@adhdev/daemon-core 0.9.82-rc.461 → 0.9.82-rc.463

package/dist/mesh/mesh-events-pending.d.ts

@@ -52,8 +52,32 @@ export interface PendingEventEmitHint {
     /** coordinatorRunId to fold into the derived identity when the event lacks one. */
     coordinatorRunId?: string;
 }
-/** Observability counters for the accept-and-warn rollout. Read by tests and (later,
- *  B4) surfaced in mesh_status. Process-lifetime totals — never reset in production. */
+/**
+ * T6 (B3c) enforce switch. When ON, the drain path stops passing an unversioned
+ * (v1) or a validation-failing v2 event through to the coordinator — it QUARANTINES
+ * it instead (excluded from the delivered batch + WARN + counter), and unicast
+ * routing is the only delivery path (there is no v1 broadcast fallback). Off (the
+ * default) preserves the accept-and-warn rollout behaviour exactly.
+ *
+ * Per the rollout plan (§1 decision 4): enforce is `MESH_PROTOCOL_V2_ENFORCE` (env)
+ * — its activation is a deliberate operational step taken ONLY after daemonBuilds
+ * confirms every node emits v2 (§배포 게이트 1 / risk §4). So the code default is
+ * OFF; flipping the env back to accept mode is a pure-env rollback (no code change,
+ * no data migration — the schema is additive). Read at call time so a test /
+ * operator can toggle it without a restart.
+ *
+ * Quarantine (not drop) keeps the loss-free invariant. The DESTRUCTIVE drain has
+ * already consumed the event from its store by the time routing runs, so "held
+ * back" here means: excluded from the delivered batch AND mirrored into the mesh
+ * ledger as a recoverable `event_held` entry (the same recovery channel the
+ * pending-trim path uses). It is observable via the counters + the ledger, so an
+ * operator can requeue it after fixing the producer. The non-destructive PEEK path
+ * (countMetrics=false) merely omits the event from the returned list — it never
+ * consumed it and must not ledger-record on every status poll.
+ */
+export declare function isMeshProtocolV2EnforceEnabled(): boolean;
+/** Observability counters for the v2 drain path. Read by tests and surfaced in
+ *  mesh_status (B4/T6). Process-lifetime totals — never reset in production. */
 declare const meshV2DrainCounters: {
     /** v2 events that passed validation and unicast/broadcast routing → delivered. */
     v2Delivered: number;
@@ -70,6 +94,14 @@ declare const meshV2DrainCounters: {
     v2ReattributedToDrainer: number;
     /** v1 (unversioned) events passed through as broadcast (rollout baseline). */
     v1BroadcastAccepted: number;
+    /** T6 enforce: v2 events that FAILED validation and were QUARANTINED (held back
+     *  from delivery, not dropped). Non-zero here means a producer is still emitting a
+     *  malformed envelope after enforce was turned on. */
+    v2ValidationFailedQuarantined: number;
+    /** T6 enforce: v1 (unversioned) events QUARANTINED because no v2 envelope could be
+     *  derived at emit time. Non-zero here means a producer path still emits v1 after
+     *  enforce — it should reach 0 once every node is on a v2-stamping build. */
+    v1UnversionedQuarantined: number;
 };
 /** Test/observability accessor for the v2 drain counters (snapshot copy). */
 export declare function getMeshV2DrainCounters(): Readonly<typeof meshV2DrainCounters>;

package/dist/mesh/mesh-events.d.ts

@@ -1,6 +1,6 @@
 export type { PendingMeshCoordinatorEvent } from './mesh-events-pending.js';
-export { queuePendingMeshCoordinatorEvent, drainPendingMeshCoordinatorEvents, getPendingMeshCoordinatorEvents, clearPendingMeshCoordinatorEvents, serializeV2EnvelopeToWire, readV2EnvelopeFromWire, } from './mesh-events-pending.js';
+export { queuePendingMeshCoordinatorEvent, drainPendingMeshCoordinatorEvents, getPendingMeshCoordinatorEvents, clearPendingMeshCoordinatorEvents, serializeV2EnvelopeToWire, readV2EnvelopeFromWire, getMeshV2DrainCounters, isMeshProtocolV2EnforceEnabled, } from './mesh-events-pending.js';
 export { reconcileDirectDispatchCompletionFromTranscript, } from './mesh-events-stale.js';
-export { setupMeshReconcileLoop, runMeshReconcileTick, resolveCoordinatorDrainDeliverability, shouldHoldPendingDrainForBusyLocalCoordinator, } from './mesh-reconcile-loop.js';
+export { setupMeshReconcileLoop, runMeshReconcileTick, resolveCoordinatorDrainDeliverability, shouldHoldPendingDrainForBusyLocalCoordinator, getMeshV2BackstopCounters, } from './mesh-reconcile-loop.js';
 export type { MeshQueueTriggerResult } from './mesh-events-coordinator.js';
 export { tryAssignQueueTask, isSessionActivelyGenerating, triggerMeshQueue, handleMeshForwardEvent, setupMeshEventForwarding, isMeshCoordinatorEvent, __resetIdleAutoFastForwardForTests, __resetMeshWorkspaceCacheForTests, } from './mesh-events-coordinator.js';

