@adhdev/daemon-core 0.9.82-rc.388 → 0.9.82-rc.389

package/dist/mesh/mesh-reconcile-loop.d.ts

@@ -1,4 +1,5 @@
 import type { DaemonComponents } from '../boot/daemon-lifecycle.js';
+export declare function __resetReconcileInFlightSynthDebounceForTests(): void;
 /**
  * DRAIN-WITHOUT-INJECT guard. Classify, for a mesh on THIS daemon, whether a
  * queue-drain caller (the MCP `get_pending_mesh_events` poll) may safely consume

package/dist/mesh/mesh-runtime-store.d.ts

@@ -16,8 +16,16 @@ export declare class MeshRuntimeStore {
     close(): void;
     transaction<T>(fn: () => T): T;
     private migrate;
-    hasCompletionFingerprint(fingerprint: string): boolean;
-    recordCompletionFingerprint(fingerprint: string, ttlMs: number): void;
+    private tableColumns;
+    /**
+     * MESH-ISOLATION-LEAK migration. Two tables historically lacked a `mesh_id` column,
+     * letting one machine that belongs to multiple meshes (multiple repos) leak rows
+     * across meshes. Both migrations are idempotent and run on every boot — the column
+     * check short-circuits once the new schema is in place.
+     */
+    private migrateMeshIsolationColumns;
+    hasCompletionFingerprint(meshId: string, fingerprint: string): boolean;
+    recordCompletionFingerprint(meshId: string, fingerprint: string, ttlMs: number): void;
     sweepExpiredFingerprints(): void;
     private maybeCheckpointWal;
     private ensureLegacyQueueMigrated;
@@ -149,15 +157,15 @@ export declare class MeshRuntimeStore {
      */
     deleteDirectDispatchesByTaskId(meshId: string, taskIds: string[]): number;
     markStaleDirectDispatches(meshId: string, olderThanMs: number): void;
-    setRemoteIdleSession(nodeId: string, sessionId: string, providerType: string, expiresAt: number, metadata?: any): void;
-    getRemoteIdleSessions(): Array<{
+    setRemoteIdleSession(meshId: string, nodeId: string, sessionId: string, providerType: string, expiresAt: number, metadata?: any): void;
+    getRemoteIdleSessions(meshId: string): Array<{
         nodeId: string;
         sessionId: string;
         providerType: string;
         expiresAt: number;
         metadata?: any;
     }>;
-    deleteRemoteIdleSession(nodeId: string, sessionId: string): void;
+    deleteRemoteIdleSession(meshId: string, nodeId: string, sessionId: string): void;
     pruneExpiredRemoteIdleSessions(): void;
     insertSessionDelivery(entry: {
         id: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.388",
+  "version": "0.9.82-rc.389",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.388",
+    "@adhdev/mesh-shared": "0.9.82-rc.389",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/mesh/mesh-event-forwarding.ts

@@ -226,18 +226,18 @@ function shouldSuppressIntentionalCleanupStop(args: {
 
 const RECENT_COMPLETION_FINGERPRINT_TTL_MS = 10 * 60 * 1000;
 
-function hasFingerprintSeen(fingerprint: string): boolean {
+function hasFingerprintSeen(meshId: string, fingerprint: string): boolean {
     try {
-        return MeshRuntimeStore.getInstance().hasCompletionFingerprint(fingerprint);
+        return MeshRuntimeStore.getInstance().hasCompletionFingerprint(meshId, fingerprint);
     } catch {
         return false;
     }
 }
 
-function recordFingerprintSeen(fingerprint: string): void {
+function recordFingerprintSeen(meshId: string, fingerprint: string): void {
     try {
         const db = MeshRuntimeStore.getInstance();
-        db.recordCompletionFingerprint(fingerprint, RECENT_COMPLETION_FINGERPRINT_TTL_MS);
+        db.recordCompletionFingerprint(meshId, fingerprint, RECENT_COMPLETION_FINGERPRINT_TTL_MS);
         db.sweepExpiredFingerprints();
     } catch { /* best-effort; duplicate events are preferable to a crash */ }
 }
@@ -291,7 +291,7 @@ function isDuplicateMeshCompletionEvent(args: {
 }): boolean {
     const fingerprint = buildMeshCompletionFingerprint(args);
     if (!fingerprint) return false;
-    if (hasFingerprintSeen(fingerprint)) {
+    if (hasFingerprintSeen(args.meshId, fingerprint)) {
         if (args.taskId) {
             recordCompletionConflict({
                 meshId: args.meshId,
@@ -303,7 +303,7 @@ function isDuplicateMeshCompletionEvent(args: {
         }
         return true;
     }
-    recordFingerprintSeen(fingerprint);
+    recordFingerprintSeen(args.meshId, fingerprint);
     return false;
 }
 
