@adhdev/daemon-core 0.9.82-rc.420 → 0.9.82-rc.422

package/dist/mesh/mesh-event-forwarding.d.ts

@@ -16,4 +16,26 @@ export declare function handleMeshForwardEvent(components: DaemonComponents, pay
     success: boolean;
     error: string;
 };
+/**
+ * NOTIF-HELD-DRAIN (Fix 2): event-driven coordinator drain. The reconcile loop delivers a
+ * worker's queued completion to an IDLE local coordinator only on its periodic poll. When a
+ * coordinator is sitting idle awaiting exactly that completion, waiting up to a full poll
+ * interval is the avoidable delivery latency the RCA flags — and combined with the (now-fixed)
+ * modal-park false-positive it stretched into the multi-minute notification stall. So the
+ * MOMENT a worker delegate event is persisted for a mesh, attempt the same idle-coordinator
+ * drain immediately, mirroring the event-driven worker-claim path (agent:ready /
+ * agent:generating_completed → triggerMeshQueue).
+ *
+ * Safety:
+ *  - drainPendingMeshCoordinatorEvents marks rows drained=1 atomically, so this races the
+ *    reconcile poll and the coordinator's own idle auto-flush harmlessly — exactly one consumes
+ *    each row.
+ *  - Only IDLE, non-modal-parked coordinators are delivery targets (never a generating /
+ *    consent-modal PTY).
+ *  - Strict session routing is honoured: an event naming an originating coordinator session is
+ *    delivered only to that live idle session; anything not currently deliverable here
+ *    (wrong/absent session, or a message-less lifecycle event) is RE-QUEUED — never dropped —
+ *    so the reconcile loop's strict hold/expire path remains the single authority for it.
+ */
+export declare function flushPendingForMeshIdleCoordinators(components: DaemonComponents, meshId: string): void;
 export declare function setupMeshEventForwarding(components: DaemonComponents): void;

package/dist/providers/cli-provider-instance.d.ts

@@ -205,6 +205,17 @@ export declare class CliProviderInstance implements ProviderInstance {
      * absent from some of them.
      */
     resolveModalParkStatus(): 'waiting_choice' | 'waiting_approval' | null;
+    /**
+     * NOTIF-HELD-DRAIN: true when this `waiting_approval` is a routine, transient tool-consent
+     * of an autonomously-progressing mesh session rather than a genuine human-await modal —
+     * i.e. it is a mesh coordinator/worker session, a turn is actively in flight
+     * (hasAdapterPendingResponse), and no human is attending it by hand. Such a consent is
+     * driven to resolution by the harness/operator as part of the in-flight turn, so holding
+     * the mesh's completion events behind it (modal_parked) is the false-positive that stalls
+     * delivery. Narrow by design: manual attendance or a non-progressing session falls through
+     * to the genuine-modal classification.
+     */
+    private isTransientToolConsent;
     /** True when this session is parked on a modal awaiting a human answer. */
     isModalParked(): boolean;
     onEvent(event: string, data?: any): void;

package/dist/providers/provider-instance-manager.d.ts

@@ -84,15 +84,30 @@ export declare class ProviderInstanceManager {
     updateInstanceSettings(providerType: string, settings: Record<string, any>): number;
     /** Stamp a mesh assignment on a single instance (used by mesh_send_task
      *  --direct so the worker's completion event has a coordinator routing
-     *  marker in state.settings). Returns true if the instance existed and
-     *  the stamp was applied. */
+     *  marker in state.settings). Returns `{ stamped: true }` when the stamp was
+     *  applied, or `{ stamped: false, reason }` when it was refused — the instance
+     *  was missing / has no attach method, or the DOUBLE-DISPATCH idempotence guard
+     *  fired (the same task is already running on another live session here). */
     attachMeshAssignmentToInstance(instanceId: string, assignment: {
         meshId: string;
         nodeId?: string;
         taskId?: string;
         coordinatorDaemonId?: string;
         coordinatorSessionId?: string;
-    }): boolean;
+    }): {
+        stamped: boolean;
+        reason?: string;
+    };
+    /**
+     * DOUBLE-DISPATCH support: the id of another LIVE, actively-working instance that already
+     * holds (meshId, taskId), or null. "Live working" = stamped with this exact mesh+task AND
+     * currently mid-turn / booting toward it (generating / waiting on approval-or-choice /
+     * starting) — NOT idle, stopped, or errored. A stale/dead/idle holder is deliberately
+     * ignored so a legitimate re-dispatch (e.g. after a dispatch failure) is never blocked.
+     * The instance being stamped (excludeInstanceId) is skipped so re-stamping the same
+     * session stays idempotent. O(n) over instances — the count is small.
+     */
+    private findLiveWorkingTaskHolder;
     /** Clear a mesh assignment after the dispatched task reaches a terminal
      *  state (generating_completed / stopped / failed). */
     detachMeshAssignmentFromInstance(instanceId: string): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.420",
+  "version": "0.9.82-rc.422",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.420",
+    "@adhdev/mesh-shared": "0.9.82-rc.422",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/commands/cli-manager.ts