package/dist/mesh/mesh-reconcile-loop.d.ts

@@ -1,4 +1,16 @@
 import type { DaemonComponents } from '../boot/daemon-lifecycle.js';
+declare const meshV2BackstopCounters: {
+    /** PHASE-4 transcript synthesis actually reconciled a missing completion. */
+    phase4SynthesisFired: number;
+    /** Acked-hold transcript fast-track promoted a synth ahead of the death deadline. */
+    ackedHoldFastTrackFired: number;
+    /** Acked-hold death-deadline backstop released a held synth (the 8-min net). */
+    ackedHoldDeathDeadlineFired: number;
+};
+/** Test/observability accessor for the v2 last-resort backstop counters (snapshot). */
+export declare function getMeshV2BackstopCounters(): Readonly<typeof meshV2BackstopCounters>;
+/** Test helper: zero the backstop counters so a case starts from a clean slate. */
+export declare function __resetMeshV2BackstopCountersForTests(): void;
 export declare function __resetReconcileInFlightSynthDebounceForTests(): void;
 /**
  * DRAIN-WITHOUT-INJECT guard. Classify, for a mesh on THIS daemon, whether a

package/dist/providers/approval-utils.d.ts

@@ -1,4 +1,5 @@
 import type { ProviderModule } from './contracts.js';
+export declare function normalizeApprovalLabel(value: string): string;
 /**
  * True when any of the given button labels reads as a decline/negative option
  * (No / Deny / Cancel / Skip / …). Used as the second half of an approval-modal

package/dist/providers/cli-provider-instance.d.ts

@@ -283,6 +283,15 @@ export declare class CliProviderInstance implements ProviderInstance {
     private completionHasFinalAssistantMessage;
     private buildExternalTranscriptProbe;
     private recordPendingTranscriptProbe;
+    /**
+     * The spawned CLI's env overrides (e.g. the mesh coordinator points hermes
+     * at a per-coordinator HERMES_HOME so its state.db lives in a tmpdir instead
+     * of ~/.hermes). The native-history executor expands `${HERMES_HOME:-~/.hermes}`
+     * from this map, so the completion gate MUST pass it through — otherwise the
+     * gate reads ~/.hermes, finds no coordinator-session transcript, and
+     * false-fires missing_final_assistant on every coordinator turn.
+     */
+    private spawnedEnvOverrides;
     private readExternalCompletionMessages;
     private completionFinalAssistantEvidence;
     private completionFinalSummary;

package/dist/providers/spec/types.d.ts

@@ -83,6 +83,28 @@ export interface NativeHistorySqliteSource {
     path: string;
     session_query: string;
     message_query: string;
+    /**
+     * Optional sub-session cluster expansion. Some agents (hermes ≥0.14) split
+     * a SINGLE logical turn across several `sessions` rows linked by a parent
+     * pointer, and the turn's final assistant message lands in a DIFFERENT row
+     * than the one `session_query` / the daemon's pin resolves. Reading only
+     * the anchor session then surfaces zero (or stale) assistant bubbles even
+     * though the answer is physically present in a sibling/descendant row —
+     * `read_chat` returns no final assistant and the completion gate false-fires
+     * `missing_final_assistant`.
+     *
+     * When present, the executor treats the resolved session id as an ANCHOR
+     * and runs this query (bound `?` = anchor id) to expand it to every session
+     * id in the same logical cluster (typically a `WITH RECURSIVE` walk over the
+     * parent pointer, up to the root and back down through all descendants).
+     * `message_query` is then run once per cluster id and the rows merged and
+     * re-sorted by their mapped timestamp, so the turn's final assistant — in
+     * whichever sub-session it was written — is always included. Each returned
+     * row's first column is a cluster session id.
+     *
+     * Absent → single-session behaviour is unchanged (anchor session only).
+     */
+    session_cluster_query?: string;
     message_map: NativeHistoryMessageMap;
 }
 export interface NativeHistoryMessageMap {

