is a manual coordinator restart. Recover the mark
             // from the persisted registry scoped to this exact workspace, but ONLY when it is
             // UNAMBIGUOUS: exactly one registered coordinator for this workspace AND its
-            // cliType matches the restored session's type. The registry never holds worker
-            // sessions (only launch_mesh_coordinator registrations), so this cannot mis-mark a
-            // delegated worker; the uniqueness + cliType gate keeps it from guessing when two
-            // coordinators ever shared a workspace. Anything ambiguous stays unbound (we would
-            // rather miss a badge than mis-attribute one).
+            // cliType matches the restored session's type.
+            //
+            // WORKER-OVERBIND guard: "exactly one registered coordinator" is NOT enough —
+            // a delegated worker session sharing the coordinator's workspace+cliType also
+            // misses the by-id lookup, and the registry holding only the (single) real
+            // coordinator does NOT stop the fallback from projecting that coordinator's
+            // mark onto the worker record. So before adopting the mark we positively rule
+            // the worker out:
+            //   (a) coordinatorPresentById — the registered coordinator's own sessionId is
+            //       in this restore batch, i.e. it is being restored under its known id and
+            //       the exact match already binds it. Then THIS record (which missed) is a
+            //       worker, not the renamed coordinator → do not rebind.
+            //   (b) siblingCount > 1 — more than one session shares this workspace+cliType,
+            //       so even if the coordinator's id changed we cannot tell it from a worker
+            //       → stay unbound (ambiguous).
+            // Anything ambiguous stays unbound (we would rather miss a badge than
+            // mis-attribute one).
             if (!coordinatorEntry?.meshId && record.workspace) {
                 const workspaceCoordinators = listCoordinatorsForWorkspace(record.workspace)
                     .filter(e => e.meshId && (!e.cliType || e.cliType === record.cliType));
                 if (workspaceCoordinators.length === 1) {
-                    coordinatorEntry = workspaceCoordinators[0];
-                    LOG.info(
-                        'CLI',
-                        `↻ Rebound coordinator mark by workspace for ${record.runtimeKey || record.runtimeId} (mesh ${coordinatorEntry.meshId} @ ${record.workspace}); registry key did not match runtimeId`
-                    );
+                    const candidate = workspaceCoordinators[0];
+                    const coordinatorPresentById = !!candidate.sessionId && restoredRuntimeIds.has(candidate.sessionId);
+                    const siblingCount = workspaceTypeCounts.get(`${record.workspace}::${record.cliType}`) || 1;
+                    if (!coordinatorPresentById && siblingCount === 1) {
+                        coordinatorEntry = candidate;
+                        LOG.info(
+                            'CLI',
+                            `↻ Rebound coordinator mark by workspace for ${record.runtimeKey || record.runtimeId} (mesh ${candidate.meshId} @ ${record.workspace}); registry key did not match runtimeId`
+                        );
+                    } else {
+                        LOG.info(
+                            'CLI',
+                            `↷ Skipping workspace coordinator rebind for ${record.runtimeKey || record.runtimeId} (${record.cliType} @ ${record.workspace}): ${coordinatorPresentById
+                                ? 'registered coordinator is restoring under its own id — this is a delegated worker'
+                                : `ambiguous (${siblingCount} sessions share this workspace+cliType)`}`
+                        );
+                    }
                 }
             }
             if (coordinatorEntry?.meshId) {

package/src/commands/high-family/mesh-status.ts

@@ -49,6 +49,7 @@ import {
     summarizeInlineMeshBranchConvergence,
     buildHistoricalMeshSessions,
     hydrateInlineMeshDirectTruth,
+    MESH_NODE_LIVE_TRUTH_MARKER,
     logRepoMeshStatusDebug,
     summarizeRepoMeshStatusDebug,
     MESH_DIRECT_PROBE_TIMEOUT_MS,
@@ -359,6 +360,7 @@ export const meshStatusHandlers: Record<string, HighFamilyHandler> = {
                                     const remoteGit = await meshGitProbeCache.probe(daemonId, workspace, runNodeProbe);
