@adhdev/daemon-core 0.9.82-rc.463 → 0.9.82-rc.465

package/dist/mesh/mesh-events-pending.d.ts

@@ -56,15 +56,16 @@ export interface PendingEventEmitHint {
  * T6 (B3c) enforce switch. When ON, the drain path stops passing an unversioned
  * (v1) or a validation-failing v2 event through to the coordinator — it QUARANTINES
  * it instead (excluded from the delivered batch + WARN + counter), and unicast
- * routing is the only delivery path (there is no v1 broadcast fallback). Off (the
- * default) preserves the accept-and-warn rollout behaviour exactly.
+ * routing is the only delivery path (there is no v1 broadcast fallback). On by
+ * default; set MESH_PROTOCOL_V2_ENFORCE=0/false/off/no to disable and restore the
+ * accept-and-warn rollout behaviour exactly.
  *
- * Per the rollout plan (§1 decision 4): enforce is `MESH_PROTOCOL_V2_ENFORCE` (env)
- * — its activation is a deliberate operational step taken ONLY after daemonBuilds
- * confirms every node emits v2 (§배포 게이트 1 / risk §4). So the code default is
- * OFF; flipping the env back to accept mode is a pure-env rollback (no code change,
- * no data migration — the schema is additive). Read at call time so a test /
- * operator can toggle it without a restart.
+ * Per the rollout plan (§1 decision 4): enforce is `MESH_PROTOCOL_V2_ENFORCE` (env).
+ * Now that every node emits v2 (§배포 게이트 1 / risk §4), the code default is ON —
+ * a manual env injection is no longer required to get enforce behaviour. Rollback to
+ * accept mode is a pure-env step: set `MESH_PROTOCOL_V2_ENFORCE=0` (or `false`/`off`/
+ * `no`) — no code change, no data migration (the schema is additive). Read at call
+ * time so a test / operator can toggle it without a restart.
  *
  * Quarantine (not drop) keeps the loss-free invariant. The DESTRUCTIVE drain has
  * already consumed the event from its store by the time routing runs, so "held
@@ -182,6 +183,16 @@ export declare function getPendingMeshCoordinatorEvents(meshId?: string, coordin
  * (including drained fingerprint history) and JSONL files.
  */
 export declare function __clearMeshPendingEventsForTests(meshId: string): void;
+/**
+ * Test helper: persist a pending event VERBATIM, skipping the emit-time v2 stamp.
+ * The local emit path (queuePendingMeshCoordinatorEvent → stampPendingEventV2) now
+ * always mints a v2 envelope (self-daemon broadcast fallback when no coordinator
+ * identity is present), so a genuinely-unversioned (v1) row can no longer be produced
+ * through the normal queue. The drain-side v1 handling (accept-broadcast / enforce-
+ * quarantine) still matters for durable v1 rows written by a pre-v2 daemon and for
+ * version-skewed remote relays, so tests inject those rows directly through this.
+ */
+export declare function __persistUnstampedPendingEventForTests(event: PendingMeshCoordinatorEvent): boolean;
 /** Explicitly clear all pending coordinator events for a mesh (and coordinator if scoped). */
 export declare function clearPendingMeshCoordinatorEvents(meshId?: string, coordinatorDaemonId?: string): void;
 export {};

package/dist/mesh/mesh-reconcile-acked-hold.d.ts

@@ -0,0 +1,17 @@
+export declare const ACKED_DEATH_CONSECUTIVE_READ_FAILURES = 3;
+export declare function resolveTunedReconcileMs(envName: string, def: number, min: number, max: number): number;
+export declare function resolveAckedDeathDeadlineMs(): number;
+export declare function resolveAckedTranscriptFastTrackGraceMs(): number;
+export interface AckedHoldState {
+    liveConfirmedSinceAck: boolean;
+    consecutiveReadFailures: number;
+    transcriptIdleSinceMs?: number;
+}
+export declare const inFlightAckedHoldState: Map<string, AckedHoldState>;
+export declare function inFlightSynthKey(meshId: string, taskId: string): string;
+export declare function getHoldState(synthKey: string, meshId: string): AckedHoldState | undefined;
+export declare function setHoldState(synthKey: string, meshId: string, state: AckedHoldState): void;
+export declare function deleteHoldState(synthKey: string, meshId: string): void;
+export declare function rehydrateAckedHoldsForMesh(meshId: string): void;
+export declare function collectHeldSynthKeysForMesh(meshId: string): Set<string>;
+export declare function __resetReconcileInFlightSynthDebounceForTests(): void;