@@ -329,8 +329,8 @@ function isDuplicateMeshApprovalEvent(args: {
         args.providerType || '',
         approvalIdentity,
     ].join('::');
-    if (hasFingerprintSeen(fingerprint)) return true;
-    recordFingerprintSeen(fingerprint);
+    if (hasFingerprintSeen(args.meshId, fingerprint)) return true;
+    recordFingerprintSeen(args.meshId, fingerprint);
     return false;
 }
 
@@ -338,8 +338,8 @@ function isDuplicateRefineTerminalEvent(meshId: string, eventName: string, metad
     const jobId = readRefineJobId({ metadataEvent });
     const fingerprint = jobId && new Set(['refine:completed', 'refine:failed']).has(eventName) ? `${meshId}::${eventName}::${jobId}` : '';
     if (!fingerprint) return false;
-    if (hasFingerprintSeen(fingerprint)) return true;
-    recordFingerprintSeen(fingerprint);
+    if (hasFingerprintSeen(meshId, fingerprint)) return true;
+    recordFingerprintSeen(meshId, fingerprint);
     return false;
 }
 
@@ -485,7 +485,7 @@ function evaluateMeshEventSuppression(
     if (intentionalCleanupStop) {
         if (eventSessionId && eventNodeId) {
             try {
-                MeshRuntimeStore.getInstance().deleteRemoteIdleSession(eventNodeId, eventSessionId);
+                MeshRuntimeStore.getInstance().deleteRemoteIdleSession(args.meshId, eventNodeId, eventSessionId);
             } catch { /* best-effort */ }
         }
         LOG.info('MeshEvents', `Suppressed ${args.event} for intentionally cleanup-stopped session ${eventSessionId || '(unknown session)'}`);
@@ -597,9 +597,19 @@ function evaluateMeshEventSuppression(
             // permanently mask the real completion: let the real event through (it is re-recorded by
             // the normal task_completed path, superseding the synthesized one). A second SYNTHESIZED
             // re-arrival is NOT a real event and still dedups normally.
+            // RECONCILE-SYNTH-PREEMPTS-COMPLETION: the bar here is deliberately LOWER than the
+            // weak/truncated supersessions above — a synthesized terminal is a coordinator-side
+            // reconstruction, never a real provider event, so ANY genuine real provider completion
+            // for the session must win over it. Requiring the full isGenuineCompletionEvidence
+            // (finalSummary OR workerResult present) dropped the real event whenever the relay did
+            // not re-populate finalSummary at this layer — exactly the observed 71s task whose real
+            // generating_completed hit drop:duplicate_completion_terminal_ledger after a premature
+            // synth. We require only that the incoming event is a REAL provider completion that is
+            // not itself a false idle (missing-final-assistant); a real-but-false-idle event still
+            // does not supersede (it is not trustworthy terminal evidence either).
             const supersedesSynthesizedTerminal = isSynthesizedReconciledTerminal(terminal.payload)
                 && isRealProviderCompletionEvent(args.metadataEvent)
-                && isGenuineCompletionEvidence(args.metadataEvent);
+                && !isFalseIdleCompletion(args.metadataEvent);
             if (!newDispatchAfterTerminal && !supersedesWeakTerminal && !distinctTaskCompletion && !supersedesTruncatedTerminal && !supersedesSynthesizedTerminal) {
                 const terminalProviderSessionId = readNonEmptyString(terminal.payload.providerSessionId);
                 const terminalFinalSummary = readNonEmptyString(terminal.payload.finalSummary);
@@ -825,7 +835,42 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
             const isFalseIdle = isFalseIdleCompletion(args.metadataEvent);
             completedTaskForLedger = markSessionTerminal(sessionId, 'completed', eventTimestamp, { tentativeIfDirect: isFalseIdle });
             if (nodeId && providerType) {
-                runIdleMaintenanceThenAssignQueue(components, { meshId: args.meshId, nodeId, sessionId, providerType });
+                // OVEREAGER-REMOTE-IDLE (Defect A+B): re-register the now-idle remote session into
+                // the remote-idle store, symmetric with the agent:ready branch. Previously
+                // setRemoteIdleSession ran ONLY on agent:ready, while agent:generating_started
+                // DELETES the entry — so the FIRST turn a remote worker runs permanently evicts it
+                // from the store, and generating_completed never re-added it. A later
+                // mesh_enqueue_task's triggerMeshQueue then read getRemoteIdleSessions() == 0
+                // (remoteIdleSessionsChecked:0) for a session that is genuinely live-idle, needlessly
+                // auto-launching a second worker (Defect A). Worse, the two idle-session sources then