                                     if (remoteGit) {
                                         status.git = remoteGit;
+                                        status[MESH_NODE_LIVE_TRUTH_MARKER] = true;
                                         status.health = remoteGit.isGitRepo
                                             ? deriveMeshNodeHealthFromGit(remoteGit as unknown as Record<string, unknown>)
                                             : 'degraded';
@@ -395,13 +397,13 @@ export const meshStatusHandlers: Record<string, HighFamilyHandler> = {
                                         pendingPeerGitProbe ? { skipGit: true, skipError: true, skipHealth: true } : undefined,
                                     )) {
                                         applyInlineMeshBranchConvergence(mesh, node, status);
-                                        finalizeMeshNodeStatus({ status, node, daemonId, isSelfNode });
+                                        finalizeMeshNodeStatus({ status, node, daemonId, isSelfNode, directTruthUnavailable: directTruthUnavailableNodeIds.has(nodeId) });
                                         nodeStatuses.push(status);
                                         continue;
                                     }
                                     if (meshRecord?.source === 'inline_cache' && !isSelfNode) {
                                         applyInlineMeshBranchConvergence(mesh, node, status);
-                                        finalizeMeshNodeStatus({ status, node, daemonId, isSelfNode });
+                                        finalizeMeshNodeStatus({ status, node, daemonId, isSelfNode, directTruthUnavailable: directTruthUnavailableNodeIds.has(nodeId) });
                                         nodeStatuses.push(status);
                                         continue;
                                     }
@@ -410,6 +412,7 @@ export const meshStatusHandlers: Record<string, HighFamilyHandler> = {
                                 try {
                                     const gitStatus = await getGitRepoStatus(workspace, { timeoutMs: 10_000, refreshUpstream: true });
                                     status.git = gitStatus;
+                                    status[MESH_NODE_LIVE_TRUTH_MARKER] = true;
                                     const reporter = recordInlineMeshDirectGitTruth(node, gitStatus as unknown as Record<string, unknown>, 'selected_coordinator_local_git');
                                     persistNodeReporterPlatform(meshRecord.source, mesh, nodeId, reporter);
                                     if (gitStatus.isGitRepo) {
@@ -428,7 +431,7 @@ export const meshStatusHandlers: Record<string, HighFamilyHandler> = {
                             applyCachedInlineMeshNodeStatus(status, node);
                         }
                         applyInlineMeshBranchConvergence(mesh, node, status);
-                        finalizeMeshNodeStatus({ status, node, daemonId, isSelfNode });
+                        finalizeMeshNodeStatus({ status, node, daemonId, isSelfNode, directTruthUnavailable: directTruthUnavailableNodeIds.has(nodeId) });
                         nodeStatuses.push(status);
                     }
 

package/src/commands/router.ts

@@ -80,6 +80,7 @@ import {
 } from '../mesh/worktree-bootstrap-config.js';
 import { runMeshInit } from '../mesh/mesh-init.js';
 import { getMeshQueueRevision } from '../mesh/mesh-work-queue.js';
+import { awaitWithWarmupDeadline, resolveWarmupDeadlineOpts } from '../mesh/mesh-warmup-deadline.js';
 import type { RepoMeshSessionCleanupMode } from '../repo-mesh-types.js';
 import { DEFAULT_MESH_POLICY } from '../repo-mesh-types.js';
 import { homedir, hostname as osHostname } from 'os';
@@ -1073,19 +1074,176 @@ function synthesizeMeshNodeFreshnessFromConnection(status: Record<string, unknow
     }
 }
 
+/**
+ * Transient per-node marker the mesh_status render loop stamps onto a node
+ * `status` at the two sites that obtain git truth from a FRESH probe this call
+ * (a successful local `getGitRepoStatus`, or a successful P2P `git_status`
+ * round-trip). finalizeMeshNodeStatus consumes and deletes it. Held/standing
+ * truth (node.lastGit / cachedStatus / inline transit) is deliberately NOT
+ * stamped — its absence is exactly how the freshness marker tells "live" apart
+ * from "cached". Internal only; never serialized in the response.
