@adhdev/daemon-core 0.9.82-rc.442 → 0.9.82-rc.444

package/src/mesh/mesh-ledger.ts

@@ -49,6 +49,11 @@ export type MeshLedgerKind =
     // the ledger so it survives coordinator restarts and is provider-neutral.
     // payload: { text, category?, createdAt?, sourceCoordinator? }
     | 'coordinator_operating_note'
+    // Retraction of a coordinator_operating_note. Append-only (history preserved);
+    // readers filter out the targeted note so it leaves the prompt/list. Targets by
+    // note id (exact) and/or by trimmed-text fingerprint (matches all notes with that
+    // text). payload: { targetNoteId?, targetFingerprint?, reason?, forgottenAt? }
+    | 'coordinator_operating_note_tombstone'
     // Mission audit trail: mission record mutations (mesh_mission_upsert) so the
     // ledger captures mission lifecycle, not just task events. Without these a
     // mission create / goal rewrite / status transition left no ledger trace,
@@ -253,6 +258,32 @@ const ARCHIVABLE_KINDS: ReadonlySet<MeshLedgerKind> = new Set([
 const DEFAULT_LEDGER_SLICE_LIMIT = 100;
 export const MAX_LEDGER_SLICE_LIMIT = 500;
 
+// ─── Operating-note growth control ──────────────
+// coordinator_operating_note is append-only and, unlike task_* entries, is never
+// archived by compactLedger (it is not in ARCHIVABLE_KINDS — it must survive
+// restarts and there is no time-based cutoff for a "lesson"). Without dedicated
+// controls the note set grows without bound and duplicate/stale notes crowd the
+// bounded tail that rides into the coordinator prompt. These three constants back
+// the three growth controls: dedupe-on-record, tombstone/forget, keep-latest-N.
+
+// Kind marking an operating note as retracted. A tombstone is itself an
+// append-only ledger entry (history is never destroyed); readers filter out the
+// notes it targets. payload: { targetNoteId?, targetFingerprint?, reason? }
+export const OPERATING_NOTE_KIND: MeshLedgerKind = 'coordinator_operating_note';
+export const OPERATING_NOTE_TOMBSTONE_KIND: MeshLedgerKind = 'coordinator_operating_note_tombstone';
+
+// Dedupe window: when recording a note, if the same trimmed text already appears
+// among the most recent OPERATING_NOTE_DEDUPE_WINDOW notes, the record is a no-op
+// (the existing entry is returned). Keeps the prompt tail from filling with the
+// same lesson recorded 20 times.
+export const OPERATING_NOTE_DEDUPE_WINDOW = 40;
+
+// Keep-latest-N: pruneOperatingNotes retains at most this many live (non-tombstoned)
+// operating notes, removing the oldest surplus and any tombstoned notes from the
+// store. The prompt reads a much smaller tail (20), so this bound never trims what
+// a coordinator actually sees while still capping unbounded store growth.
+export const OPERATING_NOTE_KEEP_LATEST = 100;
+
 // ─── Path Helpers ───────────────────────────────
 
 export function getLedgerDir(): string {
@@ -605,6 +636,23 @@ export function appendLedgerEntry(
     meshId: string,
     partial: Omit<MeshLedgerEntry, 'id' | 'meshId' | 'timestamp'>,
 ): MeshLedgerEntry {
+    // Fix (1) dedupe-on-record: for a coordinator_operating_note, if the same
+    // trimmed text already appears among the most recent OPERATING_NOTE_DEDUPE_WINDOW
+    // notes, do NOT append a duplicate — return the existing entry so the bounded
+    // prompt tail can't be crowded by the same lesson recorded repeatedly. Other
+    // kinds (task_completed, …) are untouched.
+    if (partial.kind === OPERATING_NOTE_KIND) {
+        const text = operatingNoteText(partial.payload);
+        if (text) {
+            const recentNotes = readLedgerEntries(meshId, {
+                kind: [OPERATING_NOTE_KIND],
+                tail: OPERATING_NOTE_DEDUPE_WINDOW,
+            });
+            const existing = recentNotes.find(e => operatingNoteText(e.payload) === text);
+            if (existing) return existing;
+        }
+    }
+
     const entry: MeshLedgerEntry = {
         id: randomUUID(),
         meshId,
@@ -653,12 +701,149 @@ export function appendLedgerEntry(
         appendFileSync(filePath, line, { encoding: 'utf-8', mode: 0o600 });
         invalidateLedgerCache(meshId);
         meshLedgerEvents.emit('append', meshId, entry);
+        // Fix (3) keep-latest-N: operating notes are never archived by compactLedger,
+        // so cap their store footprint here. Runs only when a note (or its tombstone)
+        // is recorded, and is a no-op until the live-note count exceeds the bound.
+        if (entry.kind === OPERATING_NOTE_KIND || entry.kind === OPERATING_NOTE_TOMBSTONE_KIND) {
+            try { pruneOperatingNotes(meshId); } catch { /* prune is best-effort */ }
+        }
         return entry;
     } catch (e: any) {
         throw new Error(`Failed to append to ledger for mesh ${meshId}: ${e.message}`);
     }
 }
 