package/dist/repo-mesh-types.d.ts

@@ -743,6 +743,37 @@ export interface RepoMeshStatus {
      * Omitted when nothing was drained. Mirrors the MCP tool's meshProtocolMetrics.
      */
     meshProtocolMetrics?: MeshProtocolMetrics;
+    /**
+     * T6 (B3c): live process-lifetime mesh-protocol-v2 enforce counters from THIS
+     * daemon — the enforce flag state, drain-routing tallies (deliver / route-away /
+     * dedup / quarantine), and the last-resort backstop fire counts (PHASE-4 synth,
+     * acked-hold fast-track / death-deadline). Diagnostic-only and never cached (a
+     * live snapshot). Under enforce, non-zero quarantine or backstop counts are the
+     * rollout-health signal (target 0). Omitted when unavailable.
+     */
+    meshProtocolV2Counters?: MeshProtocolV2Counters;
+}
+/** T6 (B3c) live v2 enforce/observability counters (see RepoMeshStatus.meshProtocolV2Counters). */
+export interface MeshProtocolV2Counters {
+    /** True when MESH_PROTOCOL_V2_ENFORCE is active on this daemon. */
+    enforce: boolean;
+    /** Drain-path routing tallies (accept + enforce). Process-lifetime totals. */
+    drain: {
+        v2Delivered: number;
+        v2RoutedAway: number;
+        v2DedupSkipped: number;
+        v2ValidationFailedAccepted: number;
+        v2ReattributedToDrainer: number;
+        v1BroadcastAccepted: number;
+        v2ValidationFailedQuarantined: number;
+        v1UnversionedQuarantined: number;
+    };
+    /** Last-resort backstop fire counts. Target 0 under a healthy v2 contract. */
+    backstop: {
+        phase4SynthesisFired: number;
+        ackedHoldFastTrackFired: number;
+        ackedHoldDeathDeadlineFired: number;
+    };
 }
 /** One provider's version skew across mesh nodes (see RepoMeshStatus.providerVersionSkew). */
 export interface MeshProviderVersionSkew {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.461",
+  "version": "0.9.82-rc.463",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.461",
-    "@adhdev/session-host-core": "0.9.82-rc.461",
+    "@adhdev/mesh-shared": "0.9.82-rc.463",
+    "@adhdev/session-host-core": "0.9.82-rc.463",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/commands/high-family/mesh-events.ts

@@ -12,6 +12,9 @@ import {
     drainPendingMeshCoordinatorEvents,
     shouldHoldPendingDrainForBusyLocalCoordinator,
     resolveCoordinatorDrainDeliverability,
+    getMeshV2DrainCounters,
+    getMeshV2BackstopCounters,
+    isMeshProtocolV2EnforceEnabled,
 } from '../../mesh/mesh-events.js';
 import { normalizeInteractivePromptResponse } from '../../providers/types/interactive-prompt.js';
 import type { HighFamilyContext, HighFamilyHandler } from './types.js';
@@ -66,11 +69,21 @@ export const meshEventsHandlers: Record<string, HighFamilyHandler> = {
             return { success: true, events: [], heldForBusyLocalCoordinator: true, hasLiveCliCoordinator };
         }
         const events = drainPendingMeshCoordinatorEvents(meshId || undefined, coordinatorDaemonId);
+        // T6 (B3c): ride the live v2 enforce/backstop counters on the drain response so a
+        // pure stdio MCP coordinator (which reads its inbox via this IPC call, not the
+        // daemon-core mesh_status command) sees the same enforce state + quarantine /
+        // last-resort-backstop tallies. Process-lifetime snapshot; the counters were just
+        // updated by the drain above. Additive — omitting it keeps version-skewed pullers safe.
+        const meshProtocolV2Counters = {
+            enforce: isMeshProtocolV2EnforceEnabled(),
+            drain: { ...getMeshV2DrainCounters() },
+            backstop: { ...getMeshV2BackstopCounters() },
+        };
         // SELF-COORDINATOR INBOX LEVEL-DRAIN: when the busy local coordinator drained its OWN
         // inbox (selfCoordinatorInboxRead), tell the puller these events were surfaced through
         // the caller's tool result — it must NOT re-forward them into the (busy) PTY (that is the
         // lossy path). Absent the flag, delivery is unchanged (reconcile-owned PTY / remote pull).
-        return { success: true, events, hasLiveCliCoordinator, ...(selfCoordinatorInboxRead ? { surfacedForSelfCoordinator: true } : {}) };
+        return { success: true, events, hasLiveCliCoordinator, meshProtocolV2Counters, ...(selfCoordinatorInboxRead ? { surfacedForSelfCoordinator: true } : {}) };
     },
 
