@adhdev/daemon-core 0.9.82-rc.455 → 0.9.82-rc.457

package/src/mesh/preview-freshness.ts

@@ -23,6 +23,46 @@ export interface PreviewFreshness {
 
 const PREVIEW_DEPLOY_RECORD = '.adhdev/preview-deploy.json';
 
+// Repo-relative driver scripts that indicate this repository actually ships the
+// preview-deploy pipeline. Presence of any one of these (or the deploy record,
+// or a `deploy:preview` npm script) means the private release-pipeline guidance
+// carried by buildPreviewFreshness is relevant here. In every other repo the
+// pipeline is not configured and the guidance must NOT leak (F15).
+const PREVIEW_PIPELINE_SCRIPTS = [
+    'scripts/preview-freshness.mjs',
+    'scripts/smoke-preview-web.mjs',
+    'scripts/deploy-preview-local.mjs',
+] as const;
+
+function hasDeployPreviewNpmScript(repoRoot: string): boolean {
+    const pkgPath = resolve(repoRoot, 'package.json');
+    if (!existsSync(pkgPath)) return false;
+    try {
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as { scripts?: Record<string, unknown> };
+        return typeof pkg?.scripts?.['deploy:preview'] === 'string';
+    } catch {
+        return false;
+    }
+}
+
+/**
+ * Gate: does this repository actually configure the preview-deploy pipeline?
+ *
+ * The preview-freshness surface embeds this project's private release-pipeline
+ * instructions (`npm run deploy:preview`, smoke preview, …). Those are only
+ * meaningful in a repo that ships the pipeline. An external repo joined to a
+ * mesh must not have that guidance leak into its coordinator prompt, so this
+ * gate keeps the surface off unless a concrete pipeline artifact is present.
+ */
+export function isPreviewPipelineConfigured(repoRoot: string): boolean {
+    // Strongest signal: the repo has produced a preview-deploy record before.
+    if (existsSync(resolve(repoRoot, PREVIEW_DEPLOY_RECORD))) return true;
+    // Otherwise the pipeline's own driver scripts are enough.
+    if (PREVIEW_PIPELINE_SCRIPTS.some((rel) => existsSync(resolve(repoRoot, rel)))) return true;
+    // Or the `deploy:preview` npm script that fronts the pipeline.
+    return hasDeployPreviewNpmScript(repoRoot);
+}
+
 function runGit(repoRoot: string, args: readonly string[]): string {
     try {
         return execFileSync('git', args, {
@@ -86,7 +126,12 @@ function readCurrentMainCommit(repoRoot: string): Pick<PreviewFreshness, 'curren
     return { currentMainCommit: null, currentMainCommitSource: 'unknown' };
 }
 
-export function buildPreviewFreshness(repoRoot: string): PreviewFreshness {
+export function buildPreviewFreshness(repoRoot: string): PreviewFreshness | null {
+    // F15 gate: only surface preview-freshness (and its private pipeline
+    // guidance) in repos that actually configure the preview-deploy pipeline.
+    // Unconfigured repos return null so the caller omits the field entirely.
+    if (!isPreviewPipelineConfigured(repoRoot)) return null;
+
     const current = readCurrentMainCommit(repoRoot);
     const record = readRecord(repoRoot);
     const lastPreviewCommit = normalizeCommit(record?.lastPreviewCommit);

package/src/mesh/worktree-bootstrap-config.ts

@@ -69,7 +69,7 @@ export const WORKTREE_BOOTSTRAP_STALE_RUNNING_MS = 10 * 60 * 1000;
  * trailing slash stripped. Returns an empty set when there are no submodules or the
  * lookup fails — callers must then treat any change as dirty (conservative).
  */
-function getRegisteredSubmodulePaths(workspace: string): Set<string> {
+export function getRegisteredSubmodulePaths(workspace: string): Set<string> {
     const paths = new Set<string>();
     try {
         const out = execFileSync(

package/src/providers/approval-utils.ts

@@ -41,6 +41,48 @@ export function hasNegativeApprovalOption(buttons: string[] | null | undefined):
     return (buttons || []).some((button) => isNegativeApprovalLabel(String(button || '')));
 }
 