+// ─── Operating-note growth controls ─────────────
+
+/** Extract the trimmed note text from a coordinator_operating_note payload. */
+function operatingNoteText(payload: Record<string, unknown> | undefined): string | undefined {
+    const text = payload && typeof payload.text === 'string' ? payload.text.trim() : '';
+    return text || undefined;
+}
+
+/**
+ * Set of trimmed-text fingerprints and note ids retracted by tombstone entries in
+ * the given entry set. A tombstone targets by note id and/or by text fingerprint.
+ */
+function collectOperatingNoteTombstones(entries: MeshLedgerEntry[]): { ids: Set<string>; fingerprints: Set<string> } {
+    const ids = new Set<string>();
+    const fingerprints = new Set<string>();
+    for (const e of entries) {
+        if (e.kind !== OPERATING_NOTE_TOMBSTONE_KIND) continue;
+        const p = e.payload || {};
+        const targetId = typeof p.targetNoteId === 'string' ? p.targetNoteId.trim() : '';
+        const targetFp = typeof p.targetFingerprint === 'string' ? p.targetFingerprint.trim() : '';
+        if (targetId) ids.add(targetId);
+        if (targetFp) fingerprints.add(targetFp);
+    }
+    return { ids, fingerprints };
+}
+
+/** True if the operating note is retracted by any tombstone in `tombstones`. */
+export function isOperatingNoteTombstoned(
+    entry: Pick<MeshLedgerEntry, 'id' | 'payload'>,
+    tombstones: { ids: Set<string>; fingerprints: Set<string> },
+): boolean {
+    if (tombstones.ids.has(entry.id)) return true;
+    const text = operatingNoteText(entry.payload);
+    return text ? tombstones.fingerprints.has(text) : false;
+}
+
+/**
+ * Fix (2) supersede/remove: append a tombstone that retracts a coordinator
+ * operating note. Targets by note id and/or by exact trimmed text (a text target
+ * retracts every note with that text). History is preserved — the notes stay in
+ * the ledger but readers filter them out. Returns how many currently-live notes
+ * the tombstone will hide.
+ */
+export function tombstoneOperatingNote(
+    meshId: string,
+    target: { noteId?: string; text?: string; reason?: string },
+): { tombstone: MeshLedgerEntry; matched: number } {
+    const noteId = typeof target.noteId === 'string' ? target.noteId.trim() : '';
+    const fingerprint = typeof target.text === 'string' ? target.text.trim() : '';
+    if (!noteId && !fingerprint) {
+        throw new Error('tombstoneOperatingNote requires a noteId or text target');
+    }
+
+    // Count currently-live matches (not already tombstoned) for the caller's report.
+    const notes = readOperatingNotes(meshId);
+    const matched = notes.filter(n =>
+        (noteId && n.id === noteId) || (fingerprint && operatingNoteText(n.payload) === fingerprint),
+    ).length;
+
+    const tombstone = appendLedgerEntry(meshId, {
+        kind: OPERATING_NOTE_TOMBSTONE_KIND,
+        payload: {
+            ...(noteId ? { targetNoteId: noteId } : {}),
+            ...(fingerprint ? { targetFingerprint: fingerprint } : {}),
