@adhdev/daemon-core 0.9.82-rc.431 → 0.9.82-rc.433

package/dist/mesh/mesh-host-ownership.d.ts

@@ -1,6 +1,26 @@
 import type { RepoMeshDaemonRole, RepoMeshHostMetadata, RepoMeshHostStatus } from '../repo-mesh-types.js';
 export declare function normalizeMeshDaemonRole(value: unknown): RepoMeshDaemonRole | undefined;
-export declare function resolveMeshHostStatus(mesh: unknown): RepoMeshHostStatus;
+/**
+ * Options for resolveMeshHostStatus's read-side host-pin default.
+ *
+ * `localDaemonId` is the id of the daemon evaluating the mesh (typically
+ * `deps.statusInstanceId`). When the persisted `meshHost` declares `role:'host'`
+ * but carries NO `hostDaemonId` (the first-setup miss — a host mesh whose pin was
+ * never written to config), the host daemon IS this local daemon by definition, so
+ * we synthesize `hostDaemonId = localDaemonId` (and, when the mesh has a node
+ * representing this daemon, `hostNodeId`). This is the read-side default — the SSOT
+ * is computed from the role + the evaluating daemon's identity rather than requiring
+ * a config migration to backfill every already-created mesh.
+ *
+ * HARD guard: the synthesis fires ONLY for `role:'host'`. A `role:'member'` daemon
+ * must NEVER fill itself in as host — that would make a member falsely claim
+ * coordinator/queue ownership.
+ */
+export interface ResolveMeshHostOptions {
+    /** Id of the daemon evaluating this mesh (e.g. deps.statusInstanceId). */
+    localDaemonId?: string;
+}
+export declare function resolveMeshHostStatus(mesh: unknown, opts?: ResolveMeshHostOptions): RepoMeshHostStatus;
 export declare function isMeshHostOwner(mesh: unknown): boolean;
 export declare function buildMeshHostRequiredFailure(mesh: unknown, operation: string): Record<string, unknown>;
 export declare function requireMeshHostQueueOwner(opts?: {

package/dist/providers/cli-provider-instance.d.ts

@@ -231,6 +231,37 @@ export declare class CliProviderInstance implements ProviderInstance {
     private isTransientToolConsent;
     /** True when this session is parked on a modal awaiting a human answer. */
     isModalParked(): boolean;
+    /**
+     * PTY-OVERTRUST-DRAIN (Defect B). The deliverability/drain status the mesh
+     * reconcile loop must consult — the RAW adapter turn-state, with the
+     * auto-approve "hold-idle" visual mask STRIPPED.
+     *
+     * getState().status overlays `autoApproveHoldIdle`/`autoApproveActive` to paint a
+     * genuinely-idle adapter as `generating` (a UI-flicker suppression while an
+     * auto-approve key-press settles — see getState() ~:800). That mask is correct
+     * for the dashboard, but the reconcile loop trusts it as "the coordinator is
+     * busy" and therefore HOLDS a worker's completion under
+     * `generating_no_idle_coordinator` even though the coordinator's PTY is at a real
+     * turn end and would accept the inject as a turn — the completion is stranded.
+     *
+     * This accessor reports the drain truth instead:
+     *   - 'modal_parked' — a GENUINE human-await modal (AskUserQuestion / a non-
+     *     transient tool-consent). Still excluded from drain (a force-inject here
+     *     writes raw keystrokes the modal eats → data corruption). Mirrors
+     *     isModalParked(), evaluated first so a parked session never reads idle.
+     *   - 'idle' — the RAW adapter is at a turn end (adapter.getStatus(allowParse:false)
+     *     === 'idle') and the session is not modal-parked. Drain-eligible REGARDLESS
+     *     of the auto-approve mask. This is the case the mask used to hide.
+     *   - 'generating' — the raw adapter is genuinely mid-turn. Held (a raw PTY write
+     *     into a generating claude-cli is not consumed as a turn → data loss). The
+     *     intentional removal of force-inject-into-generating is preserved.
+     *   - 'other' — any other raw status (error / starting / waiting_choice handled by
+     *     modal-park above). Not a drain target.
+     *
+     * Uses allowParse:false (engine.activeModal only, side-effect-free) so it never
+     * mutates the very auto-approve mask state the diagnostics read.
+     */
+    getDrainStatus(): 'idle' | 'generating' | 'modal_parked' | 'other';
     onEvent(event: string, data?: any): void;
     recordAcknowledgedUserInput(input: InputEnvelope | string): void;
     /** Drop user-input ack entries older than the dedup window so the map can't grow unbounded. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.431",
+  "version": "0.9.82-rc.433",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.431",
+    "@adhdev/mesh-shared": "0.9.82-rc.433",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/commands/high-family/mesh-status.ts