+/**
+ * True when a button reliably identifies a tool-CONSENT modal on its own — a
+ * scoped permission-grant affirmative such as:
+ *   - "Yes, allow all edits in tmp/ during this session"
+ *   - "Yes, and don't ask again for example.com"
+ *   - "Yes, allow reading from etc/ from this project"
+ *   - "Always allow"
+ *
+ * These options only ever appear in a genuine approval/permission prompt; a
+ * /model or /mode picker ("1. Default  2. Opus  3. Sonnet") never offers a
+ * "grant this scope" choice. They therefore serve as a SECOND reliable
+ * structural anchor alongside {@link hasNegativeApprovalOption}.
+ *
+ * Why this exists (tall-diff fallback, #137): when a Write/Edit diff is tall,
+ * the trailing decline option ("3. No") can scroll off the bottom of the
+ * captured PTY frame, leaving only "1. Yes" + "2. Yes, allow … this session".
+ * hasNegativeApprovalOption then reads false and the auto-approve gate bails —
+ * a delegated worker sits forever on a modal it could safely have approved. The
+ * grant-scope affirmative lets the gate recognize the consent modal WITHOUT
+ * seeing the off-frame decline. The gate still selects the plain "Yes"
+ * (allow-once) via pickApprovalButton, never the broader grant, and the settle
+ * gate still requires a stable modal — so a half-rendered frame never fires.
+ * Kept deliberately narrow so no picker/confirm modal can trip it.
+ */
+export function hasReliableApprovalAffirmative(buttons: string[] | null | undefined): boolean {
+    return (buttons || []).some((button) => {
+        const label = normalizeApprovalLabel(String(button || ''));
+        if (!label) return false;
+        // "always allow …" as a standalone grant option.
+        if (/^always allow\b/.test(label)) return true;
+        // "yes, …" scoped grants: allow / always allow / don't ask again / etc.
+        // (normalizeApprovalLabel strips the apostrophe, so "don't" → "don t").
+        if (/^yes\b/.test(label)) {
+            if (/\ballow\b/.test(label)) return true;
+            if (/\bask again\b/.test(label)) return true;
+            if (/\bduring this session\b/.test(label)) return true;
+            if (/\bfrom this project\b/.test(label)) return true;
+        }
+        return false;
+    });
+}
+
 export function getApprovalPositiveHints(provider?: Pick<ProviderModule, 'approvalPositiveHints'> | null): string[] {
     const customHints = Array.isArray(provider?.approvalPositiveHints)
         ? provider.approvalPositiveHints

package/src/providers/cli-provider-instance.ts

@@ -22,10 +22,12 @@ import type { PtyRuntimeMetadata, PtyTransportFactory } from '../cli-adapters/pt
 import { StatusMonitor } from './status-monitor.js';
 import { ChatHistoryWriter, isNativeSourceCanonicalHistory, materializeProviderNativeHistory, readChatHistory, readProviderChatHistory } from '../config/chat-history.js';
 import { LOG } from '../logging/logger.js';
+import { recordDebugTrace } from '../logging/debug-trace.js';
+import { shouldCollectTraceCategory } from '../logging/debug-config.js';
 import { traceMeshEventStage, traceMeshEventDrop } from '../mesh/mesh-event-trace.js';
 import type { ChatMessage } from '../types.js';
 import { buildPersistedProviderEffectMessage, normalizeProviderEffects } from './control-effects.js';
-import { formatAutoApprovalMessage, pickApprovalButton, hasNegativeApprovalOption, looksLikeActiveApprovalPromptText } from './approval-utils.js';
+import { formatAutoApprovalMessage, pickApprovalButton, hasNegativeApprovalOption, hasReliableApprovalAffirmative, looksLikeActiveApprovalPromptText } from './approval-utils.js';
 import { getCliScriptCommand, parseCliScriptResult } from './cli-script-results.js';
 import { mergeProviderPatchState, resolveProviderStateSurface } from './provider-patch-state.js';
 import { normalizeProviderSessionId } from './provider-session-id.js';
@@ -572,6 +574,13 @@ export class CliProviderInstance implements ProviderInstance {
     // mask is dropped so the real waiting_approval surfaces. Cleared when the episode ends
     // (modal genuinely gone, manual attendance takes over, or auto-approve fires).
     private autoApproveMaskSince = 0;
+    // NOTIF-APPROVAL-MASKED (Q1b): the autoApproveMaskSince episode value for which a
+    // stalled-approval coordinator nudge has already been emitted, so the nudge fires
+    // exactly once per stalled auto-approve episode (0 = none emitted). Reusing the
+    // per-episode mask-clock value as the key makes it provider-agnostic (no reliance on
+    // approvalEntrySeq) and self-resetting: each new episode gets a fresh
+    // autoApproveMaskSince timestamp, and the episode-end reset zeroes it.
+    private stalledApprovalNudgeEpisode = 0;
     // Provider-common manual-attendance signal: while a human is actively driving
     // this session from the dashboard, auto-approve holds so they can take manual
     // control. Background mesh workers are never attended → delegated auto-approve
@@ -1519,9 +1528,23 @@ export class CliProviderInstance implements ProviderInstance {
     }
 