+            ...(target.reason && target.reason.trim() ? { reason: target.reason.trim() } : {}),
+            forgottenAt: new Date().toISOString(),
+        },
+    });
+    return { tombstone, matched };
+}
+
+/**
+ * Read live operating notes (tombstoned notes filtered out), oldest→newest.
+ * `tail` bounds the number of live notes returned (the freshest N).
+ */
+export function readOperatingNotes(meshId: string, opts?: { tail?: number }): MeshLedgerEntry[] {
+    const raw = getCachedRawEntries(meshId);
+    const tombstones = collectOperatingNoteTombstones(raw);
+    let notes = raw.filter(e => e.kind === OPERATING_NOTE_KIND && !isOperatingNoteTombstoned(e, tombstones));
+    if (opts?.tail && opts.tail > 0 && notes.length > opts.tail) {
+        notes = notes.slice(-opts.tail);
+    }
+    return notes;
+}
+
+/**
+ * Fix (3) keep-latest-N prune for coordinator_operating_note. Removes, from the
+ * store, (a) every note retracted by a tombstone, and (b) the oldest live notes
+ * beyond `keepLatest`. Tombstone entries themselves are retained as an audit trail
+ * of what was forgotten. Returns the number of note entries removed.
+ */
+export function pruneOperatingNotes(meshId: string, keepLatest: number = OPERATING_NOTE_KEEP_LATEST): number {
+    const raw = getCachedRawEntries(meshId);
+    const tombstones = collectOperatingNoteTombstones(raw);
+
+    const removeIds: string[] = [];
+    const liveNotes: MeshLedgerEntry[] = [];
+    for (const e of raw) {
+        if (e.kind !== OPERATING_NOTE_KIND) continue;
+        if (isOperatingNoteTombstoned(e, tombstones)) {
+            removeIds.push(e.id); // tombstoned notes are pruned first
+        } else {
+            liveNotes.push(e);
+        }
+    }
+
+    // Drop the oldest live notes beyond keepLatest; the freshest (prompt tail) survive.
+    const bound = Math.max(0, Math.floor(keepLatest));
+    if (liveNotes.length > bound) {
+        for (const e of liveNotes.slice(0, liveNotes.length - bound)) removeIds.push(e.id);
+    }
+
+    if (removeIds.length === 0) return 0;
+
+    try {
+        MeshRuntimeStore.getInstance().deleteLedgerEntries(meshId, removeIds);
+    } catch { /* store unavailable — JSONL rewrite below still trims */ }
+
+    // Rewrite the JSONL mirror without the pruned note entries so the export
+    // artifact stays consistent with the store.
+    try {
+        const remaining = readLedgerFile(meshId).filter(e => !removeIds.includes(e.id));
+        const filePath = getLedgerPath(meshId);
+        const lines = remaining.length ? remaining.map(e => JSON.stringify(e)).join('\n') + '\n' : '';
+        writeFileSync(filePath, lines, { encoding: 'utf-8', mode: 0o600 });
+    } catch { /* JSONL rewrite best-effort; store is the primary read path */ }
+
+    invalidateLedgerCache(meshId);
+    return removeIds.length;
+}
+
 function clampLedgerSliceLimit(limit: unknown): number {
     if (typeof limit !== 'number' || !Number.isFinite(limit)) return DEFAULT_LEDGER_SLICE_LIMIT;
     return Math.max(1, Math.min(MAX_LEDGER_SLICE_LIMIT, Math.floor(limit)));

