@adhdev/daemon-core 0.9.82-rc.41 → 0.9.82-rc.410

package/dist/commands/low-family/status-meta.d.ts

@@ -0,0 +1,2 @@
+import type { LowFamilyHandler } from './types.js';
+export declare const statusMetaHandlers: Record<string, LowFamilyHandler>;

package/dist/commands/low-family/types.d.ts

@@ -0,0 +1,33 @@
+/**
+ * RF-ROUTER LOW family — shared types for the extracted low-coupling command
+ * handlers. Each handler is a pure function of (context, args): it reads only the
+ * router deps it needs and returns the exact CommandRouterResult the original
+ * `executeDaemonCommand` switch case returned, so the router facade is unchanged.
+ *
+ * Registry dispatch: DaemonCommandRouter.executeDaemonCommand looks up the cmd in
+ * lowFamilyRegistry BEFORE its switch; a hit returns the handler result, a miss
+ * falls through to the remaining switch (and ultimately CommandHandler delegation).
+ */
+import type { CommandRouterDeps, CommandRouterResult } from '../router.js';
+/** Mesh record resolved from the router's inline-mesh cache + local config. */
+export type ResolvedMeshForCommand = {
+    mesh: any;
+    inline: boolean;
+    source: 'inline_cache' | 'inline_bootstrap' | 'local_config';
+} | null;
+export interface LowFamilyContext {
+    deps: CommandRouterDeps;
+    /**
+     * Bound `DaemonCommandRouter.getMeshForCommand`. A handful of LOW handlers
+     * (mesh-node-logs) must resolve a mesh node's owning daemonId from the
+     * router's inline-mesh cache, which is router instance state not present in
+     * `deps`. The router injects it at dispatch; handlers that don't need it
+     * ignore it. Optional so unit tests can omit it (and assert the guarded
+     * fallback) without constructing a full router.
+     */
+    getMeshForCommand?: (meshId: string, inlineMesh?: unknown, options?: {
+        preferInline?: boolean;
+    }) => Promise<ResolvedMeshForCommand>;
+}
+export type LowFamilyHandler = (ctx: LowFamilyContext, args: any) => Promise<CommandRouterResult>;
+export type LowFamilyRegistry = Map<string, LowFamilyHandler>;

package/dist/commands/med-family/cli-agent.d.ts

@@ -0,0 +1,2 @@
+import type { MedFamilyHandler } from './types.js';
+export declare const cliAgentHandlers: Record<string, MedFamilyHandler>;

package/dist/commands/med-family/fast-forward.d.ts

@@ -0,0 +1,2 @@
+import type { MedFamilyHandler } from './types.js';
+export declare const fastForwardHandlers: Record<string, MedFamilyHandler>;

package/dist/commands/med-family/ide.d.ts

@@ -0,0 +1,10 @@
+import type { CommandRouterResult } from '../router.js';
+import type { MedFamilyContext, MedFamilyHandler } from './types.js';
+/**
+ * IDE launch + CDP connect. Lifted verbatim from the original `launch_ide` switch
+ * case so restart_session / restart_ide can call it directly instead of recursing
+ * through executeDaemonCommand. Reads the router's CDP managers and detection
+ * caches via ctx.deps.
+ */
+export declare function launchIde(ctx: MedFamilyContext, args: any): Promise<CommandRouterResult>;
+export declare const ideHandlers: Record<string, MedFamilyHandler>;

package/dist/commands/med-family/index.d.ts

@@ -0,0 +1,3 @@
+import type { MedFamilyRegistry } from './types.js';
+export type { MedFamilyContext, MedFamilyHandler, MedFamilyRegistry } from './types.js';
+export declare const medFamilyRegistry: MedFamilyRegistry;

package/dist/commands/med-family/mesh-crud.d.ts

@@ -0,0 +1,2 @@
+import type { MedFamilyHandler } from './types.js';
+export declare const meshCrudHandlers: Record<string, MedFamilyHandler>;

package/dist/commands/med-family/mesh-host-pairing.d.ts

@@ -0,0 +1,2 @@
+import type { MedFamilyHandler } from './types.js';
+export declare const meshHostPairingHandlers: Record<string, MedFamilyHandler>;

package/dist/commands/med-family/mesh-queue.d.ts

@@ -0,0 +1,2 @@
+import type { MedFamilyHandler } from './types.js';
+export declare const meshQueueHandlers: Record<string, MedFamilyHandler>;