     private completionFinalAssistantEvidence(parsedMessages: unknown, turnStartedAt?: number): CompletionFinalAssistantEvidence {
+        // (FALSEIDLE FixB) UPPER-BOUND turn-end evidence. completionHasFinalAssistantMessage is a
+        // pure message-content check ("does the last visible bubble read as a finalized assistant
+        // reply, post-dating the turn start?"). That LOWER bound alone treated the FIRST assistant
+        // bubble of a turn that is STILL running — a tool call in flight between two assistant
+        // bubbles — as proof the turn ended (RCA cases a & b). Require in ADDITION that the turn is
+        // genuinely OVER: hasAdapterPendingResponse() folds the three upper-bound discriminators
+        // into one — currentTurnScope closed, no in-flight tool (isProcessing false), and no partial
+        // response buffer. So a mid-turn point-sample (short-gen / fast-collapse inline paths that
+        // do NOT route through getCompletedFinalizationBlock) yields present=false and is held/settled
+        // rather than fired. A genuinely-finished turn (adapter idle, no pending) is unaffected — the
+        // gate stays open and the completion fires exactly as before. This mirrors the established
+        // `completionHasFinalAssistantMessage(...) && !hasAdapterPendingResponse()` pairing already
+        // used by the no-progress monitor reconcile path.
+        const turnClosed = !this.hasAdapterPendingResponse();
         if (this.completionHasFinalAssistantMessage(parsedMessages, turnStartedAt)) {
             return {
-                present: true,
+                present: turnClosed,
                 messages: Array.isArray(parsedMessages) ? parsedMessages : [],
                 source: 'parsed',
             };
@@ -1530,7 +1553,7 @@ export class CliProviderInstance implements ProviderInstance {
         const externalMessages = this.readExternalCompletionMessages();
         if (externalMessages) {
             return {
-                present: this.completionHasFinalAssistantMessage(externalMessages, turnStartedAt),
+                present: turnClosed && this.completionHasFinalAssistantMessage(externalMessages, turnStartedAt),
                 messages: externalMessages,
                 source: 'external-native',
             };
@@ -1683,11 +1706,21 @@ export class CliProviderInstance implements ProviderInstance {
 
         const adapterAny = this.adapter as any;
         const approvalResolvedIdle = pending.previousStatus === 'waiting_approval';
-        if (!approvalResolvedIdle) {
-            if (adapterAny?.isWaitingForResponse === true) return { reason: 'adapter_waiting_for_response', terminal: true };
-            if (adapterAny?.currentTurnScope) return { reason: 'adapter_turn_scope_active', terminal: true };
-            if (this.hasAdapterPendingResponse()) return { reason: 'adapter_pending_response', terminal: true };
-        }
+        // (FALSEIDLE-a FixA) The adapter pending-response checks run UNCONDITIONALLY.
+        // Previously they were SKIPPED when approvalResolvedIdle, on the assumption that
+        // a waiting_approval→idle transition proved the approval's turn was over. But
+        // auto-approve RESOLVES the modal and the agent RESUMES the same turn — currentTurnScope
+        // / isWaitingForResponse stay set, or a tool runs — so skipping the guard let the FIRST
+        // assistant bubble of the still-running turn be mistaken for the last and fired an early
+        // completion the coordinator could never correct (RCA case a). Keep the guard live for the
+        // approval path too: when the resumed turn genuinely ends these clear and the completion
+        // fires. Approval-resolved holds are NON-terminal (bounded by COMPLETED_FINALIZATION_MAX_WAIT_MS)
+        // so a provider that never closes its turn-scope still force-fires a weak completion rather
+        // than wedging; the non-approval path keeps its terminal hold (a genuinely-busy adapter must
+        // never force a completion out).
+        if (adapterAny?.isWaitingForResponse === true) return { reason: 'adapter_waiting_for_response', terminal: !approvalResolvedIdle };
+        if (adapterAny?.currentTurnScope) return { reason: 'adapter_turn_scope_active', terminal: !approvalResolvedIdle };
+        if (this.hasAdapterPendingResponse()) return { reason: 'adapter_pending_response', terminal: !approvalResolvedIdle };
 
         const partial = typeof this.adapter.getPartialResponse === 'function'
             ? this.adapter.getPartialResponse()
@@ -1884,6 +1917,40 @@ export class CliProviderInstance implements ProviderInstance {
         };
     }
 
