@adhdev/daemon-core 0.9.82-rc.468 → 0.9.82-rc.469

package/src/mesh/mesh-reconcile-loop.ts

@@ -41,11 +41,10 @@
 // ---------------------------------------------------------------------------
 
 import type { DaemonComponents } from '../boot/daemon-lifecycle.js';
-import type { LocalMeshEntry } from '../repo-mesh-types.js';
 import { loadConfig } from '../config/config.js';
 import { listMeshes } from '../config/mesh-config.js';
 import { LOG, getLogLevel } from '../logging/logger.js';
-import { drainPendingMeshCoordinatorEvents, getPendingMeshCoordinatorEvents, buildPendingEventFingerprint, queuePendingMeshCoordinatorEvent, serializeV2EnvelopeToWire } from './mesh-events-pending.js';
+import { drainPendingMeshCoordinatorEvents, getPendingMeshCoordinatorEvents, buildPendingEventFingerprint, queuePendingMeshCoordinatorEvent } from './mesh-events-pending.js';
 import type { PendingMeshCoordinatorEvent } from './mesh-events-pending.js';
 import { appendLedgerEntry } from './mesh-ledger.js';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
@@ -59,93 +58,37 @@ import {
 import { readNonEmptyString, readMeshCompletionSummary, buildMeshSystemMessage } from './mesh-events-utils.js';
 import { traceMeshEventStage, traceMeshEventDrop } from './mesh-event-trace.js';
 import { expandDaemonIdForms, daemonIdsEquivalent, sessionIdsEquivalent } from '@adhdev/mesh-shared';
-import { getActiveDirectDispatches, getQueue, reclaimStrandedAssignedTask, updateTaskStatus } from './mesh-work-queue.js';
+import { getQueue, reclaimStrandedAssignedTask, updateTaskStatus } from './mesh-work-queue.js';
 import { resolveSessionBusyVerdict } from './mesh-queue-assignment.js';
 import { readLedgerEntries } from './mesh-ledger.js';
 import type { MeshLedgerEntry } from './mesh-ledger.js';
-import { pruneStaleDirectDispatches } from './mesh-active-work.js';
-import { findTerminalLedgerEvidenceForTask, reconcileDirectDispatchCompletionFromTranscript } from './mesh-events-stale.js';
-import { extractFinalAssistantSummaryEvidence } from '../providers/chat-message-normalization.js';
-import type { ChatMessage } from '../types.js';
+import { findTerminalLedgerEvidenceForTask } from './mesh-events-stale.js';
 import {
     resolveCoordinatorDaemonIds,
     daemonHostsMesh,
-    daemonIdListIncludes,
     resolveCoordinatorSelfIds,
 } from './mesh-reconcile-identity.js';
 import {
-    getMeshV2BackstopCounters,
-    recordBackstopFire,
-} from './mesh-reconcile-v2-backstop.js';
+    resolveAutoPruneMinAgeMs,
+    resolvePendingHeldDrainEscalateMs,
+    resolveReconcileIntervalMs,
+} from './mesh-reconcile-config.js';
+import { pullRemoteNodeQueues } from './mesh-remote-event-pull.js';
 import {
-    ACKED_DEATH_CONSECUTIVE_READ_FAILURES,
-    resolveTunedReconcileMs,
-    resolveAckedDeathDeadlineMs,
-    resolveAckedTranscriptFastTrackGraceMs,
-    inFlightSynthKey,
-    getHoldState,
-    setHoldState,
-    deleteHoldState,
-    rehydrateAckedHoldsForMesh,
-    collectHeldSynthKeysForMesh,
-} from './mesh-reconcile-acked-hold.js';
+    reconcileUnterminatedDirectDispatches,
+    autoPruneStaleDirectDispatches,
+} from './mesh-completion-synthesis.js';
 
 // Re-export the extracted public API so existing importers (mesh-events.ts barrel;
 // the reconcile-loop test suite) keep their `from './mesh-reconcile-loop.js'` paths.
 export { getMeshV2BackstopCounters, __resetMeshV2BackstopCountersForTests } from './mesh-reconcile-v2-backstop.js';
 export { __resetReconcileInFlightSynthDebounceForTests } from './mesh-reconcile-acked-hold.js';
 
-// Default reconcile cadence. approval/completion notifications to a live CLI
-// coordinator land within at most one interval. Overridable via env for tuning.
-const DEFAULT_RECONCILE_INTERVAL_MS = 4_000;
-
-// PHASE 5 (auto-prune) conservative age gate. A direct dispatch whose node/session is
-// orphaned (no longer in the live mesh) is only auto-pruned once it is at least this old,
-// measured from its dispatch time. This protects against a node/session that is only
-// *transiently* invisible (a momentary probe failure, a daemon restart) being pruned the
-// instant it disappears. The MANUAL prune (mesh_prune_stale_direct) has no age gate — an
-// operator pruning explicitly wants the orphan gone now. Overridable via env for tuning.
-const DEFAULT_AUTO_PRUNE_MIN_AGE_MS = 24 * 60 * 60_000; // 24h
-
-function resolveAutoPruneMinAgeMs(): number {
-    const raw = readNonEmptyString(process.env.MESH_AUTO_PRUNE_MIN_AGE_MS);
-    if (raw) {
-        const parsed = Number.parseInt(raw, 10);
-        // Clamp to [1h, 30d] so a mis-set env can't make the gate pathologically aggressive
-        // (prune the moment something blinks) or effectively disable it forever.
