@adhdev/daemon-core 0.9.82-rc.411 → 0.9.82-rc.413

package/dist/mesh/mesh-ledger.d.ts

@@ -14,7 +14,7 @@
  */
 import { EventEmitter } from 'events';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
-export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned' | 'event_held' | 'task_reclaimed' | 'coordinator_operating_note';
+export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned' | 'event_held' | 'task_reclaimed' | 'coordinator_operating_note' | 'mission_created' | 'mission_status_changed' | 'mission_goal_updated';
 export interface MeshLedgerEntry {
     id: string;
     meshId: string;

package/dist/mesh/mesh-task-inflight.d.ts

@@ -0,0 +1,46 @@
+/**
+ * CANON-IDENTITY single-flight dispatch guard.
+ *
+ * A queue task is double-dispatched into two worker sessions when a SECOND dispatch
+ * path opens after the first has already claimed + dispatched the task. The two
+ * observed paths:
+ *   - the idle-claim drain / auto-launch both funnel through tryAssignQueueTask,
+ *     which is serialized by the atomic claim transaction (claimNextQueueTask) — so
+ *     two concurrent claims can never both win; and
+ *   - the operator requeue tool (mesh_queue_requeue → requeueTask), which flips an
+ *     already-`assigned` row back to `pending` REGARDLESS of whether the worker
+ *     holding it is still generating. A requeue issued while the worker is mid-turn
+ *     re-opens the task for a SECOND session to claim — the live `ade8586d` race.
+ *
+ * The atomic claim already discriminates pending-vs-assigned, but it cannot tell a
+ * GENUINELY-in-flight assigned row (dispatched, worker generating) from a STALE
+ * assigned row (dead session, dispatch never confirmed) — and the requeue contract
+ * must still reopen the stale case. This module is that discriminator: a task id is
+ * registered here ONLY by the dispatch path at the moment it hands the claimed task
+ * to a transport, and cleared the moment the task leaves the `assigned` state
+ * (terminal completion/failure, dispatch-failure requeue, cancel, reclaim, or a
+ * forced requeue). requeueTask consults it and refuses (no-op) to reopen a task that
+ * is still in-flight unless the caller passes `force`.
+ *
+ * Dependency-free leaf (no imports) so both mesh-queue-assignment (begin) and
+ * mesh-work-queue (clear + the requeue guard) can import it without a cycle. The key
+ * is `${meshId}::${taskId}`; a task id is a single-form UUID, so no daemon-id
+ * normalization is needed on the key itself.
+ */
+/**
+ * Mark a task as actively dispatched/generating (in-flight). Called by the dispatch
+ * path right after a successful claim, before/as the task is handed to a transport.
+ * Returns true when this call transitioned the task into the in-flight set, false
+ * when it was already in-flight (a redundant begin — the caller may treat that as a
+ * signal that a dispatch is already live for this task).
+ */
+export declare function beginTaskDispatchInFlight(meshId: string, taskId: string): boolean;
+/** True while a task is actively dispatched/generating (registered by the dispatch
+ *  path and not yet cleared by a terminal/requeue/cancel transition). */
+export declare function isTaskDispatchInFlight(meshId: string, taskId: string): boolean;
+/** Clear a task's in-flight mark. Called whenever the task leaves the `assigned`
+ *  state (terminal completion/failure, dispatch-failure requeue, cancel, reclaim, or
+ *  a forced requeue). Idempotent / safe to call when the task was never in-flight. */
+export declare function endTaskDispatchInFlight(meshId: string, taskId: string): void;
+/** Test-only: drop all in-flight marks so a fresh test starts from a clean guard. */
+export declare function __resetTaskDispatchInFlightForTests(): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.411",
+  "version": "0.9.82-rc.413",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.411",
+    "@adhdev/mesh-shared": "0.9.82-rc.413",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/commands/high-family/mesh-coordinator-launch.ts

@@ -177,10 +177,15 @@ export const meshCoordinatorLaunchHandlers: Record<string, HighFamilyHandler> =
 
                     // OPSRULES — layer the repo-shared declarative mesh config
                     // (.adhdev/mesh.json in the coordinator node workspace, else
-                    // the calling cwd) UNDER the machine-local mesh entry. The
-                    // merge is LOCAL-WINS and in-memory only: meshes.json on disk
-                    // is never mutated. The effective mesh feeds prompt building;
-                    // operating notes are merged with the runtime ledger below.
+                    // the calling cwd) UNDER the machine-local mesh entry. Only the
+                    // COORDINATOR zone (prompt override/append) is merged — policy is
+                    // machine-local and is never sourced from the repo file. The merge
+                    // is in-memory only: meshes.json on disk is never mutated. Coordinator
+                    // launch needs only the mesh.json zone (coordinator + operatingNotes),
+                    // so it reads that dedicated loader directly rather than the unified
+                    // loadRepoSettings (which would also touch refine/bootstrap via the
+                    // machine-local inline seam). The effective mesh feeds prompt
+                    // building; operating notes are merged with the runtime ledger below.
                     const { loadRepoMeshJsonConfig, applyRepoMeshConfig, mergeEffectiveOperatingNotes } =
                         await import('../../config/mesh-json-config.js');
                     const repoMeshConfigLoad = loadRepoMeshJsonConfig(workspace);