package/src/mesh/mesh-node-identity.ts

@@ -1308,6 +1308,28 @@ export class MeshGitProbeCache {
         return `${daemonId}::${workspace}`;
     }
 
+    /**
+     * Local (same-machine) git_status dedup. The bootstrap direct-truth hydrate
+     * and the per-node render loop both call getGitRepoStatus(refreshUpstream:true)
+     * for the same local workspace within one mesh_status call. Each such probe
+     * fans out ~13-15 git subprocesses, and because the two passes are separated by
+     * the render/hydrate work of every OTHER node they routinely straddle the
+     * getGitRepoStatus 1.5s TTL, so the second pass re-shells the whole ~14-process
+     * collection. Routing both through this cache (namespaced under a reserved
+     * daemon id so it never collides with a remote-peer key) collapses them to one
+     * collection per workspace per request, and reuses it across the reuse window
+     * so the dashboard auto-retry loop can't restart a fresh local probe seconds
+     * apart either.
+     */
+    private static readonly LOCAL_PROBE_DAEMON_ID = '__local_git__';
+
+    async probeLocal(
+        workspace: string,
+        probe: () => Promise<Record<string, unknown> | null>,
+    ): Promise<Record<string, unknown> | null> {
+        return this.probe(MeshGitProbeCache.LOCAL_PROBE_DAEMON_ID, workspace, probe);
+    }
+
     /**
      * Run `probe` for this peer, but reuse a fresh recent result or an in-flight
      * probe for the same key when one is available. `probe` is only invoked when
@@ -1551,7 +1573,25 @@ export async function hydrateInlineMeshDirectTruth(args: {
     const unavailableNodeIds: string[] = [];
     const deadNodeIds: string[] = [];
 
-    for (const [nodeIndex, node] of nodes.entries()) {
+    // Each node's classification (local git probe, standing truth, or the remote
+    // P2P fan-out) is independent, so probing them serially stacked one slow
+    // (often TURN-relayed) peer's latency onto every other node — the 3×25s serial
+    // stall. Classify all nodes concurrently via Promise.allSettled; each node has
+    // its own bounded per-peer timeout + definitively-down fast-fail inside
+    // probeRemoteMeshGitStatusWithRetry, so a hung peer degrades to `unavailable`
+    // for THAT node only and never blocks the aggregate. The counters and
+    // unavailable/dead node lists are folded from the settled results afterward so
+    // no shared mutable state is touched concurrently.
+    type NodeTruthResult =
+        | { kind: 'dead'; nodeId: string }
+        | { kind: 'unavailable'; nodeId: string; attempted?: boolean }
+        | { kind: 'local' }
+        | { kind: 'standing' }
+        | { kind: 'peerConfirmed' }
+        | { kind: 'peerUnavailable'; nodeId: string }
+        | { kind: 'skip' };
+
+    const classifyNode = async (nodeIndex: number, node: any): Promise<NodeTruthResult> => {
         const nodeId = normalizeMeshNodeId(node) || `node_${nodeIndex}`;
         const workspace = readStringValue(node?.workspace);
         const daemonId = readStringValue(node?.daemonId);
@@ -1573,23 +1613,27 @@ export async function hydrateInlineMeshDirectTruth(args: {
             daemonId && (daemonIdsEquivalent(daemonId, args.localMachineId) || daemonIdsEquivalent(daemonId, args.statusInstanceId)),
         );
         if ((isSelfNode || isSelfDaemonNode) && isDeadLocalWorktreeNode(node)) {
-            deadNodeIds.push(nodeId);
-            continue;
+            return { kind: 'dead', nodeId };
         }
 
         if (!workspace) {
-            if (!isSelfNode && daemonId) unavailableNodeIds.push(nodeId);
-            continue;
+            return (!isSelfNode && daemonId) ? { kind: 'unavailable', nodeId } : { kind: 'skip' };
         }
 
