@adhdev/daemon-core 0.9.82-rc.464 → 0.9.82-rc.466

package/dist/mesh/mesh-events-pending.d.ts

@@ -115,6 +115,14 @@ export declare function readRefineJobId(event: {
 } | Record<string, unknown>): string;
 export declare function buildPendingEventFingerprint(event: PendingMeshCoordinatorEvent): string;
 export declare function hasPendingCoordinatorEventDuplicate(event: PendingMeshCoordinatorEvent): boolean;
+/**
+ * Retention sweep for the SQLite mesh_pending_events inbox. Deletes long-drained
+ * rows (past the idempotency-useful window) and long-orphaned undrained rows (a
+ * coordinator identity that never returned). Best-effort and idempotent: a store
+ * failure or an empty table is a cheap no-op. Called from the periodic mesh-event
+ * maintenance sweep. Returns the number of rows pruned (0 when nothing to do).
+ */
+export declare function prunePendingMeshCoordinatorEventsRetention(): number;
 /**
  * Stamp the v2 protocol envelope onto a pending event at emit time (B2a).
  *
@@ -183,6 +191,16 @@ export declare function getPendingMeshCoordinatorEvents(meshId?: string, coordin
  * (including drained fingerprint history) and JSONL files.
  */
 export declare function __clearMeshPendingEventsForTests(meshId: string): void;
+/**
+ * Test helper: persist a pending event VERBATIM, skipping the emit-time v2 stamp.
+ * The local emit path (queuePendingMeshCoordinatorEvent → stampPendingEventV2) now
+ * always mints a v2 envelope (self-daemon broadcast fallback when no coordinator
+ * identity is present), so a genuinely-unversioned (v1) row can no longer be produced
+ * through the normal queue. The drain-side v1 handling (accept-broadcast / enforce-
+ * quarantine) still matters for durable v1 rows written by a pre-v2 daemon and for
+ * version-skewed remote relays, so tests inject those rows directly through this.
+ */
+export declare function __persistUnstampedPendingEventForTests(event: PendingMeshCoordinatorEvent): boolean;
 /** Explicitly clear all pending coordinator events for a mesh (and coordinator if scoped). */
 export declare function clearPendingMeshCoordinatorEvents(meshId?: string, coordinatorDaemonId?: string): void;
 export {};

package/dist/mesh/mesh-reconcile-acked-hold.d.ts

@@ -0,0 +1,17 @@
+export declare const ACKED_DEATH_CONSECUTIVE_READ_FAILURES = 3;
+export declare function resolveTunedReconcileMs(envName: string, def: number, min: number, max: number): number;
+export declare function resolveAckedDeathDeadlineMs(): number;
+export declare function resolveAckedTranscriptFastTrackGraceMs(): number;
+export interface AckedHoldState {
+    liveConfirmedSinceAck: boolean;
+    consecutiveReadFailures: number;
+    transcriptIdleSinceMs?: number;
+}
+export declare const inFlightAckedHoldState: Map<string, AckedHoldState>;
+export declare function inFlightSynthKey(meshId: string, taskId: string): string;
+export declare function getHoldState(synthKey: string, meshId: string): AckedHoldState | undefined;
+export declare function setHoldState(synthKey: string, meshId: string, state: AckedHoldState): void;
+export declare function deleteHoldState(synthKey: string, meshId: string): void;
+export declare function rehydrateAckedHoldsForMesh(meshId: string): void;
+export declare function collectHeldSynthKeysForMesh(meshId: string): Set<string>;
+export declare function __resetReconcileInFlightSynthDebounceForTests(): void;

package/dist/mesh/mesh-reconcile-identity.d.ts

@@ -0,0 +1,6 @@
+import type { DaemonComponents } from '../boot/daemon-lifecycle.js';
+import type { LocalMeshEntry } from '../repo-mesh-types.js';
+export declare function resolveCoordinatorDaemonIds(components: DaemonComponents): string[];
+export declare function daemonHostsMesh(mesh: LocalMeshEntry, daemonIds: string[]): boolean;
+export declare function daemonIdListIncludes(ids: readonly string[], id: string | undefined): boolean;
+export declare function resolveCoordinatorSelfIds(mesh: LocalMeshEntry, drainDaemonIds: string[]): string[];