package/src/commands/med-family/mesh-crud.ts

@@ -16,6 +16,7 @@ import {
     runMeshWorktreeBootstrap,
     type WorktreeBootstrapState,
 } from '../../mesh/worktree-bootstrap-config.js';
+import { loadRepoSettings } from '../../config/repo-settings.js';
 import { handleMeshForwardEvent, queuePendingMeshCoordinatorEvent } from '../../mesh/mesh-events.js';
 import { loadConfig } from '../../config/config.js';
 import {
@@ -24,8 +25,61 @@ import {
     readMeshNodeMachineId,
 } from '../router.js';
 import type { CommandRouterResult } from '../router.js';
+import type { GitRepoIdentity } from '../../git/git-types.js';
 import type { MedFamilyContext, MedFamilyHandler } from './types.js';
 
+/**
+ * Decision for syncing a freshly-cloned worktree's `oss` submodule to its clone
+ * source node, applying resolveWorktreeBaseStartPoint's origin-tip-priority
+ * policy to the submodule.
+ *
+ * On clone, `submodule update --init` checks the worktree's `oss` out at the
+ * gitlink recorded in the FRESH root base — which the root base-stale fix
+ * branches from origin/main, so it is the up-to-date origin tip. The clone
+ * source node's *working* `oss` SHA can lag that tip. The original sync blindly
+ * checked out the source SHA whenever it merely differed, which REWINDS the
+ * submodule back onto the stale source and re-introduces staleness.
+ *
+ * Guard policy (never rewind, mirror the base-start-point resolver):
+ *   - source SHA == worktree SHA            → `noop`
+ *   - source SHA is an ancestor of worktree → `skip_rewind`  (source is behind; keep fresh tip)
+ *   - worktree SHA is an ancestor of source → `advance`      (source strictly newer; safe fast-forward)
+ *   - neither is an ancestor (diverged)     → `skip_diverged` (keep fresh tip; coordinator reconciles)
+ *
+ * Both SHAs must already be resolvable in `ossCtx` (the caller fetches the
+ * source SHA first). A non-1 git exit (unresolvable SHA / real failure) is
+ * rethrown so the caller can fall back to keeping the fresh worktree HEAD.
+ */
+export type OssCloneSyncAction = 'noop' | 'advance' | 'skip_rewind' | 'skip_diverged';
+
+export async function decideOssCloneSync(
+    ossCtx: GitRepoIdentity,
+    worktreeOssSha: string,
+    sourceSha: string,
+    rg: (ctx: GitRepoIdentity, argv: string[], opts?: { timeoutMs?: number }) => Promise<unknown>,
+): Promise<OssCloneSyncAction> {
+    if (!worktreeOssSha || !sourceSha || worktreeOssSha === sourceSha) return 'noop';
+
+    const isAncestor = async (ancestor: string, descendant: string): Promise<boolean> => {
+        try {
+            await rg(ossCtx, ['merge-base', '--is-ancestor', ancestor, descendant], { timeoutMs: 10000 });
+            return true;
+        } catch (err: any) {
+            // `merge-base --is-ancestor` exits 1 for a clean "not an ancestor".
+            // Any other exit (128 = unresolvable commit, etc.) is a real failure.
+            if (err?.exitCode === 1 || err?.code === 1) return false;
+            throw err;
+        }
+    };
+
+    // Source is an ancestor of the fresh worktree tip → checking it out rewinds.
+    if (await isAncestor(sourceSha, worktreeOssSha)) return 'skip_rewind';
+    // Worktree tip is an ancestor of source → source is strictly newer → safe FF.
+    if (await isAncestor(worktreeOssSha, sourceSha)) return 'advance';
+    // Neither is an ancestor → diverged → keep the fresh worktree HEAD.
+    return 'skip_diverged';
+}
+
 export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
     list_meshes: async (_ctx: MedFamilyContext, _args: any) => {
         try {
@@ -129,7 +183,8 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
     // entry. This is an export scaffold for the operator to review and commit to
     // the repo, NOT an automatic data migration: nothing is written to disk and
     // meshes.json is untouched. The returned `scaffold` (object) + `scaffoldJson`
-    // (2-space text) capture the local policy + coordinator prompt override/append.
+    // (2-space text) capture the coordinator prompt override/append (policy is
+    // machine-local and is intentionally NOT exported into mesh.json).
     export_mesh_json_config: async (_ctx: MedFamilyContext, args: any) => {
         const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
         if (!meshId) return { success: false, error: 'meshId required' };
@@ -637,7 +692,10 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
             };
 