package/dist/mesh/mesh-reconcile-identity.d.ts

@@ -0,0 +1,6 @@
+import type { DaemonComponents } from '../boot/daemon-lifecycle.js';
+import type { LocalMeshEntry } from '../repo-mesh-types.js';
+export declare function resolveCoordinatorDaemonIds(components: DaemonComponents): string[];
+export declare function daemonHostsMesh(mesh: LocalMeshEntry, daemonIds: string[]): boolean;
+export declare function daemonIdListIncludes(ids: readonly string[], id: string | undefined): boolean;
+export declare function resolveCoordinatorSelfIds(mesh: LocalMeshEntry, drainDaemonIds: string[]): string[];

package/dist/mesh/mesh-reconcile-loop.d.ts

@@ -1,17 +1,6 @@
 import type { DaemonComponents } from '../boot/daemon-lifecycle.js';
-declare const meshV2BackstopCounters: {
-    /** PHASE-4 transcript synthesis actually reconciled a missing completion. */
-    phase4SynthesisFired: number;
-    /** Acked-hold transcript fast-track promoted a synth ahead of the death deadline. */
-    ackedHoldFastTrackFired: number;
-    /** Acked-hold death-deadline backstop released a held synth (the 8-min net). */
-    ackedHoldDeathDeadlineFired: number;
-};
-/** Test/observability accessor for the v2 last-resort backstop counters (snapshot). */
-export declare function getMeshV2BackstopCounters(): Readonly<typeof meshV2BackstopCounters>;
-/** Test helper: zero the backstop counters so a case starts from a clean slate. */
-export declare function __resetMeshV2BackstopCountersForTests(): void;
-export declare function __resetReconcileInFlightSynthDebounceForTests(): void;
+export { getMeshV2BackstopCounters, __resetMeshV2BackstopCountersForTests } from './mesh-reconcile-v2-backstop.js';
+export { __resetReconcileInFlightSynthDebounceForTests } from './mesh-reconcile-acked-hold.js';
 /**
  * DRAIN-WITHOUT-INJECT guard. Classify, for a mesh on THIS daemon, whether a
  * queue-drain caller (the MCP `get_pending_mesh_events` poll) may safely consume
@@ -89,4 +78,3 @@ interface ReconcileLoopHandle {
     stop(): void;
 }
 export declare function setupMeshReconcileLoop(components: DaemonComponents): ReconcileLoopHandle;
-export {};

package/dist/mesh/mesh-reconcile-v2-backstop.d.ts

@@ -0,0 +1,16 @@
+declare const meshV2BackstopCounters: {
+    /** PHASE-4 transcript synthesis actually reconciled a missing completion. */
+    phase4SynthesisFired: number;
+    /** Acked-hold transcript fast-track promoted a synth ahead of the death deadline. */
+    ackedHoldFastTrackFired: number;
+    /** Acked-hold death-deadline backstop released a held synth (the 8-min net). */
+    ackedHoldDeathDeadlineFired: number;
+};
+/** Test/observability accessor for the v2 last-resort backstop counters (snapshot). */
+export declare function getMeshV2BackstopCounters(): Readonly<typeof meshV2BackstopCounters>;
+/** Test helper: zero the backstop counters so a case starts from a clean slate. */
+export declare function __resetMeshV2BackstopCountersForTests(): void;
+/** Bump a backstop counter and, under enforce, WARN that a last-resort net fired —
+ *  which under a healthy v2 contract should not happen (the real emit was lost). */
+export declare function recordBackstopFire(kind: keyof typeof meshV2BackstopCounters, detail: string): void;
+export {};

package/dist/providers/cli-provider-history-dedup.d.ts

@@ -0,0 +1,17 @@
+/**
+ * CLI provider persisted-history dedup — incremental append computation.
+ *
+ * Pure move out of cli-provider-instance.ts (no behavior change): the
+ * shared-prefix diff that turns a full parsed transcript into the newly-added
+ * tail to append to the persisted chat history. cli-provider-instance
+ * re-exports buildIncrementalHistoryAppendMessages so existing importers/tests
+ * keep their path.
+ */
+export type PersistableCliHistoryMessage = {
+    role: string;
+    content: string;
+    kind?: string;
+    senderName?: string;
+    receivedAt?: number;
+};
+export declare function buildIncrementalHistoryAppendMessages(previousMessages: PersistableCliHistoryMessage[], currentMessages: PersistableCliHistoryMessage[]): PersistableCliHistoryMessage[];

package/dist/providers/cli-provider-input-prompt.d.ts

@@ -0,0 +1,12 @@
+/**
+ * CLI provider structured-input helpers — image materialization + prompt build.
+ *
+ * Pure move out of cli-provider-instance.ts (no behavior change): the input
+ * envelope → CLI prompt string construction and its image-materialization
+ * support. cli-provider-instance re-exports buildCliStructuredInputPrompt so
+ * existing importers/tests keep their path.
+ */
+import { type InputEnvelope } from './contracts.js';
+export declare function buildCliStructuredInputPrompt(input: InputEnvelope, options?: {
+    materializeDir?: string;
+}): string;