     interactive_prompt_response: async (ctx: HighFamilyContext, args: any) => {

package/src/commands/high-family/mesh-status.ts

@@ -19,7 +19,13 @@ import {
     normalizeMeshNodeId,
     daemonIdsEquivalent,
 } from '@adhdev/mesh-shared';
-import { getPendingMeshCoordinatorEvents } from '../../mesh/mesh-events.js';
+import {
+    getPendingMeshCoordinatorEvents,
+    getMeshV2DrainCounters,
+    getMeshV2BackstopCounters,
+    isMeshProtocolV2EnforceEnabled,
+} from '../../mesh/mesh-events.js';
+import type { MeshProtocolV2Counters } from '../../repo-mesh-types.js';
 import { getRecentUnroutableDeliveries } from '../../mesh/mesh-routing.js';
 import { normalizeMeshDaemonRole, resolveMeshHostStatus } from '../../mesh/mesh-host-ownership.js';
 import { buildPreviewFreshness } from '../../mesh/preview-freshness.js';
@@ -592,6 +598,15 @@ export const meshStatusHandlers: Record<string, HighFamilyHandler> = {
                     // that a worker completion was lost (envelope present, mesh unresolved) instead
                     // of it vanishing silently. Diagnostic-only — never cached (see omit below).
                     const unroutableDeliveries = getRecentUnroutableDeliveries();
+                    // T6 (B3c): live enforce/observability counters from this daemon. A
+                    // process-lifetime snapshot (never cached — like unroutableDeliveries)
+                    // so an operator/coordinator can read enforce state, quarantine tallies,
+                    // and last-resort backstop fires straight from the aggregate status.
+                    const meshProtocolV2Counters: MeshProtocolV2Counters = {
+                        enforce: isMeshProtocolV2EnforceEnabled(),
+                        drain: { ...getMeshV2DrainCounters() },
+                        backstop: { ...getMeshV2BackstopCounters() },
+                    };
                     const previewFreshness = (() => {
                         const localRepoRoot = nodeStatuses
                             .map((node: any) => readStringValue(node?.git?.repoRoot, node?.repoRoot, node?.workspace))
@@ -707,6 +722,7 @@ export const meshStatusHandlers: Record<string, HighFamilyHandler> = {
                         ...(historicalSessions ? { historicalSessions } : {}),
                         ...(pendingCoordinatorEvents.length > 0 ? { pendingCoordinatorEvents } : {}),
                         ...(unroutableDeliveries.length > 0 ? { unroutableDeliveries } : {}),
+                        meshProtocolV2Counters,
                         activeRefineJobs: Array.from(ctx.runningRefineJobs.values())
                             .filter(job => job.meshId === meshId)
                             .map(job => ({
@@ -718,7 +734,7 @@ export const meshStatusHandlers: Record<string, HighFamilyHandler> = {
                                 targetCoordinatorDaemonId: job.targetCoordinatorDaemonId,
                             })),
                     };
-                    const { pendingCoordinatorEvents: _pendingCoordinatorEvents, unroutableDeliveries: _unroutableDeliveries, ...cacheableStatusResult } = statusResult as any;
+                    const { pendingCoordinatorEvents: _pendingCoordinatorEvents, unroutableDeliveries: _unroutableDeliveries, meshProtocolV2Counters: _meshProtocolV2Counters, ...cacheableStatusResult } = statusResult as any;
                     // Verbose carries full mission goals; never store it in the shared
                     // (compact) aggregate cache or a later compact poll would return the
                     // heavy goals from cache. Return it without caching.
@@ -729,6 +745,7 @@ export const meshStatusHandlers: Record<string, HighFamilyHandler> = {
                         ...rememberedStatus,
                         ...(pendingCoordinatorEvents.length > 0 ? { pendingCoordinatorEvents } : {}),
                         ...(unroutableDeliveries.length > 0 ? { unroutableDeliveries } : {}),
+                        meshProtocolV2Counters,
                     };
                     logRepoMeshStatusDebug('return_live', {
                         meshId,