@@ -65,7 +65,11 @@ export const meshStatusHandlers: Record<string, HighFamilyHandler> = {
                     const meshRecord = await ctx.getMeshForCommand(meshId, args?.inlineMesh, { preferInline: true });
                     const mesh = meshRecord?.mesh;
                     if (!mesh) return { success: false, error: 'Mesh not found' };
-                    const meshHost = resolveMeshHostStatus(mesh);
+                    // Pass the evaluating daemon's id so a host mesh whose
+                    // hostDaemonId was never persisted (HOST-MISSEED-FIRSTSETUP) gets
+                    // pinned to THIS daemon — the dashboard then renders M4 as host
+                    // instead of falling back to 'no host yet'.
+                    const meshHost = resolveMeshHostStatus(mesh, { localDaemonId: ctx.deps.statusInstanceId });
 
                     const refreshRequested = args?.refresh === true || args?.forceRefresh === true;
                     // Compact (default) elides each mission's full goal text from the

package/src/mesh/mesh-event-forwarding.ts

@@ -1717,7 +1717,16 @@ export function flushPendingForMeshIdleCoordinators(components: DaemonComponents
             const modalParked = typeof (inst as any).isModalParked === 'function'
                 ? (inst as any).isModalParked() === true
                 : (status === 'waiting_choice' || status === 'waiting_approval');
-            if (status === 'idle' && !modalParked) {
+            // PTY-OVERTRUST-DRAIN (Defect B): decide idle on the RAW adapter turn-state
+            // (getDrainStatus, mask-stripped) to match the reconcile loop — getState().status
+            // overlays the auto-approve hold-idle mask that paints a genuinely-idle coordinator
+            // `generating`, which would make this opportunistic flush skip a real drain target.
+            // Fall back to the masked literal for any instance without getDrainStatus().
+            const drainStatus: string | null = typeof (inst as any).getDrainStatus === 'function'
+                ? (inst as any).getDrainStatus()
+                : null;
+            const idle = drainStatus !== null ? drainStatus === 'idle' : (status === 'idle');
+            if (idle && !modalParked) {
                 idleCoordinators.push({ instance: inst, sessionId: readNonEmptyString(state.instanceId) });
             }
         }

package/src/mesh/mesh-host-ownership.ts

@@ -1,3 +1,4 @@
+import { daemonIdsEquivalent } from '@adhdev/mesh-shared';
 import type { RepoMeshDaemonRole, RepoMeshHostMetadata, RepoMeshHostStatus } from '../repo-mesh-types.js';
 
 function readObject(value: unknown): Record<string, unknown> | null {
@@ -12,7 +13,28 @@ export function normalizeMeshDaemonRole(value: unknown): RepoMeshDaemonRole | un
     return value === 'host' || value === 'member' ? value : undefined;
 }
 
-export function resolveMeshHostStatus(mesh: unknown): RepoMeshHostStatus {
+/**
+ * Options for resolveMeshHostStatus's read-side host-pin default.
+ *
+ * `localDaemonId` is the id of the daemon evaluating the mesh (typically
+ * `deps.statusInstanceId`). When the persisted `meshHost` declares `role:'host'`
+ * but carries NO `hostDaemonId` (the first-setup miss — a host mesh whose pin was
+ * never written to config), the host daemon IS this local daemon by definition, so
+ * we synthesize `hostDaemonId = localDaemonId` (and, when the mesh has a node
+ * representing this daemon, `hostNodeId`). This is the read-side default — the SSOT
+ * is computed from the role + the evaluating daemon's identity rather than requiring
+ * a config migration to backfill every already-created mesh.
+ *
+ * HARD guard: the synthesis fires ONLY for `role:'host'`. A `role:'member'` daemon
+ * must NEVER fill itself in as host — that would make a member falsely claim
+ * coordinator/queue ownership.
+ */
+export interface ResolveMeshHostOptions {
+    /** Id of the daemon evaluating this mesh (e.g. deps.statusInstanceId). */
+    localDaemonId?: string;
+}
+
+export function resolveMeshHostStatus(mesh: unknown, opts?: ResolveMeshHostOptions): RepoMeshHostStatus {
     const meshRecord = readObject(mesh);
     const raw = readObject(meshRecord?.meshHost);
     const role = normalizeMeshDaemonRole(raw?.role) ?? 'host';
@@ -23,9 +45,25 @@ export function resolveMeshHostStatus(mesh: unknown): RepoMeshHostStatus {
         canOwnQueue: role === 'host',
         defaulted: !raw,
     };
-    const hostDaemonId = readString(raw?.hostDaemonId);
-    const hostNodeId = readString(raw?.hostNodeId);
+    let hostDaemonId = readString(raw?.hostDaemonId);
+    let hostNodeId = readString(raw?.hostNodeId);
     const hostAddress = readString(raw?.hostAddress);
+    // HOST-MISSEED-FIRSTSETUP read-side default: a host mesh with no persisted
+    // hostDaemonId is hosted by THIS daemon (role:'host' is local-relative), so
+    // fill the pin from the evaluating daemon. Member daemons are never synthesized.
+    const localDaemonId = readString(opts?.localDaemonId);
+    if (role === 'host' && !hostDaemonId && localDaemonId) {
+        hostDaemonId = localDaemonId;
+        // Anchor hostNodeId to the node representing this local daemon, when present.
+        if (!hostNodeId && Array.isArray(meshRecord?.nodes)) {
+            const selfNode = (meshRecord!.nodes as unknown[]).find(n => {
+                const nodeDaemonId = readString(readObject(n)?.daemonId);
+                return nodeDaemonId ? daemonIdsEquivalent(nodeDaemonId, localDaemonId) : false;
+            });
+            const selfNodeId = readString(readObject(selfNode)?.id);
+            if (selfNodeId) hostNodeId = selfNodeId;
+        }
+    }
     if (hostDaemonId) normalized.hostDaemonId = hostDaemonId;
     if (hostNodeId) normalized.hostNodeId = hostNodeId;
     if (hostAddress) normalized.hostAddress = hostAddress;

package/src/mesh/mesh-reconcile-loop.ts

@@ -88,6 +88,26 @@ function resolveAutoPruneMinAgeMs(): number {
     return DEFAULT_AUTO_PRUNE_MIN_AGE_MS;
 }
 