+    // COMPLETION-EARLYNOTIFY instrumentation. A session-keyed FSM-transition +
+    // completion-gate snapshot recorded into the shared debug-trace ring buffer
+    // (secret-safe, length/role/pattern-name only — never screen or bubble text).
+    // Retrieved via getRecentDebugTrace (chat_debug_bundle). Both categories are a
+    // no-op unless collectDebugTrace is on AND the category is selected, so the
+    // hot-path guards below (completionTraceOn / fsmTraceOn) keep production cost
+    // at a single boolean check.
+    private completionTraceOn(): boolean {
+        return shouldCollectTraceCategory('completion-gate');
+    }
+    private fsmTraceOn(): boolean {
+        return shouldCollectTraceCategory('fsm-transition');
+    }
+    private recordCompletionGateTrace(stage: string, payload: Record<string, unknown>): void {
+        recordDebugTrace({
+            category: 'completion-gate',
+            stage,
+            level: 'debug',
+            sessionId: this.instanceId,
+            providerType: this.type,
+            payload,
+        });
+    }
+    private recordFsmTransitionTrace(payload: Record<string, unknown>): void {
+        recordDebugTrace({
+            category: 'fsm-transition',
+            stage: 'transition',
+            level: 'debug',
+            sessionId: this.instanceId,
+            providerType: this.type,
+            payload,
+        });
+    }
+
     private flushCompletedDebounceIfFinalized(): void {
         const pending = this.completedDebouncePending;
         if (!pending) {
@@ -1897,6 +1964,13 @@ export class CliProviderInstance implements ProviderInstance {
         LOG.debug('CLI', `[${this.type}] flush attempt: adapterStatus=${latestStatus.status} latestVisible=${latestVisibleStatus} generatingStartedAt=${this.generatingStartedAt} isWaitingForResponse=${!!(this.adapter as any)?.isWaitingForResponse} hasPartial=${!!this.adapter.getPartialResponse?.()}`);
         if (latestVisibleStatus !== 'idle') {
             LOG.info('CLI', `[${this.type}] cancelled pending completed (resumed ${latestVisibleStatus})`);
+            if (this.completionTraceOn()) this.recordCompletionGateTrace('cancel', {
+                blockReason: 'resumed_status',
+                latestVisibleStatus,
+                previousStatus: pending.previousStatus,
+                busyEpochAtArm: pending.busyEpochAtArm,
+                busyEpoch: this.busyEpoch,
+            });
             this.completedDebouncePending = null;
             this.completedDebounceTimer = null;
             return;
@@ -1914,6 +1988,14 @@ export class CliProviderInstance implements ProviderInstance {
         // so shared behaviour for claude/codex/antigravity is strictly stricter, never looser.
         if (typeof pending.busyEpochAtArm === 'number' && this.busyEpoch !== pending.busyEpochAtArm) {
             LOG.info('CLI', `[${this.type}] cancelled pending completed (busy re-entry during settle: epoch ${pending.busyEpochAtArm}→${this.busyEpoch})`);
+            if (this.completionTraceOn()) this.recordCompletionGateTrace('cancel', {
+                blockReason: 'busy_reentry',
+                latestVisibleStatus,
+                previousStatus: pending.previousStatus,
+                busyEpochAtArm: pending.busyEpochAtArm,
+                busyEpoch: this.busyEpoch,
+                busyEpochDelta: this.busyEpoch - pending.busyEpochAtArm,
+            });
             this.completedDebouncePending = null;
             this.completedDebounceTimer = null;
             return;
@@ -1923,6 +2005,14 @@ export class CliProviderInstance implements ProviderInstance {
             && typeof latestOutputAt === 'number'
             && latestOutputAt > pending.lastOutputAtArm) {
             LOG.info('CLI', `[${this.type}] cancelled pending completed (new PTY output during settle: ${pending.lastOutputAtArm}→${latestOutputAt})`);
+            if (this.completionTraceOn()) this.recordCompletionGateTrace('cancel', {
+                blockReason: 'new_pty_output',
+                latestVisibleStatus,
+                previousStatus: pending.previousStatus,
+                lastOutputAtArm: pending.lastOutputAtArm,
+                lastOutputAt: latestOutputAt,
+                lastOutputAtDelta: latestOutputAt - pending.lastOutputAtArm,
+            });
             this.completedDebouncePending = null;
             this.completedDebounceTimer = null;
             return;
@@ -1968,6 +2058,17 @@ export class CliProviderInstance implements ProviderInstance {
                     if (this.isMeshWorkerSession()) {
                         traceMeshEventDrop('completion_gate_hold', this.meshTraceCtx(), `${blockReason} waited=${waitedMs}ms`);
                     }
+                    // COMPLETION-EARLYNOTIFY: a hold is the CORRECT outcome when the turn is not
+                    // yet proven done (the FixA/FixB gates route here); trace it so an early-notify
+                    // investigation can see the gate holding rather than firing.
+                    if (this.completionTraceOn()) this.recordCompletionGateTrace('hold', {
+                        blockReason,
+                        latestVisibleStatus,
+                        terminal: block.terminal === true,
+                        holdForTranscript: block.holdForTranscript === true,
+                        approvalResolvedIdle: pending.previousStatus === 'waiting_approval',
+                        waitedMs,
+                    });
                     pending.loggedBlockReason = blockReason;