@@ -1535,14 +1535,22 @@ export class DaemonCliManager {
                     const meshContext = (args as any)?.meshContext;
                     if (meshContext && typeof meshContext === 'object' && typeof meshContext.meshId === 'string' && meshContext.meshId) {
                         const targetInstanceId = key;
+                        let stampResult: { stamped: boolean; reason?: string } | undefined;
                         try {
-                            this.deps.getInstanceManager()?.attachMeshAssignmentToInstance(targetInstanceId, {
+                            stampResult = this.deps.getInstanceManager()?.attachMeshAssignmentToInstance(targetInstanceId, {
                                 meshId: meshContext.meshId,
                                 ...(typeof meshContext.nodeId === 'string' && meshContext.nodeId ? { nodeId: meshContext.nodeId } : {}),
                                 ...(typeof meshContext.taskId === 'string' && meshContext.taskId ? { taskId: meshContext.taskId } : {}),
                                 ...(typeof meshContext.coordinatorDaemonId === 'string' && meshContext.coordinatorDaemonId ? { coordinatorDaemonId: meshContext.coordinatorDaemonId } : {}),
                             });
-                        } catch { /* best-effort */ }
+                        } catch { /* best-effort — stamping is a routing aid, not a hard requirement */ }
+                        // DOUBLE-DISPATCH stamp guard: the instance manager refused this stamp because
+                        // the SAME task is already running on another live session on this daemon.
+                        // Sending the prompt anyway would double-execute the task — fail closed so the
+                        // coordinator does not duplicate the work onto a second session.
+                        if (stampResult && stampResult.stamped === false && stampResult.reason === 'task_already_stamped_on_live_instance') {
+                            throw new Error(`Refusing duplicate mesh dispatch: task ${meshContext.taskId} is already being worked by a live session on this daemon`);
+                        }
                     }
                     const input = normalizeInputEnvelope(args?.input ? { input: args.input } : args);
                     const provider = this.providerLoader.resolve(agentType) || this.providerLoader.getMeta(agentType);

package/src/index.ts

@@ -293,7 +293,7 @@ export type { PendingMeshCoordinatorEvent } from './mesh/mesh-events.js';
 // (finalSummary / workerResult.summary / lastMessagePreview). Same data the mobile
 // inbox is fed; reused by mesh_read_chat's cache fallback when the live P2P read path
 // is unavailable (saturated/unreachable peer).
-export { resolveMeshSurfacedSessionPreview, readMeshCompletionSummary } from './mesh/mesh-events-utils.js';
+export { resolveMeshSurfacedSessionPreview, readMeshCompletionSummary, isWeakCompletionEvidence } from './mesh/mesh-events-utils.js';
 
 // ── Mesh Delivery Policy ──
 export { resolveDeliveryDecision, createSessionDelivery, updateSessionDeliveryStatus, getActiveSessionDeliveries, markSessionDeliveriesTerminal, recordCompletionConflict, getRecentCompletionConflicts } from './mesh/mesh-delivery-policy.js';