package/dist/mesh/mesh-reconcile-loop.d.ts

@@ -1,17 +1,6 @@
 import type { DaemonComponents } from '../boot/daemon-lifecycle.js';
-declare const meshV2BackstopCounters: {
-    /** PHASE-4 transcript synthesis actually reconciled a missing completion. */
-    phase4SynthesisFired: number;
-    /** Acked-hold transcript fast-track promoted a synth ahead of the death deadline. */
-    ackedHoldFastTrackFired: number;
-    /** Acked-hold death-deadline backstop released a held synth (the 8-min net). */
-    ackedHoldDeathDeadlineFired: number;
-};
-/** Test/observability accessor for the v2 last-resort backstop counters (snapshot). */
-export declare function getMeshV2BackstopCounters(): Readonly<typeof meshV2BackstopCounters>;
-/** Test helper: zero the backstop counters so a case starts from a clean slate. */
-export declare function __resetMeshV2BackstopCountersForTests(): void;
-export declare function __resetReconcileInFlightSynthDebounceForTests(): void;
+export { getMeshV2BackstopCounters, __resetMeshV2BackstopCountersForTests } from './mesh-reconcile-v2-backstop.js';
+export { __resetReconcileInFlightSynthDebounceForTests } from './mesh-reconcile-acked-hold.js';
 /**
  * DRAIN-WITHOUT-INJECT guard. Classify, for a mesh on THIS daemon, whether a
  * queue-drain caller (the MCP `get_pending_mesh_events` poll) may safely consume
@@ -89,4 +78,3 @@ interface ReconcileLoopHandle {
     stop(): void;
 }
 export declare function setupMeshReconcileLoop(components: DaemonComponents): ReconcileLoopHandle;
-export {};

package/dist/mesh/mesh-reconcile-v2-backstop.d.ts

@@ -0,0 +1,16 @@
+declare const meshV2BackstopCounters: {
+    /** PHASE-4 transcript synthesis actually reconciled a missing completion. */
+    phase4SynthesisFired: number;
+    /** Acked-hold transcript fast-track promoted a synth ahead of the death deadline. */
+    ackedHoldFastTrackFired: number;
+    /** Acked-hold death-deadline backstop released a held synth (the 8-min net). */
+    ackedHoldDeathDeadlineFired: number;
+};
+/** Test/observability accessor for the v2 last-resort backstop counters (snapshot). */
+export declare function getMeshV2BackstopCounters(): Readonly<typeof meshV2BackstopCounters>;
+/** Test helper: zero the backstop counters so a case starts from a clean slate. */
+export declare function __resetMeshV2BackstopCountersForTests(): void;
+/** Bump a backstop counter and, under enforce, WARN that a last-resort net fired —
+ *  which under a healthy v2 contract should not happen (the real emit was lost). */
+export declare function recordBackstopFire(kind: keyof typeof meshV2BackstopCounters, detail: string): void;
+export {};

package/dist/mesh/mesh-runtime-store.d.ts

@@ -490,4 +490,30 @@ export declare class MeshRuntimeStore {
      * for the same task could be re-queued later. Returns the number of rows deleted.
      */
     deletePendingEventsById(ids: ReadonlyArray<string>): number;
+    /**
+     * Retention prune for mesh_pending_events. This table has no lifecycle GC of its
+     * own: a drained row is soft-marked (drained=1) and RETAINED — deliberately, so
+     * drainedEventIdsForMesh() has a durable v2-eventId dedup baseline — and an
+     * undrained row queued for a coordinator that never returned (a dead/evicted
+     * coordinator identity) stays drained=0 forever. Both accumulate without bound
+     * (observed: tens of thousands of rows, mostly stale). This is the missing
+     * retention step. Two independent windows:
+     *
+     *   - drained rows older than `drainedOlderThanMs`: the coordinator consumed them
+     *     long ago; the only thing they still back is the eventId re-delivery guard,
+     *     which is only meaningful for the recent past (a re-delivery of a week-old
+     *     event cannot occur — its producer session is long gone). Safe to delete.
+     *   - UNDRAINED rows older than `undrainedOlderThanMs` (a much wider window):
+     *     these are orphaned events for a coordinator identity that never drained
+     *     them. Kept wide so a genuinely-offline-but-returning coordinator still
+     *     receives its backlog; only genuinely unrecoverable orphans are swept.
+     *
+     * Both windows key off `queued_at` (always present) — `drained_at` can be NULL on
+     * legacy rows. Returns the number of rows deleted. Best-effort / idempotent:
+     * running it repeatedly with nothing to prune is a cheap no-op.
+     */
+    prunePendingEvents(opts: {
+        drainedOlderThanMs: number;
+        undrainedOlderThanMs: number;
+    }): number;
 }