+// PTY-OVERTRUST-DRAIN (Defect B, fix B). Age-based escape for the
+// `generating_no_idle_coordinator` hold. Fix A makes the drain predicate read the RAW
+// adapter (mask-stripped), so the common mask-driven false-busy is gone. But a hold can
+// still arise from a genuine status-source desync that fix A does not reach (e.g. the
+// adapter raw itself momentarily reads generating while the coordinator is actually at a
+// turn end). This is a TIME-BASED BACKSTOP: when a mesh's pending terminal events have
+// been held this long, re-confirm the coordinator's RAW adapter idle on the tick and, if
+// it is genuinely idle, drain ONCE. It NEVER injects into a genuinely-generating PTY —
+// the re-confirmation gates on raw adapter idle, so the intentional removal of
+// force-inject-into-generating (data-loss) is preserved. Default 12s = 3 reconcile ticks
+// at the 4s cadence: long enough that a normal mid-turn settle is not pre-empted, short
+// enough that a desync-stranded completion is not held for minutes. Env-tunable.
+const DEFAULT_PENDING_HELD_DRAIN_ESCALATE_MS = 12_000;
+
+function resolvePendingHeldDrainEscalateMs(): number {
+    // Floor 4s (one tick) so a mis-set env cannot make the escape race a normal settle;
+    // ceiling 5min so it cannot be disabled into a permanent strand.
+    return resolveTunedReconcileMs('MESH_PENDING_HELD_DRAIN_ESCALATE_MS', DEFAULT_PENDING_HELD_DRAIN_ESCALATE_MS, 4_000, 5 * 60_000);
+}
+
 function resolveReconcileIntervalMs(): number {
     const raw = readNonEmptyString(process.env.MESH_RECONCILE_INTERVAL_MS);
     if (raw) {
@@ -163,12 +183,58 @@ function resolveAckedDeathDeadlineMs(): number {
     return resolveTunedReconcileMs('MESH_INFLIGHT_ACKED_DEATH_DEADLINE_MS', 8 * 60_000, 0, 60 * 60_000);
 }
 
+// ACKED-HOLD-IDLE-OVERTRUST (transcript-completion fast-track). The indefinite acked-hold above is
+// safe but SLOW: when the worker's real generating_completed emit is dropped/lost, the only thing
+// that promotes the missing completion is the 8-min death backstop — even though the answer has been
+// FULLY rendered in the transcript for minutes (read_chat reports idle WITH a final visible assistant
+// message every ~4s). Observed live: completions surfaced 144s / 492s late, both incompatible with the
+// provider's own emit ceiling (COMPLETED_FINALIZATION_MAX_WAIT_MS 30s + NATIVE_HISTORY_MESH_IDLE_SETTLE
+// 4s ≈ 34s). That gap = a worker that finished, whose PTY generating→idle edge / real emit was lost,
+// held hostage to the 8-min net.
+//
+// Fast-track: when an acked task reads idle AND a final visible assistant message is present (the same
+// transcript-completion evidence PHASE 4 already requires to synth), and that idle-with-final-assistant
+// state has PERSISTED for a short continuous grace, promote the synth EARLY — ahead of the 8-min
+// backstop. The grace is the correctness gate: a SINGLE idle read could be a mid-turn blip (PTY
+// inter-tool-call settle, or final text rendered while the next tool call is about to start), so we
+// require the idle-with-final-assistant signal to hold continuously for the grace window before
+// trusting it as a genuine turn-end. Any non-idle read (generating / waiting_approval), a read
+// failure, or the disappearance of the final assistant message RESETS the streak — so an actively
+// streaming worker that momentarily reads idle never crosses the grace.
+//
+// Safety: this only changes WHEN an acked synth fires (earlier), never WHETHER it is correct —
+// reconcileDirectDispatchCompletionFromTranscript's hasTerminalLedgerAfterDispatch makes a real
+// emit that lands later an idempotent no-op, exactly as the death-backstop synth relies on. The
+// death backstop (8 min) is PRESERVED unchanged as the final net; the fast-track is a faster path in
+// front of it. The grace is set ABOVE the provider's own emit ceiling (~34s) so a worker still inside
+// its normal finalization window is never pre-empted — we only fast-track once enough continuous idle
+// has elapsed that a live emit would already have arrived.
+function resolveAckedTranscriptFastTrackGraceMs(): number {
+    // Default 40s — above the provider emit ceiling (30s COMPLETED_FINALIZATION_MAX_WAIT_MS + 4s
+    // NATIVE_HISTORY_MESH_IDLE_SETTLE ≈ 34s): a genuinely-live worker would have emitted its real
+    // terminal within that window, so 40s of CONTINUOUS idle-with-final-assistant means the emit was
+    // lost, not late. Far below the 8-min death backstop, so the fast-track is the dominant path for a
+    // lost emit while the backstop remains the last-resort net. Floor 0 lets tests force an immediate
+    // fast-track; ceiling 5min keeps a mis-set env from collapsing it into the death backstop.
+    return resolveTunedReconcileMs('MESH_INFLIGHT_ACKED_TRANSCRIPT_FASTTRACK_GRACE_MS', 40_000, 0, 5 * 60_000);
+}
+
 // Per-task in-flight hold state for an acked dispatch:
 //   - liveConfirmedSinceAck: we have seen at least one conclusive read (idle OR generating) since
 //     the ack — proves the session is reachable, so a later read FAILURE is a genuine liveness loss
 //     rather than a node that was never reachable.
 //   - consecutiveReadFailures: streak of inconclusive read_chat results (death backstop (a)).
-const inFlightAckedHoldState = new Map<string, { liveConfirmedSinceAck: boolean; consecutiveReadFailures: number }>();
+//   - transcriptIdleSinceMs: the timestamp of the FIRST tick in the current continuous run of
+//     idle-with-final-assistant reads (ACKED-HOLD-IDLE-OVERTRUST fast-track). Cleared to undefined
+//     whenever the signal breaks (non-idle read, read failure, or no final assistant message), so a
+//     mid-turn idle blip never accumulates grace. When `now - transcriptIdleSinceMs` exceeds the
+//     fast-track grace the synth is promoted ahead of the death backstop.
+interface AckedHoldState {
+    liveConfirmedSinceAck: boolean;
+    consecutiveReadFailures: number;
+    transcriptIdleSinceMs?: number;
+}
+const inFlightAckedHoldState = new Map<string, AckedHoldState>();
 