         if (fs.existsSync(workspace)) {
             try {
-                const localGit = await getGitRepoStatus(workspace, { timeoutMs: 10_000, refreshUpstream: true });
+                // Route the local probe through the shared cache so the per-node
+                // render loop's getGitRepoStatus for the same workspace reuses this
+                // exact result instead of re-shelling ~14 git processes when the two
+                // passes straddle the getGitRepoStatus 1.5s TTL.
+                const runLocalProbe = () => getGitRepoStatus(workspace, { timeoutMs: 10_000, refreshUpstream: true }) as unknown as Promise<Record<string, unknown> | null>;
+                const localGit = args.probeCache
+                    ? await args.probeCache.probeLocal(workspace, runLocalProbe)
+                    : await runLocalProbe();
                 if (localGit?.isGitRepo) {
                     const reporter = recordInlineMeshDirectGitTruth(node, localGit as unknown as Record<string, unknown>, 'selected_coordinator_local_git');
                     persistNodeReporterPlatform(args.meshSource, args.mesh, nodeId, reporter);
-                    localConfirmedCount += 1;
-                    continue;
+                    return { kind: 'local' };
                 }
             } catch {
                 // Fall through to remote classification.
@@ -1603,8 +1647,7 @@ export async function hydrateInlineMeshDirectTruth(args: {
         // block the bootstrap.
         const standingGit = buildInlineMeshTransitGitStatus(node);
         if (standingGit) {
-            standingEvidenceCount += 1;
-            continue;
+            return { kind: 'standing' };
         }
 
         if (!args.probeRemotePeers) {
@@ -1612,15 +1655,13 @@ export async function hydrateInlineMeshDirectTruth(args: {
             // pending (the per-node loop marks it gitProbePending and the graph
             // shows setup inventory for it). It is NOT unavailable — the graph
             // must still render. An explicit refresh will fan out and freshen it.
-            continue;
+            return { kind: 'skip' };
         }
 
         if (!daemonId || !args.dispatchMeshCommand) {
-            if (!isSelfNode) unavailableNodeIds.push(nodeId);
-            continue;
+            return !isSelfNode ? { kind: 'unavailable', nodeId } : { kind: 'skip' };
         }
 
-        peerAttemptedCount += 1;
         // Bounded retry, gated on the peer staying `connected`: a slow
         // (TURN-relayed) peer that just exceeds one probe window is recovered
         // instead of being hard-failed. The connection is re-checked before each
@@ -1642,8 +1683,7 @@ export async function hydrateInlineMeshDirectTruth(args: {
         if (remoteGit) {
             const reporter = recordInlineMeshDirectGitTruth(node, remoteGit, 'selected_coordinator_mesh_p2p_git');
             persistNodeReporterPlatform(args.meshSource, args.mesh, nodeId, reporter);
-            peerConfirmedCount += 1;
-            continue;
+            return { kind: 'peerConfirmed' };
         }
 
         // Invariant: a connected peer that still holds standing git truth is
@@ -1652,8 +1692,56 @@ export async function hydrateInlineMeshDirectTruth(args: {
         // not currently connected, or it is connected but every bounded probe
         // failed — that is the genuine "connected, no truth, retries exhausted"
         // case that drives the explicit-refresh hard-fail.
-        unavailableNodeIds.push(nodeId);
-    }
+        return { kind: 'peerUnavailable', nodeId };
+    };
+
+    const nodeEntries = [...nodes.entries()];
+    const settledResults = await Promise.allSettled(
+        nodeEntries.map(([nodeIndex, node]) => classifyNode(nodeIndex, node)),
+    );
+    settledResults.forEach((settled, i) => {
+        const [nodeIndex, node] = nodeEntries[i];
+        // A classifier should never reject (every probe is caught internally), but
+        // if one does, degrade that node to `unavailable` when it is a remote peer —
+        // never silently drop it, never fail the whole aggregate.
+        const result: NodeTruthResult = settled.status === 'fulfilled'
+            ? settled.value
+            : (() => {
+                const nodeId = normalizeMeshNodeId(node) || `node_${nodeIndex}`;
+                const daemonId = readStringValue(node?.daemonId);
+                const isSelfNode = Boolean(
+                    nodeId && selectedCoordinatorNodeId && nodeId === selectedCoordinatorNodeId,
+                ) || Boolean(
+                    daemonId && (daemonIdsEquivalent(daemonId, args.localMachineId) || daemonIdsEquivalent(daemonId, args.statusInstanceId)),
+                );
+                return (!isSelfNode && daemonId) ? { kind: 'unavailable', nodeId } as NodeTruthResult : { kind: 'skip' } as NodeTruthResult;
+            })();
+        switch (result.kind) {
+            case 'dead':
+                deadNodeIds.push(result.nodeId);
+                break;
+            case 'unavailable':
+                unavailableNodeIds.push(result.nodeId);
+                break;
+            case 'local':
+                localConfirmedCount += 1;
+                break;
+            case 'standing':
+                standingEvidenceCount += 1;
+                break;
+            case 'peerConfirmed':
+                peerAttemptedCount += 1;
+                peerConfirmedCount += 1;
+                break;
+            case 'peerUnavailable':
+                peerAttemptedCount += 1;
+                unavailableNodeIds.push(result.nodeId);
+                break;
+            case 'skip':
+            default:
+                break;
+        }
+    });
 