package/dist/providers/cli-provider-instance.d.ts

@@ -9,40 +9,9 @@ import type { ProviderInstance, ProviderState, InstanceContext, HotChatSessionSt
 import { ProviderCliAdapter } from '../cli-adapters/provider-cli-adapter.js';
 import type { PtyTransportFactory } from '../cli-adapters/pty-transport.js';
 import type { ChatMessage } from '../types.js';
-type PersistableCliHistoryMessage = {
-    role: string;
-    content: string;
-    kind?: string;
-    senderName?: string;
-    receivedAt?: number;
-};
-/**
- * NOTIF Defect-2a: the REPORTED short-generating duration, anchored on the IMMUTABLE turn
- * start. generatingStartedAt is reset to 0 on every mid-turn waiting_approval/idle blip and
- * re-armed on the next →generating, so a long turn that blips would otherwise measure only the
- * final 1.5-2.5s sliver. engine.currentTurnStartedAt (set once at onTurnStarted, surviving
- * mid-turn blips until the next turn starts) is preferred; generatingStartedAt is the fallback
- * for turns that never recorded an engine turn start. Returns 0 when neither anchor is set.
- * Pure / unit-testable.
- */
-export declare function computeTurnAnchoredDurationMs(engineTurnStartedAt: number | undefined, generatingStartedAt: number, now: number): {
-    durationMs: number;
-    anchor: 'turn-start' | 'generatingStartedAt' | 'none';
-};
-export declare function buildCliStructuredInputPrompt(input: InputEnvelope, options?: {
-    materializeDir?: string;
-}): string;
-export declare function buildIncrementalHistoryAppendMessages(previousMessages: PersistableCliHistoryMessage[], currentMessages: PersistableCliHistoryMessage[]): PersistableCliHistoryMessage[];
-export declare function getForcedNewSessionScriptName(provider: ProviderModule | undefined, launchMode: 'new' | 'resume' | 'manual'): string | null;
-export declare function waitForCliAdapterReady(adapter: {
-    isReady?: () => boolean;
-    getStatus?: () => {
-        status?: string;
-    };
-}, options?: {
-    timeoutMs?: number;
-    pollMs?: number;
-}): Promise<void>;
+export { buildCliStructuredInputPrompt } from './cli-provider-input-prompt.js';
+export { buildIncrementalHistoryAppendMessages } from './cli-provider-history-dedup.js';
+export { computeTurnAnchoredDurationMs, getForcedNewSessionScriptName, waitForCliAdapterReady, } from './cli-provider-status-helpers.js';
 export declare class CliProviderInstance implements ProviderInstance {
     private provider;
     private workingDir;
@@ -429,4 +398,3 @@ export declare class CliProviderInstance implements ProviderInstance {
     private buildSqlPlaceholderList;
     private querySqliteText;
 }
-export {};

package/dist/providers/cli-provider-status-helpers.d.ts

@@ -0,0 +1,46 @@
+/**
+ * CLI provider status/launch pure helpers.
+ *
+ * Pure move out of cli-provider-instance.ts (no behavior change): the
+ * side-effect-free status predicates, the turn-anchored duration computation,
+ * the forced-new-session script resolver, the adapter-ready poll, and the lazy
+ * node:sqlite DatabaseSync loader. cli-provider-instance re-exports the
+ * public symbols (computeTurnAnchoredDurationMs, getForcedNewSessionScriptName,
+ * waitForCliAdapterReady) so existing importers/tests keep their path.
+ */
+import type { ProviderModule } from './contracts.js';
+export declare function isIdleStatus(value: unknown): boolean;
+export declare function getMessageTime(message: unknown): number;
+export declare function hasNonEmptyCliModalButtons(activeModal: unknown): boolean;
+export declare function isCliGeneratingLikeStatus(status: unknown): boolean;
+/**
+ * NOTIF Defect-2a: the REPORTED short-generating duration, anchored on the IMMUTABLE turn
+ * start. generatingStartedAt is reset to 0 on every mid-turn waiting_approval/idle blip and
+ * re-armed on the next →generating, so a long turn that blips would otherwise measure only the
+ * final 1.5-2.5s sliver. engine.currentTurnStartedAt (set once at onTurnStarted, surviving
+ * mid-turn blips until the next turn starts) is preferred; generatingStartedAt is the fallback
+ * for turns that never recorded an engine turn start. Returns 0 when neither anchor is set.
+ * Pure / unit-testable.
+ */
+export declare function computeTurnAnchoredDurationMs(engineTurnStartedAt: number | undefined, generatingStartedAt: number, now: number): {
+    durationMs: number;
+    anchor: 'turn-start' | 'generatingStartedAt' | 'none';
+};
+export declare function getDatabaseSync(): new (path: string, options?: {
+    readOnly?: boolean;
+}) => {
+    prepare(sql: string): {
+        get(...params: Array<string | number>): unknown;
+    };
+    close(): void;
+};
+export declare function getForcedNewSessionScriptName(provider: ProviderModule | undefined, launchMode: 'new' | 'resume' | 'manual'): string | null;
+export declare function waitForCliAdapterReady(adapter: {
+    isReady?: () => boolean;
+    getStatus?: () => {
+        status?: string;
+    };
+}, options?: {
+    timeoutMs?: number;
+    pollMs?: number;
+}): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.463",
+  "version": "0.9.82-rc.465",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.463",
-    "@adhdev/session-host-core": "0.9.82-rc.463",
+    "@adhdev/mesh-shared": "0.9.82-rc.465",
+    "@adhdev/session-host-core": "0.9.82-rc.465",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/mesh/mesh-events-pending.ts