 function inFlightSynthKey(meshId: string, taskId: string): string {
     return `${meshId}::${taskId}`;
@@ -187,6 +253,13 @@ interface LiveCoordinator {
     // routes back to the exact originating coordinator session, not a sibling on the same
     // daemon (the multi-coordinator misroute).
     sessionId: string;
+    // PTY-OVERTRUST-DRAIN (Defect B): drain-eligibility, decided on the RAW adapter
+    // turn-state (mask-stripped) — NOT on getState().status, which overlays the
+    // auto-approve "hold-idle" visual mask that paints a genuinely-idle coordinator
+    // `generating` and so used to strand its worker's completion. True only when the
+    // raw adapter is at a real turn end AND the session is not modal-parked. When the
+    // instance does not expose getDrainStatus() (non-CLI / older), this falls back to
+    // the masked `status === 'idle'` (the pre-fix behaviour) so nothing regresses.
     idle: boolean;
     // True when the coordinator session is parked on a harness modal awaiting a
     // human answer — claude-cli AskUserQuestion (waiting_choice) or a tool-consent
@@ -318,6 +391,18 @@ function findLiveCoordinators(components: DaemonComponents): LiveCoordinator[] {
         const modalParked = typeof (inst as any).isModalParked === 'function'
             ? (inst as any).isModalParked() === true
             : (status === 'waiting_choice' || status === 'waiting_approval');
+        // PTY-OVERTRUST-DRAIN (Defect B, fix A): drain-eligible idle is decided on the
+        // RAW adapter turn-state, not getState().status. getState() overlays the
+        // auto-approve hold-idle mask that paints a genuinely-idle coordinator
+        // `generating` (a UI-flicker suppressant), and the reconcile loop used to trust
+        // that mask and HOLD the worker's completion (generating_no_idle_coordinator)
+        // even though the PTY was at a real turn end. getDrainStatus() strips the mask
+        // (raw adapter idle, modal-park preserved). Fall back to the masked literal for
+        // any instance that does not expose it (non-CLI / older) — regression-0.
+        const drainStatus: string | null = typeof (inst as any).getDrainStatus === 'function'
+            ? (inst as any).getDrainStatus()
+            : null;
+        const idle = drainStatus !== null ? drainStatus === 'idle' : (status === 'idle');
         const sessionId = readNonEmptyString(state.instanceId);
         // ── NOTIF (B) desync diagnostic (read-only, no behavior change) ───────────
         // The confirmed (B) defect: a coordinator whose FSM is idle (status above ===
@@ -349,7 +434,10 @@ function findLiveCoordinators(components: DaemonComponents): LiveCoordinator[] {
             const lastStatus = readNonEmptyString((inst as any).lastStatus) || '?';
             const autoApproveBusy = (inst as any).autoApproveBusy;
             const maskSince = (inst as any).autoApproveMaskSince;
-            LOG.debug('MeshReconcile', `coordDiag sess=${sessionId || '?'} mesh=${meshId} getState=${status || '?'} lastStatus=${lastStatus} adapterRaw=${adapterRaw} autoApproveBusy=${autoApproveBusy === true} maskSince=${maskSince || 0}`);
+            // PTY-OVERTRUST-DRAIN: include the mask-stripped drainStatus next to the three
+            // legacy sources so the divergence (getState=generating while adapterRaw=idle =
+            // the mask) is directly readable, and confirm drain now follows adapterRaw.
+            LOG.debug('MeshReconcile', `coordDiag sess=${sessionId || '?'} mesh=${meshId} getState=${status || '?'} drainStatus=${drainStatus || 'n/a'} lastStatus=${lastStatus} adapterRaw=${adapterRaw} autoApproveBusy=${autoApproveBusy === true} maskSince=${maskSince || 0}`);
         }
         // Modal-park transition observability: a coordinator entering modal-park is what
         // begins holding completion events under `modal_parked`; one leaving it is what
@@ -365,7 +453,7 @@ function findLiveCoordinators(components: DaemonComponents): LiveCoordinator[] {
                 LOG.info('MeshReconcile', `Coordinator ${sessionId || '?'} (mesh ${meshId}) left modal-park (status=${status}) — held events will drain on this/next tick`);
             }
         }
-        out.push({ meshId, instance: inst, sessionId, idle: status === 'idle', modalParked });
+        out.push({ meshId, instance: inst, sessionId, idle, modalParked });
     }
     return out;
 }
@@ -566,6 +654,107 @@ function recordHeldTerminalEventsToLedger(
     }
 }
 
