@adhdev/daemon-core 0.9.82-rc.481 → 0.9.82-rc.482

package/dist/mesh/contracts.d.ts

@@ -172,11 +172,14 @@ export declare function assertPendingMeshCoordinatorEventV2(raw: unknown, path?:
 export declare function shouldDeliverPendingEventToCoordinator(event: PendingMeshCoordinatorEventV2, drainer: CoordinatorIdentity): boolean;
 /**
  * Default the v2 scope for an event by its producer event name (design decision
- * §3). Terminal task events → unicast (routed to the originating coordinator).
- * Ledger-consistency / dispatch-plane events → system. Everything else — node
- * lifecycle and progress signals — → broadcast, which also matches v1's
- * implicit "deliver to any coordinator" behaviour, so an unstamped v1 event and
- * a v2-stamped-as-broadcast event route identically during rollout.
+ * §3). Terminal task events and coordinator-addressed alerts → unicast (routed
+ * to the originating coordinator). Everything else — node lifecycle and
+ * progress signals — → broadcast, which also matches v1's implicit "deliver to
+ * any coordinator" behaviour, so an unstamped v1 event and a v2-stamped-as-
+ * broadcast event route identically during rollout. No event currently defaults
+ * to 'system'; the scope remains in MESH_EVENT_SCOPES for wire compatibility
+ * (an already-queued or version-skewed 'system' event still routes away from
+ * coordinators).
  */
 export declare function defaultScopeForEvent(eventName: string): MeshEventScope;
 /**

package/dist/mesh/mesh-reconcile-loop.d.ts

@@ -72,6 +72,10 @@ export declare function shouldHoldPendingDrainForBusyLocalCoordinator(components
     statusInstanceId?: string;
 }, meshId: string, requestedCoordinatorDaemonId?: string | null, callerIsSelfCoordinatorInboxRead?: boolean): boolean;
 export declare function __resetReclaimUnknownStreakForTests(): void;
+export declare function reconcileZombieAssignedTasks(components: DaemonComponents, mesh: {
+    id: string;
+    nodes?: unknown[];
+}, selfIds: string[]): void;
 export declare function runMeshReconcileTick(components: DaemonComponents): Promise<void>;
 export declare function __resetUnresolvedForwardRejectionCountsForTests(): void;
 interface ReconcileLoopHandle {

package/dist/mesh/mesh-runtime-store.d.ts

@@ -262,9 +262,39 @@ export declare class MeshRuntimeStore {
     };
     /**
      * Prune tool call log entries older than the given age in ms.
-     * Exposed for testing.
+     * Returns the number of rows deleted. Also used by the periodic retention
+     * sweep (pruneMeshRuntimeRetention) — the in-write sweep in recordMeshToolCall
+     * only fires every 200 calls and only covers the rate-limit window, so a
+     * quiet mesh otherwise accumulates rows indefinitely.
      */
-    pruneToolCallLog(olderThanMs: number): void;
+    pruneToolCallLog(olderThanMs: number): number;
+    /**
+     * Retention prune for mesh_event_ledger (SoT 1-11 (b)). The ledger is append-only
+     * with NO lifecycle GC of its own, so lifecycle events accumulate without bound
+     * (the dominant mesh-runtime.db growth). Every production reader is bounded to a
+     * recent window (readLedgerEntries tail/limit ≤ a few hundred; task-stats /
+     * terminal-evidence scans look at recent tasks), so rows past a generous age only
+     * cost space. Excluded from deletion — retained forever:
+     *   - coordinator_operating_note / _tombstone: runtime-accumulated lessons whose
+     *     whole point is surviving restarts; a tombstone must also outlive the notes
+     *     it retracts.
+     * Timestamps are ISO-8601 TEXT, so the lexicographic `<` cutoff is a correct time
+     * comparison; a malformed timestamp compares greater than any ISO date and is
+     * conservatively retained. Returns rows deleted.
+     */
+    pruneEventLedger(olderThanMs: number): number;
+    /**
+     * Retention prune for TERMINAL (completed/cancelled/failed) mesh_queue rows
+     * (SoT 1-11 (b)). Terminal rows are kept as recent history (mesh_task_history,
+     * completion-dedup taskId lookups) but nothing ever deletes them, so the queue
+     * table grows monotonically. Rows past the retention window serve no reader —
+     * every dedup/attribution path operates on recent tasks — EXCEPT as a dependency
+     * anchor: taskDependenciesSatisfied resolves dependsOn by id and treats a MISSING
+     * row as not-completed, so deleting a completed row that a still-live
+     * (pending/assigned) row depends on would permanently strand the dependent.
+     * Those ids are collected first and excluded. Returns rows deleted.
+     */
+    pruneTerminalQueueEntries(olderThanMs: number): number;
     appendLedgerEntry(entry: {
         id: string;
         meshId: string;
@@ -506,3 +536,18 @@ export declare class MeshRuntimeStore {
         undrainedOlderThanMs: number;
     }): number;
 }
+export declare const MESH_EVENT_LEDGER_RETENTION_MS: number;
+export declare const MESH_TOOL_CALL_LOG_RETENTION_MS: number;
+export declare const MESH_TERMINAL_QUEUE_RETENTION_MS: number;
+/**
+ * Periodic retention sweep for the mesh-runtime.db tables that previously had no
+ * lifecycle GC (event ledger, tool-call log, terminal queue rows). Runs on the SAME
+ * cadence as the pending-events retention prune (the hourly mesh-event maintenance
+ * sweep in mesh-event-forwarding.ts). Best-effort and idempotent: a store failure
+ * degrades to a no-op with one warn; an empty table costs three cheap DELETEs.
+ */
+export declare function pruneMeshRuntimeRetention(): {
+    ledger: number;
+    toolCalls: number;
+    terminalQueue: number;
+};