package/dist/commands/med-family/mesh-restart.d.ts

@@ -0,0 +1,2 @@
+import type { MedFamilyHandler } from './types.js';
+export declare const meshRestartHandlers: Record<string, MedFamilyHandler>;

package/dist/commands/med-family/types.d.ts

@@ -0,0 +1,116 @@
+/**
+ * RF-ROUTER MED family — shared types for the extracted medium-coupling command
+ * handlers. Like the LOW family, each handler is a function of (context, args)
+ * that returns the exact CommandRouterResult the original `executeDaemonCommand`
+ * switch case returned, so the router facade is unchanged.
+ *
+ * Unlike the LOW family, MED handlers need a handful of router-private
+ * collaborators (mesh resolution, owner gating, inline-cache mutation, worktree /
+ * session cleanup, refine job starters, IDE launch). The router binds these onto
+ * MedFamilyContext at dispatch; they are NOT reachable from `deps`. The IDE family
+ * also needs `launchIde` to break the original `launch_ide`/`restart_*`
+ * self-recursion through executeDaemonCommand.
+ *
+ * Registry dispatch: DaemonCommandRouter.executeDaemonCommand looks up the cmd in
+ * medFamilyRegistry BEFORE its switch; a hit returns the handler result, a miss
+ * falls through to the remaining switch (and ultimately CommandHandler delegation).
+ */
+import type { CommandRouterDeps, CommandRouterResult, MeshGitProbeCache } from '../router.js';
+import type { RepoMeshSessionCleanupMode } from '../../repo-mesh-types.js';
+import type { WorktreeBootstrapState } from '../../mesh/worktree-bootstrap-config.js';
+/** Mesh record resolved from the router's inline-mesh cache + local config. */
+export type ResolvedMeshForCommand = {
+    mesh: any;
+    inline: boolean;
+    source: 'inline_cache' | 'inline_bootstrap' | 'local_config';
+} | null;
+/** Result of the router's local worktree-node cleanup. */
+export type CleanupLocalWorktreeNodeResult = {
+    success: true;
+    skipped?: boolean;
+    removedPath?: string;
+    repoRoot?: string;
+    reason?: string;
+    fallback?: string;
+    forced?: boolean;
+    convergence?: Record<string, unknown>;
+    recovered?: boolean;
+    residue?: boolean;
+    residueWarning?: string;
+    residueError?: string;
+} | {
+    success: false;
+    code: string;
+    error: string;
+    recoveryHint: string;
+    convergence?: Record<string, unknown>;
+};
+/**
+ * Router-private collaborators injected at dispatch. Each is a bound method or
+ * field of DaemonCommandRouter; handlers that don't need a given collaborator
+ * simply ignore it. The router owns this instance state (inline-mesh cache,
+ * aggregate-status cache, session/worktree cleanup, refine jobs), so it cannot be
+ * read from `deps` — the registry receives bound references instead.
+ */
+export interface MedFamilyContext {
+    deps: CommandRouterDeps;
+    /** Bound `DaemonCommandRouter.getMeshForCommand`. */
+    getMeshForCommand: (meshId: string, inlineMesh?: unknown, options?: {
+        preferInline?: boolean;
+    }) => Promise<ResolvedMeshForCommand>;
+    /** Bound `DaemonCommandRouter.getCachedInlineMesh`. */
+    getCachedInlineMesh: (meshId: string, inlineMesh?: unknown) => any | undefined;