+// PTY-OVERTRUST-DRAIN (Defect B, fix B). Age of the OLDEST queued terminal/force-inject
+// event for a mesh, in ms — the signal the generating-hold age-escape gates on. Returns 0
+// when there is no held terminal event (no escape needed). Best-effort: a peek failure
+// returns 0 (no escape this tick), never throws into the tick.
+function oldestHeldTerminalEventAgeMs(meshId: string, drainDaemonIds: string[]): number {
+    let pending: readonly PendingMeshCoordinatorEvent[];
+    try {
+        pending = getPendingMeshCoordinatorEvents(meshId, drainDaemonIds.length > 0 ? drainDaemonIds : undefined);
+    } catch {
+        return 0;
+    }
+    const now = Date.now();
+    let maxAge = 0;
+    for (const event of pending) {
+        if (!shouldForceInjectMeshEvent(event.event)) continue; // only terminal events matter
+        const queuedAt = typeof event.queuedAt === 'number' ? event.queuedAt : now;
+        const age = now - queuedAt;
+        if (age > maxAge) maxAge = age;
+    }
+    return maxAge;
+}
+
+// PTY-OVERTRUST-DRAIN (Defect B, fix B). Re-confirm, on the RAW adapter (mask-stripped),
+// which of the held-as-generating coordinators is GENUINELY idle right now. A coordinator
+// whose getDrainStatus() reads 'idle' is a real drain target the time-based escape may
+// deliver into. One that still reads 'generating'/'modal_parked'/'other' stays held — the
+// escape NEVER injects into a genuinely-busy PTY (that is the data-loss force-inject path
+// intentionally removed; re-confirmation is what keeps this safe). Falls back to the
+// coordinator's already-computed `idle` flag when the instance does not expose
+// getDrainStatus() (non-CLI / older) — that flag is itself raw-adapter-derived post-fix-A.
+function reconfirmGenuinelyIdleCoordinators(generating: LiveCoordinator[]): LiveCoordinator[] {
+    const out: LiveCoordinator[] = [];
+    for (const c of generating) {
+        const inst = c.instance as any;
+        const drainStatus: string | null = typeof inst?.getDrainStatus === 'function'
+            ? inst.getDrainStatus()
+            : null;
+        const genuinelyIdle = drainStatus !== null ? drainStatus === 'idle' : c.idle;
+        if (genuinelyIdle) out.push({ ...c, idle: true });
+    }
+    return out;
+}
+
+// Full-drain the local pending queue for a mesh and inject every event into the given
+// IDLE target coordinators, honouring strict session routing. Shared by the normal idle
+// delivery path and the Defect-B age-escape so both deliver identically (one drain, one
+// inject-per-event, strict-route hold for an unmatched session). Returns the number of
+// events drained (0 when the queue was empty / drain failed). Callers must have already
+// confirmed the targets are genuinely idle.
+function drainAndInjectIntoTargets(
+    meshId: string,
+    drainDaemonIds: string[],
+    localDaemonId: string | undefined,
+    targetCoordinators: LiveCoordinator[],
+    logLabel: string,
+): number {
+    let pendingEvents: PendingMeshCoordinatorEvent[] = [];
+    try {
+        pendingEvents = drainPendingMeshCoordinatorEvents(
+            meshId,
+            drainDaemonIds.length > 0 ? drainDaemonIds : localDaemonId,
+        );
+    } catch (e: any) {
+        LOG.warn('MeshReconcile', `Drain failed for mesh ${meshId}: ${e?.message || e}`);
+        return 0;
+    }
+    if (pendingEvents.length === 0) return 0;
+
+    LOG.info('MeshReconcile', `Reconcile inject → ${logLabel}: ${pendingEvents.length} pending event(s) → ${targetCoordinators.length} coordinator(s) for mesh ${meshId}`);
+    for (const pending of pendingEvents) {
+        // Strict session routing (multi-coordinator): when the event names an
+        // originating coordinator session, deliver ONLY to the live coordinator whose
+        // session id matches — a sibling coordinator on the same daemon must NOT receive
+        // another coordinator's completion. When the event carries no session id (legacy /
+        // version-skewed / single-coordinator), fall back to the daemon-level set
+        // (unchanged behaviour — regression-0 for the common case).
+        const wantSession = readNonEmptyString(pending.targetCoordinatorSessionId);
+        if (wantSession) {
+            // SESSION-ID IS SINGLE-FORM: a coordinator session id is one canonical
+            // UUID (crypto.randomUUID), carried verbatim end-to-end — no node/daemon-id
+            // style serialization variants. Exact `===` is the correct match; unlike
+            // the daemon-level set below it needs no equivalence helper.
+            const matched = targetCoordinators.filter(c => c.sessionId === wantSession);
+            if (matched.length === 0) {
+                // The originating coordinator session is not deliverable on this daemon
+                // right now (gone, or modal-parked and excluded from targets). Strict mode
+                // does NOT broadcast to siblings — hold the event for a later tick, and
+                // ledger-expire it past a TTL so it can never wedge forever.
+                holdOrExpireStrictUnmatchedEvent(pending, wantSession, meshId);
+                continue;
+            }
+            for (const c of matched) injectPendingIntoCoordinator(c.instance, pending);
+            continue;
+        }
+        for (const c of targetCoordinators) {
+            injectPendingIntoCoordinator(c.instance, pending);
+        }
+    }
+    return pendingEvents.length;
+}
+
 // One reconcile tick. Two independent phases:
 //
 //   PHASE 1 — Remote queue pull (the fix for remote worktree completions never
@@ -974,6 +1163,31 @@ export async function runMeshReconcileTick(components: DaemonComponents): Promis
                     try { hasPending = store.pendingEventCount(meshId) > 0; } catch { /* peek below */ }
                 }