package/dist/mesh/mesh-unresolved-forward-outbox.d.ts

@@ -9,6 +9,10 @@ export interface UnresolvedForwardEntry {
     /** When the entry was first enqueued (epoch ms) — used for age-based expiry. */
     queuedAt: number;
 }
+/** Register (or clear, with undefined) the PHASE 0 retry nudge handler. */
+export declare function registerUnresolvedForwardRetryNudge(handler?: () => void): void;
+/** Fire-and-forget nudge: ask the reconcile loop to run the outbox retry soon. */
+export declare function nudgeUnresolvedForwardRetry(): void;
 /**
  * Durably enqueue an unresolved-delegate forward for a coordinator daemon. The
  * `forwardPayload` is the flat shape handleMeshForwardEvent reads on the coordinator.

package/dist/repo-mesh-types.d.ts

@@ -13,7 +13,7 @@
 import type { GitRepoStatus, GitCompactSummary } from './git/git-types.js';
 import type { MeshMissionSummary, MeshMissionSlimSummary } from './mesh/mesh-missions.js';
 import type { MeshMagiActivitySummary } from './mesh/mesh-magi-status.js';
-import type { MagiPanelMap, MagiKindPanelMap } from '@adhdev/mesh-shared';
+import type { MagiKindPanelMap } from '@adhdev/mesh-shared';
 export interface RepoMesh {
     id: string;
     name: string;
@@ -547,18 +547,12 @@ export interface RepoMeshCoordinatorConfig {
 export interface LocalMeshConfig {
     meshes: LocalMeshEntry[];
     /**
-     * MAGI cross-verification panels (machine-local). Keyed by panel name; each
-     * binds concrete `(node × provider)` members — machine-dependent facts — so
-     * panels live here in meshes.json, never in the repo-shared .adhdev/mesh.json.
-     * Optional: absent on configs written before MAGI existed.
-     */
-    magiPanels?: MagiPanelMap;
-    /**
-     * MAGI-KIND-PANEL: per-task_kind panel bindings (machine-local). Keyed by
-     * task_kind (rca / design / claim_audit / freeform); each maps to ≥1
-     * `(node × provider × model?)` slot. A `mesh_magi_review` invoked with a bare
-     * `task_kind` resolves its panel from here — an unconfigured kind is a hard
-     * error, never a synthesized fallback. Optional; absent on pre-feature configs.
+     * MAGI-KIND-PANEL: per-task_kind panel bindings (machine-local), the SOLE MAGI
+     * panel-resolution surface (the former named-panel `magiPanels` map was removed).
+     * Keyed by task_kind (rca / design / claim_audit / freeform); each maps to ≥1
+     * `(node × provider × model?)` slot. A `mesh_magi_review` resolves its panel from
+     * here — an unconfigured kind is a hard error, never a synthesized fallback.
+     * Optional; absent on pre-feature configs.
      */
     magiKindPanels?: MagiKindPanelMap;
 }