+                // disagreed: the enqueue drain saw 0 (store empty) and auto-launched + left the queue
+                // task pending, while THIS completing session's runIdleMaintenanceThenAssignQueue
+                // claimed the same still-pending row straight from SQL — so the task body injected into
+                // BOTH the reused idle session and the auto-launched one (Defect B). Re-registering here
+                // unifies the source: the next triggerMeshQueue drain sees the live idle session, reuses
+                // it (claimed:true, no auto-launch), and injects exactly once. Skip a false-idle
+                // (mid-turn / no-final-assistant) completion — that session is NOT genuinely idle.
+                if (!isFalseIdle) {
+                    sweepExpiredRemoteIdleSessions();
+                    try {
+                        MeshRuntimeStore.getInstance().setRemoteIdleSession(args.meshId, nodeId, sessionId, providerType, Date.now() + REMOTE_IDLE_SESSION_TTL_MS);
+                    } catch { /* best-effort */ }
+                    setImmediate(() => {
+                        maybeAutoFastForwardIdleNode(components, { meshId: args.meshId, nodeId, sessionId, providerType })
+                            .finally(() => {
+                                try {
+                                    // Claim for THIS session first; on success drop the just-registered
+                                    // idle entry so the enqueue drain doesn't re-pick an already-busy session.
+                                    const assigned = tryAssignQueueTask(components, args.meshId, nodeId, sessionId, providerType);
+                                    if (assigned) MeshRuntimeStore.getInstance().deleteRemoteIdleSession(args.meshId, nodeId, sessionId);
+                                } catch (e: any) {
+                                    LOG.warn('MeshQueue', `Failed to assign idle queue task after completion for ${nodeId}: ${e?.message || e}`);
+                                }
+                            });
+                    });
+                } else {
+                    runIdleMaintenanceThenAssignQueue(components, { meshId: args.meshId, nodeId, sessionId, providerType });
+                }
             }
             // M1-3: wake dependents of the completed task. The maintenance path above
             // only assigns to the completing session; dependents may be claimable by
@@ -884,14 +929,14 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
         if (sessionId && nodeId && providerType) {
             sweepExpiredRemoteIdleSessions();
             try {
-                MeshRuntimeStore.getInstance().setRemoteIdleSession(nodeId, sessionId, providerType, Date.now() + REMOTE_IDLE_SESSION_TTL_MS);
+                MeshRuntimeStore.getInstance().setRemoteIdleSession(args.meshId, nodeId, sessionId, providerType, Date.now() + REMOTE_IDLE_SESSION_TTL_MS);
             } catch { /* best-effort */ }
             setImmediate(() => {
                 maybeAutoFastForwardIdleNode(components, { meshId: args.meshId, nodeId, sessionId, providerType })
                     .finally(() => {
                         try {
                             const assigned = tryAssignQueueTask(components, args.meshId, nodeId, sessionId, providerType);
-                            if (assigned) MeshRuntimeStore.getInstance().deleteRemoteIdleSession(nodeId, sessionId);
+                            if (assigned) MeshRuntimeStore.getInstance().deleteRemoteIdleSession(args.meshId, nodeId, sessionId);
                         } catch (e: any) {
                             LOG.warn('MeshQueue', `Failed to assign idle queue task after maintenance for ${nodeId}: ${e?.message || e}`);
                         }
@@ -903,7 +948,7 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
         const nodeId = readNonEmptyString(args.nodeId) || readNonEmptyString(args.metadataEvent.meshNodeId);
         if (sessionId && nodeId) {
             try {
-                MeshRuntimeStore.getInstance().deleteRemoteIdleSession(nodeId, sessionId);
+                MeshRuntimeStore.getInstance().deleteRemoteIdleSession(args.meshId, nodeId, sessionId);
             } catch { /* best-effort */ }
         }
         if (sessionId) {
@@ -954,7 +999,7 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
         const nodeId = readNonEmptyString(args.nodeId) || readNonEmptyString(args.metadataEvent.meshNodeId);
         if (sessionId && nodeId) {
             try {
-                MeshRuntimeStore.getInstance().deleteRemoteIdleSession(nodeId, sessionId);
+                MeshRuntimeStore.getInstance().deleteRemoteIdleSession(args.meshId, nodeId, sessionId);
             } catch { /* best-effort */ }
         }
         if (sessionId) {