-        if (Number.isFinite(parsed) && parsed >= 60 * 60_000 && parsed <= 30 * 24 * 60 * 60_000) return parsed;
-    }
-    return DEFAULT_AUTO_PRUNE_MIN_AGE_MS;
-}
-
-// PTY-OVERTRUST-DRAIN (Defect B, fix B). Age-based escape for the
-// `generating_no_idle_coordinator` hold. Fix A makes the drain predicate read the RAW
-// adapter (mask-stripped), so the common mask-driven false-busy is gone. But a hold can
-// still arise from a genuine status-source desync that fix A does not reach (e.g. the
-// adapter raw itself momentarily reads generating while the coordinator is actually at a
-// turn end). This is a TIME-BASED BACKSTOP: when a mesh's pending terminal events have
-// been held this long, re-confirm the coordinator's RAW adapter idle on the tick and, if
-// it is genuinely idle, drain ONCE. It NEVER injects into a genuinely-generating PTY —
-// the re-confirmation gates on raw adapter idle, so the intentional removal of
-// force-inject-into-generating (data-loss) is preserved. Default 12s = 3 reconcile ticks
-// at the 4s cadence: long enough that a normal mid-turn settle is not pre-empted, short
-// enough that a desync-stranded completion is not held for minutes. Env-tunable.
-const DEFAULT_PENDING_HELD_DRAIN_ESCALATE_MS = 12_000;
-
-function resolvePendingHeldDrainEscalateMs(): number {
-    // Floor 4s (one tick) so a mis-set env cannot make the escape race a normal settle;
-    // ceiling 5min so it cannot be disabled into a permanent strand.
-    return resolveTunedReconcileMs('MESH_PENDING_HELD_DRAIN_ESCALATE_MS', DEFAULT_PENDING_HELD_DRAIN_ESCALATE_MS, 4_000, 5 * 60_000);
-}
-
-function resolveReconcileIntervalMs(): number {
-    const raw = readNonEmptyString(process.env.MESH_RECONCILE_INTERVAL_MS);
-    if (raw) {
-        const parsed = Number.parseInt(raw, 10);
-        if (Number.isFinite(parsed) && parsed >= 1_000 && parsed <= 60_000) return parsed;
-    }
-    return DEFAULT_RECONCILE_INTERVAL_MS;
-}
+// Reconcile-loop timing tunables + their env-override resolvers
+// (DEFAULT_RECONCILE_INTERVAL_MS, DEFAULT_AUTO_PRUNE_MIN_AGE_MS,
+// DEFAULT_PENDING_HELD_DRAIN_ESCALATE_MS, resolveReconcileIntervalMs,
+// resolveAutoPruneMinAgeMs, resolvePendingHeldDrainEscalateMs) live in
+// ./mesh-reconcile-config.ts (A-3 extraction) and are imported above.
 
 interface LiveCoordinator {
     meshId: string;
@@ -1498,607 +1441,11 @@ async function retryUnresolvedDelegateForwards(components: DaemonComponents): Pr
     }
 }
 
-// Cloud-only: poll each remote worker node daemon for pending coordinator events
-// and re-inject them locally via handleMeshForwardEvent (which re-queues +
-// surfaces to the live coordinator on the next tick / immediately if idle).
-//
-// Scoping: the remote handler (get_pending_mesh_events) drains its queue filtered
-// by coordinatorDaemonId — returning events targeted at that id OR unscoped, and
-// leaving events targeted at a *different* coordinator. A remote worker stamps the
-// coordinator id in one of SEVERAL forms (the canonical status id `standalone_`/
-// `daemon_<machineId>` stamped by the MCP layer, the bare machineId stamped by the
-// local queue path, OR — most commonly for remote launches — the coordinator mesh
-// node's config-form `daemonId`, which resolveCoordinatorDaemonId prefers and which
-// is NOT canonicalised). `candidateDaemonIds` is the already-expanded self-identity
-// set (resolveCoordinatorSelfIds: runtime drain ids ∪ this daemon's mesh-config node/
-// host id forms), so we pull ONCE PER candidate id and a completion stamped with any
-// of them is recovered. The remote drain is atomic (drained=1), so issuing multiple
-// pulls cannot double-deliver — the first pull that matches consumes the event; the
-// rest see nothing. When no ids resolve we fall back to a single unscoped pull.
-async function pullRemoteNodeQueues(
-    components: DaemonComponents,
-    mesh: LocalMeshEntry,
-    localDaemonId: string | undefined,
-    candidateDaemonIds: string[],
-): Promise<void> {
-    const dispatchMeshCommand = components.dispatchMeshCommand;
-    if (!dispatchMeshCommand) return;
-    const meshId = mesh.id;
-
-    // One args object per candidate coordinator-id form, or a single unscoped pull
-    // when none resolve.
-    const pulls: Array<Record<string, unknown>> = candidateDaemonIds.length > 0
-        ? candidateDaemonIds.map(id => ({ meshId, coordinatorDaemonId: id }))
-        : [{ meshId }];
-
-    // Parallelize across nodes: a single connected-but-slow node must not serially
-    // block the other nodes for the rest of the tick. Each node callback is fully
-    // self-contained (local/candidate skip, peer-connected pre-check, per-candidate
-    // pulls, extract→re-inject) and best-effort — allSettled swallows per-node errors.
-    await Promise.allSettled(mesh.nodes.map(async (node) => {
-        const nodeDaemonId = readNonEmptyString(node.daemonId);
-        // Skip nodes without a daemon, and nodes on THIS daemon (their events are
-        // already in the local queue drained in PHASE 2). "This daemon" is matched
-        // against the full self-identity set (candidateDaemonIds), not just the bare
-        // localDaemonId — a self node can be registered under the config-form daemonId
-        // (`daemon_<machineId>`) which would NOT equal bare localDaemonId, and pulling
-        // from ourselves over P2P is both wasteful and a self-dispatch hazard.