package/dist/types.d.ts

@@ -5,7 +5,7 @@
  * When modifying this file, also update interface contracts in AGENT_PROTOCOL.md.
  */
 import type { StatusReportPayload, AvailableProviderInfo } from './shared-types.js';
-import type { ChatMessageKind } from './providers/chat-message-normalization.js';
+import type { ChatMessageKind, ChatMessageVisibility, ChatMessageTranscriptVisibility, ChatMessageAudience, ChatMessageSource } from './providers/chat-message-normalization.js';
 /** Full status response from /api/v1/status and WS events */
 export interface StatusResponse extends StatusReportPayload {
     /** For standalone API compat */
@@ -47,11 +47,20 @@ export interface ChatMessage {
     /** Optional: fiber metadata */
     _type?: string;
     _sub?: string;
-    /** Transcript visibility/audience contract for separating chat-visible content from internal/debug runtime rows. */
-    visibility?: 'visible' | 'user' | 'chat' | 'hidden' | 'debug' | 'internal' | (string & {});
-    transcriptVisibility?: 'visible' | 'user' | 'chat' | 'hidden' | 'debug' | 'internal' | (string & {});
-    audience?: 'chat' | 'debug' | 'trace' | 'internal' | (string & {});
-    source?: 'assistant_text' | 'tool_call' | 'terminal_command' | 'runtime_activity' | 'runtime_status' | 'provider_chrome' | 'control' | (string & {});
+    /**
+     * Transcript visibility/audience contract for separating chat-visible content
+     * from internal/debug runtime rows. These reference the canonical named unions
+     * declared alongside the classifier (chat-message-normalization.ts) so the known
+     * values have one source of truth instead of a hand-inlined copy that drifts.
+     * Each alias keeps the `| (string & {})` escape hatch: the read-chat contract
+     * (read-chat-contract.ts) preserves ANY producer-supplied string verbatim, so
+     * the type must stay open — it documents the known values without forbidding
+     * provider-specific extensions.
+     */
+    visibility?: ChatMessageVisibility;
+    transcriptVisibility?: ChatMessageTranscriptVisibility;
+    audience?: ChatMessageAudience;
+    source?: ChatMessageSource;
     userFacing?: boolean;
     internal?: boolean;
     isInternal?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.481",
+  "version": "0.9.82-rc.482",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.481",
-    "@adhdev/session-host-core": "0.9.82-rc.481",
+    "@adhdev/mesh-shared": "0.9.82-rc.482",
+    "@adhdev/session-host-core": "0.9.82-rc.482",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/commands/chat-commands-read.ts