+    /** Bound `DaemonCommandRouter.requireMeshHostMutationOwner` (owner gate). */
+    requireMeshHostMutationOwner: (meshId: string, inlineMesh: unknown, operation: string) => Promise<CommandRouterResult | null>;
+    /** Bound `DaemonCommandRouter.invalidateAggregateMeshStatus`. */
+    invalidateAggregateMeshStatus: (meshId: string) => void;
+    /** Bound `DaemonCommandRouter.updateInlineMeshNode`. */
+    updateInlineMeshNode: (meshId: string, mesh: any, node: any) => void;
+    /** Bound `DaemonCommandRouter.removeInlineMeshNode`. */
+    removeInlineMeshNode: (meshId: string, mesh: any, nodeId: string) => boolean;
+    /** Bound `DaemonCommandRouter.normalizeMeshSessionCleanupMode`. */
+    normalizeMeshSessionCleanupMode: (value: unknown) => RepoMeshSessionCleanupMode;
+    /** Bound `DaemonCommandRouter.cleanupMeshSessions`. */
+    cleanupMeshSessions: (args: {
+        meshId: string;
+        nodeId: string;
+        node: any;
+        mode: RepoMeshSessionCleanupMode;
+        sessionIds?: string[];
+        dryRun?: boolean;
+        source?: 'mesh_cleanup_sessions' | 'mesh_remove_node';
+    }) => Promise<{
+        success: boolean;
+        [key: string]: unknown;
+    }>;
+    /** Bound `DaemonCommandRouter.cleanupLocalWorktreeNode`. */
+    cleanupLocalWorktreeNode: (args: {
+        mesh: any;
+        node: any;
+        nodeId: string;
+        force?: boolean;
+    }) => Promise<CleanupLocalWorktreeNodeResult>;
+    /** Bound `DaemonCommandRouter.startMeshRefineJob` (async execute path). */
+    startMeshRefineJob: (meshId: string, nodeId: string, args: any) => Promise<CommandRouterResult>;
+    /** Bound `DaemonCommandRouter.batchRefineMeshNodes` (dry-run batch plan). */
+    batchRefineMeshNodes: (meshId: string, requestedNodeIds: string[] | undefined, args: any) => Promise<CommandRouterResult>;
+    /** Bound `DaemonCommandRouter.startMeshRefineBatchJob` (async batch execute). */
+    startMeshRefineBatchJob: (meshId: string, requestedNodeIds: string[] | undefined, args: any) => Promise<CommandRouterResult>;
+    /** Bound `DaemonCommandRouter.stopIde` (CDP disconnect + cleanup + optional kill). */
+    stopIde: (ideType: string, killProcess?: boolean) => Promise<void>;
+    /**
+     * Module-level `launchIde` helper bound to this context. The original
+     * `launch_ide` case body, lifted into a free function so `restart_session` /
+     * `restart_ide` can invoke the IDE launch directly instead of recursing
+     * through `executeDaemonCommand('launch_ide')` (which would re-enter the
+     * registry). Byte-identical to the original case body.
+     */
+    launchIde: (args: any) => Promise<CommandRouterResult>;
+    /** Router's inline-mesh cache (read/write of resolved mesh records). */
+    inlineMeshCache: Map<string, any>;
+    /** Router's mesh git-probe cache (reused direct-truth probes for get_mesh). */
+    meshGitProbeCache: MeshGitProbeCache;
+}
+export type MedFamilyHandler = (ctx: MedFamilyContext, args: any) => Promise<CommandRouterResult | null>;
+export type MedFamilyRegistry = Map<string, MedFamilyHandler>;
+export type { WorktreeBootstrapState };