package/src/mesh/mesh-event-forwarding.ts

@@ -7,7 +7,8 @@ import type { SessionRecoveryContext } from './mesh-ledger.js';
 import { updateSessionTaskStatus, enqueueTask, updateDirectDispatchStatus, cleanupTerminalDirectDispatches, getActiveDirectDispatches, hasPendingDependents, getQueue } from './mesh-work-queue.js';
 import { markSessionDeliveriesTerminal, updateSessionDeliveryStatus, recordCompletionConflict } from './mesh-delivery-policy.js';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
-import { queuePendingMeshCoordinatorEvent, drainPendingMeshCoordinatorEvents } from './mesh-events-pending.js';
+import { queuePendingMeshCoordinatorEvent, drainPendingMeshCoordinatorEvents, type PendingMeshCoordinatorEvent } from './mesh-events-pending.js';
+import type { ProviderInstance } from '../providers/provider-instance.js';
 import { resolveWorkerDelegateRouting, recordUnroutableDelegateEvent, isUnroutableDelegateRejection } from './mesh-routing.js';
 import { resolveMeshHostStatus } from './mesh-host-ownership.js';
 import { enqueueUnresolvedDelegateForward, peekUnresolvedDelegateForwards, ackUnresolvedDelegateForward } from './mesh-unresolved-forward-outbox.js';
@@ -1670,6 +1671,93 @@ function ackUnresolvedDelegateForwardByFingerprint(
     if (match) ackUnresolvedDelegateForward(match.id);
 }
 
+/**
+ * NOTIF-HELD-DRAIN (Fix 2): event-driven coordinator drain. The reconcile loop delivers a
+ * worker's queued completion to an IDLE local coordinator only on its periodic poll. When a
+ * coordinator is sitting idle awaiting exactly that completion, waiting up to a full poll
+ * interval is the avoidable delivery latency the RCA flags — and combined with the (now-fixed)
+ * modal-park false-positive it stretched into the multi-minute notification stall. So the
+ * MOMENT a worker delegate event is persisted for a mesh, attempt the same idle-coordinator
+ * drain immediately, mirroring the event-driven worker-claim path (agent:ready /
+ * agent:generating_completed → triggerMeshQueue).
+ *
+ * Safety:
+ *  - drainPendingMeshCoordinatorEvents marks rows drained=1 atomically, so this races the
+ *    reconcile poll and the coordinator's own idle auto-flush harmlessly — exactly one consumes
+ *    each row.
+ *  - Only IDLE, non-modal-parked coordinators are delivery targets (never a generating /
+ *    consent-modal PTY).
+ *  - Strict session routing is honoured: an event naming an originating coordinator session is
+ *    delivered only to that live idle session; anything not currently deliverable here
+ *    (wrong/absent session, or a message-less lifecycle event) is RE-QUEUED — never dropped —
+ *    so the reconcile loop's strict hold/expire path remains the single authority for it.
+ */
+export function flushPendingForMeshIdleCoordinators(components: DaemonComponents, meshId: string): void {
+    // O(1) gate: skip the (relatively expensive) per-instance getState scan when the queue is
+    // empty for this mesh.
+    try {
+        const store = MeshRuntimeStore.getInstance();
+        if (store.pendingEventCount(meshId) === 0) return;
+    } catch { /* store unavailable — fall through and let the drain decide */ }
+
+    const idleCoordinators: { instance: ProviderInstance; sessionId: string }[] = [];
+    try {
+        for (const inst of components.instanceManager.getByCategory('cli')) {
+            const state = inst.getState();
+            const settings = state.settings && typeof state.settings === 'object'
+                ? state.settings as Record<string, unknown>