@@ -2,6 +2,7 @@ import { appendFileSync, existsSync, readFileSync, renameSync, statSync, unlinkS
 import { join } from 'path';
 import { randomUUID } from 'crypto';
 import { LOG } from '../logging/logger.js';
+import { loadConfig } from '../config/config.js';
 import { getLedgerDir, readLedgerEntries, appendLedgerEntry } from './mesh-ledger.js';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
 import { buildMeshSystemMessage, readNonEmptyString, readRecord, resolveEventSessionId, readMeshCompletionSummary, isWeakCompletionMetadata } from './mesh-events-utils.js';
@@ -138,15 +139,16 @@ function normalizeCoordinatorDaemonIds(
  * T6 (B3c) enforce switch. When ON, the drain path stops passing an unversioned
  * (v1) or a validation-failing v2 event through to the coordinator — it QUARANTINES
  * it instead (excluded from the delivered batch + WARN + counter), and unicast
- * routing is the only delivery path (there is no v1 broadcast fallback). Off (the
- * default) preserves the accept-and-warn rollout behaviour exactly.
+ * routing is the only delivery path (there is no v1 broadcast fallback). On by
+ * default; set MESH_PROTOCOL_V2_ENFORCE=0/false/off/no to disable and restore the
+ * accept-and-warn rollout behaviour exactly.
  *
- * Per the rollout plan (§1 decision 4): enforce is `MESH_PROTOCOL_V2_ENFORCE` (env)
- * — its activation is a deliberate operational step taken ONLY after daemonBuilds
- * confirms every node emits v2 (§배포 게이트 1 / risk §4). So the code default is
- * OFF; flipping the env back to accept mode is a pure-env rollback (no code change,
- * no data migration — the schema is additive). Read at call time so a test /
- * operator can toggle it without a restart.
+ * Per the rollout plan (§1 decision 4): enforce is `MESH_PROTOCOL_V2_ENFORCE` (env).
+ * Now that every node emits v2 (§배포 게이트 1 / risk §4), the code default is ON —
+ * a manual env injection is no longer required to get enforce behaviour. Rollback to
+ * accept mode is a pure-env step: set `MESH_PROTOCOL_V2_ENFORCE=0` (or `false`/`off`/
+ * `no`) — no code change, no data migration (the schema is additive). Read at call
+ * time so a test / operator can toggle it without a restart.
  *
  * Quarantine (not drop) keeps the loss-free invariant. The DESTRUCTIVE drain has
  * already consumed the event from its store by the time routing runs, so "held
@@ -159,9 +161,9 @@ function normalizeCoordinatorDaemonIds(
  */
 export function isMeshProtocolV2EnforceEnabled(): boolean {
     const raw = readNonEmptyString(process.env.MESH_PROTOCOL_V2_ENFORCE);
-    if (!raw) return false;
+    if (!raw) return true;                      // unset/blank = default ON
     const v = raw.trim().toLowerCase();
-    return v === '1' || v === 'true' || v === 'on' || v === 'yes';
+    return !(v === '0' || v === 'false' || v === 'off' || v === 'no');  // only explicit off = false
 }
 
 /**
@@ -745,23 +747,51 @@ export function stampPendingEventV2(
         return event;
     }
 