                 if (hasPending) {
+                    // ── PTY-OVERTRUST-DRAIN (Defect B, fix B): age-based escape ───────────
+                    // Fix A already routes the common mask-driven false-busy to the idle path,
+                    // so reaching here means the coordinator's RAW adapter reads generating.
+                    // That is almost always genuine — but a status-source desync fix A does not
+                    // reach can momentarily make the raw adapter read generating while the PTY
+                    // is actually at a turn end, stranding the completion across many ticks. As a
+                    // TIME-BASED BACKSTOP, once the oldest held terminal event has aged past the
+                    // escalate threshold, RE-CONFIRM each held coordinator's raw adapter idle and,
+                    // if genuinely idle, drain ONCE into it. The re-confirmation gate is what makes
+                    // this safe: it NEVER injects into a genuinely-generating PTY (that is the
+                    // data-loss force-inject path intentionally removed). A coordinator still
+                    // genuinely generating stays held.
+                    const escalateMs = resolvePendingHeldDrainEscalateMs();
+                    const heldAgeMs = oldestHeldTerminalEventAgeMs(
+                        meshId,
+                        drainDaemonIds.length > 0 ? drainDaemonIds : (localDaemonId ? [localDaemonId] : []),
+                    );
+                    if (heldAgeMs >= escalateMs) {
+                        const escapeTargets = reconfirmGenuinelyIdleCoordinators(generatingCoordinators);
+                        if (escapeTargets.length > 0) {
+                            LOG.info('MeshReconcile', `Reconcile age-escape → generating-hold: held terminal event(s) for mesh ${meshId} aged ${Math.round(heldAgeMs / 1000)}s (≥ ${Math.round(escalateMs / 1000)}s) and ${escapeTargets.length} coordinator(s) re-confirmed genuinely idle on the raw adapter — draining once`);
+                            const drained = drainAndInjectIntoTargets(meshId, drainDaemonIds, localDaemonId, escapeTargets, 'age-escape');
+                            if (drained > 0) continue; // delivered → no hold this tick
+                        }
+                    }
                     LOG.info('MeshReconcile', `Reconcile skip → generating: holding pending event(s) for mesh ${meshId} (${generatingCoordinators.length} coordinator(s) busy; events left queued for the next idle tick)`);
                     // NOTIF (B) diagnostic: this is the hold that strands the completion. Name
                     // the sessionId(s) the loop just classified non-idle/non-modal so the
@@ -1005,48 +1219,7 @@ export async function runMeshReconcileTick(components: DaemonComponents): Promis
         // queued event and deliver it to the idle input box as a real turn. The no-idle case
         // (generating/modal-only) was already held above and never reaches here, so there is
         // no force-drain-into-generating path left — the single delivery is the idle drain.
-        let pendingEvents: PendingMeshCoordinatorEvent[] = [];
-        try {
-            pendingEvents = drainPendingMeshCoordinatorEvents(
-                meshId,
-                drainDaemonIds.length > 0 ? drainDaemonIds : localDaemonId,
-            );
-        } catch (e: any) {
-            LOG.warn('MeshReconcile', `Drain failed for mesh ${meshId}: ${e?.message || e}`);
-            continue;
-        }
-        if (pendingEvents.length === 0) continue;
-
-        LOG.info('MeshReconcile', `Reconcile inject → idle: ${pendingEvents.length} pending event(s) → ${targetCoordinators.length} coordinator(s) for mesh ${meshId}`);
-        for (const pending of pendingEvents) {
-            // Strict session routing (multi-coordinator): when the event names an
-            // originating coordinator session, deliver ONLY to the live coordinator whose
-            // session id matches — a sibling coordinator on the same daemon must NOT receive
-            // another coordinator's completion. When the event carries no session id (legacy /
-            // version-skewed / single-coordinator), fall back to the daemon-level set
-            // (unchanged behaviour — regression-0 for the common case).
-            const wantSession = readNonEmptyString(pending.targetCoordinatorSessionId);
-            if (wantSession) {
-                // SESSION-ID IS SINGLE-FORM: a coordinator session id is one canonical
-                // UUID (crypto.randomUUID), carried verbatim end-to-end — no node/daemon-id
-                // style serialization variants. Exact `===` is the correct match; unlike
-                // the daemon-level set below it needs no equivalence helper.
-                const matched = targetCoordinators.filter(c => c.sessionId === wantSession);
-                if (matched.length === 0) {
-                    // The originating coordinator session is not deliverable on this daemon
-                    // right now (gone, or modal-parked and excluded from targets). Strict mode
-                    // does NOT broadcast to siblings — hold the event for a later tick, and
-                    // ledger-expire it past a TTL so it can never wedge forever.
-                    holdOrExpireStrictUnmatchedEvent(pending, wantSession, meshId);
-                    continue;
-                }
-                for (const c of matched) injectPendingIntoCoordinator(c.instance, pending);
-                continue;
-            }
-            for (const c of targetCoordinators) {
-                injectPendingIntoCoordinator(c.instance, pending);
-            }
-        }
+        drainAndInjectIntoTargets(meshId, drainDaemonIds, localDaemonId, targetCoordinators, 'idle');
     }
 }
 