+                : {};
+            if (readNonEmptyString(settings.meshCoordinatorFor) !== meshId) continue;
+            const status = readNonEmptyString(state.status).toLowerCase();
+            const modalParked = typeof (inst as any).isModalParked === 'function'
+                ? (inst as any).isModalParked() === true
+                : (status === 'waiting_choice' || status === 'waiting_approval');
+            if (status === 'idle' && !modalParked) {
+                idleCoordinators.push({ instance: inst, sessionId: readNonEmptyString(state.instanceId) });
+            }
+        }
+    } catch { return; }
+    if (idleCoordinators.length === 0) return; // no idle target now → leave for the reconcile poll
+
+    const drainDaemonIds = resolveCoordinatorDrainDaemonIds(components);
+    let pendingEvents: PendingMeshCoordinatorEvent[];
+    try {
+        pendingEvents = drainPendingMeshCoordinatorEvents(meshId, drainDaemonIds.length > 0 ? drainDaemonIds : undefined);
+    } catch (e: any) {
+        LOG.warn('MeshEvents', `Event-driven coordinator drain failed for mesh ${meshId}: ${e?.message || e}`);
+        return;
+    }
+    if (pendingEvents.length === 0) return;
+
+    let delivered = 0;
+    for (const pending of pendingEvents) {
+        const wantSession = readNonEmptyString(pending.targetCoordinatorSessionId);
+        const targets = wantSession
+            ? idleCoordinators.filter(c => c.sessionId === wantSession)
+            : idleCoordinators;
+        // Not deliverable into an idle target here (wrong/absent session), or a message-less
+        // lifecycle event (agent:ready / generating_started carry no coordinatorMessage and
+        // must not be injected): re-queue so the reconcile loop owns it (lazy-synth / strict
+        // hold/expire). Re-queue preserves queuedAt so the strict TTL measures true age.
+        if (targets.length === 0 || !pending.coordinatorMessage) {
+            try { queuePendingMeshCoordinatorEvent(pending); } catch { /* best-effort re-queue */ }
+            continue;
+        }
+        const message = pending.coordinatorMessage;
+        const force = shouldForceInjectMeshEvent(pending.event);
+        for (const c of targets) {
+            c.instance.onEvent('send_message', {
+                input: { text: message, textFallback: message },
+                ...(force ? { force: true } : {}),
+            });
+            delivered++;
+        }
+    }
+    if (delivered > 0) {
+        LOG.info('MeshEvents', `Event-driven drain delivered ${delivered} pending event(s) to ${idleCoordinators.length} idle coordinator(s) for mesh ${meshId}`);
+    }
+}
+
 export function setupMeshEventForwarding(components: DaemonComponents) {
     components.instanceManager.onEvent((event) => {
         // --- Coordinator idle auto-flush (fast path) ---
@@ -1785,5 +1873,11 @@ export function setupMeshEventForwarding(components: DaemonComponents) {
             event: event.event,
             metadataEvent: event,
         });
+
+        // NOTIF-HELD-DRAIN (Fix 2): the worker's event is now persisted in the pending queue.
+        // If a local coordinator for this mesh is sitting idle awaiting it, deliver immediately
+        // instead of waiting up to a full reconcile interval (event-driven, mirrors the
+        // worker-claim path). No-op when no idle coordinator is present (held for reconcile).
+        flushPendingForMeshIdleCoordinators(components, routing.meshId);
     });
 }