package/dist/providers/cli-provider-history-dedup.d.ts

@@ -0,0 +1,17 @@
+/**
+ * CLI provider persisted-history dedup — incremental append computation.
+ *
+ * Pure move out of cli-provider-instance.ts (no behavior change): the
+ * shared-prefix diff that turns a full parsed transcript into the newly-added
+ * tail to append to the persisted chat history. cli-provider-instance
+ * re-exports buildIncrementalHistoryAppendMessages so existing importers/tests
+ * keep their path.
+ */
+export type PersistableCliHistoryMessage = {
+    role: string;
+    content: string;
+    kind?: string;
+    senderName?: string;
+    receivedAt?: number;
+};
+export declare function buildIncrementalHistoryAppendMessages(previousMessages: PersistableCliHistoryMessage[], currentMessages: PersistableCliHistoryMessage[]): PersistableCliHistoryMessage[];

package/dist/providers/cli-provider-input-prompt.d.ts

@@ -0,0 +1,12 @@
+/**
+ * CLI provider structured-input helpers — image materialization + prompt build.
+ *
+ * Pure move out of cli-provider-instance.ts (no behavior change): the input
+ * envelope → CLI prompt string construction and its image-materialization
+ * support. cli-provider-instance re-exports buildCliStructuredInputPrompt so
+ * existing importers/tests keep their path.
+ */
+import { type InputEnvelope } from './contracts.js';
+export declare function buildCliStructuredInputPrompt(input: InputEnvelope, options?: {
+    materializeDir?: string;
+}): string;