package/dist/commands/mesh-coordinator.d.ts

@@ -1,4 +1,4 @@
-import type { ProviderModule, MeshCoordinatorMcpConfigFormat } from '../providers/contracts.js';
+import type { MeshCoordinatorMcpConfigFormat, MeshCoordinatorSystemPromptInjection, ProviderModule } from '../providers/contracts.js';
 export interface MeshCoordinatorMcpServerLaunch {
     command: string;
     args: string[];
@@ -25,6 +25,7 @@ export type MeshCoordinatorSetup = {
     command: string;
     requiresRestart: boolean;
     instructions: string;
+    mcpServer: MeshCoordinatorMcpServerLaunch;
 } | {
     kind: 'unsupported';
     reason: string;
@@ -42,3 +43,86 @@ export interface ResolveMeshCoordinatorSetupOptions {
 }
 export declare function createHermesManualMeshCoordinatorSetup(meshId: string, workspace: string): MeshCoordinatorSetup;
 export declare function resolveMeshCoordinatorSetup(options: ResolveMeshCoordinatorSetupOptions): MeshCoordinatorSetup;
+/**
+ * Apply a provider's declared system-prompt injection rule, mutating `cliArgs`
+ * and `launchEnv` in place and writing any required workspace context file.
+ *
+ * Replaces the previous hard-coded `if (cliType === 'claude-cli') ... else if
+ * (cliType === 'hermes-cli') ...` branches in router.ts. Adding a new CLI is
+ * now provider.v1.json data, not a router edit.
+ *
+ * Failures are non-fatal: log and continue with whatever was applied so the
+ * coordinator session still launches, just without the prompt for that
+ * provider. A missing/unknown rule means "skip injection" — safe by default
+ * (the previous fallback unconditionally pushed --append-system-prompt onto
+ * every non-Claude CLI, which crashed agy on launch).
+ */
+export interface CoordinatorInjectionEffect {
+    /** Absolute path the daemon wrote a wrapper-blocked file to. Only set for
+     *  context_file injection. R48 schedules a strip after launch so workers
+     *  don't see the wrapper on disk; R47's unregister cleanup uses it as a
+     *  fallback if the timer never fires (process crash, etc). */
+    contextFilePath?: string;
+}
+export declare function applyMeshCoordinatorSystemPromptInjection(systemPrompt: string, injection: MeshCoordinatorSystemPromptInjection | undefined, ctx: {
+    cliArgs: string[];
+    launchEnv: Record<string, string>;
+    workspace: string;
+    cliType: string;
+}): CoordinatorInjectionEffect;
+/**
+ * Strip the daemon's wrapper block from a context_file we previously wrote.
+ *
+ * Used in two places:
+ *   1. R48 inject-then-remove: ~5s after spawn, after agy/gemini have read
+ *      the file into their in-memory system-prompt cache. Removing it from
+ *      disk at that point doesn't affect the running coordinator but keeps
+ *      worker sessions (or fresh non-coordinator launches) in the same
+ *      workspace from picking up our wrapper.
+ *   2. R47 unregister fallback: if the timer never fires (process crash,
+ *      kill -9), coordinator-registry.unregisterMeshCoordinator runs the
+ *      same logic when its entry is dropped.
+ *
+ * Idempotent: missing file is fine, missing sentinels are fine, returns
+ * silently. Leaves user-authored content outside the sentinels intact.
+ * Deletes the file outright if our wrapper was the only content.
+ */
+export declare function stripCoordinatorWrapperFile(filePath: string): void;
+export interface PtyExecResult {
+    exitCode: number | null;
+    signal: number | null;
+    output: string;
+    timedOut: boolean;
+}
+export interface MeshCoordinatorRegistrationStep {
+    command: string;
+    args: string[];
+    required: boolean;
+    label: 'remove_existing' | 'register';
+}
+/**
+ * Codex rejects `mcp add` when a server with the same name already exists.
+ * Replace that entry before registering so transport/mesh changes do not leave
+ * a fresh coordinator attached to stale MCP launch arguments.
+ */
+export declare function buildMeshCoordinatorRegistrationPlan(cliType: string, serverName: string, registrationCommand: string): MeshCoordinatorRegistrationStep[];
+/**
+ * Run a one-shot CLI command under a real PTY and collect its output.
+ *
+ * Some provider mcp-registration commands (`agy mcp add`, future bubbletea
+ * TUIs) refuse to run without `/dev/tty`. Daemon-side `execFileSync` runs
+ * pipe-only, so those commands fail with errors like
+ *   `bubbletea: error opening TTY: open /dev/tty: device not configured`
+ * and silently skip the registration, leaving the launched session
+ * without the adhdev-mesh MCP tools — which is exactly what we saw with
+ * agy coordinators.
+ *
+ * Wrapping the registration through node-pty gives the child a real PTY,
+ * so the bubbletea check passes. We close stdin immediately and just
+ * collect stdout until the process exits or the timeout fires.
+ */
+export declare function execUnderPty(command: string, args: string[], options?: {
+    cwd?: string;
+    env?: Record<string, string>;
+    timeoutMs?: number;
+}): Promise<PtyExecResult>;