package/src/mesh/mesh-queue-assignment.ts

@@ -1098,6 +1098,47 @@ function liveSessionCountForNode(components: DaemonComponents, meshId: string, n
     }).length;
 }
 
+/**
+ * DOUBLE-DISPATCH auto-launch gate: does this node already have a LIVE mesh session that
+ * is NOT holding an assigned queue task — i.e. one that is idle, booting toward its first
+ * claim, or in a momentary non-idle flip? Such a session WILL claim a still-pending task
+ * on its own via the idle→claim / agent:ready drain, so spawning a NEW session here only
+ * races it and yields a duplicate worker that double-stamps the same taskId (the
+ * enqueue → drain-miss → auto-launch RCA: the drain skipped a momentarily-non-idle idle
+ * session as a candidate, and the write-only nodeHasActiveAssignment gate — which only
+ * inspects status='assigned' rows — could not see the about-to-claim session either).
+ *
+ * A session that already HOLDS an assigned queue task is genuine concurrent work, not a
+ * free claimer, and is excluded — so a read-only auto-launch onto a busy-but-no-idle node
+ * is still allowed. A node with NO live mesh session at all (dead, or never launched) does
+ * not match, preserving the legitimate first-session spawn.
+ */
+function nodeHasLiveSessionPendingClaim(components: DaemonComponents, meshId: string, nodeId: string): boolean {
+    // Session ids currently holding an assigned queue task on this node — those are busy,
+    // not pending claimers, so they must NOT suppress a (read-only) launch.
+    const busySessionIds = new Set(
+        getQueue(meshId, { status: ['assigned'] as any })
+            .filter(task => daemonIdsEquivalent(task.assignedNodeId, nodeId))
+            .map(task => readNonEmptyString(task.assignedSessionId))
+            .filter(Boolean),
+    );
+    return components.instanceManager.getByCategory('cli').some((inst: any) => {
+        const state = inst.getState();
+        const settings = state.settings as Record<string, unknown> || {};
+        if (readNonEmptyString(settings.meshNodeFor) !== meshId) return false;
+        const instNodeId = readNonEmptyString(settings.meshNodeId) || readNonEmptyString(settings.nodeId);
+        // Canonical-form match (see nodeHasActiveMeshWork / liveSessionCountForNode): a
+        // daemon-id form skew must not make a present session look absent and reopen the
+        // duplicate-launch hole.
+        if (!daemonIdsEquivalent(instNodeId, nodeId)) return false;
+        const status = readNonEmptyString(state.status).toLowerCase();
+        if (isTerminalSessionStatus(status)) return false; // dead → no claimer here, allow launch
+        const sessionId = readNonEmptyString(state.instanceId);
+        if (sessionId && busySessionIds.has(sessionId)) return false; // busy with its own assigned task
+        return true; // live + unassigned → will claim the pending task itself
+    });
+}
+
 function recordAutoLaunchEvent(meshId: string, args: {
     phase: 'skipped' | 'started' | 'failed' | 'completed';
     taskId: string;
@@ -1417,6 +1458,20 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
                 autoLaunchCooldownUntil.set(launchKey, Date.now() + AUTO_LAUNCH_COOLDOWN_MS); sweepExpiredCooldowns();
                 continue;
             }
+            // DOUBLE-DISPATCH auto-launch gate (see nodeHasLiveSessionPendingClaim): when this
+            // node already has a live session on its way to claim (idle / booting / momentary
+            // non-idle flip), do NOT spawn a second one — that session pulls the pending task
+            // via the normal idle→claim / agent:ready drain. Launching here races it and yields
+            // a duplicate worker that double-stamps the same taskId. Applies to read-only tasks
+            // too: an idle session can claim either kind, while a genuinely BUSY session (holding
+            // its own assigned task) is excluded by the helper, so a read-only launch onto a
+            // busy-but-no-idle node is still allowed. Skip with a transient (non-actionable)
+            // reason so the coordinator is not paged; the 4s reconcile retries, and once the
+            // existing session goes terminal this gate clears and a legitimate launch proceeds.
+            if (nodeHasLiveSessionPendingClaim(components, meshId, nodeId)) {
+                markAutoLaunch(meshId, task.id, { status: 'skipped', reason: 'node_has_live_session_pending_claim', nodeId });
+                continue;
+            }
             // Write tasks keep the one-active-per-node invariant (worktree isolation);
             // read-only diagnoses may auto-launch onto a node that already has an active
             // assignment. Classified by the shared isTaskReadonly predicate.

package/src/mesh/mesh-reconcile-loop.ts

@@ -307,9 +307,17 @@ function findLiveCoordinators(components: DaemonComponents): LiveCoordinator[] {
         const status = readNonEmptyString(state.status).toLowerCase();
         // getState() overlays the modal-park statuses: an active AskUserQuestion
         // prompt surfaces as waiting_choice, a tool-consent prompt as waiting_approval.
-        // Lowercase literal compare — the SessionStatus enum is forked across modules
-        // and waiting_choice is absent from some of them (see cli-provider-instance).
-        const modalParked = status === 'waiting_choice' || status === 'waiting_approval';
+        // NOTIF-HELD-DRAIN (Fix 1): consult the instance's own isModalParked() rather than the
+        // raw status literal so the corrected classification flows here — a busy mesh
+        // coordinator's routine, in-flight tool-consent (auto-approve off) is NOT a human-await
+        // modal and must NOT wedge the mesh's pending completion events under `modal_parked`.
+        // resolveModalParkStatus() (which isModalParked wraps) already encodes that distinction
+        // and the waiting_choice/stalled-auto-approve genuine-modal cases. Fall back to the
+        // status literal for any instance that does not expose the method. Lowercase compare —
+        // the SessionStatus enum is forked across modules and waiting_choice is absent from some.
+        const modalParked = typeof (inst as any).isModalParked === 'function'
+            ? (inst as any).isModalParked() === true
+            : (status === 'waiting_choice' || status === 'waiting_approval');
         const sessionId = readNonEmptyString(state.instanceId);
         // Modal-park transition observability: a coordinator entering modal-park is what
         // begins holding completion events under `modal_parked`; one leaving it is what