+ */
+export const MESH_NODE_LIVE_TRUTH_MARKER = '__liveTruthProbed';
+
+type MeshNodeDataSource =
+    | 'self'          // the selected coordinator's own node — local truth
+    | 'live'          // git/session truth confirmed by a fresh probe THIS call
+    | 'cached'        // rendered from held standing truth (possibly old — see staleness)
+    | 'pending'       // reachable/known but no probe attempted yet (default load)
+    | 'unreachable'   // peer could not be reached (P2P probe failed / not connected, no held truth)
+    | 'empty'         // reachable but genuinely no session + git data
+    | 'unconfigured'; // node has no daemonId, so transport truth cannot be reported
+
+type MeshNodeStaleness = 'fresh' | 'recent' | 'stale' | 'unknown';
+
+// Staleness buckets (ms). Held/cached truth younger than FRESH reads as fresh,
+// younger than RECENT as recent, older as stale. Kept coarse on purpose — the
+// coordinator only needs "just-now / minutes-old / old", not millisecond precision.
+const MESH_FRESHNESS_FRESH_MS = 30_000;
+const MESH_FRESHNESS_RECENT_MS = 300_000;
+
+function classifyMeshNodeStaleness(dataSource: MeshNodeDataSource, ageMs: number | null): MeshNodeStaleness {
+    if (dataSource === 'self' || dataSource === 'live') return 'fresh';
+    if (ageMs === null) return 'unknown';
+    if (ageMs < MESH_FRESHNESS_FRESH_MS) return 'fresh';
+    if (ageMs < MESH_FRESHNESS_RECENT_MS) return 'recent';
+    return 'stale';
+}
+
+/**
+ * Build the additive per-node `dataFreshness` marker. This NEVER mutates any
+ * existing field — it only adds an explicit, machine-readable answer to the
+ * question the legacy fields blurred: is this node's data live (just probed),
+ * cached (held truth, maybe old), or absent because the peer was unreachable?
+ *
+ * The crucial separation: an UNREACHABLE peer (P2P probe failed / not connected)
+ * is no longer indistinguishable from an idle/EMPTY node. Both used to render as
+ * `health:'unknown'` with no sessions; now `dataFreshness.dataSource` and
+ * `reachable` tell them apart so a coordinator never reads a dead peer as "online
+ * but doing nothing".
+ */
+export function buildMeshNodeDataFreshness(args: {
+    status: Record<string, unknown>;
+    node?: any;
+    isSelfNode: boolean;
+    daemonId?: string;
+    /** True when this node was stamped with a fresh live git probe this call. */
+    liveTruthProbed: boolean;
+    /** True when direct-peer-truth accounting classified this node unavailable. */
+    directTruthUnavailable?: boolean;
+    now?: () => number;
+}): Record<string, unknown> {
+    const { status, node, isSelfNode, daemonId, liveTruthProbed, directTruthUnavailable } = args;
+    const now = args.now ?? Date.now;
+    const connection = readObjectRecord(status.connection);
+    const connectionState = readStringValue(connection.state);
+    const git = readObjectRecord(status.git);
+    const hasGit = readBooleanValue(git.isGitRepo) === true
+        || !!readStringValue(git.branch, git.headCommit, git.head, git.upstream);
+    const connectionFreshAt = toIsoTimestamp(connection.lastCommandAt ?? connection.lastConnectedAt ?? connection.lastStateChangeAt);
+    // Provenance-aware probe time. A FRESH probe this call writes a genuine
+    // git.lastCheckedAt, so trust it for live nodes. Held/standing truth, however,
+    // is re-normalized through pickBestTransitGitStatus which stamps lastCheckedAt
+    // with Date.now() on assembly (git-normalize.ts) — so status.git.lastCheckedAt
+    // would falsely read fresh. For cached nodes prefer the authentic peer-reported
+    // check time persisted on node.lastGit.checkedAt / cachedStatus, so a genuinely
+    // old cache is correctly reported stale.