-    const dispatchedBy = hint?.dispatchedBy ?? coordinatorIdentityFromEmitFields({
+    const coordinatorIdentity = hint?.dispatchedBy ?? coordinatorIdentityFromEmitFields({
         daemonId: event.targetCoordinatorDaemonId,
         coordinatorRunId: hint?.coordinatorRunId,
         sessionId: event.targetCoordinatorSessionId,
     });
+
+    // A/C ROOT FIX: an emit site with NO coordinator identity (direct-dispatch /
+    // refine notification / any path where the worker session never carried a
+    // meshCoordinatorDaemonId) used to leave the event UNVERSIONED (v1). Under v2
+    // enforce (default ON) routeV2EventsForDrainer QUARANTINES every unversioned
+    // event — so a summary-less completion (agent:generating_completed) and every
+    // refine terminal notification (refine:accepted/completed/failed) were held
+    // back and never reached the coordinator; only the backstop papered over it.
+    //
+    // Fall back to THIS daemon's own id as the dispatcher so a v2 envelope can
+    // still be minted. There is no addressable coordinator, so we intentionally
+    // leave intendedFor empty and let buildPendingEventEmitStamp downgrade the
+    // (unicast-defaulting) terminal event to a BROADCAST — deliverable to whatever
+    // coordinator drains on this machine, instead of an undeliverable v1 event.
+    // When a real coordinator identity DOES exist the unicast path below is
+    // unchanged (no regression). loadConfig().machineId is the same self-id source
+    // resolveCoordinatorDaemonIds / the local queue-assignment stamp use, so the
+    // broadcast dispatcher matches the drainer's own identity form.
+    const selfFallback = !coordinatorIdentity;
+    const dispatchedBy = coordinatorIdentity ?? coordinatorIdentityFromEmitFields({
+        daemonId: readNonEmptyString(loadConfig().machineId),
+    });
     // The unicast target is, by default, the same coordinator the event is already
-    // routed to (its originating coordinator). A hint may override it.
-    const intendedFor: CoordinatorIdentity | undefined = hint?.intendedFor ?? dispatchedBy;
+    // routed to (its originating coordinator). A hint may override it. In the
+    // self-fallback case there is no originating coordinator to address, so leave
+    // it empty → broadcast (never a self-unicast that a sibling session's drainer
+    // would skip).
+    const intendedFor: CoordinatorIdentity | undefined = hint?.intendedFor
+        ?? (selfFallback ? undefined : coordinatorIdentity);
 
     const stamp = buildPendingEventEmitStamp({
         eventName: event.event,
         eventId: randomUUID(),
         dispatchedBy,
         intendedFor,
-        scope: hint?.scope,
+        // Force broadcast for the self-fallback so a unicast-defaulting terminal
+        // event isn't addressed to this daemon alone; an explicit hint still wins.
+        scope: hint?.scope ?? (selfFallback ? 'broadcast' : undefined),
     });
-    if (!stamp) return event; // no coordinator identity → stays a v1 event
+    if (!stamp) return event; // no coordinator identity at all (no self id) → stays a v1 event
 
     return {
         ...event,
@@ -848,6 +878,17 @@ export function queuePendingMeshCoordinatorEvent(
     // B2a: stamp the v2 envelope before dedup/persist so the eventId/scope ride
     // into both stores and the fingerprint/dedup logic sees the final shape.
     const event = stampPendingEventV2(rawEvent, hint);
+    return persistPendingMeshCoordinatorEvent(event);
+}
+
+/**
+ * Persist an ALREADY-STAMPED pending event to both stores (dedup + SQLite + JSONL),
+ * without re-running the emit stamp. queuePendingMeshCoordinatorEvent stamps then
+ * calls this; the only other caller is the test helper below, which needs to inject
+ * a genuinely-unversioned (v1) row to exercise the drain-side v1 handling now that
+ * the emit path never produces one (self-daemon fallback stamps every local emit).
+ */
+function persistPendingMeshCoordinatorEvent(event: PendingMeshCoordinatorEvent): boolean {
     try {
         if (hasPendingRefineTerminalEventDuplicate(event)) {
             LOG.info('MeshEvents', `Suppressed duplicate pending ${event.event} for refine job ${readRefineJobId(event)}`);
@@ -1211,6 +1252,19 @@ export function __clearMeshPendingEventsForTests(meshId: string): void {
     clearPendingMeshCoordinatorEvents(meshId);
 }
 
+/**
+ * Test helper: persist a pending event VERBATIM, skipping the emit-time v2 stamp.
+ * The local emit path (queuePendingMeshCoordinatorEvent → stampPendingEventV2) now
+ * always mints a v2 envelope (self-daemon broadcast fallback when no coordinator
+ * identity is present), so a genuinely-unversioned (v1) row can no longer be produced
+ * through the normal queue. The drain-side v1 handling (accept-broadcast / enforce-
+ * quarantine) still matters for durable v1 rows written by a pre-v2 daemon and for
+ * version-skewed remote relays, so tests inject those rows directly through this.
+ */
+export function __persistUnstampedPendingEventForTests(event: PendingMeshCoordinatorEvent): boolean {
+    return persistPendingMeshCoordinatorEvent(event);
+}
+
 /** Explicitly clear all pending coordinator events for a mesh (and coordinator if scoped). */
 export function clearPendingMeshCoordinatorEvents(meshId?: string, coordinatorDaemonId?: string): void {
     if (!meshId) return;