package/src/providers/cli-provider-instance.ts

@@ -1134,11 +1134,44 @@ export class CliProviderInstance implements ProviderInstance {
         // as modal-parked so its events are held/surfaced rather than masked behind generating.
         if (adapterStatus.status === 'waiting_approval'
             && (!this.autoApproveEffectivelyActive(adapterStatus.status) || this.autoApproveMaskStalled())) {
+            // NOTIF-HELD-DRAIN (Fix 1): an autonomous mesh session (coordinator or worker)
+            // that is actively progressing a turn — a tool call is in flight
+            // (hasAdapterPendingResponse) and NO human is attending it by hand — surfaces a
+            // routine tool-consent `waiting_approval` on EVERY tool call when auto-approve is
+            // off. That transient consent is part of the turn the harness/operator drives to
+            // completion, NOT a session genuinely wedged awaiting a human's modal answer.
+            // Classifying it modal-parked makes findLiveCoordinators hold the mesh's pending
+            // completion events under `modal_parked` across a busy coordinator's whole work
+            // batch, which is the multi-minute notification stall. Treat such a transient
+            // consent as NOT modal-parked so it is held as ordinary "generating" (released on
+            // the next idle) instead. A manually-attended session, a stalled auto-approve, or a
+            // non-progressing session (no turn in flight) still parks — those are the genuine
+            // human-await cases the guard must keep holding.
+            if (this.isTransientToolConsent()) {
+                return null;
+            }
             return 'waiting_approval';
         }
         return null;
     }
 
+    /**
+     * NOTIF-HELD-DRAIN: true when this `waiting_approval` is a routine, transient tool-consent
+     * of an autonomously-progressing mesh session rather than a genuine human-await modal —
+     * i.e. it is a mesh coordinator/worker session, a turn is actively in flight
+     * (hasAdapterPendingResponse), and no human is attending it by hand. Such a consent is
+     * driven to resolution by the harness/operator as part of the in-flight turn, so holding
+     * the mesh's completion events behind it (modal_parked) is the false-positive that stalls
+     * delivery. Narrow by design: manual attendance or a non-progressing session falls through
+     * to the genuine-modal classification.
+     */
+    private isTransientToolConsent(now = Date.now()): boolean {
+        const isAutonomousMeshSession = this.isMeshWorkerSession() || !!this.settings.meshCoordinatorFor;
+        return isAutonomousMeshSession
+            && this.hasAdapterPendingResponse()
+            && !this.manualAttendance.isAttended(now);
+    }
+
     /** True when this session is parked on a modal awaiting a human answer. */
     isModalParked(): boolean {
         return this.resolveModalParkStatus() !== null;