package/dist/providers/cli-provider-instance.d.ts

@@ -9,40 +9,9 @@ import type { ProviderInstance, ProviderState, InstanceContext, HotChatSessionSt
 import { ProviderCliAdapter } from '../cli-adapters/provider-cli-adapter.js';
 import type { PtyTransportFactory } from '../cli-adapters/pty-transport.js';
 import type { ChatMessage } from '../types.js';
-type PersistableCliHistoryMessage = {
-    role: string;
-    content: string;
-    kind?: string;
-    senderName?: string;
-    receivedAt?: number;
-};
-/**
- * NOTIF Defect-2a: the REPORTED short-generating duration, anchored on the IMMUTABLE turn
- * start. generatingStartedAt is reset to 0 on every mid-turn waiting_approval/idle blip and
- * re-armed on the next →generating, so a long turn that blips would otherwise measure only the
- * final 1.5-2.5s sliver. engine.currentTurnStartedAt (set once at onTurnStarted, surviving
- * mid-turn blips until the next turn starts) is preferred; generatingStartedAt is the fallback
- * for turns that never recorded an engine turn start. Returns 0 when neither anchor is set.
- * Pure / unit-testable.
- */
-export declare function computeTurnAnchoredDurationMs(engineTurnStartedAt: number | undefined, generatingStartedAt: number, now: number): {
-    durationMs: number;
-    anchor: 'turn-start' | 'generatingStartedAt' | 'none';
-};
-export declare function buildCliStructuredInputPrompt(input: InputEnvelope, options?: {
-    materializeDir?: string;
-}): string;
-export declare function buildIncrementalHistoryAppendMessages(previousMessages: PersistableCliHistoryMessage[], currentMessages: PersistableCliHistoryMessage[]): PersistableCliHistoryMessage[];
-export declare function getForcedNewSessionScriptName(provider: ProviderModule | undefined, launchMode: 'new' | 'resume' | 'manual'): string | null;
-export declare function waitForCliAdapterReady(adapter: {
-    isReady?: () => boolean;
-    getStatus?: () => {
-        status?: string;
-    };
-}, options?: {
-    timeoutMs?: number;
-    pollMs?: number;
-}): Promise<void>;
+export { buildCliStructuredInputPrompt } from './cli-provider-input-prompt.js';
+export { buildIncrementalHistoryAppendMessages } from './cli-provider-history-dedup.js';
+export { computeTurnAnchoredDurationMs, getForcedNewSessionScriptName, waitForCliAdapterReady, } from './cli-provider-status-helpers.js';
 export declare class CliProviderInstance implements ProviderInstance {
     private provider;
     private workingDir;
@@ -75,6 +44,33 @@ export declare class CliProviderInstance implements ProviderInstance {
      * from scratch rather than firing on a stale timestamp.
      */
     private static readonly AUTO_APPROVE_GATE_HYSTERESIS_MS;
+    /**
+     * AUTOAPPROVE-FLAP-RECUR (Fix B): extended busy-side continuity window for a
+     * DELEGATED-WORKER auto-approve episode that is genuinely still cycling.
+     *
+     * The default AUTO_APPROVE_GATE_HYSTERESIS_MS (1500) absorbs a *momentary*
+     * `generating` blip. But a delegated worker running a Bash approval observed
+     * the FSM cycle the FULL state waiting_approval → busy → waiting_approval on a
+     * 2–5s period (the button set scrolls in/out AND the modal question repaints,
+     * so the adapter genuinely reports status=generating for whole seconds between
+     * approval frames). Each busy phase outran the 1500ms hysteresis, so the
+     * settle clock was WIPED (the genuine-resolution branch), the 600ms settle
+     * window never accumulated across the flap, resolveModal never fired
+     * (resolveModal count 0), and the mask-stall clock instead tripped at 4500ms →
+     * coordinator nudge → the flap the coordinator observed.
+     *
+     * A genuine resolution and a flap both start with a busy phase; they diverge
+     * only in whether waiting_approval RETURNS. So we cannot simply lengthen the
+     * blanket hysteresis (that would make every real resolution hold the gate
+     * open for seconds). Instead this longer window applies ONLY while an active
+     * mask episode is alive (autoApproveMaskSince > 0) AND the session is a
+     * delegated worker — i.e. exactly the never-resolving-flap case. A foreground
+     * / attended session keeps the tight 1500ms window unchanged. The mask-stall
+     * bound below still caps the episode, so a worker whose approval truly never
+     * returns is surfaced to the coordinator within AUTO_APPROVE_MASK_STALL_MS
+     * rather than held forever.
+     */
+    private static readonly AUTO_APPROVE_FLAP_CONTINUITY_MS;
     /**
      * STATUS-MISMATCH: upper bound on how long the auto-approve→`generating` SURFACE
      * mask may hide a worker's `waiting_approval` (status + activeModal) before we give
@@ -114,6 +110,7 @@ export declare class CliProviderInstance implements ProviderInstance {
     private pendingAutoApprovalSince;
     private autoApproveSettleTimer;
     private autoApproveInactiveSince;
+    private autoApproveLastModalSeenAt;
     private autoApproveMaskSince;
     private stalledApprovalNudgeEpisode;
     private readonly manualAttendance;
@@ -303,6 +300,18 @@ export declare class CliProviderInstance implements ProviderInstance {
     private approvalResolutionFinalizationBlock;
     private scheduleCompletedDebounceFlush;
     private isMeshWorkerSession;
+    /**
+     * AUTOAPPROVE-FLAP-RECUR (Fix A+B): how long a busy blip / modal scroll-out may
+     * persist before the in-progress settle gate is torn down. For a delegated
+     * worker whose auto-approve episode is genuinely still cycling (mask clock
+     * alive), the FSM's full waiting_approval → busy → waiting_approval flap runs
+     * on a multi-second period, so the settle continuity window is extended to
+     * AUTO_APPROVE_FLAP_CONTINUITY_MS to bridge it (still bounded, and still capped
+     * by AUTO_APPROVE_MASK_STALL_MS). Every other case — foreground/attended
+     * session, or no active mask episode — keeps the tight default hysteresis so a
+     * genuine resolution frees the gate promptly.
+     */
+    private autoApproveContinuityWindowMs;
     private isAutonomousMeshSession;
     /**
      * ARCH-REFACTOR R1: the taskId to attribute the CURRENTLY-completing turn to.
@@ -429,4 +438,3 @@ export declare class CliProviderInstance implements ProviderInstance {
     private buildSqlPlaceholderList;
     private querySqliteText;
 }
-export {};