package/dist/commands/router.d.ts

@@ -14,6 +14,9 @@ import { DaemonCliManager } from './cli-manager.js';
 import type { ProviderLoader } from '../providers/provider-loader.js';
 import type { ProviderInstanceManager } from '../providers/provider-instance-manager.js';
 import { SessionRegistry } from '../sessions/registry.js';
+export * from '../mesh/mesh-node-identity.js';
+export * from '../mesh/mesh-refine-gates.js';
+export * from '../mesh/mesh-coordinator-config.js';
 export interface SessionHostControlPlane {
     getDiagnostics(payload?: {
         includeSessions?: boolean;
@@ -55,12 +58,14 @@ export interface CommandRouterDeps {
         value: any[];
     };
     sessionRegistry: SessionRegistry;
-    /** Callback for CDP manager creation after launch_ide */
+    /** Callback after CDP manager created (transport-specific extras) */
     onCdpManagerCreated?: (ideType: string, manager: DaemonCdpManager) => void;
     /** Callback after IDE connected (e.g., startAgentStreamPolling) */
     onIdeConnected?: () => void;
     /** Callback after status change (stop_ide, restart) */
     onStatusChange?: () => void;
+    /** Callback when a mesh state is invalidated */
+    onMeshStateChange?: (meshId: string) => void;
     /** Callback after chat-related commands */
     onPostChatCommand?: () => void;
     /** Get a connected CDP manager (for agent stream reset check) */
@@ -81,32 +86,173 @@ export interface CommandRouterResult {
     success: boolean;
     [key: string]: unknown;
 }
+/**
+ * Confine a spec path to ~/.adhdev/providers, defeating both prefix-bypass
+ * (e.g. ".../providers-evil") and symlink escape. Resolves the real path of
+ * the *parent* directory (the file may not exist yet for writes), requires the
+ * basename to be a literal `*.json`, and re-joins under the verified parent so
+ * the returned path can't point outside the tree. Used by get/write_spec_source.
+ */
+export declare function normalizeStandaloneHostCommandUrl(hostAddress: string): string;
+export declare function buildMemberJoinNode(mesh: any, args: any, fallbackDaemonId?: string): Record<string, unknown> | null;
 export declare class DaemonCommandRouter {
     private deps;
     /** In-memory cache for cloud-originating meshes passed via inlineMesh.
      *  Allows the MCP server to query mesh data via get_mesh even when
      *  the mesh doesn't exist in the local meshes.json file. */
     private inlineMeshCache;
+    /** Tombstones for inline mesh nodes removed via remove_mesh_node, keyed by
+     *  meshId → set of removed nodeIds. The dashboard keeps echoing the removed
+     *  node in the inlineMesh it attaches to every command; without a tombstone,
+     *  reconcileInlineMeshCache MERGEs it straight back (resurrection). A
+     *  tombstoned node is skipped during reconcile only while its workspace is
+     *  absent from disk — a genuine re-registration (same nodeId, workspace back
+     *  on disk) clears the tombstone and merges normally, preserving clone
+     *  worktree visibility and legitimate node re-creation. */
+    private removedInlineMeshNodeIds;
     /** Coordinator-owned whole-mesh aggregate status snapshots. Browser callers read this by default. */
     private aggregateMeshStatusCache;
+    /** Shared per-peer git_status probe dedup + recently-probed reuse gate.
+     *  Spans separate mesh_status/get_mesh calls so the dashboard auto-retry
+     *  loop cannot storm a slow peer with back-to-back refreshUpstream probes. */
+    private meshGitProbeCache;
+    /** In-memory async Refinery jobs keyed by meshId:nodeId to reject/return duplicate in-flight requests. */
+    private runningRefineJobs;
+    /** Terminal async Refinery jobs preserve a clear answer after the worktree node has been removed. */
+    private terminalRefineJobs;
+    /** In-memory async batch Refinery jobs keyed by meshId (one batch convergence per mesh at a time). */
+    private runningRefineBatchJobs;
+    /** Terminal async batch Refinery jobs preserve the last batch outcome for late readers. */
+    private terminalRefineBatchJobs;
     constructor(deps: CommandRouterDeps);
     private cloneJsonValue;
+    private hydrateCachedAggregateMeshStatusFromInline;
     private getCachedAggregateMeshStatus;
     private rememberAggregateMeshStatus;
+    getCachedInlineMeshNodes(): any[];
+    /**
+     * Resolve the REMOTE worker daemonId that owns a given session, when the session
+     * belongs to a mesh node hosted on a DIFFERENT daemon than this coordinator.
+     *
+     * The coordinator does not host remote-worker session instances in its own
+     * instanceManager/sessionRegistry — only their cached mesh-node metadata. A
+     * dashboard-issued session-scoped command (invoke_provider_script / resolve_action /