@@ -195,6 +195,57 @@ function isRuntimeFallbackHistorySessionId(
     const candidate = typeof candidateHistorySessionId === 'string' ? candidateHistorySessionId.trim() : '';
     return candidate === target;
 }
+
+interface ResolvedNativeHistoryReadSession {
+    /**
+     * True when the candidate history id is the daemon runtime session id (==
+     * targetSessionId) standing in for a real provider-native conv uuid — reached
+     * either via getHistorySessionId's internal fallback (empty args) or because
+     * the browser explicitly echoed targetSessionId back as historySessionId (the
+     * poisoned agy-coordinator read). See isRuntimeFallbackHistorySessionId.
+     */
+    isRuntimeFallback: boolean;
+    /** Owner-confirmed pin recorded by a prior bound read for this mesh session, if any. */
+    pinnedProviderSessionId: string | undefined;
+    /**
+     * The id to key the native read on: the pin (or undefined) when the candidate
+     * is a runtime fallback so pin / workspace-latest resolution engages, else the
+     * candidate unchanged (a real DISTINCT provider uuid still exact-binds).
+     */
+    effectiveHistorySessionId: string | undefined;
+}
+
+/**
+ * Resolve the runtime-fallback → pin substitution shared by every native-history
+ * read path (handleChatHistory, the CLI-adapter main read, and the history-only
+ * read). Each site previously inlined this same four-step computation verbatim:
+ * detect the runtime fallback (candidate === targetSessionId AND no distinct
+ * explicit id), look up the owner-confirmed pin, and drop the runtime id in favor
+ * of the pin (or undefined) so readCliProviderNativeHistory's pin / workspace-
+ * latest paths can engage instead of fail-closing to pty-parser. Extracted to a
+ * single helper so the D9 historySessionId-poison guard has one definition.
+ * Behavior is identical to the inlined blocks — same target (args.targetSessionId),
+ * same explicit-id source, same pin key (getBoundProviderSessionIdPin trims).
+ */
+function resolveNativeHistoryReadSession(
+    args: any,
+    candidateHistorySessionId: string | undefined,
+): ResolvedNativeHistoryReadSession {
+    const targetSid = typeof args?.targetSessionId === 'string' ? args.targetSessionId.trim() : '';
+    const explicitHistorySessionId = getExplicitHistorySessionId(args);
+    const isRuntimeFallback = Boolean(
+        targetSid
+        && isRuntimeFallbackHistorySessionId(candidateHistorySessionId, targetSid)
+        && (!explicitHistorySessionId
+            || isRuntimeFallbackHistorySessionId(explicitHistorySessionId, targetSid)),
+    );
+    const pinnedProviderSessionId = getBoundProviderSessionIdPin(args?.targetSessionId);
+    const effectiveHistorySessionId = isRuntimeFallback
+        ? (pinnedProviderSessionId || undefined)
+        : candidateHistorySessionId;
+    return { isRuntimeFallback, pinnedProviderSessionId, effectiveHistorySessionId };
+}
+
 function getHistorySessionId(h: CommandHelpers, args: any): string | undefined {
     const explicit = getExplicitHistorySessionId(args);
     if (explicit) return explicit;
@@ -1653,24 +1704,18 @@ export async function handleChatHistory(h: CommandHelpers, args: any): Promise<C
                 ? (h.currentSession as any).workspace
                 : undefined;
         // Same runtime-fallback poison guard as the subscribe / history-only
-        // paths: getHistorySessionId falls back to targetSessionId (the ADHDev
-        // id) for an agy coordinator, and the browser may also send that id back
-        // explicitly. Reading native history keyed on it can never exact-bind
-        // (it is not the on-disk conv uuid). Drop it here too so the pin /
-        // workspace-latest / owner-confirmed resolution engages instead of
-        // fail-closing to pty-parser. A real DISTINCT provider uuid is preserved.
-        const targetSidForHistory = typeof args?.targetSessionId === 'string' ? args.targetSessionId.trim() : '';
-        const explicitHistorySessionIdForHistory = getExplicitHistorySessionId(args);
-        const historySessionIdIsRuntimeFallback = Boolean(
-            targetSidForHistory
-            && isRuntimeFallbackHistorySessionId(historySessionId, targetSidForHistory)
-            && (!explicitHistorySessionIdForHistory
-                || isRuntimeFallbackHistorySessionId(explicitHistorySessionIdForHistory, targetSidForHistory)),
-        );
-        const pinnedProviderSessionIdForHistory = getBoundProviderSessionIdPin(args?.targetSessionId);
-        const effectiveHistorySessionId = historySessionIdIsRuntimeFallback
-            ? (pinnedProviderSessionIdForHistory || undefined)
-            : historySessionId;
+        // paths (see resolveNativeHistoryReadSession): getHistorySessionId falls
+        // back to targetSessionId (the ADHDev id) for an agy coordinator, and the
+        // browser may also send that id back explicitly. Reading native history
+        // keyed on it can never exact-bind (it is not the on-disk conv uuid). Drop
+        // it here too so the pin / workspace-latest / owner-confirmed resolution
+        // engages instead of fail-closing to pty-parser. A real DISTINCT provider
+        // uuid is preserved.
+        const {
+            isRuntimeFallback: historySessionIdIsRuntimeFallback,
+            pinnedProviderSessionId: pinnedProviderSessionIdForHistory,
+            effectiveHistorySessionId,
+        } = resolveNativeHistoryReadSession(args, historySessionId);
         const exactNativeHistoryScope = Boolean(
             (typeof args?.targetSessionId === 'string' && args.targetSessionId.trim())
             || (typeof args?.historySessionId === 'string' && args.historySessionId.trim() && !historySessionIdIsRuntimeFallback)
@@ -1921,7 +1966,8 @@ export async function handleReadChat(h: CommandHelpers, args: any): Promise<Comm