package/src/mesh/mesh-reconcile-acked-hold.ts

@@ -0,0 +1,230 @@
+// ---------------------------------------------------------------------------
+// mesh-reconcile-acked-hold — in-flight acked-hold state (persistence + tuning)
+// ---------------------------------------------------------------------------
+// Pure move out of mesh-reconcile-loop.ts (no behavior change). This is the
+// read-through/write-through cache over the mesh_inflight_hold table plus the
+// env-tunable timers (death deadline, transcript fast-track grace) that govern
+// when an acked dispatch's indefinite synth hold is released. See the R4f and
+// ACKED-HOLD-IDLE-OVERTRUST design commentary inline.
+// ---------------------------------------------------------------------------
+
+import { LOG } from '../logging/logger.js';
+import { MeshRuntimeStore } from './mesh-runtime-store.js';
+import { readNonEmptyString } from './mesh-events-utils.js';
+
+// R4f backstop (a): how many CONSECUTIVE read_chat failures (transport error / success:false /
+// no payload) for an acked task are treated as a death signal that releases the indefinite hold.
+// A single failed read is a transient probe blip; a session that genuinely died reads-fail every
+// tick, so a small streak distinguishes the two without racing a live-but-slow worker.
+export const ACKED_DEATH_CONSECUTIVE_READ_FAILURES = 3;
+
+// R4f backstop (b): the absolute death-deadline. An acked task is held indefinitely until this much
+// time has elapsed since its generating_started ack (dispatch.updatedAt); past it, a persistently
+// idle session is synthesized as a notification-loss net. This is set FAR above any observed emit
+// latency (R4e's worst case was ~16s) so it does NOT race a normal slow turn — it only catches a
+// genuinely wedged worker or a permanently-lost emit. Read at call time so tests can tune it.
+export function resolveTunedReconcileMs(envName: string, def: number, min: number, max: number): number {
+    const raw = readNonEmptyString(process.env[envName]);
+    if (raw) {
+        const parsed = Number.parseInt(raw, 10);
+        if (Number.isFinite(parsed) && parsed >= min && parsed <= max) return parsed;
+    }
+    return def;
+}
+export function resolveAckedDeathDeadlineMs(): number {
+    // Default 8 min — FAR above the variable emit latency the finite R4..R4e timers raced (R4e's
+    // worst case was ~16s); by the time this fires a live worker would long since have emitted its
+    // real terminal. The env-override floor is 0 so tests can force the deadline (production never
+    // sets it that low); the ceiling is 60min so a mis-set env cannot disable the loss-net forever.
+    return resolveTunedReconcileMs('MESH_INFLIGHT_ACKED_DEATH_DEADLINE_MS', 8 * 60_000, 0, 60 * 60_000);
+}
+
+// ACKED-HOLD-IDLE-OVERTRUST (transcript-completion fast-track). The indefinite acked-hold above is
+// safe but SLOW: when the worker's real generating_completed emit is dropped/lost, the only thing
+// that promotes the missing completion is the 8-min death backstop — even though the answer has been
+// FULLY rendered in the transcript for minutes (read_chat reports idle WITH a final visible assistant
+// message every ~4s). Observed live: completions surfaced 144s / 492s late, both incompatible with the
+// provider's own emit ceiling (COMPLETED_FINALIZATION_MAX_WAIT_MS 30s + NATIVE_HISTORY_MESH_IDLE_SETTLE
+// 4s ≈ 34s). That gap = a worker that finished, whose PTY generating→idle edge / real emit was lost,
+// held hostage to the 8-min net.
+//
+// Fast-track: when an acked task reads idle AND a final visible assistant message is present (the same
+// transcript-completion evidence PHASE 4 already requires to synth), and that idle-with-final-assistant
+// state has PERSISTED for a short continuous grace, promote the synth EARLY — ahead of the 8-min
+// backstop. The grace is the correctness gate: a SINGLE idle read could be a mid-turn blip (PTY
+// inter-tool-call settle, or final text rendered while the next tool call is about to start), so we
+// require the idle-with-final-assistant signal to hold continuously for the grace window before
+// trusting it as a genuine turn-end. Any non-idle read (generating / waiting_approval), a read
+// failure, or the disappearance of the final assistant message RESETS the streak — so an actively
+// streaming worker that momentarily reads idle never crosses the grace.
+//
+// Safety: this only changes WHEN an acked synth fires (earlier), never WHETHER it is correct —
+// reconcileDirectDispatchCompletionFromTranscript's hasTerminalLedgerAfterDispatch makes a real