package/src/commands/router-aggregate-status.ts

@@ -0,0 +1,209 @@
+/**
+ * Aggregate mesh-status cache — extracted from router.ts (behavior-preserving code move).
+ *
+ * These functions were `DaemonCommandRouter` methods; they now take the router
+ * instance as `self`. The class keeps thin delegating wrappers
+ * (getCachedAggregateMeshStatus / rememberAggregateMeshStatus are bound into
+ * HighFamilyContext — intra-cluster calls therefore go through `self.` so instance
+ * dispatch is preserved). No log string, error message, refusal condition, or
+ * result shape changed — only physical location + `this.` → `self.`.
+ *
+ * The group is self-contained: it reads only `self.aggregateMeshStatusCache` and
+ * imported mesh-node-identity / mesh-work-queue helpers. It does NOT touch the
+ * inline-mesh cache cluster, so the move is a pure lift.
+ */
+import type { DaemonCommandRouter } from './router.js';
+import { normalizeMeshNodeId } from '@adhdev/mesh-shared';
+import { getMeshQueueRevision } from '../mesh/mesh-work-queue.js';
+import {
+    applyInlineMeshBranchConvergence,
+    buildInlineMeshTransitGitStatus,
+    buildLivePeerGitConnection,
+    deriveMeshNodeHealthFromGit,
+    isDeadLocalWorktreeNode,
+    readBooleanValue,
+    readInlineMeshNodeId,
+    readObjectRecord,
+    readStringValue,
+    shouldRefreshStalePendingAggregate,
+    summarizeInlineMeshBranchConvergence,
+} from '../mesh/mesh-node-identity.js';
+
+export function cloneJsonValue<T>(value: T): T {
+    if (typeof structuredClone === 'function') return structuredClone(value);
+    return JSON.parse(JSON.stringify(value)) as T;
+}
+
+export function hydrateCachedAggregateMeshStatusFromInline(
+    self: DaemonCommandRouter,
+    snapshot: any,
+    mesh: any,
+    options?: { requireDirectPeerTruth?: boolean },
+): any {
+        if (!mesh || typeof mesh !== 'object' || !Array.isArray(mesh.nodes) || !Array.isArray(snapshot?.nodes)) return snapshot;
+        const inlineNodesById = new Map<string, any>();
+        for (const node of mesh.nodes) {
+            const nodeId = readInlineMeshNodeId(node);
+            if (nodeId) inlineNodesById.set(nodeId, node);
+        }
+        if (!inlineNodesById.size) return snapshot;
+
+        let changed = false;
+        const unavailableNodeIds = new Set<string>();
+        const sourceOfTruth = readObjectRecord(snapshot.sourceOfTruth);
+        const directPeerTruth = readObjectRecord(sourceOfTruth.directPeerTruth);
+        // Dead local worktree nodes (isLocalWorktree, workspace deleted from disk)
+        // carry no live truth and must never gate the aggregate as unavailable.
+        // A cached snapshot built before the worktree was removed can still list
+        // such a node in unavailableNodeIds, which would wedge the graph in a
+        // permanent direct_peer_truth_unavailable; drop them here so the held
+        // standing-state truth for the surviving nodes satisfies the aggregate.
+        const deadNodeIds = new Set<string>();
+        for (const node of mesh.nodes) {
+            if (!isDeadLocalWorktreeNode(node)) continue;
+            const deadId = readInlineMeshNodeId(node);
+            if (deadId) deadNodeIds.add(deadId);
+        }
+        let droppedDeadUnavailable = false;
+        for (const entry of Array.isArray(directPeerTruth.unavailableNodeIds) ? directPeerTruth.unavailableNodeIds : []) {
+            const nodeId = readStringValue(entry);
+            if (!nodeId) continue;
+            if (deadNodeIds.has(nodeId)) {
+                droppedDeadUnavailable = true;
+                continue;
+            }
+            unavailableNodeIds.add(nodeId);
+        }
+        // Force a rewrite when a dead worktree was filtered out of a previously
+        // built unavailable set, even if no live git was re-hydrated this pass —
+        // otherwise the early-return below would hand back the stale snapshot that
+        // still says direct_peer_truth_unavailable.
+        if (droppedDeadUnavailable) changed = true;
+
+        const nodes = snapshot.nodes.map((statusNode: any) => {
+            const nodeId = normalizeMeshNodeId(statusNode);
+            const inlineNode = nodeId ? inlineNodesById.get(nodeId) : undefined;
+            if (!inlineNode) return statusNode;
+            const liveGit = buildInlineMeshTransitGitStatus(inlineNode);
+            if (!liveGit) return statusNode;
+            const nextStatus = { ...statusNode };
+            nextStatus.git = liveGit;
+            nextStatus.health = deriveMeshNodeHealthFromGit(liveGit);
+            applyInlineMeshBranchConvergence(mesh, inlineNode, nextStatus);
+            nextStatus.launchReady = readBooleanValue(nextStatus.launchReady) ?? true;
+            const connection = readObjectRecord(nextStatus.connection);
+            const connectionState = readStringValue(connection.state);
+            const connectionReported = readBooleanValue(connection.reported) ?? false;
+            if (!connectionReported || connectionState === 'unknown') {
+                nextStatus.connection = buildLivePeerGitConnection(connection);
+            }
+            delete nextStatus.gitProbePending;
+            const error = readStringValue(nextStatus.error);
+            if (error && /pending_git|git probe|live peer git snapshot|no peer git snapshot/i.test(error)) delete nextStatus.error;