-        if (!nodeDaemonId) return;
-        if (daemonIdsEquivalent(nodeDaemonId, localDaemonId)) return;
-        if (daemonIdListIncludes(candidateDaemonIds, nodeDaemonId)) return;
-
-        // Peer-connected pre-check (EVENT-DELIVERY-DELAY fix(a)): a degraded peer whose
-        // DataChannel is not open would sink this pull into peer.connectQueue and stall
-        // until CONNECT_TIMEOUT_MS (90s), formerly freezing the whole serial loop and
-        // delaying completion-event recovery from healthy nodes. Skip such a node THIS
-        // tick and retry next tick — LOSSLESS: an unconnected peer has not drained
-        // anything (drained=0 preserved), so its events are recovered whole on the next
-        // successful tick. Skip = delay, never loss.
-        //   • snapshot present and state !== 'connected' → skip (continue next tick).
-        //   • snapshot null/undefined (getter unwired, e.g. standalone) → DO NOT skip;
-        //     fall through to the legacy path so this stays regression-free.
-        const peerSnapshot = components.getMeshPeerConnectionStatus?.(nodeDaemonId);
-        if (peerSnapshot && String(peerSnapshot.state) !== 'connected') return;
-
-        for (const pendingEventArgs of pulls) {
-            let events: unknown;
-            try {
-                events = await dispatchMeshCommand(nodeDaemonId, 'get_pending_mesh_events', pendingEventArgs);
-            } catch {
-                // Remote pull is best-effort; the node may be offline. Retry next tick.
-                break; // node unreachable — don't bother with the other id form this tick.
-            }
-            const list = extractPendingEvents(events).filter(e => readNonEmptyString(e?.meshId) === meshId);
-            for (const event of list) {
-                const payload = buildForwardPayloadFromPending(event);
-                if (!payload.event || !payload.meshId) continue;
-                try {
-                    handleMeshForwardEvent(components, payload);
-                } catch { /* best-effort re-inject */ }
-            }
-        }
-    }));
-}
-
-// Pull the read_chat payload out of whatever envelope the transport returned.
-// A local commandHandler.handle() returns the CommandResult directly; a remote
-// dispatchMeshCommand returns it possibly wrapped in { payload } / { result }.
-function unwrapReadChatPayload(raw: unknown): Record<string, unknown> | null {
-    let cursor: unknown = raw;
-    for (let depth = 0; depth < 4 && cursor && typeof cursor === 'object'; depth++) {
-        const record = cursor as Record<string, unknown>;
-        if (Array.isArray(record.messages)) return record;
-        if (record.payload && typeof record.payload === 'object') { cursor = record.payload; continue; }
-        if (record.result && typeof record.result === 'object') { cursor = record.result; continue; }
-        if (record.data && typeof record.data === 'object') { cursor = record.data; continue; }
-        break;
-    }
-    return cursor && typeof cursor === 'object' ? cursor as Record<string, unknown> : null;
-}
-
-function readChatPayloadStatus(payload: Record<string, unknown> | null): string {
-    return readNonEmptyString(payload?.status).toLowerCase();
-}
-
-// R4e fix (3): peek the pending-events queue for a REAL (worker-emitted) terminal completion
-// already queued for a task — used to yield the in-flight synth to the worker's own emit. Broad
-// peek (no daemon-id scoping) matched precisely by taskId, so a worker stamp in any daemon-id form
-// is still recognized. Best-effort: a peek failure returns false (proceed to synth — never block
-// delivery). A prior SYNTH's still-queued pending event also names this taskId, but a synth always
-// writes its terminal ledger atomically, so hasTerminalLedgerAfterDispatch downstream already
-// no-ops that case — this guard is specifically for an as-yet-unledgered worker emit in flight.
-function realTerminalEmitPendingForTask(meshId: string, taskId: string): boolean {
-    let pending: readonly PendingMeshCoordinatorEvent[];
-    try {
-        pending = getPendingMeshCoordinatorEvents(meshId);
-    } catch {
-        return false;
-    }
-    return pending.some(e =>
-        readNonEmptyString(e.metadataEvent?.taskId) === taskId
-        && (e.event === 'agent:generating_completed' || e.event === 'agent:stopped'));
-}
-
-// R4e fix (2): one fresh read_chat status read for the worker session, via the same local/remote
-// transport PHASE 4 uses. Returns the lowercased status, or null when the read is inconclusive
-// (transport error, success:false, no payload) — callers treat null as "no new evidence, proceed".
-async function reprobeWorkerStatus(
-    components: DaemonComponents,
-    args: { isLocalNode: boolean; nodeDaemonId: string; readArgs: Record<string, unknown> },
-): Promise<string | null> {
-    try {
-        if (args.isLocalNode) {
-            const r = await components.commandHandler.handle('read_chat', args.readArgs);
-            if (r && (r as { success?: boolean }).success === false) return null;
-            return readChatPayloadStatus(unwrapReadChatPayload(r));
-        }
-        if (components.dispatchMeshCommand) {
-            const r = await components.dispatchMeshCommand(args.nodeDaemonId, 'read_chat', args.readArgs);
-            const p = unwrapReadChatPayload(r);
-            if (p && (p as { success?: boolean }).success === false) return null;
-            return readChatPayloadStatus(p);
-        }
-    } catch {
-        return null;
-    }
-    return null;
-}
-
-// PHASE 4 helper. For every active (non-terminal) direct dispatch this daemon
-// hosts, confirm the worker session is idle via a read_chat and — if a final
-// assistant summary is present but no terminal ledger exists for that dispatch —
-// synthesize the missing completion through reconcileDirectDispatchCompletionFromTranscript.
-//
-// read_chat is resolved against the target node: a node on THIS daemon is read
-// through the local commandHandler; a remote node is read over P2P via
-// dispatchMeshCommand. Both yield the same { messages, status, providerSessionId }
-// shape. We only synthesize when the session reports idle AND a final assistant
-// message exists — the same evidence bar the MCP poll path uses — so an actively
-// generating worker is never falsely completed. The reconcile itself is idempotent.