+// emit that lands later an idempotent no-op, exactly as the death-backstop synth relies on. The
+// death backstop (8 min) is PRESERVED unchanged as the final net; the fast-track is a faster path in
+// front of it. The grace is set ABOVE the provider's own emit ceiling (~34s) so a worker still inside
+// its normal finalization window is never pre-empted — we only fast-track once enough continuous idle
+// has elapsed that a live emit would already have arrived.
+export function resolveAckedTranscriptFastTrackGraceMs(): number {
+    // Default 40s — above the provider emit ceiling (30s COMPLETED_FINALIZATION_MAX_WAIT_MS + 4s
+    // NATIVE_HISTORY_MESH_IDLE_SETTLE ≈ 34s): a genuinely-live worker would have emitted its real
+    // terminal within that window, so 40s of CONTINUOUS idle-with-final-assistant means the emit was
+    // lost, not late. Far below the 8-min death backstop, so the fast-track is the dominant path for a
+    // lost emit while the backstop remains the last-resort net. Floor 0 lets tests force an immediate
+    // fast-track; ceiling 5min keeps a mis-set env from collapsing it into the death backstop.
+    return resolveTunedReconcileMs('MESH_INFLIGHT_ACKED_TRANSCRIPT_FASTTRACK_GRACE_MS', 40_000, 0, 5 * 60_000);
+}
+
+// Per-task in-flight hold state for an acked dispatch:
+//   - liveConfirmedSinceAck: we have seen at least one conclusive read (idle OR generating) since
+//     the ack — proves the session is reachable, so a later read FAILURE is a genuine liveness loss
+//     rather than a node that was never reachable.
+//   - consecutiveReadFailures: streak of inconclusive read_chat results (death backstop (a)).
+//   - transcriptIdleSinceMs: the timestamp of the FIRST tick in the current continuous run of
+//     idle-with-final-assistant reads (ACKED-HOLD-IDLE-OVERTRUST fast-track). Cleared to undefined
+//     whenever the signal breaks (non-idle read, read failure, or no final assistant message), so a
+//     mid-turn idle blip never accumulates grace. When `now - transcriptIdleSinceMs` exceeds the
+//     fast-track grace the synth is promoted ahead of the death backstop.
+export interface AckedHoldState {
+    liveConfirmedSinceAck: boolean;
+    consecutiveReadFailures: number;
+    transcriptIdleSinceMs?: number;
+}
+
+// T2 (B2b): acked-hold state persistence. The Map below is a process-local CACHE;
+// the SSOT is the mesh_inflight_hold table in MeshRuntimeStore. Every read goes
+// read-through (Map miss → load from store, then cache), every mutation goes
+// write-through (Map set → store upsert; Map delete → store delete). On daemon
+// boot the reconcile loop rehydrates the Map from the store per-mesh the first
+// time it touches that mesh (rehydrateAckedHoldsForMesh), so a hold established
+// before a restart survives it — closing the duplicate-emit / drop window the
+// PHASE-4 transcript synth backstop otherwise had to correct after the fact.
+//
+// Store row ↔ AckedHoldState mapping:
+//   hold_reason 'live'|'unconfirmed'  ↔ liveConfirmedSinceAck (boolean)
+//   read_failure_count                ↔ consecutiveReadFailures
+//   first_idle_since_ack              ↔ transcriptIdleSinceMs (undefined ⇒ NULL)
+//   mesh_id                            = the owning mesh (for listByMesh / prune)
+//   held_at                            = ms the hold was first created (store-managed)
+export const inFlightAckedHoldState = new Map<string, AckedHoldState>();
+// Meshes whose store rows have already been rehydrated into the Map this process.
+// A restart resets this set, so the first touch of each mesh reloads from disk.
+const rehydratedHoldMeshes = new Set<string>();
+
+export function inFlightSynthKey(meshId: string, taskId: string): string {
+    return `${meshId}::${taskId}`;
+}
+
+// Extract the taskId back out of a `${meshId}::${taskId}` synth key. The meshId
+// prefix can itself contain '::' only if the caller passed one (mesh ids are
+// config-derived and never do), so split on the FIRST '::' and treat the remainder
+// as the taskId.
+function taskIdFromSynthKey(meshId: string, synthKey: string): string {
+    const prefix = `${meshId}::`;
+    return synthKey.startsWith(prefix) ? synthKey.slice(prefix.length) : synthKey;
+}
+
+function holdStore(): MeshRuntimeStore | undefined {
+    try { return MeshRuntimeStore.getInstance(); } catch { return undefined; }
+}
+
+// Read-through: Map hit returns the cached state; a miss consults the store and,
+// when a row exists, hydrates the Map from it before returning. A store failure