package/src/mesh/mesh-queue-assignment.ts

@@ -1298,7 +1298,7 @@ export async function triggerMeshQueue(components: DaemonComponents, meshId: str
 
     let remoteSessions: Array<{ nodeId: string; sessionId: string; providerType: string }> = [];
     try {
-        remoteSessions = MeshRuntimeStore.getInstance().getRemoteIdleSessions();
+        remoteSessions = MeshRuntimeStore.getInstance().getRemoteIdleSessions(meshId);
     } catch { /* best-effort */ }
 
     const remoteCandidates: IdleCandidate[] = [];
@@ -1318,7 +1318,7 @@ export async function triggerMeshQueue(components: DaemonComponents, meshId: str
         const assigned = tryAssignQueueTask(components, meshId, candidate.nodeId, candidate.sessionId, candidate.providerType);
         if (assigned && candidate.origin === 'remote') {
             try {
-                MeshRuntimeStore.getInstance().deleteRemoteIdleSession(candidate.nodeId, candidate.sessionId);
+                MeshRuntimeStore.getInstance().deleteRemoteIdleSession(meshId, candidate.nodeId, candidate.sessionId);
             } catch { /* best-effort */ }
         }
     };

package/src/mesh/mesh-reconcile-loop.ts

@@ -97,6 +97,35 @@ function resolveReconcileIntervalMs(): number {
     return DEFAULT_RECONCILE_INTERVAL_MS;
 }
 
+// RECONCILE-SYNTH-PREEMPTS-COMPLETION in-flight debounce. PHASE 4 only synthesizes a missing
+// completion when the worker session reads `idle`. But a worker that is GENUINELY generating
+// (it emitted agent:generating_started — the dispatch row is 'acked' — and has not yet
+// completed) can momentarily read `idle` mid-turn: a CLI PTY parser sees an inter-turn blip
+// between tool calls, or the read_chat probe races a brief settle. A single such idle read
+// must NOT fabricate a completion for an in-flight task — doing so writes a synthesized
+// terminal that then masks the REAL completion when it lands seconds later
+// (drop:duplicate_completion_terminal_ledger; the observed 71s task a250fb44 lost its [System]
+// notification this way). We require the session to read `idle` on CONSECUTIVE reconcile ticks
+// before synthesizing for an `acked` (started-generating) dispatch — a transient mid-turn idle
+// flicker clears on the next ~4s tick, whereas a genuinely-settled (completed-but-lost) or dead
+// session reads idle every tick. A dispatch that was never acked (worker never started) is NOT
+// debounced here: there is no in-flight generation to protect, and the downstream grace gate +
+// stale-summary guard remain the backstops for that lost-dispatch case.
+//
+// Keyed by `${meshId}::${taskId}`. The map is pruned each PHASE-4 pass to the set of currently
+// active dispatches, so a completed/pruned task's counter is dropped (no unbounded growth).
+const REQUIRED_CONSECUTIVE_IDLE_TICKS_FOR_INFLIGHT_SYNTH = 2;
+const inFlightIdleObservationCounts = new Map<string, number>();
+
+function inFlightSynthKey(meshId: string, taskId: string): string {
+    return `${meshId}::${taskId}`;
+}
+
+// Test hook: clear the in-flight idle debounce state between cases.
+export function __resetReconcileInFlightSynthDebounceForTests(): void {
+    inFlightIdleObservationCounts.clear();
+}
+
 interface LiveCoordinator {
     meshId: string;
     instance: ReturnType<DaemonComponents['instanceManager']['getInstance']>;
@@ -1195,6 +1224,20 @@ async function reconcileUnterminatedDirectDispatches(
     const dispatches = getActiveDirectDispatches(mesh.id);
     if (dispatches.length === 0) return; // cheap exit — nothing dispatched, nothing to reconcile
 