package/dist/providers/cli-provider-status-helpers.d.ts

@@ -0,0 +1,46 @@
+/**
+ * CLI provider status/launch pure helpers.
+ *
+ * Pure move out of cli-provider-instance.ts (no behavior change): the
+ * side-effect-free status predicates, the turn-anchored duration computation,
+ * the forced-new-session script resolver, the adapter-ready poll, and the lazy
+ * node:sqlite DatabaseSync loader. cli-provider-instance re-exports the
+ * public symbols (computeTurnAnchoredDurationMs, getForcedNewSessionScriptName,
+ * waitForCliAdapterReady) so existing importers/tests keep their path.
+ */
+import type { ProviderModule } from './contracts.js';
+export declare function isIdleStatus(value: unknown): boolean;
+export declare function getMessageTime(message: unknown): number;
+export declare function hasNonEmptyCliModalButtons(activeModal: unknown): boolean;
+export declare function isCliGeneratingLikeStatus(status: unknown): boolean;
+/**
+ * NOTIF Defect-2a: the REPORTED short-generating duration, anchored on the IMMUTABLE turn
+ * start. generatingStartedAt is reset to 0 on every mid-turn waiting_approval/idle blip and
+ * re-armed on the next →generating, so a long turn that blips would otherwise measure only the
+ * final 1.5-2.5s sliver. engine.currentTurnStartedAt (set once at onTurnStarted, surviving
+ * mid-turn blips until the next turn starts) is preferred; generatingStartedAt is the fallback
+ * for turns that never recorded an engine turn start. Returns 0 when neither anchor is set.
+ * Pure / unit-testable.
+ */
+export declare function computeTurnAnchoredDurationMs(engineTurnStartedAt: number | undefined, generatingStartedAt: number, now: number): {
+    durationMs: number;
+    anchor: 'turn-start' | 'generatingStartedAt' | 'none';
+};
+export declare function getDatabaseSync(): new (path: string, options?: {
+    readOnly?: boolean;
+}) => {
+    prepare(sql: string): {
+        get(...params: Array<string | number>): unknown;
+    };
+    close(): void;
+};
+export declare function getForcedNewSessionScriptName(provider: ProviderModule | undefined, launchMode: 'new' | 'resume' | 'manual'): string | null;
+export declare function waitForCliAdapterReady(adapter: {
+    isReady?: () => boolean;
+    getStatus?: () => {
+        status?: string;
+    };
+}, options?: {
+    timeoutMs?: number;
+    pollMs?: number;
+}): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.464",
+  "version": "0.9.82-rc.466",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.464",
-    "@adhdev/session-host-core": "0.9.82-rc.464",
+    "@adhdev/mesh-shared": "0.9.82-rc.466",
+    "@adhdev/session-host-core": "0.9.82-rc.466",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/mesh/mesh-event-forwarding.ts