                 }
                 this.scheduleCompletedDebounceFlush(COMPLETED_FINALIZATION_RETRY_MS);
@@ -1990,6 +2091,19 @@ export class CliProviderInstance implements ProviderInstance {
             if (this.isMeshWorkerSession()) {
                 traceMeshEventStage('fired', this.meshTraceCtx(), `forced after ${waitedMs}ms (${blockReason})`);
             }
+            if (this.completionTraceOn()) this.recordCompletionGateTrace('fire', {
+                path: isTranscriptEvidenceGate && !emittedAfterFinalizationTimeout ? 'canon_c_decoupled' : 'forced_timeout',
+                blockReason,
+                latestVisibleStatus,
+                approvalResolvedIdle: pending.previousStatus === 'waiting_approval',
+                finalAssistantPresent: (completionDiagnostic as any).finalAssistantPresent === true,
+                evidenceSource: (completionDiagnostic as any).finalAssistantEvidenceSource ?? null,
+                lastVisibleRole: (completionDiagnostic as any).lastVisibleRole ?? null,
+                lastVisibleContentLen: (completionDiagnostic as any).lastVisibleContentLength ?? null,
+                emittedAfterFinalizationTimeout,
+                waitedMs,
+                busyEpoch: this.busyEpoch,
+            });
             this.pushEvent({
                 event: 'agent:generating_completed',
                 chatTitle: pending.chatTitle,
@@ -2021,6 +2135,14 @@ export class CliProviderInstance implements ProviderInstance {
         if (this.isMeshWorkerSession()) {
             traceMeshEventStage('fired', this.meshTraceCtx(), `duration=${pending.duration}s`);
         }
+        if (this.completionTraceOn()) this.recordCompletionGateTrace('fire', {
+            path: 'clean',
+            latestVisibleStatus,
+            approvalResolvedIdle: pending.previousStatus === 'waiting_approval',
+            finalAssistantPresent: true,
+            duration: pending.duration,
+            busyEpoch: this.busyEpoch,
+        });
         this.pushEvent({
             event: 'agent:generating_completed',
             chatTitle: pending.chatTitle,
@@ -2056,6 +2178,7 @@ export class CliProviderInstance implements ProviderInstance {
             // Manual attendance takes over — the modal stays surfaced (maybeAutoApproveStatus
             // returns false), so end the mask episode.
             this.autoApproveMaskSince = 0;
+            this.stalledApprovalNudgeEpisode = 0;
             if (this.autoApproveSettleTimer) clearTimeout(this.autoApproveSettleTimer);
             this.autoApproveSettleTimer = setTimeout(() => {
                 this.autoApproveSettleTimer = null;
@@ -2100,6 +2223,7 @@ export class CliProviderInstance implements ProviderInstance {
             // Modal has genuinely been gone past the hysteresis window → the episode ended;
             // end the mask episode too (a later approval starts a fresh stall clock).
             this.autoApproveMaskSince = 0;
+            this.stalledApprovalNudgeEpisode = 0;
             if (this.autoApproveSettleTimer) { clearTimeout(this.autoApproveSettleTimer); this.autoApproveSettleTimer = null; }
             return autoApproveActive;
         }
@@ -2110,6 +2234,12 @@ export class CliProviderInstance implements ProviderInstance {
         // when zero so it survives modal-signature changes and hysteresis blips — it measures
         // the true age of the unresolved auto-approve, not the per-signature settle window.
         if (!this.autoApproveMaskSince) this.autoApproveMaskSince = now;
+        // NOTIF-APPROVAL-MASKED (Q1b): once this episode has stalled past the mask threshold,
+        // surface the raw waiting_approval to the mesh coordinator (decoupled from the dashboard
+        // mask). Placed on the active-approval path here — the single choke point that owns the
+        // mask-stall clock and is re-driven throughout a silent stall (getState heartbeat,
+        // detectStatusTransition, recheckAutoApproveSettled). No-op until the stall threshold trips.
+        this.maybeEmitStalledApprovalNudge(adapterStatus, now);
         const modal = adapterStatus.activeModal;
         // (fix) Do not auto-approve when no concrete modal/buttons are present.
         // Claude TUI flaps between paints; without this guard adapterStatus
@@ -2147,10 +2277,22 @@ export class CliProviderInstance implements ProviderInstance {
             return autoApproveActive;
         }
         const { index: buttonIndex, label: buttonLabel } = pickApprovalButton(buttons, this.provider);
-        if (buttonIndex < 0 || !hasNegativeApprovalOption(buttons)) {
-            // No affirmative matched, or no decline option present (→ not a real
-            // consent prompt, e.g. a picker that slipped past the kind gate).
-            // Surface the modal so the user decides; never pick blindly.
+        // Structural decline anchor. A real approval offers BOTH an affirmative
+        // and a decline — but on a TALL Write/Edit diff the trailing "3. No"
+        // scrolls off the captured frame, leaving only "1. Yes" + "2. Yes, allow
+        // … this session" so hasNegativeApprovalOption reads false (#137). A
+        // scoped grant-affirmative ("Yes, allow … during this session" / "…don't
+        // ask again") ONLY appears in a genuine consent modal (never a picker),
+        // so it stands in for the off-frame decline as a reliable second anchor.
+        // Conservative by construction: a picker without a grant-scope option
+        // still bails here, and the fire below still picks the plain allow-once