+    // Prune the in-flight idle debounce map to the tasks still active in THIS mesh, so a
+    // completed/pruned task's counter is dropped (the map never grows without bound).
+    const activeTaskKeys = new Set(
+        dispatches
+            .map(d => readNonEmptyString(d.taskId))
+            .filter(Boolean)
+            .map(taskId => inFlightSynthKey(mesh.id, taskId)),
+    );
+    for (const key of inFlightIdleObservationCounts.keys()) {
+        if (key.startsWith(`${mesh.id}::`) && !activeTaskKeys.has(key)) {
+            inFlightIdleObservationCounts.delete(key);
+        }
+    }
+
     const dispatchMeshCommand = components.dispatchMeshCommand;
     const nodeById = new Map(mesh.nodes.map(n => [n.id, n] as const));
 
@@ -1243,7 +1286,31 @@ async function reconcileUnterminatedDirectDispatches(
         // Only act on a session that has actually settled to idle. A generating /
         // waiting_approval session is mid-turn — synthesizing a completion now would
         // be wrong. (idle is the only status the MCP poll path reconciles too.)
-        if (readChatPayloadStatus(payload) !== 'idle') continue;
+        const synthKey = inFlightSynthKey(mesh.id, taskId);
+        if (readChatPayloadStatus(payload) !== 'idle') {
+            // Not idle → the worker is mid-turn. Reset any partial idle streak so a single
+            // idle blip during a long generation never accumulates toward the synth threshold.
+            inFlightIdleObservationCounts.delete(synthKey);
+            continue;
+        }
+
+        // RECONCILE-SYNTH-PREEMPTS-COMPLETION: a dispatch whose worker was OBSERVED to start
+        // generating (the agent:generating_started ack flipped the row to 'acked') and has no
+        // terminal yet is potentially still in-flight — its `idle` read here may be a transient
+        // mid-turn flicker, not a settled completion. Require CONSECUTIVE idle observations
+        // before synthesizing for such a task: a flicker clears next tick (counter reset above),
+        // while a genuinely-settled (completed-but-lost) or dead session reads idle every tick
+        // and crosses the threshold within ~one extra interval. A never-acked dispatch (worker
+        // never started) is exempt — there is no in-flight generation to pre-empt, and its
+        // lost-dispatch case is still covered by the downstream grace + stale-summary guards.
+        if (dispatch.status === 'acked') {
+            const idleStreak = (inFlightIdleObservationCounts.get(synthKey) ?? 0) + 1;
+            inFlightIdleObservationCounts.set(synthKey, idleStreak);
+            if (idleStreak < REQUIRED_CONSECUTIVE_IDLE_TICKS_FOR_INFLIGHT_SYNTH) {
+                LOG.info('MeshReconcile', `In-flight synth hold: task ${taskId} on node ${nodeId} (mesh ${mesh.id}) read idle ${idleStreak}/${REQUIRED_CONSECUTIVE_IDLE_TICKS_FOR_INFLIGHT_SYNTH} consecutive tick(s) after generating_started — deferring completion synth until the idle settle is confirmed (guards against a mid-turn idle flicker pre-empting the real completion)`);
+                continue;
+            }
+        }
 
         const messages = Array.isArray(payload.messages) ? payload.messages as ChatMessage[] : [];
         const evidence = extractFinalAssistantSummaryEvidence(messages);

package/src/mesh/mesh-runtime-store.ts

@@ -147,10 +147,20 @@ export class MeshRuntimeStore {
             CREATE INDEX IF NOT EXISTS idx_mesh_queue_assignment
                 ON mesh_queue(mesh_id, assigned_node_id, assigned_session_id, status);
 
+            -- mesh_id is DB-level isolation (defense-in-depth). The fingerprint STRING
+            -- also carries meshId as its first '::'-joined segment (see
+            -- buildMeshCompletionFingerprint) — that string-prefix defense is kept; this
+            -- column makes cross-mesh suppression impossible even if the string format
+            -- drifts or two meshes ever collide on a fingerprint body.
             CREATE TABLE IF NOT EXISTS mesh_completion_fingerprints (
                 fingerprint TEXT PRIMARY KEY,
-                expires_at INTEGER NOT NULL
+                expires_at INTEGER NOT NULL,
+                mesh_id TEXT NOT NULL DEFAULT ''
             );
+            -- NOTE: the (mesh_id, fingerprint) index is created in migrateMeshIsolationColumns,
+            -- NOT here. A pre-isolation DB still has the legacy table (CREATE IF NOT EXISTS is a
+            -- no-op), so referencing mesh_id in an index before the ALTER ADD COLUMN runs would
+            -- fail with "no such column". The migration adds the column then the index.
 