@@ -7,7 +7,7 @@ import type { SessionRecoveryContext } from './mesh-ledger.js';
 import { updateSessionTaskStatus, enqueueTask, updateDirectDispatchStatus, cleanupTerminalDirectDispatches, getActiveDirectDispatches, hasPendingDependents, getQueue } from './mesh-work-queue.js';
 import { markSessionDeliveriesTerminal, updateSessionDeliveryStatus, recordCompletionConflict } from './mesh-delivery-policy.js';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
-import { queuePendingMeshCoordinatorEvent, drainPendingMeshCoordinatorEvents, readV2EnvelopeFromWire, type PendingMeshCoordinatorEvent } from './mesh-events-pending.js';
+import { queuePendingMeshCoordinatorEvent, drainPendingMeshCoordinatorEvents, prunePendingMeshCoordinatorEventsRetention, readV2EnvelopeFromWire, type PendingMeshCoordinatorEvent } from './mesh-events-pending.js';
 import type { ProviderInstance } from '../providers/provider-instance.js';
 import { resolveWorkerDelegateRouting, recordUnroutableDelegateEvent, isUnroutableDelegateRejection } from './mesh-routing.js';
 import { resolveMeshHostStatus } from './mesh-host-ownership.js';
@@ -178,10 +178,25 @@ export function __resetMeshWorkspaceCacheForTests(): void {
     meshByWorkspaceCache.clear();
 }
 
+// Throttle the pending-event retention DELETE so it runs at most hourly — the
+// remote-idle sweep below fires on every completion/idle transition, but a table
+// scan + DELETE should not. In-process timestamp; a restart re-arms it, which only
+// means one prune shortly after boot (harmless, idempotent).
+let lastPendingEventsPruneAt = 0;
+const PENDING_EVENTS_PRUNE_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
+
 function sweepExpiredRemoteIdleSessions(): void {
     try {
         MeshRuntimeStore.getInstance().pruneExpiredRemoteIdleSessions();
     } catch { /* best-effort */ }
+    // Piggyback the pending-event retention prune on the same periodic sweep, but
+    // hourly — this is the maintenance hook that keeps mesh_pending_events from
+    // accumulating stale drained/orphaned rows without bound.
+    const now = Date.now();
+    if (now - lastPendingEventsPruneAt >= PENDING_EVENTS_PRUNE_INTERVAL_MS) {
+        lastPendingEventsPruneAt = now;
+        prunePendingMeshCoordinatorEventsRetention();
+    }
 }
 
 const INTENTIONAL_CLEANUP_STOP_SUPPRESSION_MS = 30 * 60 * 1000;

package/src/mesh/mesh-events-pending.ts

@@ -2,6 +2,7 @@ import { appendFileSync, existsSync, readFileSync, renameSync, statSync, unlinkS
 import { join } from 'path';
 import { randomUUID } from 'crypto';
 import { LOG } from '../logging/logger.js';
+import { loadConfig } from '../config/config.js';
 import { getLedgerDir, readLedgerEntries, appendLedgerEntry } from './mesh-ledger.js';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
 import { buildMeshSystemMessage, readNonEmptyString, readRecord, resolveEventSessionId, readMeshCompletionSummary, isWeakCompletionMetadata } from './mesh-events-utils.js';
@@ -674,6 +675,42 @@ function reconcilePendingMeshCoordinatorEvents(meshId: string, events: PendingMe
 const MAX_PENDING_EVENTS_BYTES = 100 * 1024; // 100 KB — keep the pending file small
 const MAX_PENDING_EVENTS_KEEP = 50;           // keep the last 50 events when trimming
 