+            if (!readStringValue(nextStatus.machineStatus)) nextStatus.machineStatus = 'online';
+            if (nodeId) unavailableNodeIds.delete(nodeId);
+            changed = true;
+            return nextStatus;
+        });
+
+        const aggregateDirectTruthSatisfied = sourceOfTruth.coordinatorOwnsLiveTruth === true
+            || directPeerTruth.satisfied === true;
+        if (!changed && !(options?.requireDirectPeerTruth && unavailableNodeIds.size > 0 && !aggregateDirectTruthSatisfied)) return snapshot;
+        const nextSourceOfTruth = {
+            ...sourceOfTruth,
+            ...(Object.keys(directPeerTruth).length ? {
+                directPeerTruth: {
+                    ...directPeerTruth,
+                    satisfied: options?.requireDirectPeerTruth === true
+                        ? aggregateDirectTruthSatisfied || unavailableNodeIds.size === 0
+                        : directPeerTruth.satisfied,
+                    unavailableNodeIds: [...unavailableNodeIds],
+                },
+                ...(options?.requireDirectPeerTruth === true ? {
+                    coordinatorOwnsLiveTruth: aggregateDirectTruthSatisfied || unavailableNodeIds.size === 0,
+                    currentStatus: aggregateDirectTruthSatisfied || unavailableNodeIds.size === 0 ? 'live_git_and_session_probes' : 'direct_peer_truth_unavailable',
+                } : {}),
+            } : {}),
+        };
+        return {
+            ...snapshot,
+            ...(options?.requireDirectPeerTruth === true && unavailableNodeIds.size > 0 && !aggregateDirectTruthSatisfied ? {
+                success: false,
+                code: 'mesh_direct_peer_truth_unavailable',
+                error: 'Selected coordinator could not confirm direct mesh truth for every remote node yet.',
+            } : {}),
+            sourceOfTruth: nextSourceOfTruth,
+            branchConvergenceSummary: summarizeInlineMeshBranchConvergence(nodes),
+            nodes,
+        };
+}
+
+export function getCachedAggregateMeshStatus(
+    self: DaemonCommandRouter,
+    meshId: string,
+    mesh?: any,
+    options?: { requireDirectPeerTruth?: boolean; allowStalePending?: boolean },
+): any | null {
+        const cached = self.aggregateMeshStatusCache.get(meshId);
+        if (!cached?.snapshot || cached.snapshot.success !== true || !Array.isArray(cached.snapshot.nodes)) return null;
+        // Genuine invalidation still forces truth: a queue mutation bumps the
+        // revision, so a stale-revision snapshot is never served (even under the
+        // SWR allowStalePending path below).
+        if (cached.queueRevision !== getMeshQueueRevision(meshId)) return null;
+        let snapshot = cloneJsonValue(cached.snapshot);
+        snapshot = hydrateCachedAggregateMeshStatusFromInline(self, snapshot, mesh, options);
+        // SWR: allowStalePending lets the interactive detail-open serve a snapshot
+        // that still has pending peer-git nodes (would otherwise miss here) so the
+        // graph paints instantly; the caller fires a background freshen. The
+        // queueRevision guard above is NOT relaxed — only the pending-git freshness
+        // gate is, so a genuine queue/identity mutation still forces a live rebuild.
+        if (!options?.allowStalePending && shouldRefreshStalePendingAggregate(snapshot, options)) return null;
+        const ageMs = Math.max(0, Date.now() - cached.builtAt);
+        const sourceOfTruth = snapshot.sourceOfTruth && typeof snapshot.sourceOfTruth === 'object'
+            ? snapshot.sourceOfTruth
+            : {};
+        snapshot.sourceOfTruth = {
+            ...sourceOfTruth,
+            aggregateSnapshot: {
+                ...(sourceOfTruth.aggregateSnapshot && typeof sourceOfTruth.aggregateSnapshot === 'object'
+                    ? sourceOfTruth.aggregateSnapshot
+                    : {}),
+                owner: 'coordinator_daemon_memory',
+                cached: true,
+                source: 'memory',
+                refreshReason: 'memory_cache_hit',
+                ageMs,
+                cachedAt: new Date(cached.builtAt).toISOString(),
+                returnedAt: new Date().toISOString(),
+            },
+        };
+        return snapshot;
+}
+
+export function rememberAggregateMeshStatus(
+    self: DaemonCommandRouter,
+    meshId: string,
+    snapshot: any,
+    refreshReason: string,
+): any {
+        if (!snapshot || typeof snapshot !== 'object' || snapshot.success !== true || !Array.isArray(snapshot.nodes)) return snapshot;
+        const builtAt = Date.now();
+        const next = cloneJsonValue(snapshot);
+        const sourceOfTruth = next.sourceOfTruth && typeof next.sourceOfTruth === 'object'
+            ? next.sourceOfTruth
+            : {};
+        next.sourceOfTruth = {
+            ...sourceOfTruth,
+            aggregateSnapshot: {
+                owner: 'coordinator_daemon_memory',
+                cached: false,
+                source: 'live_refresh',
+                refreshReason,
+                ageMs: 0,
+                cachedAt: new Date(builtAt).toISOString(),
+                returnedAt: new Date(builtAt).toISOString(),
+            },
+        };
+        self.aggregateMeshStatusCache.set(meshId, { builtAt, snapshot: cloneJsonValue(next), queueRevision: getMeshQueueRevision(meshId) });
+        return next;
+}