             CREATE TABLE IF NOT EXISTS mesh_direct_dispatches (
                 task_id TEXT PRIMARY KEY,
@@ -170,13 +180,18 @@ export class MeshRuntimeStore {
             CREATE INDEX IF NOT EXISTS idx_direct_dispatches_mesh_session
                 ON mesh_direct_dispatches(mesh_id, session_id, status);
 
+            -- MESH-ISOLATION-LEAK: mesh_id is part of the PK so a nodeId shared across two
+            -- meshes (same machine in multiple repos) keeps a separate idle-session row per
+            -- mesh, and getRemoteIdleSessions(meshId) can never surface another mesh's
+            -- session for a queue claim.
             CREATE TABLE IF NOT EXISTS remote_idle_sessions (
+                mesh_id TEXT NOT NULL,
                 node_id TEXT NOT NULL,
                 session_id TEXT NOT NULL,
                 provider_type TEXT NOT NULL,
                 expires_at INTEGER NOT NULL,
                 metadata TEXT,
-                PRIMARY KEY (node_id, session_id)
+                PRIMARY KEY (mesh_id, node_id, session_id)
             );
 
             CREATE TABLE IF NOT EXISTS mesh_session_delivery (
@@ -300,13 +315,83 @@ export class MeshRuntimeStore {
                 cursor INTEGER NOT NULL DEFAULT 0
             );
         `);
+        this.migrateMeshIsolationColumns();
+    }
+
+    private tableColumns(table: string): Set<string> {
+        const rows = this.db.prepare(`PRAGMA table_info(${table})`).all() as Array<{ name: string }>;
+        return new Set(rows.map(r => r.name));
+    }
+
+    /**
+     * MESH-ISOLATION-LEAK migration. Two tables historically lacked a `mesh_id` column,
+     * letting one machine that belongs to multiple meshes (multiple repos) leak rows
+     * across meshes. Both migrations are idempotent and run on every boot — the column
+     * check short-circuits once the new schema is in place.
+     */
+    private migrateMeshIsolationColumns(): void {
+        try {
+            // 1. mesh_completion_fingerprints: ADD COLUMN + backfill mesh_id from the
+            //    fingerprint string's first '::'-joined segment (buildMeshCompletionFingerprint
+            //    prefixes meshId). A row whose fingerprint has no '::' (legacy/foreign format)
+            //    backfills to '' — still strictly tighter than the prior global query.
+            const fpCols = this.tableColumns('mesh_completion_fingerprints');
+            if (!fpCols.has('mesh_id')) {
+                this.db.exec(`ALTER TABLE mesh_completion_fingerprints ADD COLUMN mesh_id TEXT NOT NULL DEFAULT ''`);
+                this.db.exec(`
+                    UPDATE mesh_completion_fingerprints
+                    SET mesh_id = substr(fingerprint, 1, instr(fingerprint, '::') - 1)
+                    WHERE instr(fingerprint, '::') > 0 AND mesh_id = ''
+                `);
+            }
+            // The mesh_id column is now guaranteed to exist (fresh DB had it from CREATE TABLE,
+            // legacy DB just got it via ALTER). Create the index unconditionally — IF NOT EXISTS
+            // makes it a no-op once present.
+            this.db.exec(`
+                CREATE INDEX IF NOT EXISTS idx_mesh_completion_fingerprints_mesh
+                    ON mesh_completion_fingerprints(mesh_id, fingerprint)
+            `);
+
+            // 2. remote_idle_sessions: the mesh_id is part of the PRIMARY KEY, which SQLite
+            //    cannot add via ALTER. The rows are ephemeral — sessions re-register on the
+            //    next agent:ready / agent:generating_completed — so a safe DROP+recreate is
+            //    acceptable (per fix spec) rather than a full table rebuild + un-backfillable
+            //    mesh_id. Only rebuild when the legacy (no mesh_id) schema is detected.
+            const idleCols = this.tableColumns('remote_idle_sessions');
+            if (!idleCols.has('mesh_id')) {
+                this.db.exec(`
+                    DROP TABLE IF EXISTS remote_idle_sessions;
+                    CREATE TABLE remote_idle_sessions (
+                        mesh_id TEXT NOT NULL,
+                        node_id TEXT NOT NULL,
+                        session_id TEXT NOT NULL,
+                        provider_type TEXT NOT NULL,
+                        expires_at INTEGER NOT NULL,
+                        metadata TEXT,
+                        PRIMARY KEY (mesh_id, node_id, session_id)
+                    );
+                `);
+            }
+        } catch (err: any) {
+            // Best-effort: a failed isolation migration must not brick the store. The
+            // CREATE-TABLE definitions above already carry the new schema for fresh DBs;
+            // an existing DB that fails here keeps the old (leaky-but-functional) schema
+            // until the next boot retries. Surface one warn for diagnosability.
+            if (!loggedMigrationFailure) {
+                loggedMigrationFailure = true;
+                LOG.warn('MeshRuntimeStore', `mesh-isolation column migration failed: ${err?.message || err}`);
+            }
+        }
     }
 