package/src/providers/provider-instance-manager.ts

@@ -308,23 +308,64 @@ export class ProviderInstanceManager {
 
     /** Stamp a mesh assignment on a single instance (used by mesh_send_task
      *  --direct so the worker's completion event has a coordinator routing
-     *  marker in state.settings). Returns true if the instance existed and
-     *  the stamp was applied. */
-    attachMeshAssignmentToInstance(instanceId: string, assignment: { meshId: string; nodeId?: string; taskId?: string; coordinatorDaemonId?: string; coordinatorSessionId?: string }): boolean {
+     *  marker in state.settings). Returns `{ stamped: true }` when the stamp was
+     *  applied, or `{ stamped: false, reason }` when it was refused — the instance
+     *  was missing / has no attach method, or the DOUBLE-DISPATCH idempotence guard
+     *  fired (the same task is already running on another live session here). */
+    attachMeshAssignmentToInstance(instanceId: string, assignment: { meshId: string; nodeId?: string; taskId?: string; coordinatorDaemonId?: string; coordinatorSessionId?: string }): { stamped: boolean; reason?: string } {
         const inst = this.instances.get(instanceId);
         if (!inst || typeof inst.attachMeshAssignment !== 'function') {
-            try {
-                const { LOG } = require('../logging/logger.js');
-                LOG.warn?.('MeshDispatch', `attachMeshAssignment skipped: instance ${instanceId} ${inst ? 'has no attach method' : 'not found'}`);
-            } catch { /* noop */ }
-            return false;
+            LOG.warn('MeshDispatch', `attachMeshAssignment skipped: instance ${instanceId} ${inst ? 'has no attach method' : 'not found'}`);
+            return { stamped: false, reason: inst ? 'instance_has_no_attach_method' : 'instance_not_found' };
+        }
+        // DOUBLE-DISPATCH stamp idempotence guard (defense in depth): refuse to stamp this
+        // (meshId, taskId) onto a SECOND instance when a DIFFERENT, still-live and actively
+        // working instance already holds the exact same task. Two sessions carrying one taskId
+        // double-execute the work (the auto-launch race RCA: a delayed claim by the original
+        // session plus the new session's post-boot claim sequentially stamp the same task —
+        // the atomic claim only blocks SIMULTANEOUS claims). A stale/dead/idle prior holder is
+        // NOT a conflict — a legitimate re-dispatch after a dispatch failure must still stamp.
+        if (assignment.taskId) {
+            const conflict = this.findLiveWorkingTaskHolder(assignment.meshId, assignment.taskId, instanceId);
+            if (conflict) {
+                LOG.warn('MeshDispatch', `attachMeshAssignment refused: task ${assignment.taskId} (mesh ${assignment.meshId}) is already being worked by live session ${conflict} — skipping duplicate stamp on ${instanceId}`);
+                return { stamped: false, reason: 'task_already_stamped_on_live_instance' };
+            }
         }
         inst.attachMeshAssignment(assignment);
-        try {
-            const { LOG } = require('../logging/logger.js');
-            LOG.info?.('MeshDispatch', `stamped mesh assignment on ${instanceId}: mesh=${assignment.meshId} node=${assignment.nodeId || ''} task=${assignment.taskId || ''} coordinator=${assignment.coordinatorDaemonId || ''}`);
-        } catch { /* noop */ }
-        return true;
+        LOG.info('MeshDispatch', `stamped mesh assignment on ${instanceId}: mesh=${assignment.meshId} node=${assignment.nodeId || ''} task=${assignment.taskId || ''} coordinator=${assignment.coordinatorDaemonId || ''}`);
+        return { stamped: true };
+    }
+
+    /**
+     * DOUBLE-DISPATCH support: the id of another LIVE, actively-working instance that already
+     * holds (meshId, taskId), or null. "Live working" = stamped with this exact mesh+task AND
+     * currently mid-turn / booting toward it (generating / waiting on approval-or-choice /
+     * starting) — NOT idle, stopped, or errored. A stale/dead/idle holder is deliberately
+     * ignored so a legitimate re-dispatch (e.g. after a dispatch failure) is never blocked.
+     * The instance being stamped (excludeInstanceId) is skipped so re-stamping the same
+     * session stays idempotent. O(n) over instances — the count is small.
+     */
+    private findLiveWorkingTaskHolder(meshId: string, taskId: string, excludeInstanceId: string): string | null {
+        // Mid-turn / booting statuses (top-level or activeChat). Anything else — idle, stopped,
+        // error — is not a live worker actively holding the task.
+        const working = new Set(['generating', 'waiting_approval', 'waiting_choice', 'starting', 'streaming', 'working', 'no_progress', 'long_generating']);
+        for (const [id, inst] of this.instances) {
+            if (id === excludeInstanceId) continue;
+            let state: ProviderState;
+            try {
+                state = inst.getState();
+            } catch {
+                continue;
+            }
+            const settings = (state.settings as Record<string, unknown>) || {};
+            if (settings.meshNodeFor !== meshId) continue;
+            if (settings.meshActiveTaskId !== taskId) continue;
+            const status = (typeof state.status === 'string' ? state.status : '').toLowerCase();
+            const chatStatus = (typeof state.activeChat?.status === 'string' ? state.activeChat.status : '').toLowerCase();
+            if (working.has(status) || working.has(chatStatus)) return id;
+        }
+        return null;
     }
 
     /** Clear a mesh assignment after the dispatched task reaches a terminal