+// ─── SQLite pending-event retention ─────────────────────────────────────────
+// mesh_pending_events had no lifecycle GC: drained rows are retained forever (the
+// durable v2-eventId dedup baseline drainedEventIdsForMesh reads them), and an
+// undrained row for a coordinator identity that never returns stays queued forever.
+// Both accumulate without bound. These windows bound that growth while preserving
+// the two things the rows exist for — recent-re-delivery idempotency and delivery
+// to a returning coordinator. A drained event older than the drained window cannot
+// be re-delivered (its producer session is long gone), so keeping it buys nothing;
+// an undrained event is kept far longer so a genuinely-offline coordinator's backlog
+// survives, and only unrecoverable orphans are swept.
+const PENDING_EVENTS_DRAINED_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;   // 7 days
+const PENDING_EVENTS_UNDRAINED_RETENTION_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+
+/**
+ * Retention sweep for the SQLite mesh_pending_events inbox. Deletes long-drained
+ * rows (past the idempotency-useful window) and long-orphaned undrained rows (a
+ * coordinator identity that never returned). Best-effort and idempotent: a store
+ * failure or an empty table is a cheap no-op. Called from the periodic mesh-event
+ * maintenance sweep. Returns the number of rows pruned (0 when nothing to do).
+ */
+export function prunePendingMeshCoordinatorEventsRetention(): number {
+    try {
+        const removed = MeshRuntimeStore.getInstance().prunePendingEvents({
+            drainedOlderThanMs: PENDING_EVENTS_DRAINED_RETENTION_MS,
+            undrainedOlderThanMs: PENDING_EVENTS_UNDRAINED_RETENTION_MS,
+        });
+        if (removed > 0) {
+            LOG.info('MeshEvents', `Pruned ${removed} stale pending-event row(s) (drained >7d / undrained >30d)`);
+        }
+        return removed;
+    } catch (e: any) {
+        LOG.warn('MeshEvents', `Pending-event retention prune failed: ${e?.message || e}`);
+        return 0;
+    }
+}
+
 function trimPendingEventsIfNeeded(path: string): void {
     try {
         if (!existsSync(path)) return;
@@ -746,23 +783,51 @@ export function stampPendingEventV2(
         return event;
     }
 
-    const dispatchedBy = hint?.dispatchedBy ?? coordinatorIdentityFromEmitFields({
+    const coordinatorIdentity = hint?.dispatchedBy ?? coordinatorIdentityFromEmitFields({
         daemonId: event.targetCoordinatorDaemonId,
         coordinatorRunId: hint?.coordinatorRunId,
         sessionId: event.targetCoordinatorSessionId,
     });
+
+    // A/C ROOT FIX: an emit site with NO coordinator identity (direct-dispatch /
+    // refine notification / any path where the worker session never carried a
+    // meshCoordinatorDaemonId) used to leave the event UNVERSIONED (v1). Under v2
+    // enforce (default ON) routeV2EventsForDrainer QUARANTINES every unversioned
+    // event — so a summary-less completion (agent:generating_completed) and every
+    // refine terminal notification (refine:accepted/completed/failed) were held
+    // back and never reached the coordinator; only the backstop papered over it.
+    //
+    // Fall back to THIS daemon's own id as the dispatcher so a v2 envelope can
+    // still be minted. There is no addressable coordinator, so we intentionally
+    // leave intendedFor empty and let buildPendingEventEmitStamp downgrade the
+    // (unicast-defaulting) terminal event to a BROADCAST — deliverable to whatever
+    // coordinator drains on this machine, instead of an undeliverable v1 event.
+    // When a real coordinator identity DOES exist the unicast path below is
+    // unchanged (no regression). loadConfig().machineId is the same self-id source
+    // resolveCoordinatorDaemonIds / the local queue-assignment stamp use, so the
+    // broadcast dispatcher matches the drainer's own identity form.
+    const selfFallback = !coordinatorIdentity;
+    const dispatchedBy = coordinatorIdentity ?? coordinatorIdentityFromEmitFields({
+        daemonId: readNonEmptyString(loadConfig().machineId),
+    });
     // The unicast target is, by default, the same coordinator the event is already
-    // routed to (its originating coordinator). A hint may override it.
-    const intendedFor: CoordinatorIdentity | undefined = hint?.intendedFor ?? dispatchedBy;
+    // routed to (its originating coordinator). A hint may override it. In the
+    // self-fallback case there is no originating coordinator to address, so leave
+    // it empty → broadcast (never a self-unicast that a sibling session's drainer
+    // would skip).
+    const intendedFor: CoordinatorIdentity | undefined = hint?.intendedFor
+        ?? (selfFallback ? undefined : coordinatorIdentity);
 
     const stamp = buildPendingEventEmitStamp({
         eventName: event.event,
         eventId: randomUUID(),
         dispatchedBy,
         intendedFor,
-        scope: hint?.scope,
+        // Force broadcast for the self-fallback so a unicast-defaulting terminal
+        // event isn't addressed to this daemon alone; an explicit hint still wins.
+        scope: hint?.scope ?? (selfFallback ? 'broadcast' : undefined),
     });
-    if (!stamp) return event; // no coordinator identity → stays a v1 event
+    if (!stamp) return event; // no coordinator identity at all (no self id) → stays a v1 event
 