-    hasCompletionFingerprint(fingerprint: string): boolean {
+    hasCompletionFingerprint(meshId: string, fingerprint: string): boolean {
         const now = Date.now();
+        // Scope by mesh_id (defense-in-depth) AS WELL AS the fingerprint string, whose
+        // first '::' segment already encodes meshId. A fingerprint can only suppress a
+        // duplicate within its own mesh.
         const row = this.db
-            .prepare('SELECT 1 FROM mesh_completion_fingerprints WHERE fingerprint = ? AND expires_at > ?')
-            .get(fingerprint, now) as { 1: number } | undefined;
+            .prepare('SELECT 1 FROM mesh_completion_fingerprints WHERE mesh_id = ? AND fingerprint = ? AND expires_at > ?')
+            .get(meshId, fingerprint, now) as { 1: number } | undefined;
         // Sweep expired fingerprints every 100 reads so stale rows don't accumulate
         // even during read-heavy (non-write) periods when recordFingerprintSeen is idle.
         if (++this.fingerprintSweepCounter >= 100) {
@@ -316,10 +401,10 @@ export class MeshRuntimeStore {
         return row !== undefined;
     }
 
-    recordCompletionFingerprint(fingerprint: string, ttlMs: number): void {
+    recordCompletionFingerprint(meshId: string, fingerprint: string, ttlMs: number): void {
         const expiresAt = Date.now() + ttlMs;
-        this.db.prepare('INSERT OR REPLACE INTO mesh_completion_fingerprints (fingerprint, expires_at) VALUES (?, ?)')
-            .run(fingerprint, expiresAt);
+        this.db.prepare('INSERT OR REPLACE INTO mesh_completion_fingerprints (fingerprint, expires_at, mesh_id) VALUES (?, ?, ?)')
+            .run(fingerprint, expiresAt, meshId);
         this.maybeCheckpointWal();
     }
 
@@ -969,15 +1054,17 @@ export class MeshRuntimeStore {
 
     // ── Remote Idle Sessions ─────────────────────────────────────────────────
 
-    setRemoteIdleSession(nodeId: string, sessionId: string, providerType: string, expiresAt: number, metadata?: any): void {
+    setRemoteIdleSession(meshId: string, nodeId: string, sessionId: string, providerType: string, expiresAt: number, metadata?: any): void {
         this.db.prepare(`
-            INSERT OR REPLACE INTO remote_idle_sessions (node_id, session_id, provider_type, expires_at, metadata)
-            VALUES (?, ?, ?, ?, ?)
-        `).run(nodeId, sessionId, providerType, expiresAt, metadata ? JSON.stringify(metadata) : null);
+            INSERT OR REPLACE INTO remote_idle_sessions (mesh_id, node_id, session_id, provider_type, expires_at, metadata)
+            VALUES (?, ?, ?, ?, ?, ?)
+        `).run(meshId, nodeId, sessionId, providerType, expiresAt, metadata ? JSON.stringify(metadata) : null);
     }
 
-    getRemoteIdleSessions(): Array<{ nodeId: string; sessionId: string; providerType: string; expiresAt: number; metadata?: any }> {
-        const rows = this.db.prepare('SELECT node_id, session_id, provider_type, expires_at, metadata FROM remote_idle_sessions').all() as Array<any>;
+    getRemoteIdleSessions(meshId: string): Array<{ nodeId: string; sessionId: string; providerType: string; expiresAt: number; metadata?: any }> {
+        // MESH-ISOLATION-LEAK: always mesh-scoped. A bare (cross-mesh) read here is what
+        // let mesh B claim mesh A's idle session when both share a nodeId.
+        const rows = this.db.prepare('SELECT node_id, session_id, provider_type, expires_at, metadata FROM remote_idle_sessions WHERE mesh_id = ?').all(meshId) as Array<any>;
         return rows.map(r => ({
             nodeId: r.node_id,
             sessionId: r.session_id,
@@ -987,8 +1074,8 @@ export class MeshRuntimeStore {
         }));
     }
 