             let nativeHistory: any | null = null;
             let nativeHistoryError: unknown | undefined;
             if (supportsNative) {
-                // Runtime-fallback → pin substitution: nativeHistoryReadSessionId is
+                // Runtime-fallback → pin substitution (see
+                // resolveNativeHistoryReadSession): nativeHistoryReadSessionId is
                 // the bare runtime/session id when no explicit provider handle was
                 // supplied and none was parsed (antigravity takes no --session-id, so
                 // its this.providerSessionId stays empty and getHistorySessionId falls
@@ -1933,23 +1979,10 @@ export async function handleReadChat(h: CommandHelpers, args: any): Promise<Comm
                 // persisted across restart) over the runtime id, else drop the runtime
                 // id so readCliProviderNativeHistory's pin / workspace-latest paths can
                 // engage. Mirrors the handleChatHistory path's established handling.
-                const pinnedProviderSessionIdForRead = getBoundProviderSessionIdPin(targetSessionId);
-                // Runtime fallback whether the runtime id was reached via
-                // getHistorySessionId's internal fallback (empty args) OR the
-                // browser explicitly sent historySessionId === targetSessionId
-                // (the poisoned agy-coordinator read). Both must drop the
-                // runtime id so pin / live-bind resolution engages; only a real
-                // DISTINCT provider uuid stays as an exact-bind id.
-                const explicitHistorySessionIdForRead = getExplicitHistorySessionId(args);
-                const nativeReadSessionIdIsRuntimeFallback = Boolean(
-                    targetSessionId
-                    && isRuntimeFallbackHistorySessionId(nativeHistoryReadSessionId, targetSessionId)
-                    && (!explicitHistorySessionIdForRead
-                        || isRuntimeFallbackHistorySessionId(explicitHistorySessionIdForRead, targetSessionId)),
-                );
-                const effectiveNativeReadSessionId = nativeReadSessionIdIsRuntimeFallback
-                    ? (pinnedProviderSessionIdForRead || undefined)
-                    : nativeHistoryReadSessionId;
+                const {
+                    pinnedProviderSessionId: pinnedProviderSessionIdForRead,
+                    effectiveHistorySessionId: effectiveNativeReadSessionId,
+                } = resolveNativeHistoryReadSession(args, nativeHistoryReadSessionId);
                 try {
                     nativeHistory = readCliProviderNativeHistory(agentStr, {
                         canonicalHistory: provider?.nativeHistory,
@@ -2353,30 +2386,18 @@ export async function handleReadChat(h: CommandHelpers, args: any): Promise<Comm
             // zero rows) even though the transcript is present in state.db. When
             // this is that runtime fallback (historySessionId === targetSid and no
             // explicit id was passed) and we hold a pin from an earlier bound
-            // read, prefer the pin so the query hits the real session.
-            const pinnedProviderSessionIdForHistory = getBoundProviderSessionIdPin(targetSid);
-            // Runtime fallback whether historySessionId reached targetSid via
-            // getHistorySessionId's internal fallback (empty args) OR the browser
-            // explicitly sent historySessionId === targetSid (the poisoned
-            // agy-coordinator subscription / D8 refreshAuthoritativeTail read).
-            // In both cases the runtime id is NOT a real provider conv uuid, so
-            // drop it and let pin / workspace-latest / owner-confirmed resolution
-            // run. A real DISTINCT provider uuid still exact-binds unchanged.
-            const explicitHistorySessionId = getExplicitHistorySessionId(args);
-            const historySessionIdIsRuntimeFallback = Boolean(
-                targetSid
-                && isRuntimeFallbackHistorySessionId(historySessionId, targetSid)
-                && (!explicitHistorySessionId
-                    || isRuntimeFallbackHistorySessionId(explicitHistorySessionId, targetSid)),
-            );
-            // When this is the runtime fallback (not a real provider id): prefer
-            // the pin if we have one, else drop the runtime id entirely so the
-            // pin-reuse / workspace-latest logic inside readCliProviderNativeHistory
-            // can engage (passing the runtime id as historySessionId would pin the
-            // query to a non-existent session and never reach those paths).
-            const effectiveHistorySessionIdForRead = historySessionIdIsRuntimeFallback
-                ? (pinnedProviderSessionIdForHistory || undefined)
-                : historySessionId;
+            // read, prefer the pin so the query hits the real session. Detects the
+            // fallback whether historySessionId reached targetSid via
+            // getHistorySessionId's internal fallback (empty args) or the browser
+            // explicitly echoed targetSid back (poisoned agy-coordinator
+            // subscription / D8 refreshAuthoritativeTail read); a real DISTINCT
+            // provider uuid still exact-binds unchanged. See
+            // resolveNativeHistoryReadSession.
+            const {
+                isRuntimeFallback: historySessionIdIsRuntimeFallback,
+                pinnedProviderSessionId: pinnedProviderSessionIdForHistory,
+                effectiveHistorySessionId: effectiveHistorySessionIdForRead,
+            } = resolveNativeHistoryReadSession(args, historySessionId);
             const history = supportsNative
                 ? readCliProviderNativeHistory(agentStr, {
                     canonicalHistory: provider?.nativeHistory,