@@ -1485,6 +1658,8 @@ async function reconcileUnterminatedDirectDispatches(
                 const prior = inFlightAckedHoldState.get(synthKey);
                 const failures = (prior?.consecutiveReadFailures ?? 0) + 1;
                 const liveConfirmedSinceAck = prior?.liveConfirmedSinceAck ?? false;
+                // A read failure breaks the idle-with-final-assistant run → reset the fast-track streak
+                // (transcriptIdleSinceMs cleared by omission) so it must re-accumulate from scratch.
                 inFlightAckedHoldState.set(synthKey, { liveConfirmedSinceAck, consecutiveReadFailures: failures });
                 if (liveConfirmedSinceAck && failures >= ACKED_DEATH_CONSECUTIVE_READ_FAILURES) {
                     LOG.warn('MeshReconcile', `Acked-hold death signal: task ${taskId} on node ${nodeId} (mesh ${mesh.id}) read_chat failed ${failures}x consecutively after a live-confirmed ack — worker session presumed gone mid-turn; releasing the indefinite synth hold to the stranded-reclaim / orphan-prune nets`);
@@ -1495,8 +1670,15 @@ async function reconcileUnterminatedDirectDispatches(
 
         // Read succeeded (a conclusive idle/generating status) → the session is reachable: reset the
         // failure streak and mark it live-confirmed-since-ack, so a LATER read failure is recognized
-        // as a genuine liveness loss (backstop a) rather than a node that was never reachable.
-        inFlightAckedHoldState.set(synthKey, { liveConfirmedSinceAck: true, consecutiveReadFailures: 0 });
+        // as a genuine liveness loss (backstop a) rather than a node that was never reachable. The
+        // fast-track idle streak (transcriptIdleSinceMs) is PRESERVED across this reset — it is
+        // managed below where the idle + final-assistant signal is actually evaluated.
+        const priorHoldState = inFlightAckedHoldState.get(synthKey);
+        inFlightAckedHoldState.set(synthKey, {
+            liveConfirmedSinceAck: true,
+            consecutiveReadFailures: 0,
+            ...(priorHoldState?.transcriptIdleSinceMs !== undefined ? { transcriptIdleSinceMs: priorHoldState.transcriptIdleSinceMs } : {}),
+        });
 
         // Only act on a session that has actually settled to idle. A generating /
         // waiting_approval session is mid-turn — synthesizing a completion now would
@@ -1504,7 +1686,9 @@ async function reconcileUnterminatedDirectDispatches(
         const nowMs = Date.now();
         if (readChatPayloadStatus(payload) !== 'idle') {
             // Not idle → the worker is genuinely mid-turn (a clear live signal). Keep the
-            // live-confirmed flag set (above) but otherwise just wait for the real emit.
+            // live-confirmed flag set (above) but RESET the fast-track idle streak: a turn that
+            // resumed generating proves the prior idle was a mid-turn blip, not a settled turn-end.
+            inFlightAckedHoldState.set(synthKey, { liveConfirmedSinceAck: true, consecutiveReadFailures: 0 });
             continue;
         }
 