-    deleteRemoteIdleSession(nodeId: string, sessionId: string): void {
-        this.db.prepare('DELETE FROM remote_idle_sessions WHERE node_id = ? AND session_id = ?').run(nodeId, sessionId);
+    deleteRemoteIdleSession(meshId: string, nodeId: string, sessionId: string): void {
+        this.db.prepare('DELETE FROM remote_idle_sessions WHERE mesh_id = ? AND node_id = ? AND session_id = ?').run(meshId, nodeId, sessionId);
     }
 
     pruneExpiredRemoteIdleSessions(): void {

package/src/mesh/mesh-work-queue.ts

@@ -273,6 +273,38 @@ function isInsideQuotedSpan(text: string, matchStart: number, matchEnd: number):
     return false;
 }
 
+/**
+ * True if the keyword at [matchStart, matchEnd) is glued directly to a Unicode
+ * *letter* on either side with no separator — i.e. it is word-internal, part of a
+ * larger word rather than a standalone command token.
+ *
+ * The keyword regexes use `\b` boundaries, which already exclude an *ASCII-letter*
+ * suffix/prefix: `\bdeploy\b` does NOT match the "deploy" inside "deployed"
+ * (`y`→`e` is not a boundary). But `\b` fires a boundary between a Latin letter
+ * and a non-Latin letter, so `deploy된` ("deployed", Korean passive), `release한`,
+ * or `version-bump됨` DO match even though they are single conjugated/compound
+ * words in prose, not shell commands. That is the exact i18n asymmetry behind
+ * GUARDRAIL-I18N-FP: the English "deployed worker" passes (mid-prose, no command
+ * context) while the Korean "deploy된 워커" was flagged because the glued CJK
+ * suffix left the bare keyword sitting at line-start, which the command-context
+ * heuristic reads as a command invocation.
+ *
+ * We restore the symmetry `\b` provides for ASCII: a forbidden keyword fused to
+ * ANY Unicode letter (Hangul, Han, Kana, accented Latin, …) is a word-internal
+ * occurrence → descriptive prose, never a command. A genuine command keyword is
+ * always followed by a non-letter — whitespace, end-of-input, a path separator,
+ * a flag/redirect, or a shell metachar (`npm run deploy`, `wrangler deploy\n`,
+ * `version-bump.sh`, `npm publish && ...`).
+ */
+function isGluedToLetterSuffix(text: string, matchStart: number, matchEnd: number): boolean {
+    // \p{L} = any Unicode letter; \p{M} = combining mark (e.g. Jamo/diacritics
+    // that compose with the adjacent letter). Either side counts as "glued".
+    const letterOrMark = /[\p{L}\p{M}]/u;
+    const next = matchEnd < text.length ? text[matchEnd] : '';
+    const prev = matchStart > 0 ? text[matchStart - 1] : '';
+    return letterOrMark.test(next) || letterOrMark.test(prev);
+}
+
 /**
  * Decides whether a forbidden keyword match at [matchStart, matchEnd) should
  * count as a real violation. A match counts only when it is in command context
@@ -283,6 +315,10 @@ function isInsideQuotedSpan(text: string, matchStart: number, matchEnd: number):
 function isRealMutationMatch(text: string, matchStart: number, matchEnd: number): boolean {
     if (hasNegationBefore(text, matchStart)) return false;
     if (hasTrailingNegation(text, matchEnd)) return false;
+    // A keyword fused to a non-ASCII letter ("deploy된", "release한") is a single
+    // conjugated/compound word in prose, not a command — `\b` only guards the
+    // ASCII-letter case, so restore the same symmetry for all Unicode letters.
+    if (isGluedToLetterSuffix(text, matchStart, matchEnd)) return false;
     // A keyword that is part of a file path (build/Release, dist/release/) or
     // sits inside quoted prose (a commit-message citation, "포인터 bump") is a
     // description, not a command — suppress it even if it lands at line-start.