package/src/commands/med-family/mesh-crud.ts

@@ -411,69 +411,15 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
         }
     },
 
-    // ─── MAGI panels (machine-local config, sibling to meshes) ───────────────
-    // Panels live in ~/.adhdev/meshes.json `magiPanels` and are pure local config
-    // (no mesh ownership). These three handlers mirror list_meshes/create_mesh/
-    // update_mesh: dynamic-import the already-exported mesh-config accessors and
-    // surface normalizeMagiPanel's structured error codes (invalid_magi_panel,
-    // magi_panel_exists) verbatim so the dashboard can render them.
-    //
-    // Permission: magi_panel_set / magi_panel_remove are WRITE commands. They are
-    // intentionally NOT listed in canPeerUsePrivilegedShareCommand (daemon-cloud
-    // data-channel-router), so a peer holding ANY share permission hits its
-    // `default → false` branch — identical owner-only gating to create_mesh /
-    // update_mesh / list_meshes (none of which are listed there either). A trusted
-    // peer (no permission = the owner) passes the top `!permission → true` guard.
-    // Mirror, don't invent: do not add a new policy tier here.
-    //
-    // Resolvability (coupling / stale / available) is deliberately NOT computed
-    // here: buildMagiFanoutPlan lives in mcp-server, unreachable from daemon-core.
-    // magi_panel_list returns the raw definitions only; the dashboard derives
-    // member resolvability client-side (web-core MagiPanelManager, reusing the
-    // MagiGroupRow coupling logic) against live mesh_status.
-    magi_panel_list: async (_ctx: MedFamilyContext, _args: any) => {
-        try {
-            const { listMagiPanels } = await import('../../config/mesh-config.js');
-            return { success: true, panels: listMagiPanels() };
-        } catch (e: any) {
-            return { success: false, error: e.message };
-        }
-    },
-
-    magi_panel_set: async (_ctx: MedFamilyContext, args: any) => {
-        const name = typeof args?.name === 'string' ? args.name.trim() : '';
-        if (!name) return { success: false, error: 'invalid_magi_panel: panel name is required' };
-        try {
-            const { upsertMagiPanel } = await import('../../config/mesh-config.js');
-            // normalizeMagiPanel (invoked inside upsertMagiPanel) validates members,
-            // enforces MAX_MAGI_PANEL_MEMBERS, and clamps replica counts. Its
-            // invalid_magi_panel / magi_panel_exists messages flow back as `error`.
-            const panel = upsertMagiPanel(name, args?.panel, { overwrite: args?.overwrite === true });
-            return { success: true, name, panel };
-        } catch (e: any) {
-            // Surface the structured code (invalid_magi_panel: … / magi_panel_exists: …)
-            // verbatim so the editor can map it to a field-level message.
-            return { success: false, error: e.message };
-        }
-    },
-
-    magi_panel_remove: async (_ctx: MedFamilyContext, args: any) => {
-        const name = typeof args?.name === 'string' ? args.name.trim() : '';
-        if (!name) return { success: false, error: 'invalid_magi_panel: panel name is required' };
-        try {
-            const { removeMagiPanel } = await import('../../config/mesh-config.js');
-            const removed = removeMagiPanel(name);
-            return { success: true, removed };
-        } catch (e: any) {
-            return { success: false, error: e.message };
-        }
-    },
-
     // ─── MAGI kind → panel bindings (MAGI-KIND-PANEL, machine-local config) ───
-    // Per-task_kind slot lists in ~/.adhdev/meshes.json `magiKindPanels`. Same
-    // owner-only gating and structured-error precedent as the magi_panel_* handlers
-    // above (not listed in canPeerUsePrivilegedShareCommand → owner-only). set/remove
-    // are WRITE commands; list is read-only. normalizeMagiSlots (inside setMagiKindPanel)
+    // Per-task_kind slot lists in ~/.adhdev/meshes.json `magiKindPanels` — the SOLE
+    // MAGI panel-resolution surface (the former named-panel magi_panel_* handlers were
+    // removed). Owner-only gating: intentionally NOT listed in
+    // canPeerUsePrivilegedShareCommand (daemon-cloud data-channel-router), so a peer
+    // holding ANY share permission hits its `default → false` branch — identical
+    // owner-only gating to create_mesh / update_mesh / list_meshes. A trusted peer (no
+    // permission = the owner) passes the top `!permission → true` guard. set/remove are
+    // WRITE commands; list is read-only. normalizeMagiSlots (inside setMagiKindPanel)
     // surfaces invalid_magi_kind_panel: … messages verbatim for the editor.
     magi_kind_panel_list: async (_ctx: MedFamilyContext, _args: any) => {
         try {