+        // "Yes" via pickApprovalButton, not the broader grant.
+        const hasReliableConsentAnchor = hasNegativeApprovalOption(buttons)
+            || hasReliableApprovalAffirmative(buttons);
+        if (buttonIndex < 0 || !hasReliableConsentAnchor) {
+            // No affirmative matched, or no decline / reliable grant option present
+            // (→ not a real consent prompt, e.g. a picker that slipped past the
+            // kind gate). Surface the modal so the user decides; never pick blindly.
             return autoApproveActive;
         }
         // Modal *identity* signature — the question/button set only, NO volatile
@@ -2215,6 +2357,7 @@ export class CliProviderInstance implements ProviderInstance {
         this.autoApproveInactiveSince = 0;
         // Fired (resolveModal in flight) — the episode resolved; end the mask-stall clock.
         this.autoApproveMaskSince = 0;
+        this.stalledApprovalNudgeEpisode = 0;
         if (this.autoApproveBusyTimer) clearTimeout(this.autoApproveBusyTimer);
         this.autoApproveBusyTimer = setTimeout(() => {
             this.autoApproveBusy = false;
@@ -2396,6 +2539,22 @@ export class CliProviderInstance implements ProviderInstance {
         const previousStatus = this.lastStatus;
         if (newStatus !== this.lastStatus) {
             LOG.info('CLI', `[${this.type}] status: ${this.lastStatus} → ${newStatus}`);
+            // COMPLETION-EARLYNOTIFY: snapshot every FSM status transition (the arm/fire/cancel
+            // decisions downstream all hang off these edges). Guarded so production pays only a
+            // boolean check; payload carries the visibility/auto-approve flags and the continuity
+            // clocks (busyEpoch / lastOutputAt / lastScreenChangeAt) that the completion gate reads.
+            if (this.fsmTraceOn()) this.recordFsmTransitionTrace({
+                from: this.lastStatus,
+                to: newStatus,
+                rawStatus,
+                autoApproveActive,
+                autoApproveHoldIdle,
+                autoApproveBusy: this.autoApproveBusy,
+                hasPending: this.hasAdapterPendingResponse(),
+                busyEpoch: this.busyEpoch,
+                lastOutputAt: typeof adapterStatus?.lastOutputAt === 'number' ? adapterStatus.lastOutputAt : null,
+                lastScreenChangeAt: typeof adapterStatus?.lastScreenChangeAt === 'number' ? adapterStatus.lastScreenChangeAt : null,
+            });
             // GENERATING-MISSING (win32 fresh-worktree first-turn): a freshly-launched session
             // is in 'starting' until its startup-grace settles to idle. When the FIRST inject
             // lands inside that grace window, the adapter can report status DIRECTLY
@@ -2633,6 +2792,17 @@ export class CliProviderInstance implements ProviderInstance {
                         if (this.isMeshWorkerSession()) {
                             traceMeshEventStage('arm', this.meshTraceCtx(), `short-generating settle-arm (source=${shortEvidenceSource}, missingEvidence=${missingEvidence})`);
                         }
+                        if (this.completionTraceOn()) this.recordCompletionGateTrace('arm', {
+                            branch: 'short_generating',
+                            previousStatus: this.lastStatus,
+                            turnStartedAt: shortTurnStartedAt || null,
+                            busyEpochAtArm: this.busyEpoch,
+                            lastOutputAtArm: typeof adapterStatus?.lastOutputAt === 'number' ? adapterStatus.lastOutputAt : null,
+                            flushDelay: NATIVE_HISTORY_MESH_IDLE_SETTLE_MS,
+                            evidenceSource: shortEvidenceSource,
+                            missingEvidence,
+                            hasFinalSummary: !!shortFinalSummary,
+                        });
                         this.scheduleCompletedDebounceFlush(NATIVE_HISTORY_MESH_IDLE_SETTLE_MS);
                     } else if (missingEvidence) {
                         // NON-MESH, missing evidence: suppress the completion event entirely (the
@@ -2721,6 +2891,16 @@ export class CliProviderInstance implements ProviderInstance {
                         ? (meshSettleSession ? NATIVE_HISTORY_MESH_IDLE_SETTLE_MS : 0)
                         : 3000;
                     LOG.debug('CLI', `[${this.type}] set completedDebouncePending duration=${duration}s ownsExternalHistory=${ownsExternalHistory} meshSettle=${meshSettleSession} flushDelay=${flushDelay}ms generatingStartedAt=${this.generatingStartedAt}`);
+                    if (this.completionTraceOn()) this.recordCompletionGateTrace('arm', {
+                        branch: 'normal',
+                        previousStatus: this.completedDebouncePending.previousStatus,
+                        turnStartedAt: this.completedDebouncePending.turnStartedAt ?? null,
+                        busyEpochAtArm: this.completedDebouncePending.busyEpochAtArm ?? null,
+                        lastOutputAtArm: this.completedDebouncePending.lastOutputAtArm ?? null,
+                        flushDelay,
+                        ownsExternalHistory,
+                        meshSettle: meshSettleSession,
+                    });
                     this.scheduleCompletedDebounceFlush(flushDelay);
                 }
             } else if (newStatus === 'idle' && this.lastStatus === 'starting') {
@@ -3124,7 +3304,16 @@ export class CliProviderInstance implements ProviderInstance {
     }
 