@@ -1525,15 +1709,50 @@ async function reconcileUnterminatedDirectDispatches(
         // A never-acked dispatch (worker never started) is exempt — no in-flight generation to
         // pre-empt; it keeps the first-idle-tick synth, with the downstream grace + stale-summary
         // guards as its backstops.
+        //
+        // ACKED-HOLD-IDLE-OVERTRUST: the read is idle. Extract the final-assistant evidence NOW (the
+        // same signal the synth below requires) so the fast-track can gate on idle-WITH-final-assistant
+        // rather than bare idle. Only when a final visible assistant message is present do we treat
+        // this tick as a candidate turn-end and accumulate the fast-track grace streak; a bare idle
+        // with no assistant result is the worker still warming up and resets the streak.
+        const messages = Array.isArray(payload.messages) ? payload.messages as ChatMessage[] : [];
+        const evidence = extractFinalAssistantSummaryEvidence(messages);
+
         if (isAcked) {
             const ackedAtMs = Date.parse(readNonEmptyString(dispatch.updatedAt));
             const sinceAckMs = Number.isFinite(ackedAtMs) ? nowMs - ackedAtMs : Number.POSITIVE_INFINITY;
             const deathDeadlineMs = resolveAckedDeathDeadlineMs();
-            if (sinceAckMs < deathDeadlineMs) {
-                LOG.info('MeshReconcile', `Acked-hold: task ${taskId} on node ${nodeId} (mesh ${mesh.id}) read idle ${Number.isFinite(sinceAckMs) ? Math.round(sinceAckMs / 1000) + 's' : '∞'} since the generating_started ack — HOLDING synth indefinitely (worker is alive and will emit; a later real emit is idempotent). Death backstop fires at ${Math.round(deathDeadlineMs / 1000)}s or on consecutive read failures.`);
+
+            // ACKED-HOLD-IDLE-OVERTRUST fast-track. Maintain the continuous idle-with-final-assistant
+            // streak. The streak starts (or continues) only while a final visible assistant message is
+            // present; a tick with idle-but-no-assistant breaks it (the answer is not yet rendered).
+            const holdState = inFlightAckedHoldState.get(synthKey);
+            let fastTrackReady = false;
+            if (evidence.finalSummary) {
+                const idleSinceMs = holdState?.transcriptIdleSinceMs ?? nowMs;
+                if (holdState && holdState.transcriptIdleSinceMs === undefined) {
+                    inFlightAckedHoldState.set(synthKey, { ...holdState, transcriptIdleSinceMs: idleSinceMs });
+                }
+                const fastTrackGraceMs = resolveAckedTranscriptFastTrackGraceMs();
+                const idleHeldMs = nowMs - idleSinceMs;
+                if (idleHeldMs >= fastTrackGraceMs) {
+                    fastTrackReady = true;
+                    LOG.info('MeshReconcile', `Acked-hold transcript fast-track: task ${taskId} on node ${nodeId} (mesh ${mesh.id}) read idle WITH a final assistant message for ${Math.round(idleHeldMs / 1000)}s continuous (grace ${Math.round(fastTrackGraceMs / 1000)}s) — promoting the synth ahead of the ${Math.round(deathDeadlineMs / 1000)}s death backstop; the worker's real emit was lost/late and a later one no-ops idempotently.`);
+                }
+            } else if (holdState?.transcriptIdleSinceMs !== undefined) {
+                // Idle but no final assistant yet → not a turn-end; reset the streak.
+                inFlightAckedHoldState.set(synthKey, { ...holdState, transcriptIdleSinceMs: undefined });
+            }
+
+            // Hold indefinitely UNLESS the fast-track grace was met OR the absolute death deadline is
+            // reached. The fast-track is the new fast path in front of the (preserved) 8-min backstop.
+            if (!fastTrackReady && sinceAckMs < deathDeadlineMs) {
+                LOG.info('MeshReconcile', `Acked-hold: task ${taskId} on node ${nodeId} (mesh ${mesh.id}) read idle ${Number.isFinite(sinceAckMs) ? Math.round(sinceAckMs / 1000) + 's' : '∞'} since the generating_started ack — HOLDING synth (worker presumed alive; a later real emit is idempotent). Transcript fast-track promotes at ${Math.round(resolveAckedTranscriptFastTrackGraceMs() / 1000)}s continuous idle-with-final-assistant; death backstop at ${Math.round(deathDeadlineMs / 1000)}s or on consecutive read failures.`);
                 continue;
             }
-            LOG.warn('MeshReconcile', `Acked-hold death deadline reached: task ${taskId} on node ${nodeId} (mesh ${mesh.id}) still idle ${Math.round(sinceAckMs / 1000)}s after the ack (deadline ${Math.round(deathDeadlineMs / 1000)}s) — synthesizing the missing completion as a notification-loss net (a real emit, if it ever lands, no-ops idempotently).`);
+            if (!fastTrackReady) {
+                LOG.warn('MeshReconcile', `Acked-hold death deadline reached: task ${taskId} on node ${nodeId} (mesh ${mesh.id}) still idle ${Math.round(sinceAckMs / 1000)}s after the ack (deadline ${Math.round(deathDeadlineMs / 1000)}s) — synthesizing the missing completion as a notification-loss net (a real emit, if it ever lands, no-ops idempotently).`);
+            }
         }
 
         // R4f (auxiliary, was R4e fix 3) — worker-emit priority. Secondary check: if the worker's
@@ -1550,8 +1769,6 @@ async function reconcileUnterminatedDirectDispatches(
             continue;
         }
 
-        const messages = Array.isArray(payload.messages) ? payload.messages as ChatMessage[] : [];
-        const evidence = extractFinalAssistantSummaryEvidence(messages);
         if (!evidence.finalSummary) continue; // no assistant result yet — nothing to attribute
 
         // STALE-SUMMARY guard (modal-parked / reused-session misattribution): a direct