             const initSubmodules = (sourceNode.policy as any)?.initSubmodulesOnClone !== false;
-            const loadedBootstrap = loadMeshWorktreeBootstrapConfig(mesh, result.worktreePath);
+            // Read the worktree bootstrap config through the unified RepoSettings
+            // loader (file-separated `.adhdev/worktree_bootstrap.json`; machine-local
+            // inline seam honored). runMeshWorktreeBootstrap below re-loads it to run.
+            const loadedBootstrap = loadRepoSettings({ workspace: result.worktreePath, mesh }).worktreeBootstrap;
             const runningBootstrapState: WorktreeBootstrapState = {
                 status: 'running',
                 required: loadedBootstrap.config?.required !== false,
@@ -679,13 +737,32 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
                                     const worktreeOssHeadOut = await rg(ossCtx, ['rev-parse', 'HEAD'], { timeoutMs: 10000 });
                                     const worktreeOssSha = (typeof worktreeOssHeadOut === 'string' ? worktreeOssHeadOut : (worktreeOssHeadOut as any)?.stdout ?? '').trim();
 
-                                    if (worktreeOssSha !== sourceSha) {
-                                        // Fetch target SHA from source node's oss directory
+                                    if (worktreeOssSha && worktreeOssSha !== sourceSha) {
+                                        // Bring the source node's oss HEAD into the worktree object DB so
+                                        // both SHAs are resolvable for the ancestry (rewind) guard below.
                                         await rg(ossCtx, ['fetch', `${sourceWorkspace}/oss`, 'HEAD'], { timeoutMs: 60000 });
-                                        await rg(ossCtx, ['checkout', sourceSha], { timeoutMs: 10000 });
-                                        await rg(worktreeCtx, ['add', 'oss'], { timeoutMs: 10000 });
-                                        await rg(worktreeCtx, ['commit', '-m', 'chore: sync oss to source node HEAD on clone'], { timeoutMs: 10000 });
-                                        console.log(`[mesh] Synced oss submodule to source HEAD ${sourceSha.slice(0, 8)} in worktree`);
+
+                                        // Rewind guard: the worktree oss HEAD was just checked out from the
+                                        // FRESH (origin/main-derived) root base. Only advance to the source
+                                        // SHA when it is strictly newer — never rewind to a stale source.
+                                        let ossAction: OssCloneSyncAction;
+                                        try {
+                                            ossAction = await decideOssCloneSync(ossCtx, worktreeOssSha, sourceSha, rg);
+                                        } catch (decideErr: any) {
+                                            ossAction = 'skip_diverged';
+                                            console.warn(`[mesh] oss submodule sync guard could not resolve ancestry (kept fresh worktree HEAD): ${decideErr?.message ?? decideErr}`);
+                                        }
+
+                                        if (ossAction === 'advance') {
+                                            await rg(ossCtx, ['checkout', sourceSha], { timeoutMs: 10000 });
+                                            await rg(worktreeCtx, ['add', 'oss'], { timeoutMs: 10000 });
+                                            await rg(worktreeCtx, ['commit', '-m', 'chore: sync oss to source node HEAD on clone'], { timeoutMs: 10000 });
+                                            console.log(`[mesh] Advanced oss submodule to newer source HEAD ${sourceSha.slice(0, 8)} in worktree`);
+                                        } else if (ossAction === 'skip_rewind') {
+                                            console.warn(`[mesh] Skipped oss submodule rewind on clone: source node oss ${sourceSha.slice(0, 8)} is an ancestor of the fresh worktree oss ${worktreeOssSha.slice(0, 8)} — kept fresher worktree HEAD`);
+                                        } else if (ossAction === 'skip_diverged') {
+                                            console.warn(`[mesh] Skipped oss submodule sync on clone: source node oss ${sourceSha.slice(0, 8)} diverged from the fresh worktree oss ${worktreeOssSha.slice(0, 8)} — kept worktree HEAD (coordinator reconciles)`);
+                                        }
                                     }
                                 }
                             } catch (ossErr: any) {

package/src/commands/med-family/mesh-queue.ts

@@ -74,8 +74,22 @@ export const meshQueueHandlers: Record<string, MedFamilyHandler> = {
                 targetSessionId: typeof args?.targetSessionId === 'string' ? args.targetSessionId.trim() : undefined,
                 clearTargetNode: args?.clearTargetNode === true,
                 clearTargetSession: args?.clearTargetSession !== false,
+                // CANON-IDENTITY: an in-flight (actively-generating) task is refused by
+                // default to avoid a duplicate second dispatch; an explicit operator
+                // force overrides that guard (and the retry cap).
+                force: args?.force === true,
             });
             if (!task) return { success: false, error: `Queue task '${taskId}' not found` };
+            // The single-flight guard returns the row UNCHANGED (still 'assigned') when it
+            // refuses an in-flight requeue — surface that as a clear, non-success signal so
+            // the coordinator does not believe a second dispatch was opened.
+            if (task.status === 'assigned' && args?.force !== true) {
+                return {
+                    success: false,
+                    error: `Task '${taskId}' is actively dispatched/generating; requeue refused to avoid a duplicate second dispatch. Pass force:true to override, or cancel and re-enqueue.`,
+                    task,
+                };
+            }
             return { success: true, task };
         } catch (e: any) {
             return { success: false, error: e.message };