-async function reconcileUnterminatedDirectDispatches(
-    components: DaemonComponents,
-    mesh: LocalMeshEntry,
-    selfIds: string[],
-    localDaemonId: string | undefined,
-): Promise<void> {
-    const dispatches = getActiveDirectDispatches(mesh.id);
-
-    // T2 (B2b): restart rehydration. Reload this mesh's persisted acked-hold rows into
-    // the Map cache the first time this process touches the mesh — a hold established
-    // before a daemon restart is honored again. Must run BEFORE the prune below so a
-    // rehydrated hold for a still-active task is not seen as absent-from-cache and lost.
-    rehydrateAckedHoldsForMesh(mesh.id);
-
-    // Prune the in-flight acked-hold state to the tasks still active in THIS mesh, so a
-    // completed/pruned task's state is dropped (both the Map cache AND the store row —
-    // the persisted table never grows without bound). Runs even when there are zero
-    // active dispatches so a restart that landed after every task terminated still
-    // reaps orphaned store rows. Iterate the union of Map keys and store rows so a row
-    // that exists ONLY on disk (not yet cached) is pruned too.
-    const activeTaskKeys = new Set(
-        dispatches
-            .map(d => readNonEmptyString(d.taskId))
-            .filter(Boolean)
-            .map(taskId => inFlightSynthKey(mesh.id, taskId)),
-    );
-    const heldKeys = collectHeldSynthKeysForMesh(mesh.id);
-    for (const key of heldKeys) {
-        if (!activeTaskKeys.has(key)) deleteHoldState(key, mesh.id);
-    }
-
-    if (dispatches.length === 0) return; // nothing left to reconcile after the prune
-
-    const dispatchMeshCommand = components.dispatchMeshCommand;
-    const nodeById = new Map(mesh.nodes.map(n => [n.id, n] as const));
-
-    for (const dispatch of dispatches) {
-        const sessionId = readNonEmptyString(dispatch.sessionId);
-        const nodeId = readNonEmptyString(dispatch.nodeId);
-        const taskId = readNonEmptyString(dispatch.taskId);
-        if (!sessionId || !nodeId || !taskId) continue;
-
-        const node = nodeById.get(nodeId);
-        const nodeDaemonId = readNonEmptyString(node?.daemonId);
-        // A node is local when it has no daemonId, names this daemon, or actually
-        // has a live instance here. Anything else is reached over P2P.
-        const isLocalNode = !nodeDaemonId
-            || daemonIdListIncludes(selfIds, nodeDaemonId)
-            || daemonIdsEquivalent(nodeDaemonId, localDaemonId)
-            || !!components.instanceManager.getInstance(sessionId);
-
-        const providerType = readNonEmptyString(dispatch.providerType);
-        const readArgs: Record<string, unknown> = {
-            sessionId,
-            targetSessionId: sessionId,
-            tailLimit: 10,
-            ...(node?.workspace ? { workspace: node.workspace } : {}),
-            ...(providerType ? { agentType: providerType, providerType } : {}),
-        };
-
-        const synthKey = inFlightSynthKey(mesh.id, taskId);
-        const isAcked = dispatch.status === 'acked';
-        // T6: which last-resort backstop (if any) drove this synth. Set when the
-        // acked-hold fast-track / death-deadline promotes the synth; the counter is
-        // bumped only if the synth actually COMMITS (result.reconciled), so a
-        // deferred/re-probed-away synth is not miscounted. A never-acked dispatch
-        // that reaches the commit is a plain PHASE-4 transcript synthesis.
-        let backstopKind: keyof ReturnType<typeof getMeshV2BackstopCounters> | undefined;
-
-        // R4f: read the worker session. A FAILED read (transport error / success:false / no payload)
-        // is no longer silently swallowed for an acked task — it is the liveness side of the
-        // death backstop (a). We classify the read result and route an acked failure into the
-        // failure counter; a never-acked (or non-acked) failure keeps the old best-effort `continue`.
-        let payload: Record<string, unknown> | null = null;
-        let readFailed = false;
-        try {
-            if (isLocalNode) {
-                const result = await components.commandHandler.handle('read_chat', readArgs);
-                if (result && (result as { success?: boolean }).success === false) {
-                    readFailed = true;
-                } else {
-                    payload = unwrapReadChatPayload(result);
-                }
-            } else if (dispatchMeshCommand) {
-                const result = await dispatchMeshCommand(nodeDaemonId, 'read_chat', readArgs);
-                payload = unwrapReadChatPayload(result);
-                if (payload && (payload as { success?: boolean }).success === false) { payload = null; readFailed = true; }
-            } else {
-                continue; // remote node but no P2P transport — can't read; retry next tick (not a death signal)
-            }
-        } catch {
-            readFailed = true; // session may be gone or node offline
-        }
-        if (!payload && !readFailed) continue; // null payload that wasn't a hard failure — retry next tick
-
-        if (readFailed || !payload) {
-            // R4f backstop (a) — liveness failure. For a never-acked dispatch there is no in-flight
-            // turn to protect, so a read failure is a transient probe blip → retry next tick (old
-            // behavior). For an ACKED dispatch that we had previously confirmed live, a streak of
-            // consecutive read failures means the worker session genuinely went away mid-turn and
-            // will never emit its real completion — count it. The actual terminal cleanup of a
-            // gone session is owned by PHASE 2.5 (stranded reclaim) / PHASE 5 (orphan prune); here
-            // we only record the death observation and STOP holding so those nets can take over,
-            // rather than pinning the row on an indefinite hold for a session that is already gone.
-            if (isAcked) {
-                const prior = getHoldState(synthKey, mesh.id);
-                const failures = (prior?.consecutiveReadFailures ?? 0) + 1;
-                const liveConfirmedSinceAck = prior?.liveConfirmedSinceAck ?? false;
-                // A read failure breaks the idle-with-final-assistant run → reset the fast-track streak
-                // (transcriptIdleSinceMs cleared by omission) so it must re-accumulate from scratch.