     return {
         directEvidenceCount: localConfirmedCount + peerConfirmedCount + standingEvidenceCount,

package/src/mesh/mesh-reconcile-loop.ts

@@ -523,11 +523,26 @@ export function resolveCoordinatorDrainDeliverability(
  * remote pull is never blocked by our local coordinator's busy state. A pure
  * stdio MCP coordinator (no live CLI session) never satisfies (1), so its tool
  * result remains the surface and the drain proceeds. No regression to either.
+ *
+ * SELF-COORDINATOR INBOX LEVEL-DRAIN (Defect 2): the hold above assumes the ONLY
+ * surface for a busy local coordinator's events is a future PTY inject on its idle
+ * edge, so it defers to the reconcile loop. But when the drain caller IS the local
+ * coordinator reading its OWN inbox (the `get_pending_mesh_events` call whose events
+ * are returned in the caller's tool RESULT — a data queue the self-coordinating LLM
+ * consumes directly), the events ARE surfaced losslessly the moment the tool returns,
+ * with NO PTY write. A busy self-coordinating LLM that calls a mesh tool mid-turn would
+ * otherwise get an empty inbox (held) and only see the completion on its NEXT busy→idle
+ * edge — the measured ~59s strand. `callerIsSelfCoordinatorInboxRead` marks that safe
+ * caller: the hold is relaxed for it (return the events), while every OTHER drain (a
+ * backfill relay, a broadcast poll, a DIFFERENT coordinator that genuinely needs its PTY)
+ * still defers to the reconcile loop. This relaxes delivery INTO the coordinator's own
+ * inbox only — it never changes how events are injected into a live PTY prompt.
  */
 export function shouldHoldPendingDrainForBusyLocalCoordinator(
     components: Pick<DaemonComponents, 'instanceManager'> & { statusInstanceId?: string },
     meshId: string,
     requestedCoordinatorDaemonId?: string | null,
+    callerIsSelfCoordinatorInboxRead?: boolean,
 ): boolean {
     if (!meshId) return false;
     const deliverability = resolveCoordinatorDrainDeliverability(components, meshId);
@@ -539,7 +554,13 @@ export function shouldHoldPendingDrainForBusyLocalCoordinator(
         readNonEmptyString((components as { statusInstanceId?: string }).statusInstanceId),
         readNonEmptyString(loadConfig().machineId),
     ]);
-    return localIds.some(id => daemonIdsEquivalent(id, requested));
+    const targetsLocalCoordinator = localIds.some(id => daemonIdsEquivalent(id, requested));
+    if (!targetsLocalCoordinator) return false;
+    // SELF-COORDINATOR INBOX LEVEL-DRAIN: the busy local coordinator is itself the caller,
+    // reading its own inbox — the drained events return in ITS tool result (lossless data-queue
+    // surface, no PTY inject). Do NOT hold; let the self-coordinator see its completions now.
+    if (callerIsSelfCoordinatorInboxRead) return false;
+    return true;
 }
 
 // Inject a drained pending event into a live coordinator session. Force-inject

package/src/providers/chat-message-normalization.ts

@@ -27,7 +27,7 @@ export function extractFinalSummaryFromMessages(
   return '';
 }
 
-function readChatMessageTimestampMs(message: ChatMessage | null | undefined): number | undefined {
+export function readChatMessageTimestampMs(message: ChatMessage | null | undefined): number | undefined {
   if (!message) return undefined;
   const record = message as ChatMessage & Record<string, unknown>;
   for (const value of [record.timestamp, record.createdAt, record.created_at, record.updatedAt, record.time, record.receivedAt]) {