+    const liveGitCheckedAt = liveTruthProbed ? toIsoTimestamp(git.lastCheckedAt) : null;
+    const heldGit = readObjectRecord(node?.lastGit ?? node?.last_git);
+    const heldCheckedAt = toIsoTimestamp(heldGit.checkedAt ?? heldGit.checked_at);
+    const cachedStatus = readObjectRecord(node?.cachedStatus);
+    const cachedGitCheckedAt = toIsoTimestamp(readObjectRecord(cachedStatus.git).lastCheckedAt);
+    const lastProbeAt = liveGitCheckedAt
+        ?? heldCheckedAt
+        ?? cachedGitCheckedAt
+        ?? toIsoTimestamp(git.lastCheckedAt)
+        ?? connectionFreshAt
+        ?? toIsoTimestamp(status.updatedAt)
+        ?? toIsoTimestamp(status.lastSeenAt);
+
+    // connectionReachable: true (connected) / false (terminally down) / null (unknown,
+    // not yet reported) — used so a cached/pending node carries the coordinator's last
+    // known transport state rather than guessing.
+    const connectionReachable: boolean | null = connectionState === 'connected'
+        ? true
+        : (!connectionState || connectionState === 'unknown' || connectionState === 'connecting')
+            ? (connectionState === 'connecting' ? true : null)
+            : false;
+
+    let dataSource: MeshNodeDataSource;
+    let reachable: boolean | null;
+    if (isSelfNode) {
+        dataSource = 'self';
+        reachable = true;
+    } else if (liveTruthProbed) {
+        dataSource = 'live';
+        reachable = true;
+    } else if (readBooleanValue(status.gitProbePending) === true) {
+        dataSource = 'pending';
+        reachable = connectionReachable;
+    } else if (directTruthUnavailable) {
+        dataSource = 'unreachable';
+        reachable = false;
+    } else if (hasGit) {
+        dataSource = 'cached';
+        reachable = connectionReachable;
+    } else if (!daemonId) {
+        dataSource = 'unconfigured';
+        reachable = null;
+    } else if (connectionState === 'connected') {
+        dataSource = 'empty';
+        reachable = true;
+    } else {
+        dataSource = 'unreachable';
+        reachable = false;
+    }
+
+    const probeOk = dataSource === 'live' || dataSource === 'self';
+    let ageMs: number | null = null;
+    if (lastProbeAt) {
+        const parsed = Date.parse(lastProbeAt);
+        if (Number.isFinite(parsed)) ageMs = Math.max(0, now() - parsed);
+    }
+    const staleness = classifyMeshNodeStaleness(dataSource, ageMs);
+
+    return {
+        dataSource,
+        probeOk,
+        reachable,
+        lastProbeAt: lastProbeAt ?? null,
+        ageMs,
+        staleness,
+    };
+}
+
 export function finalizeMeshNodeStatus(args: {
     status: Record<string, unknown>;
     node: any;
     daemonId?: string;
     isSelfNode: boolean;
+    /** True when direct-peer-truth accounting classified this node unavailable. */
+    directTruthUnavailable?: boolean;
 }): void {
-    const { status, node, daemonId, isSelfNode } = args;
+    const { status, node, daemonId, isSelfNode, directTruthUnavailable } = args;
     if (!readStringValue(status.machineStatus)) {
         const cachedStatus = readObjectRecord(node?.cachedStatus);
         const machineStatus = readStringValue(cachedStatus.machineStatus, cachedStatus.machine_status, node?.machineStatus);
         if (machineStatus) status.machineStatus = machineStatus;
     }
     synthesizeMeshNodeFreshnessFromConnection(status);
+    // Stamp the additive freshness/reachability marker before any early return so
+    // every node — including bootstrap-blocked ones — carries it. Consume and drop
+    // the transient live-probe marker so it never leaks into the response.