-                setHoldState(synthKey, mesh.id, { liveConfirmedSinceAck, consecutiveReadFailures: failures });
-                if (liveConfirmedSinceAck && failures >= ACKED_DEATH_CONSECUTIVE_READ_FAILURES) {
-                    LOG.warn('MeshReconcile', `Acked-hold death signal: task ${taskId} on node ${nodeId} (mesh ${mesh.id}) read_chat failed ${failures}x consecutively after a live-confirmed ack — worker session presumed gone mid-turn; releasing the indefinite synth hold to the stranded-reclaim / orphan-prune nets`);
-                }
-            }
-            continue; // no readable transcript this tick → cannot synth here; retry / let backstops act
-        }
-
-        // Read succeeded (a conclusive idle/generating status) → the session is reachable: reset the
-        // failure streak and mark it live-confirmed-since-ack, so a LATER read failure is recognized
-        // as a genuine liveness loss (backstop a) rather than a node that was never reachable. The
-        // fast-track idle streak (transcriptIdleSinceMs) is PRESERVED across this reset — it is
-        // managed below where the idle + final-assistant signal is actually evaluated.
-        const priorHoldState = getHoldState(synthKey, mesh.id);
-        setHoldState(synthKey, mesh.id, {
-            liveConfirmedSinceAck: true,
-            consecutiveReadFailures: 0,
-            ...(priorHoldState?.transcriptIdleSinceMs !== undefined ? { transcriptIdleSinceMs: priorHoldState.transcriptIdleSinceMs } : {}),
-        });
-
-        // Only act on a session that has actually settled to idle. A generating /
-        // waiting_approval session is mid-turn — synthesizing a completion now would
-        // be wrong. (idle is the only status the MCP poll path reconciles too.)
-        const nowMs = Date.now();
-        if (readChatPayloadStatus(payload) !== 'idle') {
-            // Not idle → the worker is genuinely mid-turn (a clear live signal). Keep the
-            // live-confirmed flag set (above) but RESET the fast-track idle streak: a turn that
-            // resumed generating proves the prior idle was a mid-turn blip, not a settled turn-end.
-            setHoldState(synthKey, mesh.id, { liveConfirmedSinceAck: true, consecutiveReadFailures: 0 });
-            continue;
-        }
-
-        // R4f GENERATING-BOUNDARY (acked-hold): a dispatch whose worker was OBSERVED to start
-        // generating (the agent:generating_started ack flipped the row to 'acked') is ALIVE and
-        // mid-turn — it WILL eventually emit a real terminal. An `idle` read here is therefore
-        // presumed a TRANSIENT mid-turn window (a PTY inter-tool-call settle, or final text already
-        // rendered while the lifecycle close lags), NOT a settled completion. We HOLD the synth
-        // INDEFINITELY rather than racing the worker's (variable, unbounded) emit latency with a
-        // finite timer — the failure mode of R4..R4e. This is safe: when the worker's real emit
-        // lands it writes a terminal ledger, and reconcileDirectDispatchCompletionFromTranscript's
-        // hasTerminalLedgerAfterDispatch makes any later synth an idempotent no-op, so the real emit
-        // always wins no matter how late. The hold is released ONLY by the death backstops:
-        //   (a) consecutive read failures after a live-confirmed ack (handled above), or
-        //   (b) the absolute ACKED_DEATH_DEADLINE_MS since the ack — a notification-loss net set FAR
-        //       above any observed emit latency, so it catches a genuinely-wedged worker / lost emit
-        //       without racing a normal slow turn.
-        // A never-acked dispatch (worker never started) is exempt — no in-flight generation to
-        // pre-empt; it keeps the first-idle-tick synth, with the downstream grace + stale-summary
-        // guards as its backstops.
-        //
-        // ACKED-HOLD-IDLE-OVERTRUST: the read is idle. Extract the final-assistant evidence NOW (the
-        // same signal the synth below requires) so the fast-track can gate on idle-WITH-final-assistant
-        // rather than bare idle. Only when a final visible assistant message is present do we treat
-        // this tick as a candidate turn-end and accumulate the fast-track grace streak; a bare idle
-        // with no assistant result is the worker still warming up and resets the streak.
-        const messages = Array.isArray(payload.messages) ? payload.messages as ChatMessage[] : [];
-        const evidence = extractFinalAssistantSummaryEvidence(messages);
-
-        if (isAcked) {
-            const ackedAtMs = Date.parse(readNonEmptyString(dispatch.updatedAt));
-            const sinceAckMs = Number.isFinite(ackedAtMs) ? nowMs - ackedAtMs : Number.POSITIVE_INFINITY;
-            const deathDeadlineMs = resolveAckedDeathDeadlineMs();
-
-            // ACKED-HOLD-IDLE-OVERTRUST fast-track. Maintain the continuous idle-with-final-assistant
-            // streak. The streak starts (or continues) only while a final visible assistant message is
-            // present; a tick with idle-but-no-assistant breaks it (the answer is not yet rendered).