package/src/commands/router-mesh-session-owner.ts

@@ -0,0 +1,114 @@
+/**
+ * Remote mesh-session owner resolution — extracted from router.ts (behavior-preserving code move).
+ *
+ * These functions were `DaemonCommandRouter` methods; they now take the router
+ * instance as `self`. resolveRemoteMeshSessionOwnerDaemonId stays reachable as a
+ * public method (the [Z] session-scoped forward in executeDaemonCommand and the
+ * mesh-session-scoped-remote-forward test call it), so the class keeps a thin
+ * delegating wrapper. No log string, error message, refusal condition, or result
+ * shape changed — only physical location + `this.` → `self.`.
+ *
+ * The group is read-only: it reads self.deps.statusInstanceId, the cached inline-mesh
+ * nodes, and the aggregate-status snapshot nodes. It never mutates router state.
+ */
+import type { DaemonCommandRouter } from './router.js';
+import { meshNodeIdMatches, daemonIdsEquivalent } from '@adhdev/mesh-shared';
+import {
+    collectMeshNodeHostedSessionIds,
+    readMeshNodeDaemonId,
+    readObjectRecord,
+} from '../mesh/mesh-node-identity.js';
+
+/**
+ * Resolve the REMOTE worker daemonId that owns a given session, when the session
+ * belongs to a mesh node hosted on a DIFFERENT daemon than this coordinator.
+ *
+ * The coordinator does not host remote-worker session instances in its own
+ * instanceManager/sessionRegistry — only their cached mesh-node metadata. A
+ * dashboard-issued session-scoped command (invoke_provider_script / resolve_action /
+ * set_mode / …) lands on the coordinator with a targetSessionId the coordinator can't
+ * find locally, and without forwarding it dies as "Live session not found". send_chat
+ * happens to survive (its target resolves to the worker by another route), but the
+ * controlbar commands do not — so the controlbar buttons appear to do nothing.
+ *
+ * Mirror the existing node-level remote-forward pattern (fast_forward_mesh_node etc.):
+ * scan the candidate mesh nodes for the one hosting the targetSessionId, and return its
+ * daemonId when that daemonId is a remote daemon (i.e. not this coordinator's own
+ * statusInstanceId). Returns undefined for a locally-hosted session (no forward — execute
+ * locally as before) or when ownership can't be resolved.
+ *
+ * The candidate set spans BOTH the cached inline-mesh nodes and the live aggregate
+ * mesh-status snapshots. The inline cache reliably carries only each node's single primary
+ * session (cachedStatus.activeSession), so a worker hosting more than one session exposes its
+ * non-primary sessions only on the aggregate snapshot nodes (status.activeSessions /
+ * activeSessionDetails, built from live session records). collectMeshNodeHostedSessionIds does
+ * the wider plural-shape scan so a controlbar/modal command targeting a non-primary remote
+ * session still resolves its owner — the singular readCachedInlineMeshActiveSessions semantics
+ * other consumers depend on stay untouched.
+ *
+ * CANCEL-STOP-RELAY: the session-id cache scan above only matches when the coordinator's
+ * cached status snapshot already lists the worker's session id in a recognized active-sessions
+ * shape. A worktree-clone worker session whose id form/timing differs from the cached snapshot
+ * (or is simply not yet reflected) misses the scan, so a stop that carries the authoritative
+ * owning nodeId (mesh_queue_cancel knows assignedNodeId) used to silently fail to forward.
+ * `ownerNodeIdHint` adds a deterministic fallback: when the session-id scan misses, resolve the