     /** @see ProviderInstance.noteManualInteraction */
-    noteManualInteraction(now = Date.now()): void {
+    noteManualInteraction(now = Date.now(), opts?: { passive?: boolean }): void {
+        // P1b (#137 secondary): a DELEGATED worker session must not treat a
+        // passive dashboard view (foreground tab selection / panel open) as
+        // manual attendance. A coordinator merely peeking at a worker's panel
+        // would otherwise suppress that worker's delegated auto-approve for the
+        // whole 60s window. Only explicit input/intervention (controlbar,
+        // resolve_action, pty_input) attends a worker. Non-worker (foreground)
+        // sessions keep noting on passive views so a user foregrounding their own
+        // session still holds auto-approve to act on the modal themselves.
+        if (opts?.passive && this.isMeshWorkerSession()) return;
         this.manualAttendance.note(now);
     }
 
@@ -3154,6 +3343,50 @@ export class CliProviderInstance implements ProviderInstance {
             && now - this.autoApproveMaskSince > CliProviderInstance.AUTO_APPROVE_MASK_STALL_MS;
     }
 
+    /**
+     * NOTIF-APPROVAL-MASKED (Q1b): surface a delegated worker's STALLED auto-approve modal
+     * to the mesh COORDINATOR, decoupled from the dashboard visible-status mask.
+     *
+     * When auto-approve is configured but the episode never settles (modal parse miss / the
+     * settle gate never satisfied), getState()/detectStatusTransition() fold the raw
+     * `waiting_approval` into `generating` to suppress dashboard flicker — so
+     * detectStatusTransition()'s `waiting_approval` arm never runs and NO agent:waiting_approval
+     * event is emitted. The coordinator's real-time approval-nudge delivery then has no input and
+     * the worker's stuck modal is never surfaced (the live ~25s stall). The dashboard mask is
+     * intentional and stays; this emits the coordinator nudge exactly ONCE, gated on the SAME
+     * raw-waiting_approval + mask-stalled signal resolveModalParkStatus() distinguishes, the
+     * instant the mask-stall threshold trips (the same moment getState un-folds the mask).
+     *
+     * Only delegated worker sessions qualify: a foreground session has no coordinator to notify,
+     * and its own dashboard mask already reveals the modal on stall. A normally-resolving
+     * auto-approve never reaches AUTO_APPROVE_MASK_STALL_MS, so it emits nothing here; and if a
+     * masked approval clears just as this fires, rc.455's isApprovalNudgeResolved stale-drop
+     * discards the nudge coordinator-side without noise. Dedup is per-episode (keyed on the
+     * mask-clock value) so a modal that flaps between parsed/unparsed states is announced once.
+     */
+    private maybeEmitStalledApprovalNudge(adapterStatus: any, now: number): void {
+        if (!this.isMeshWorkerSession()) return;
+        if (adapterStatus?.status !== 'waiting_approval') return;
+        if (!this.autoApproveMaskStalled(now)) return;
+        // Exactly once per stalled episode (autoApproveMaskSince uniquely identifies it).
+        if (this.stalledApprovalNudgeEpisode === this.autoApproveMaskSince) return;
+        this.stalledApprovalNudgeEpisode = this.autoApproveMaskSince;
+        const modal = adapterStatus.activeModal;
+        const dirName = workingDirBasename(this.workingDir);
+        const chatTitle = `${this.provider.name} · ${dirName}`;
+        this.appendRuntimeSystemMessage(
+            this.formatApprovalRequestMessage(modal?.message, modal?.buttons),
+            `approval_request:${now}`,
+            now,
+        );
+        this.pushEvent({
+            event: 'agent:waiting_approval', chatTitle, timestamp: now,
+            modalMessage: modal?.message,
+            modalButtons: modal?.buttons,
+        });
+        LOG.info('CLI', `[${this.type}] stalled auto-approve nudge → coordinator (masked ${Math.round((now - this.autoApproveMaskSince) / 1000)}s)`);
+    }
+
     private recordAutoApproval(modalMessage?: string, buttonLabel?: string, now = Date.now()): void {
         this.appendRuntimeSystemMessage(
             formatAutoApprovalMessage(modalMessage, buttonLabel),