+    const liveTruthProbed = readBooleanValue(status[MESH_NODE_LIVE_TRUTH_MARKER]) === true;
+    delete status[MESH_NODE_LIVE_TRUTH_MARKER];
+    status.dataFreshness = buildMeshNodeDataFreshness({
+        status,
+        node,
+        isSelfNode,
+        daemonId,
+        liveTruthProbed,
+        directTruthUnavailable,
+    });
     const bootstrap = readObjectRecord(node?.worktreeBootstrap);
     if (node?.isLocalWorktree && readStringValue(bootstrap.status)) {
         status.worktreeBootstrap = bootstrap;
@@ -1214,90 +1372,11 @@ export class MeshGitProbeCache {
     }
 }
 
-/**
- * Await `work` under a warmup-aware deadline so a cold-open DataChannel handshake
- * is NOT charged against the command response budget — the root cause of the
- * "first mesh probe to a cold peer false-times-out, the warm retry succeeds"
- * signature. Two budgets, switched by the live peer connection state:
- *
- *  - While `isConnected()` returns false the peer's channel is still opening; the
- *    cold-open `connectTimeoutMs` budget applies. This phase is deliberately
- *    generous because a TURN-relayed cross-machine handshake legitimately needs
- *    many seconds — but a genuine connect *failure* is surfaced by `work`
- *    rejecting on its own (the mesh manager fails the peer the instant its
- *    PeerConnection state goes terminal), so a real failure is never masked for
- *    the whole window.
- *  - The first time `isConnected()` returns true the channel is warm; from that
- *    instant the tight `responseTimeoutMs` governs how long the handler may take.
- *    Warm-channel callers therefore see behavior identical to the old single
- *    `Promise.race(work, responseTimeoutMs)`.
- *
- * Rejects with `Error('timeout')` when either budget is exhausted, mirroring the
- * previous single-race contract. Pure except for timers + the injected
- * `isConnected` probe, so it is unit-testable under fake timers without any real
- * WebRTC. When no connection getter is wired `isConnected` should be `() => true`
- * (the caller's choice) so the response deadline governs from t0 — the legacy
- * single-budget behavior, never a combined connect+response window.
- */
-export function awaitWithWarmupDeadline<T>(
-    work: Promise<T>,
-    opts: {
-        isConnected: () => boolean;
-        connectTimeoutMs: number;
-        responseTimeoutMs: number;
-        pollIntervalMs?: number;
-    },
-): Promise<T> {
-    const pollMs = Math.max(1, Math.min(opts.pollIntervalMs ?? 200, opts.connectTimeoutMs));
-    return new Promise<T>((resolve, reject) => {
-        let done = false;
-        let poll: ReturnType<typeof setInterval> | undefined;
-        let responseTimer: ReturnType<typeof setTimeout> | undefined;
-        const startedAt = Date.now();
-        const cleanup = () => {
-            if (poll) { clearInterval(poll); poll = undefined; }
-            if (responseTimer) { clearTimeout(responseTimer); responseTimer = undefined; }
-        };
-        const settle = (fn: () => void) => {
-            if (done) return;
-            done = true;
-            cleanup();
-            fn();
-        };
-        // Arm the response deadline exactly once, the moment the channel is warm.
-        const armResponse = () => {
-            if (responseTimer || done) return;
-            responseTimer = setTimeout(
-                () => settle(() => reject(new Error('timeout'))),
-                opts.responseTimeoutMs,
-            );
-            if (typeof responseTimer.unref === 'function') responseTimer.unref();
-        };
-        const onPoll = () => {
-            if (done) return;
-            if (opts.isConnected()) {
-                if (poll) { clearInterval(poll); poll = undefined; }
-                armResponse();
-                return;
-            }
-            if (Date.now() - startedAt >= opts.connectTimeoutMs) {
-                settle(() => reject(new Error('timeout')));
-            }
-        };
-        if (opts.isConnected()) {
-            // Already warm (e.g. a retry over an open channel) — skip the warmup
-            // phase entirely and let the response deadline govern from t0.
-            armResponse();
-        } else {
-            poll = setInterval(onPoll, pollMs);
-            if (typeof poll.unref === 'function') poll.unref();
-        }
-        work.then(
-            (val) => settle(() => resolve(val)),
-            (err) => settle(() => reject(err)),
-        );
-    });
-}
+// The warmup-aware deadline now lives in the dependency-free mesh leaf so BOTH the
+// dashboard git_status probe (here) and the general task-dispatch path
+// (mesh/mesh-events-coordinator.ts) can share it without an import cycle. Re-exported
+// for the existing `from '../commands/router.js'` callers/tests.