+     * set_mode / …) lands on the coordinator with a targetSessionId the coordinator can't
+     * find locally, and without forwarding it dies as "Live session not found". send_chat
+     * happens to survive (its target resolves to the worker by another route), but the
+     * controlbar commands do not — so the controlbar buttons appear to do nothing.
+     *
+     * Mirror the existing node-level remote-forward pattern (fast_forward_mesh_node etc.):
+     * scan the candidate mesh nodes for the one hosting the targetSessionId, and return its
+     * daemonId when that daemonId is a remote daemon (i.e. not this coordinator's own
+     * statusInstanceId). Returns undefined for a locally-hosted session (no forward — execute
+     * locally as before) or when ownership can't be resolved.
+     *
+     * The candidate set spans BOTH the cached inline-mesh nodes and the live aggregate
+     * mesh-status snapshots. The inline cache reliably carries only each node's single primary
+     * session (cachedStatus.activeSession), so a worker hosting more than one session exposes its
+     * non-primary sessions only on the aggregate snapshot nodes (status.activeSessions /
+     * activeSessionDetails, built from live session records). collectMeshNodeHostedSessionIds does
+     * the wider plural-shape scan so a controlbar/modal command targeting a non-primary remote
+     * session still resolves its owner — the singular readCachedInlineMeshActiveSessions semantics
+     * other consumers depend on stay untouched.
+     *
+     * CANCEL-STOP-RELAY: the session-id cache scan above only matches when the coordinator's
+     * cached status snapshot already lists the worker's session id in a recognized active-sessions
+     * shape. A worktree-clone worker session whose id form/timing differs from the cached snapshot
+     * (or is simply not yet reflected) misses the scan, so a stop that carries the authoritative
+     * owning nodeId (mesh_queue_cancel knows assignedNodeId) used to silently fail to forward.
+     * `ownerNodeIdHint` adds a deterministic fallback: when the session-id scan misses, resolve the
+     * owner daemonId by matching the node by id (meshNodeIdMatches — same form-tolerant compare the
+     * rest of the router uses, no new raw compare). The same self-loopback guard applies to both
+     * paths, so a coordinator-hosted node is still never force-forwarded to a remote form of itself.
+     */
+    resolveRemoteMeshSessionOwnerDaemonId(sessionId: string, ownerNodeIdHint?: string): string | undefined;
+    /**
+     * Candidate nodes for remote-session owner resolution: the cached inline-mesh nodes (which
+     * carry each node's primary session) plus the nodes from every cached aggregate mesh-status
+     * snapshot (which carry each node's full live session list). getCachedInlineMeshNodes()
+     * returns a fresh array, so appending the aggregate nodes never mutates cached state.
+     */
+    private collectMeshSessionOwnerCandidateNodes;
     getCachedInlineMesh(meshId: string, inlineMesh?: unknown): any | undefined;
     private warmInlineMeshCache;
     private getMeshForCommand;
     private invalidateAggregateMeshStatus;
+    /**
+     * Build the MedFamilyContext handed to RF-ROUTER MED family handlers. Binds the
+     * router-private collaborators those handlers need (mesh resolution, owner
+     * gating, inline-cache mutation, worktree / session cleanup, refine job
+     * starters, IDE stop/launch) plus the inline-mesh and git-probe caches. The
+     * `launchIde` field closes over the freshly-built context so restart_session /
+     * restart_ide invoke the IDE launch directly instead of recursing through
+     * executeDaemonCommand('launch_ide').
+     */
+    private buildMedFamilyContext;
+    /**
+     * Build the HighFamilyContext handed to RF-ROUTER HIGH family handlers. Binds
+     * the router-private collaborators those handlers need (mesh resolution, the
+     * aggregate-status memory cache + its bound read/write helpers, the
+     * running-refine-job table, inline-mesh + git-probe caches, and the router's
+     * own `execute` for the get_mesh_review_inbox mesh_status re-entry). HIGH
+     * handlers reach more router-owned state than MED, but the binding shape is
+     * the same: bound methods + direct field references, none reachable from
+     * `deps`.
+     */
+    private buildHighFamilyContext;
+    private requireMeshHostMutationOwner;
     private updateInlineMeshNode;
     private removeInlineMeshNode;
+    /**
+     * WORKTREE-BOOTSTRAP-COORD-STATE: mark a worktree node's bootstrap as reaching a
+     * terminal state (complete / failed) in THIS daemon's mesh view.
+     *