-            const holdState = getHoldState(synthKey, mesh.id);
-            let fastTrackReady = false;
-            if (evidence.finalSummary) {
-                const idleSinceMs = holdState?.transcriptIdleSinceMs ?? nowMs;
-                if (holdState && holdState.transcriptIdleSinceMs === undefined) {
-                    setHoldState(synthKey, mesh.id, { ...holdState, transcriptIdleSinceMs: idleSinceMs });
-                }
-                const fastTrackGraceMs = resolveAckedTranscriptFastTrackGraceMs();
-                const idleHeldMs = nowMs - idleSinceMs;
-                if (idleHeldMs >= fastTrackGraceMs) {
-                    fastTrackReady = true;
-                    backstopKind = 'ackedHoldFastTrackFired';
-                    LOG.info('MeshReconcile', `Acked-hold transcript fast-track: task ${taskId} on node ${nodeId} (mesh ${mesh.id}) read idle WITH a final assistant message for ${Math.round(idleHeldMs / 1000)}s continuous (grace ${Math.round(fastTrackGraceMs / 1000)}s) — promoting the synth ahead of the ${Math.round(deathDeadlineMs / 1000)}s death backstop; the worker's real emit was lost/late and a later one no-ops idempotently.`);
-                }
-            } else if (holdState?.transcriptIdleSinceMs !== undefined) {
-                // Idle but no final assistant yet → not a turn-end; reset the streak.
-                setHoldState(synthKey, mesh.id, { ...holdState, transcriptIdleSinceMs: undefined });
-            }
-
-            // Hold indefinitely UNLESS the fast-track grace was met OR the absolute death deadline is
-            // reached. The fast-track is the new fast path in front of the (preserved) 8-min backstop.
-            if (!fastTrackReady && sinceAckMs < deathDeadlineMs) {
-                LOG.info('MeshReconcile', `Acked-hold: task ${taskId} on node ${nodeId} (mesh ${mesh.id}) read idle ${Number.isFinite(sinceAckMs) ? Math.round(sinceAckMs / 1000) + 's' : '∞'} since the generating_started ack — HOLDING synth (worker presumed alive; a later real emit is idempotent). Transcript fast-track promotes at ${Math.round(resolveAckedTranscriptFastTrackGraceMs() / 1000)}s continuous idle-with-final-assistant; death backstop at ${Math.round(deathDeadlineMs / 1000)}s or on consecutive read failures.`);
-                continue;
-            }
-            if (!fastTrackReady) {
-                backstopKind = 'ackedHoldDeathDeadlineFired';
-                LOG.warn('MeshReconcile', `Acked-hold death deadline reached: task ${taskId} on node ${nodeId} (mesh ${mesh.id}) still idle ${Math.round(sinceAckMs / 1000)}s after the ack (deadline ${Math.round(deathDeadlineMs / 1000)}s) — synthesizing the missing completion as a notification-loss net (a real emit, if it ever lands, no-ops idempotently).`);
-            }
-        }
-
-        // R4f (auxiliary, was R4e fix 3) — worker-emit priority. Secondary check: if the worker's
-        // REAL terminal emit for this task has already arrived in the pending-events queue (queued
-        // for delivery to the coordinator) but not yet written a terminal ledger, YIELD — let the
-        // genuine emit surface rather than racing it with a synth that would win the taskId-anchored
-        // fingerprint dedup and mask it. Under the R4f acked-hold this is now an auxiliary belt-and-
-        // suspenders check (the indefinite hold already defers an acked synth); it still guards the
-        // never-acked path and the post-death-deadline acked synth from racing an emit caught in
-        // flight at synth-commit time.
-        if (realTerminalEmitPendingForTask(mesh.id, taskId)) {
-            deleteHoldState(synthKey, mesh.id);
-            LOG.info('MeshReconcile', `Worker-emit priority: task ${taskId} on node ${nodeId} (mesh ${mesh.id}) has a real terminal completion already queued — yielding synth to the worker's own emit`);
-            continue;
-        }
-
-        if (!evidence.finalSummary) continue; // no assistant result yet — nothing to attribute
-
-        // STALE-SUMMARY guard (modal-parked / reused-session misattribution): a direct
-        // dispatch frequently reuses a session that already ran a PRIOR task. read_chat
-        // returns the tail of the WHOLE session, so extractFinalAssistantSummaryEvidence
-        // picks the latest user-facing assistant message — which, for a task that has
-        // barely started (the session momentarily reads idle between turns), is the prior
-        // task's final summary. The downstream reconcile proves the summary is after the
-        // LEDGER task_dispatched entry; here we additionally have the AUTHORITATIVE per-task
-        // dispatchedAt (the dispatch-store row, immune to ledger-ordering quirks), so when
-        // the selected transcript message is provably BEFORE this task's own dispatch we
-        // refuse it outright — it is a prior task's summary, not this task's output (the
-        // 2843ms-duration stale-summary bug where task 2e3f501e copy-pasted 4eca2d9d's
-        // summary). When the message carries no usable timestamp we do NOT block here: the
-        // downstream reconcile already rejects a non-JSON summary it cannot prove is
-        // post-dispatch (transcript_not_proven_after_dispatch), and a structured
-        // final_summary_json is self-attributing — so a timeless provider is not
-        // over-blocked while the provable-stale case is still caught.
-        const dispatchedAtMs = Date.parse(readNonEmptyString(dispatch.dispatchedAt));
-        const transcriptAtMs = Date.parse(evidence.transcriptMessageAt ?? '');
-        if (Number.isFinite(dispatchedAtMs) && Number.isFinite(transcriptAtMs) && transcriptAtMs < dispatchedAtMs) {
-            LOG.info('MeshReconcile', `Stale-summary guard: skipping transcript reconcile for task ${taskId} on node ${nodeId} (mesh ${mesh.id}) — final assistant message (${evidence.transcriptMessageAt}) predates this task's dispatch (${dispatch.dispatchedAt}); it is a prior task's summary`);
-            traceMeshEventDrop('reconcile_stale_summary_before_dispatch', {
-                taskId, sessionId, nodeId, meshId: mesh.id, event: 'agent:generating_completed',
-            }, `transcriptAt=${evidence.transcriptMessageAt} < dispatchedAt=${dispatch.dispatchedAt}`);
-            continue;
-        }
-
-        // R4f (auxiliary, was R4e fix 2) — live re-probe immediately before committing the synth. A
-        // fresh read right now catches a worker that resumed generating since this tick's first read
-        // so it is never falsely completed off a stale snapshot. Best-effort: an inconclusive
-        // re-probe (transport error/null) falls through to the synth — we already hold a valid idle
-        // read from the top of THIS tick, so a re-probe failure must not re-introduce a
-        // notification-miss. Under the R4f acked-hold this matters mainly for the never-acked path
-        // and the post-death-deadline acked synth (the indefinite hold already deferred a live acked
-        // turn); it stays as a final live-state guard at synth-commit time.