package/src/config/mesh-config.ts

@@ -22,7 +22,7 @@ import type {
     RepoMeshHostMetadata,
     RepoMeshDaemonRole,
 } from '../repo-mesh-types.js';
-import type { MagiPanel, MagiPanelMember, MagiPanelDefaultKind, MagiKindPanelMap, MagiSlot, MagiTaskKind } from '@adhdev/mesh-shared';
+import type { MagiKindPanelMap, MagiSlot, MagiTaskKind } from '@adhdev/mesh-shared';
 import { mergeAndNormalizePolicy } from '../repo-mesh-types.js';
 import { createDefaultMeshHostMetadata } from '../mesh/mesh-host-ownership.js';
 
@@ -626,8 +626,10 @@ export function updateNode(
 
 // ─── MAGI Panels (machine-local cross-verification quorums) ──
 
-/** Hard cap on members per panel — a sanity bound, not the per-invocation replica cap. */
-const MAX_MAGI_PANEL_MEMBERS = 24;
+// NOTE: the named-panel model (normalizeMagiPanel / list / get / upsert / remove,
+// stored under meshes.json `magiPanels`) was REMOVED. MAGI now resolves its fan-out
+// slots SOLELY from the per-task_kind `magiKindPanels` binding below. `normalizeMagiSlots`
+// is the sole slot normalizer.
 
 function normalizeReplicaCount(value: unknown): number | undefined {
     if (typeof value !== 'number' || !Number.isFinite(value)) return undefined;
@@ -635,138 +637,6 @@ function normalizeReplicaCount(value: unknown): number | undefined {
     return n >= 1 ? n : undefined;
 }
 