+export { awaitWithWarmupDeadline };
 
 async function probeRemoteMeshGitStatus(args: {
     dispatchMeshCommand?: (daemonId: string, cmd: string, args: Record<string, unknown>) => Promise<unknown>;
@@ -1308,8 +1387,9 @@ async function probeRemoteMeshGitStatus(args: {
     // Cold-open warmup budget — applies only while the channel is still opening.
     connectTimeoutMs: number;
     // Live peer connection snapshot getter; lets the deadline tell "still warming
-    // up" apart from "warm but slow". Absent → behave as if always warm (the
-    // response deadline governs from t0, i.e. the legacy single-budget behavior).
+    // up" apart from "warm but slow". Absent → degrade conservatively (fail-loud,
+    // combined connect+response window) rather than silently assuming "always warm"
+    // — see resolveWarmupDeadlineOpts.
     getConnection?: (daemonId: string) => Record<string, unknown> | null;
 }): Promise<Record<string, unknown> | null> {
     if (!args.dispatchMeshCommand) return null;
@@ -1319,15 +1399,17 @@ async function probeRemoteMeshGitStatus(args: {
     // the response budget, so the first probe to a cold peer is no longer
     // false-timed-out before its channel has even opened.
     const dispatch = args.dispatchMeshCommand(args.daemonId, 'git_status', { workspace: args.workspace, refreshUpstream: true });
-    const getConnection = args.getConnection;
-    const isConnected = getConnection
-        ? () => readMeshConnectionState(getConnection(args.daemonId)) === 'connected'
-        : () => true;
-    const remoteResult = await awaitWithWarmupDeadline(dispatch, {
-        isConnected,
+    // A missing connection getter no longer silently becomes `() => true`
+    // ("always warm") — that charged a still-opening channel against the response
+    // budget and re-introduced the cold-open false-timeout. resolveWarmupDeadlineOpts
+    // warns once per peer and grants the combined budget instead.
+    const remoteResult = await awaitWithWarmupDeadline(dispatch, resolveWarmupDeadlineOpts({
+        getConnection: args.getConnection,
+        daemonId: args.daemonId,
         connectTimeoutMs: args.connectTimeoutMs,
         responseTimeoutMs: args.responseTimeoutMs,
-    }) as any;
+        onMissingGetter: warnMeshWarmupGetterMissingOnce,
+    })) as any;
     const remoteGit = remoteResult?.status ?? remoteResult?.git ?? remoteResult;
     if (!remoteGit || typeof remoteGit !== 'object' || typeof remoteGit.isGitRepo !== 'boolean') return null;
     // The member daemon stamps its own platform/arch onto the git_status result
@@ -1349,6 +1431,18 @@ function readMeshConnectionState(connection: Record<string, unknown> | null | un
     return readStringValue((connection as any)?.state);
 }
 
+// Fail-loud (but throttled) trace for the degraded-warmup case: a direct-peer mesh
+// dispatch ran with NO live connection getter wired. This is a misconfiguration in a
+// P2P-capable daemon (the getter should be present), and the old `() => true`
+// fallback hid it while silently re-introducing the cold-open false-timeout. Warn
+// once per peer so the degrade is visible without flooding the log on every probe.
+const meshWarmupGetterMissingWarned = new Set<string>();
+function warnMeshWarmupGetterMissingOnce(daemonId: string): void {
+    if (meshWarmupGetterMissingWarned.has(daemonId)) return;
+    meshWarmupGetterMissingWarned.add(daemonId);
+    LOG.warn('Mesh', `Mesh peer connection getter unavailable for ${String(daemonId).slice(0, 12)}; warmup deadline degraded to the combined connect+response window (cannot observe DataChannel open). This avoids a cold-open false-timeout but loses warm/cold precision — wire getMeshPeerConnectionStatus on this daemon.`);
+}
+
 /**
  * Connection states that mean the peer is definitively NOT reachable right now —
  * an offline machine (no peer entry at all) or a transport that has dropped