-        const reprobeStatus = await reprobeWorkerStatus(components, { isLocalNode, nodeDaemonId, readArgs });
-        if (reprobeStatus && reprobeStatus !== 'idle') {
-            deleteHoldState(synthKey, mesh.id);
-            LOG.info('MeshReconcile', `Live re-probe defer: task ${taskId} on node ${nodeId} (mesh ${mesh.id}) read '${reprobeStatus}' at synth-commit time — worker resumed generating; deferring synth to a later tick`);
-            continue;
-        }
-
-        const providerSessionId = readNonEmptyString(payload.providerSessionId);
-        const coordinatorDaemonId = selfIds.find(id => !!id);
-        try {
-            const result = reconcileDirectDispatchCompletionFromTranscript({
-                meshId: mesh.id,
-                nodeId,
-                sessionId,
-                providerType: providerType || undefined,
-                providerSessionId: providerSessionId || undefined,
-                taskId,
-                finalSummary: evidence.finalSummary,
-                ...(evidence.transcriptMessageAt ? { transcriptMessageAt: evidence.transcriptMessageAt } : {}),
-                ...(coordinatorDaemonId ? { targetCoordinatorDaemonId: coordinatorDaemonId } : {}),
-                source: 'daemon_reconcile_transcript_completion',
-            });
-            if (result.reconciled) {
-                // T6: this synth actually committed → count the last-resort backstop fire.
-                // An acked hold routes to the fast-track / death-deadline kind captured
-                // above; a never-acked dispatch is a plain PHASE-4 transcript synthesis.
-                // Under enforce, recordBackstopFire additionally WARNs (target = 0 fires).
-                recordBackstopFire(backstopKind ?? 'phase4SynthesisFired', `task ${taskId} on node ${nodeId} (mesh ${mesh.id}), kind=${result.kind}`);
-                LOG.info('MeshReconcile', `Synthesized missing completion (${result.kind}) for task ${taskId} on node ${nodeId} (mesh ${mesh.id})`);
-            }
-        } catch (e: any) {
-            LOG.warn('MeshReconcile', `Transcript completion reconcile threw for task ${taskId}: ${e?.message || e}`);
-        }
-    }
-}
-
-// PHASE 5 helper. Build the live-node view (mesh.nodes decorated with each node's live
-// session list) and run the shared prune core in execute mode with the conservative age gate.
-//
-// Orphan detection needs the SAME live-session evidence the manual MCP prune uses: a node still
-// in mesh.nodes whose session list no longer contains the dispatched sessionId is "session not
-// present" (prunable); a node missing from mesh.nodes entirely is "node no longer in live mesh"
-// (prunable). We obtain live sessions per node via get_status_metadata — local nodes through the
-// local commandHandler, remote nodes over P2P (dispatchMeshCommand) — exactly the transports
-// PHASE 4 already uses. A node we cannot probe (offline) keeps an empty session list; combined
-// with the age gate that only matters once the orphan is genuinely old.
-//
-// O(1) fast exit: when there are no active direct dispatches at all there is nothing to prune,
-// so we skip the (per-node) status probes entirely — an idle mesh costs one indexed query.
-async function autoPruneStaleDirectDispatches(
-    components: DaemonComponents,
-    mesh: LocalMeshEntry,
-    selfIds: string[],
-    localDaemonId: string | undefined,
-    minAgeMs: number,
-): Promise<void> {
-    const directDispatches = getActiveDirectDispatches(mesh.id);
-    if (directDispatches.length === 0) return; // nothing dispatched → nothing to prune
-
-    const liveNodes = await collectLiveNodesWithSessions(components, mesh, selfIds, localDaemonId);
-
-    const result = pruneStaleDirectDispatches({
-        meshId: mesh.id,
-        queue: getQueue(mesh.id),
-        ledgerEntries: readLedgerEntries(mesh.id, { tail: 500 }),
-        directDispatches,
-        nodes: liveNodes,
-        execute: true,
-        minAgeMs,
-        source: 'daemon_reconcile_auto_prune',
-    });
-
-    // Log only when something was actually pruned — silence on the common no-op tick.
-    if (result.prunedCount > 0) {
-        LOG.info('MeshReconcile', `Auto-pruned ${result.prunedCount} orphaned direct dispatch record(s) for mesh ${mesh.id}`);
-    }
-}
-
-// Probe each node for its live session list (get_status_metadata) and return mesh.nodes
-// decorated with a `sessions` array — the shape buildMeshActiveWork / sessionStatusFromNodes
-// consume to decide whether a dispatched session is still present. Best-effort: an unreachable
-// node yields an empty session list rather than throwing.
-async function collectLiveNodesWithSessions(
-    components: DaemonComponents,
-    mesh: LocalMeshEntry,
-    selfIds: string[],
-    localDaemonId: string | undefined,
-): Promise<any[]> {
-    const dispatchMeshCommand = components.dispatchMeshCommand;
-    return Promise.all(mesh.nodes.map(async (node) => {
-        const nodeDaemonId = readNonEmptyString(node.daemonId);
-        const isLocalNode = !nodeDaemonId
-            || daemonIdListIncludes(selfIds, nodeDaemonId)
-            || daemonIdsEquivalent(nodeDaemonId, localDaemonId);
-        // Peer-connected pre-check (EVENT-DELIVERY-DELAY fix(a)): mirror pullRemoteNodeQueues.