+     * Root cause this fixes: clone_mesh_node forwards the clone+bootstrap to the
+     * source node's daemon (the worktree's machine). persistWorktreeSetupState
+     * therefore flips worktreeBootstrap.status to 'complete' on the WORKER daemon's
+     * mesh object — never on the coordinator's. The coordinator only ever holds the
+     * 'running' state it stamped from the forwarded clone reply. The claim path's
+     * bootstrap gate (mesh-event-forwarding agent:ready / mesh-queue-assignment)
+     * reads the coordinator's mesh via getMeshWithCache, sees status==='running'
+     * forever, and DEFERS every claim — so the worktree_bootstrap_complete re-fire
+     * (triggerMeshQueue) loops against a gate that never opens: claim never lands,
+     * the idle session is re-registered each tick, and auto-launch keeps spawning
+     * fresh sessions (runaway worktree-session multiplication).
+     *
+     * Called from the worktree_bootstrap_complete/_failed event handler BEFORE the
+     * queue re-fire so the gate sees the terminal state and the deferred claim can
+     * finally land. Updates the inline cache (clone worktree nodes are inline-only)
+     * and, when the node also exists in local config, persists there too; both paths
+     * invalidate the aggregate status cache. Best-effort and idempotent.
+     */
+    markWorktreeBootstrapTerminalState(meshId: string, nodeId: string, status: 'complete' | 'failed', opts?: {
+        workspace?: string;
+    }): void;
+    private tombstoneRemovedInlineMeshNode;
+    /** Filter an incoming inline mesh against this mesh's tombstones before it is
+     *  reconciled into the cache. A tombstoned node is dropped only while its
+     *  workspace is still absent from disk; if the workspace is back (genuine
+     *  re-registration), the tombstone is cleared and the node merges normally. */
+    private applyInlineMeshNodeTombstones;
     private normalizeMeshSessionCleanupMode;
     private sessionMatchesMeshNode;
+    /**
+     * Best-effort recursive removal of a managed worktree directory.
+     *
+     * The git-registry de-registration is the safety-critical step of worktree
+     * teardown; a leftover directory must never gate dropping the node from the
+     * mesh. On Windows, `fs.rmSync` can throw EINVAL/EPERM/EBUSY on submodule
+     * gitlink (`.git`) files, long paths, junctions, or while a just-stopped
+     * delegate session is still releasing a handle/cwd on the directory. This
+     * helper absorbs those errors (never throws), with bounded retries + backoff
+     * to give handles time to release, and reports whether residue remains.
+     */
+    private bestEffortRemoveWorktreeDir;
     private cleanupLocalWorktreeNode;
     private getWorktreeForceCleanupConvergence;
     private isCompletedHostedSession;
     private recordIntentionalMeshSessionStop;
     private cleanupMeshSessions;
-    private traceSessionHostAction;
     /**
      * Unified command routing.
      * Returns result for all commands:
@@ -119,6 +265,114 @@ export declare class DaemonCommandRouter {
      * @param source Log source ('ws' | 'p2p' | 'standalone' | etc.)
      */
     execute(cmd: string, args: any, source?: string): Promise<CommandRouterResult>;
+    private buildRefineJobKey;
+    private buildRefineJobHandle;
+    private queueRefineJobEvent;
+    private appendRefineJobLedger;
+    /**
+     * On daemon restart, scan all mesh ledgers for refine jobs that were dispatched
+     * but never completed/failed (i.e. the daemon died mid-job).  Re-queue each one
+     * so the job runs to completion automatically without coordinator intervention.
+     */
+    resumePendingRefineJobsOnStartup(): Promise<void>;
+    /**
+     * Synchronous refinery for a single worktree node — the gate pipeline that
+     * validates, preflights (patch-equivalence / submodule-reachability /
+     * no-op), merges, aligns submodules, cleans up the worktree node and
+     * (optionally) pushes. The body is a flat sequence of stage methods; each
+     * stage either returns a terminal CommandRouterResult (gate failure or a
+     * successful already-merged short-circuit) or `continue` with the extended
+     * context. Behavior — stage order, every early-exit, and every result shape —
+     * is identical to the previous single inlined body.
+     */
+    private executeMeshRefineNodeSynchronously;
+    /**
+     * resolve_refs stage: resolve the mesh / worktree node / source node /
+     * repoRoot, then the worktree branch, base branch, fetched base head and
+     * branch head. Seeds the RefineContext consumed by every later stage.
+     */
+    private refineResolveRefsStage;
+    /**
+     * validation stage: run the refinery validation gate (typecheck / test /