+ * owner daemonId by matching the node by id (meshNodeIdMatches — same form-tolerant compare the
+ * rest of the router uses, no new raw compare). The same self-loopback guard applies to both
+ * paths, so a coordinator-hosted node is still never force-forwarded to a remote form of itself.
+ */
+export function resolveRemoteMeshSessionOwnerDaemonId(
+    self: DaemonCommandRouter,
+    sessionId: string,
+    ownerNodeIdHint?: string,
+): string | undefined {
+        const trimmed = typeof sessionId === 'string' ? sessionId.trim() : '';
+        const nodeHint = typeof ownerNodeIdHint === 'string' ? ownerNodeIdHint.trim() : '';
+        if (!trimmed && !nodeHint) return undefined;
+        const selfDaemonId = self.deps.statusInstanceId;
+        const candidates = collectMeshSessionOwnerCandidateNodes(self);
+        if (trimmed) {
+            for (const node of candidates) {
+                if (!collectMeshNodeHostedSessionIds(node).has(trimmed)) continue;
+                const nodeDaemonId = readMeshNodeDaemonId(readObjectRecord(node));
+                // A matching node with no readable daemonId can't be attributed — keep scanning
+                // the remaining candidates (e.g. the same session on an aggregate node that does
+                // carry the daemonId) rather than bailing on the whole resolution.
+                if (!nodeDaemonId) continue;
+                // Only forward to a genuinely remote daemon. When the owning node is this
+                // coordinator itself (locally hosted worker), fall through to local handling.
+                // id-form robust: the node daemonId and selfDaemonId may be stored in different
+                // forms of the same machine — a strict `===` would miss the self-match and forward
+                // a local session to a remote form of THIS daemon (loopback).
+                if (selfDaemonId && daemonIdsEquivalent(nodeDaemonId, selfDaemonId)) return undefined;
+                return nodeDaemonId;
+            }
+        }
+        // Deterministic fallback: the session-id scan missed (cache lag / id-form mismatch on a
+        // worktree-clone worker), but the caller knows the authoritative owning nodeId. Resolve the
+        // owner daemonId straight off that node — never the fuzzy session cache.
+        if (nodeHint) {
+            for (const node of candidates) {
+                if (!meshNodeIdMatches(node, nodeHint)) continue;
+                const nodeDaemonId = readMeshNodeDaemonId(readObjectRecord(node));
+                if (!nodeDaemonId) continue;
+                if (selfDaemonId && daemonIdsEquivalent(nodeDaemonId, selfDaemonId)) return undefined;
+                return nodeDaemonId;
+            }
+        }
+        return undefined;
+}
+
+/**
+ * Candidate nodes for remote-session owner resolution: the cached inline-mesh nodes (which
+ * carry each node's primary session) plus the nodes from every cached aggregate mesh-status
+ * snapshot (which carry each node's full live session list). getCachedInlineMeshNodes()
+ * returns a fresh array, so appending the aggregate nodes never mutates cached state.
+ */
+export function collectMeshSessionOwnerCandidateNodes(self: DaemonCommandRouter): any[] {
+        const nodes: any[] = self.getCachedInlineMeshNodes();
+        for (const cached of self.aggregateMeshStatusCache.values()) {
+            const snapshotNodes = cached?.snapshot?.nodes;
+            if (Array.isArray(snapshotNodes)) nodes.push(...snapshotNodes);
+        }
+        return nodes;
+}