+// degrades to Map-only (returns undefined on a miss) — identical to the pre-T2
+// in-memory behavior, never worse.
+export function getHoldState(synthKey: string, meshId: string): AckedHoldState | undefined {
+    const cached = inFlightAckedHoldState.get(synthKey);
+    if (cached) return cached;
+    const store = holdStore();
+    if (!store) return undefined;
+    let row;
+    try { row = store.getInflightHold(taskIdFromSynthKey(meshId, synthKey)); } catch { return undefined; }
+    if (!row) return undefined;
+    const state: AckedHoldState = {
+        liveConfirmedSinceAck: row.holdReason === 'live',
+        consecutiveReadFailures: row.readFailureCount ?? 0,
+        ...(row.firstIdleSinceAck !== null && row.firstIdleSinceAck !== undefined
+            ? { transcriptIdleSinceMs: row.firstIdleSinceAck }
+            : {}),
+    };
+    inFlightAckedHoldState.set(synthKey, state);
+    return state;
+}
+
+// Write-through: update the Map cache AND the store row. A store failure leaves the
+// Map authoritative for this process (degrade, never crash the tick).
+export function setHoldState(synthKey: string, meshId: string, state: AckedHoldState): void {
+    inFlightAckedHoldState.set(synthKey, state);
+    const store = holdStore();
+    if (!store) return;
+    try {
+        store.upsertInflightHold({
+            taskId: taskIdFromSynthKey(meshId, synthKey),
+            meshId,
+            holdReason: state.liveConfirmedSinceAck ? 'live' : 'unconfirmed',
+            firstIdleSinceAck: state.transcriptIdleSinceMs ?? null,
+            readFailureCount: state.consecutiveReadFailures,
+        });
+    } catch { /* degrade to Map-only */ }
+}
+
+// Write-through delete: drop the Map entry AND the store row.
+export function deleteHoldState(synthKey: string, meshId: string): void {
+    inFlightAckedHoldState.delete(synthKey);
+    const store = holdStore();
+    if (!store) return;
+    try { store.deleteInflightHold(taskIdFromSynthKey(meshId, synthKey)); } catch { /* degrade */ }
+}
+
+// Restart rehydration: on the first touch of a mesh this process, pull its persisted
+// acked-hold rows from the store into the Map cache so a hold that outlived a daemon
+// restart is honored again. Idempotent per process via rehydratedHoldMeshes. A store
+// failure just skips rehydration (Map starts empty for the mesh — pre-T2 behavior).
+export function rehydrateAckedHoldsForMesh(meshId: string): void {
+    if (rehydratedHoldMeshes.has(meshId)) return;
+    rehydratedHoldMeshes.add(meshId);
+    const store = holdStore();
+    if (!store) return;
+    let rows;
+    try { rows = store.listInflightHoldsByMesh(meshId); } catch { return; }
+    for (const row of rows) {
+        const synthKey = inFlightSynthKey(meshId, row.taskId);
+        if (inFlightAckedHoldState.has(synthKey)) continue; // a live tick already set fresher state
+        inFlightAckedHoldState.set(synthKey, {
+            liveConfirmedSinceAck: row.holdReason === 'live',
+            consecutiveReadFailures: row.readFailureCount ?? 0,
+            ...(row.firstIdleSinceAck !== null && row.firstIdleSinceAck !== undefined
+                ? { transcriptIdleSinceMs: row.firstIdleSinceAck }
+                : {}),
+        });
+    }
+    if (rows.length > 0) {
+        LOG.info('MeshReconcile', `Rehydrated ${rows.length} persisted acked-hold row(s) for mesh ${meshId} after (re)start`);
+    }
+}
+
+// Collect the union of held synth keys for a mesh — the Map cache entries plus every
+// persisted store row — so the PHASE-4 prune can drop a hold that exists ONLY on disk
+// (not yet cached). A store failure degrades to the Map-only key set (never throws).
+export function collectHeldSynthKeysForMesh(meshId: string): Set<string> {
+    const heldKeys = new Set<string>();
+    for (const key of inFlightAckedHoldState.keys()) {
+        if (key.startsWith(`${meshId}::`)) heldKeys.add(key);
+    }
+    const store = holdStore();
+    if (store) {
+        try {
+            for (const row of store.listInflightHoldsByMesh(meshId)) {
+                heldKeys.add(inFlightSynthKey(meshId, row.taskId));
+            }
+        } catch { /* degrade — prune only what's in the Map */ }
+    }
+    return heldKeys;
+}
+
+// Test hook: clear the in-flight acked-hold state between cases (both the Map cache
+// and the per-mesh rehydrate guard, so each case starts from a clean read-through).
+export function __resetReconcileInFlightSynthDebounceForTests(): void {
+    inFlightAckedHoldState.clear();
+    rehydratedHoldMeshes.clear();
+}