-        // Without this the 90s connect-deadline block re-enters via this Promise.all —
-        // a degraded remote's get_status_metadata sinks into peer.connectQueue and stalls
-        // the whole prune probe. Only call the remote when the peer is 'connected'; an
-        // unconnected peer is left undecorated (empty session list), same as unreachable.
-        // Getter unwired (null/undefined) → do NOT skip, fall through (regression-free).
-        if (!isLocalNode) {
-            const peerSnapshot = components.getMeshPeerConnectionStatus?.(nodeDaemonId);
-            if (peerSnapshot && String(peerSnapshot.state) !== 'connected') return node;
-        }
-        let statusResult: unknown;
-        try {
-            if (isLocalNode) {
-                statusResult = await components.commandHandler.handle('get_status_metadata', {});
-            } else if (dispatchMeshCommand) {
-                statusResult = await dispatchMeshCommand(nodeDaemonId, 'get_status_metadata', {});
-            } else {
-                return node; // remote node, no P2P transport — leave undecorated
-            }
-        } catch {
-            return node; // unreachable — leave undecorated (empty session list)
-        }
-        const sessions = extractStatusMetadataSessions(statusResult);
-        return sessions.length > 0 ? { ...node, sessions } : node;
-    }));
-}
-
-// Pull the live session list out of a get_status_metadata result, tolerating the same
-// envelope shapes unwrapReadChatPayload handles (direct CommandResult or { payload }/{ result }).
-function extractStatusMetadataSessions(raw: unknown): any[] {
-    let cursor: unknown = raw;
-    for (let depth = 0; depth < 4 && cursor && typeof cursor === 'object'; depth++) {
-        const record = cursor as Record<string, unknown>;
-        const status = record.status && typeof record.status === 'object' ? record.status as Record<string, unknown> : undefined;
-        if (status && Array.isArray(status.sessions)) return status.sessions;
-        if (Array.isArray(record.sessions)) return record.sessions;
-        if (record.payload && typeof record.payload === 'object') { cursor = record.payload; continue; }
-        if (record.result && typeof record.result === 'object') { cursor = record.result; continue; }
-        if (record.data && typeof record.data === 'object') { cursor = record.data; continue; }
-        break;
-    }
-    return [];
-}
-
-function extractPendingEvents(raw: unknown): any[] {
-    if (Array.isArray(raw)) return raw;
-    if (raw && typeof raw === 'object') {
-        const events = (raw as Record<string, unknown>).events;
-        if (Array.isArray(events)) return events;
-    }
-    return [];
-}
-
-// Flatten a queued PendingMeshCoordinatorEvent into the flat payload shape
-// handleMeshForwardEvent expects (mirrors the MCP buildMeshForwardPayloadFromPendingEvent).
-function buildForwardPayloadFromPending(event: any): Record<string, unknown> {
-    const metadata = event?.metadataEvent && typeof event.metadataEvent === 'object'
-        ? event.metadataEvent as Record<string, unknown>
-        : {};
-    return {
-        event: readNonEmptyString(event?.event),
-        meshId: readNonEmptyString(event?.meshId),
-        nodeId: readNonEmptyString(event?.nodeId) || readNonEmptyString(metadata.meshNodeId),
-        workspace: readNonEmptyString(event?.workspace) || readNonEmptyString(metadata.workspace),
-        // Preserve the originating coordinator session id across the relay. It is normally
-        // carried inside metadataEvent.meshCoordinatorSessionId (spread below), but pass the
-        // top-level field through explicitly too so the handleMeshForwardEvent whitelist
-        // recovers it regardless of which carrier the producing daemon used.
-        ...(readNonEmptyString(event?.targetCoordinatorSessionId)
-            ? { targetCoordinatorSessionId: readNonEmptyString(event.targetCoordinatorSessionId) }
-            : {}),
-        ...metadata,
-        // NOTIF-MISS (FIX 3): surface the dispatch task id at the TOP LEVEL so the relay's
-        // received-stage trace (and buildRelayMetadataEvent) recovers it regardless of which
-        // carrier the producing daemon used. The metadata spread above may carry the id only as
-        // `meshActiveTaskId` (a worker provider event), leaving top-level `taskId` unset and the
-        // received stage rendering `task=-`. Resolve both carriers into an explicit `taskId` so
-        // dedup stays task-scoped end-to-end. Only set when a non-empty id exists (no clobber to
-        // undefined when neither is present).
-        ...((): Record<string, unknown> => {
-            const tid = readNonEmptyString(metadata.taskId) || readNonEmptyString(metadata.meshActiveTaskId);
-            return tid ? { taskId: tid } : {};
-        })(),
-        // T4 (B3b): carry the v2 envelope (protocolVersion/eventId/scope/dispatchedBy/
-        // intendedFor) across the P2P relay boundary at the TOP LEVEL. These live on the
-        // pending event itself, not inside metadataEvent, so without this the remote pull
-        // re-queue would re-stamp a fresh eventId — breaking cross-machine idempotency and
-        // downgrading the relayed completion to v1 broadcast routing. Spread LAST so the
-        // authoritative envelope always wins over any stale key the metadata spread carried.
-        ...serializeV2EnvelopeToWire(event as PendingMeshCoordinatorEvent),
-    };
-}
-
+// The remote P2P pull helpers (pullRemoteNodeQueues + payload/envelope utilities)
+// live in ./mesh-remote-event-pull.ts, and the PHASE-4 completion-synthesis /
+// PHASE-5 auto-prune (reconcileUnterminatedDirectDispatches,
+// autoPruneStaleDirectDispatches) live in ./mesh-completion-synthesis.ts
+// (A-3 extraction). Both are imported at the top of this file.
 interface ReconcileLoopHandle {
     stop(): void;
 }