     return {
         ...event,
@@ -849,6 +914,17 @@ export function queuePendingMeshCoordinatorEvent(
     // B2a: stamp the v2 envelope before dedup/persist so the eventId/scope ride
     // into both stores and the fingerprint/dedup logic sees the final shape.
     const event = stampPendingEventV2(rawEvent, hint);
+    return persistPendingMeshCoordinatorEvent(event);
+}
+
+/**
+ * Persist an ALREADY-STAMPED pending event to both stores (dedup + SQLite + JSONL),
+ * without re-running the emit stamp. queuePendingMeshCoordinatorEvent stamps then
+ * calls this; the only other caller is the test helper below, which needs to inject
+ * a genuinely-unversioned (v1) row to exercise the drain-side v1 handling now that
+ * the emit path never produces one (self-daemon fallback stamps every local emit).
+ */
+function persistPendingMeshCoordinatorEvent(event: PendingMeshCoordinatorEvent): boolean {
     try {
         if (hasPendingRefineTerminalEventDuplicate(event)) {
             LOG.info('MeshEvents', `Suppressed duplicate pending ${event.event} for refine job ${readRefineJobId(event)}`);
@@ -1212,6 +1288,19 @@ export function __clearMeshPendingEventsForTests(meshId: string): void {
     clearPendingMeshCoordinatorEvents(meshId);
 }
 
+/**
+ * Test helper: persist a pending event VERBATIM, skipping the emit-time v2 stamp.
+ * The local emit path (queuePendingMeshCoordinatorEvent → stampPendingEventV2) now
+ * always mints a v2 envelope (self-daemon broadcast fallback when no coordinator
+ * identity is present), so a genuinely-unversioned (v1) row can no longer be produced
+ * through the normal queue. The drain-side v1 handling (accept-broadcast / enforce-
+ * quarantine) still matters for durable v1 rows written by a pre-v2 daemon and for
+ * version-skewed remote relays, so tests inject those rows directly through this.
+ */
+export function __persistUnstampedPendingEventForTests(event: PendingMeshCoordinatorEvent): boolean {
+    return persistPendingMeshCoordinatorEvent(event);
+}
+
 /** Explicitly clear all pending coordinator events for a mesh (and coordinator if scoped). */
 export function clearPendingMeshCoordinatorEvents(meshId?: string, coordinatorDaemonId?: string): void {
     if (!meshId) return;

package/src/mesh/mesh-ledger.ts

@@ -255,11 +255,21 @@ const RECENT_FAILURE_WINDOW_MS = 30 * 60 * 1000; // 30 minutes
 
 // Kinds that accumulate indefinitely and are safe to archive after ARCHIVE_TERMINAL_OLDER_THAN_MS.
 // Non-terminal kinds (dispatched, sessions, nodes, checkpoints) are always kept in the active file.
+//
+// session_auto_launch is telemetry, NOT audit: it records the queue-assignment
+// decision on each tick (mostly phase:'skipped' — nothing was launched). No reader
+// consults it back from the ledger (unlike task_dispatched, which getSessionRecoveryContext
+// scans and which therefore MUST stay non-archivable). It is the single largest
+// avoidable ledger consumer after node/dispatch history, so archiving it after the
+// 7-day window is the volume fix — recent entries still surface for diagnosis (and the
+// per-tick dedup keeps live volume bounded), old ones move to the archive JSONL and out
+// of the runtime store. This preserves observability while removing the standing bulk.
 const ARCHIVABLE_KINDS: ReadonlySet<MeshLedgerKind> = new Set([
     'task_completed',
     'task_failed',
     'task_stalled',
     'recovery_attempted',
+    'session_auto_launch',
 ] as MeshLedgerKind[]);
 const DEFAULT_LEDGER_SLICE_LIMIT = 100;
 export const MAX_LEDGER_SLICE_LIMIT = 500;