package/src/providers/manual-attendance.ts

@@ -83,3 +83,23 @@ export const MANUAL_ATTENDANCE_COMMANDS: ReadonlySet<string> = new Set([
     'resolve_action',
     'pty_input',
 ]);
+
+/**
+ * The subset of {@link MANUAL_ATTENDANCE_COMMANDS} that are PASSIVE view-only
+ * actions — foregrounding a session's tab / opening its panel. They convey "I am
+ * looking at this session", not "I am driving it", and carry no user input.
+ *
+ * For a foreground (base-node) session these still attend: a user who
+ * foregrounds their own session should get the quiet window so an incoming
+ * approval stays visible for them to act on. But for a DELEGATED worker session
+ * a passive peek must NOT attend — a coordinator merely opening a worker's panel
+ * to watch progress would otherwise suppress that worker's delegated
+ * auto-approve for the whole window (secondary cause, #137). The per-instance
+ * hook decides: it drops a passive stamp only when the session is a delegated
+ * worker, so explicit input (controlbar / resolve_action / pty_input) still
+ * attends a worker and a foreground session is unaffected.
+ */
+export const MANUAL_ATTENDANCE_PASSIVE_VIEW_COMMANDS: ReadonlySet<string> = new Set([
+    'select_session',
+    'open_panel',
+]);

package/src/providers/provider-instance.ts

@@ -232,8 +232,13 @@ export interface ProviderInstance {
      * input). Provider-common signal that suppresses auto-approve for a short
      * window so the user can drive the session manually; background mesh worker
      * sessions never receive it, so their delegated auto-approve is unaffected.
+     *
+     * `opts.passive` marks a view-only action (select_session / open_panel). A
+     * delegated worker session ignores passive stamps so a coordinator merely
+     * watching its panel does not suppress its delegated auto-approve; explicit
+     * input still attends. Foreground sessions attend on passive views too.
      */
-    noteManualInteraction?(now?: number): void;
+    noteManualInteraction?(now?: number, opts?: { passive?: boolean }): void;
 
  /** cleanup */
     dispose(): void;