+     * lint / build per node config) and block on failure or when no allowlisted
+     * command was available. On pass, stores the summary on the context.
+     */
+    private refineValidationStage;
+    /**
+     * patch_equivalence stage: preflight that the worktree branch's cumulative
+     * patch is equivalent to base+branch. On a "behind base" branch, auto-rebase
+     * once and re-check; on an empty merge-tree with real branch changes, treat as
+     * already-merged-via-another-path and short-circuit to cleanup. Mutates the
+     * context's branchHead (after rebase) and patchEquivalence (rebased gate).
+     */
+    private refinePatchEquivalenceStage;
+    /**
+     * submodule_reachability stage: verify every submodule gitlink commit that
+     * would land via the merge is reachable from its configured remote main
+     * branch (optionally auto-publishing when policy allows). Blocks the merge
+     * when any commit is unreachable. Stores the result on the context.
+     */
+    private refineSubmoduleReachabilityStage;
+    /**
+     * effective_diff stage (no-op guard): block a silent no-op merge where the
+     * branch produces no effective root-tree diff against base — typically a
+     * submodule that has commits but whose root-level gitlink (pointer) bump was
+     * never committed, so the merge would land nothing real on main.
+     */
+    private refineEffectiveDiffStage;
+    /**
+     * merge + finalize stage: perform the --no-ff merge, align submodule
+     * checkouts after merge, clean up (remove) the worktree node per policy,
+     * append the refinery ledger entry, and (unless approval is required) push the
+     * base branch. Always terminal — produces the final CommandRouterResult.
+     */
+    private refineMergeAndFinalizeStage;
+    /**
+     * Batch refinery: converge multiple sibling worktree nodes onto the base branch
+     * in one sequential pipeline, absorbing the rebase + patch-equivalence churn that
+     * arises when several siblings touch the same submodule.
+     *
+     * Reuses executeMeshRefineNodeSynchronously per node — every node goes through the
+     * exact same validation / patch-equivalence / submodule-reachability / merge / cleanup
+     * gates, including its built-in auto-rebase onto fresh origin/<base>. Because each
+     * node fetches origin/<base> at the start of its own refine, a node merged earlier in
+     * the batch advances the base, and the next node's refine auto-rebases onto it before
+     * re-running patch-equivalence. No force-push, no reset — conflicting nodes are
+     * isolated as blocked_review while the rest of the batch proceeds.
+     */
+    private batchRefineMeshNodes;
+    /**
+     * Convergence core shared by the synchronous batch entry and the async batch job.
+     * Refines each node in order: the per-node refine pipeline fetches origin/<base>
+     * fresh, so each merged sibling advances the base before the next node's auto-rebase
+     * + patch-equivalence re-check. A blocked/failed node is isolated; the batch
+     * continues with the remaining nodes. Does NOT touch the per-node merge logic — it
+     * only sequences calls to executeMeshRefineNodeSynchronously and aggregates outcomes.
+     */
+    private runMeshRefineBatchConvergence;
+    private buildRefineBatchJobKey;
+    private buildRefineBatchJobHandle;
+    /**
+     * Emit a batch Refinery terminal/accepted event through the SAME pending-event +
+     * forward mechanism single-node refine uses (queueRefineJobEvent), so the
+     * coordinator's existing refine:accepted/completed/failed handling and message
+     * renderer apply unchanged. The aggregate per-node results ride along in `result`.
+     */
+    private queueRefineBatchJobEvent;
+    private appendRefineBatchJobLedger;
+    private finishMeshRefineBatchJob;
+    /**
+     * Async entry for the batch Refinery execute path. Mirrors startMeshRefineJob:
+     * resolves the plan synchronously (so target/ordering errors and the dry-run shape
+     * stay synchronous), then for execute=true registers an in-flight batch job, returns
+     * {async:true, status:'accepted', batch:true, ...plan} immediately, and runs the
+     * convergence loop in the background — emitting the same terminal refine event.
+     * Idempotent: a batch already in flight for this mesh returns the running handle
+     * with duplicate:true rather than spawning a second background job.
+     */
+    private startMeshRefineBatchJob;
+    private finishMeshRefineJob;
+    private startMeshRefineJob;
     /**
      * Daemon-level command execution (IDE start/stop/restart, CLI, detect, logs).
      * Returns null if not handled at this level → caller delegates to CommandHandler.