-/**
- * Normalize a panel `defaultKind` (the non-binding default output kind). Returns
- * undefined (drop, don't throw) for any absent / unknown value so a stray field
- * never blocks a panel write. 'freeform' is explicitly DROPPED with a warning: a
- * panel is a cross-verification tool and freeform contributes no structured claims
- * (claims:[]), so defaulting to it would silently zero out the very thing the panel
- * exists for. Only the evidence-bearing kinds (claim_audit / rca / design) survive.
- */
-function normalizeMagiPanelDefaultKind(raw: unknown): MagiPanelDefaultKind | undefined {
-    if (raw == null) return undefined;
-    const s = typeof raw === 'string' ? raw.trim().toLowerCase() : '';
-    if (s === 'claim_audit' || s === 'rca' || s === 'design') return s;
-    if (s === 'freeform') {
-        // eslint-disable-next-line no-console
-        console.warn(
-            "[magi] panel defaultKind='freeform' rejected — freeform contributes no structured claims to cross-verification; dropping (use claim_audit / rca / design, or omit).",
-        );
-        return undefined;
-    }
-    // Any other value (typo / unsupported kind): drop silently — the panel still
-    // resolves to the claim_audit fallback at review time.
-    return undefined;
-}
-
-/**
- * Validate + normalize a panel config before persisting. Mirrors the node-config
- * normalization style (mesh-config addNode/updateNode): trims strings, drops
- * empties, requires a provider per member, clamps replica counts. Throws on
- * structurally invalid input so the calling tool returns a clear error rather than
- * writing a malformed panel.
- */
-export function normalizeMagiPanel(config: unknown): MagiPanel {
-    if (!config || typeof config !== 'object' || Array.isArray(config)) {
-        throw new Error('invalid_magi_panel: config must be an object');
-    }
-    const raw = config as Record<string, unknown>;
-    const rawMembers = raw.members;
-    if (!Array.isArray(rawMembers) || rawMembers.length === 0) {
-        throw new Error('invalid_magi_panel: members must be a non-empty array');
-    }
-    if (rawMembers.length > MAX_MAGI_PANEL_MEMBERS) {
-        throw new Error(`invalid_magi_panel: too many members (max ${MAX_MAGI_PANEL_MEMBERS})`);
-    }
-    const members: MagiPanelMember[] = rawMembers.map((entry, idx) => {
-        if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
-            throw new Error(`invalid_magi_panel: member[${idx}] must be an object`);
-        }
-        const m = entry as Record<string, unknown>;
-        const provider = typeof m.provider === 'string' ? m.provider.trim() : '';
-        if (!provider) {
-            throw new Error(`invalid_magi_panel: member[${idx}].provider is required`);
-        }
-        const nodeId = typeof m.nodeId === 'string' && m.nodeId.trim() ? m.nodeId.trim() : undefined;
-        const model = typeof m.model === 'string' && m.model.trim() ? m.model.trim() : undefined;
-        const capabilityTags = normalizeCapabilityTags(m.capabilityTags);
-        const n = normalizeReplicaCount(m.n);
-        return {
-            provider,
-            ...(nodeId ? { nodeId } : {}),
-            ...(model ? { model } : {}),
-            ...(capabilityTags ? { capabilityTags } : {}),
-            ...(n !== undefined ? { n } : {}),
-        };
-    });
-    const description = typeof raw.description === 'string' && raw.description.trim()
-        ? raw.description.trim().slice(0, 200)
-        : undefined;
-    const defaultN = normalizeReplicaCount(raw.defaultN);
-    const defaultKind = normalizeMagiPanelDefaultKind(raw.defaultKind);
-    return {
-        ...(description ? { description } : {}),
-        members,
-        ...(defaultN !== undefined ? { defaultN } : {}),
-        ...(defaultKind !== undefined ? { defaultKind } : {}),
-        // dedupExempt is always meaningful for a MAGI panel (intentional same-prompt
-        // fan-out). Persist it true unless the caller explicitly disables it.
-        dedupExempt: raw.dedupExempt === false ? false : true,
-    };
-}
-
-function normalizePanelName(name: unknown): string {
-    const trimmed = typeof name === 'string' ? name.trim() : '';
-    if (!trimmed) throw new Error('invalid_magi_panel: panel name is required');
-    return trimmed.slice(0, 100);
-}
-
-/** All configured MAGI panels (machine-local), keyed by name. Empty when none. */
-export function listMagiPanels(): Record<string, MagiPanel> {
-    return loadMeshConfig().magiPanels ?? {};
-}
-
-/** A single panel by name, or undefined when not configured. */
-export function getMagiPanel(name: string): MagiPanel | undefined {
-    const key = typeof name === 'string' ? name.trim() : '';
-    if (!key) return undefined;
-    return loadMeshConfig().magiPanels?.[key];
-}
-
-/**
- * Upsert a named panel into meshes.json. Defaults to refusing to clobber an
- * existing panel (overwrite=false) — mirrors the mesh_init write/overwrite
- * precedent. Returns the normalized, persisted panel.
- */
-export function upsertMagiPanel(
-    name: string,
-    config: unknown,
-    opts: { overwrite?: boolean } = {},
-): MagiPanel {
-    const key = normalizePanelName(name);
-    const panel = normalizeMagiPanel(config);
-    const stored = loadMeshConfig();
-    const panels = stored.magiPanels ?? {};
-    if (panels[key] && opts.overwrite !== true) {
-        throw new Error(`magi_panel_exists: panel '${key}' already exists — pass overwrite=true to replace it`);
-    }
-    panels[key] = panel;
-    stored.magiPanels = panels;
-    saveMeshConfig(stored);
-    return panel;
-}
-
-/** Remove a named panel. Returns true when a panel was removed. */
-export function removeMagiPanel(name: string): boolean {
-    const key = typeof name === 'string' ? name.trim() : '';
-    if (!key) return false;
-    const stored = loadMeshConfig();
-    if (!stored.magiPanels || !stored.magiPanels[key]) return false;
-    delete stored.magiPanels[key];
-    saveMeshConfig(stored);
-    return true;
-}
-
 // ─── MAGI kind → panel bindings (MAGI-KIND-PANEL) ─────────
 //
 // Per-task_kind slot lists (machine-local, meshes.json `magiKindPanels`). A bare
@@ -788,11 +658,10 @@ function normalizeMagiTaskKindKey(raw: unknown): MagiTaskKind {
 }
 
 /**
- * Validate + normalize a kind-panel's slots. Mirrors normalizeMagiPanel's member
- * normalization: provider required per slot, trims strings, drops empties, clamps
- * replica counts, and additionally carries an optional per-slot `model`. Throws on
- * structurally invalid input (empty list / no provider) so the write returns a clear
- * error. Returns the normalized slot array.
+ * Validate + normalize a kind-panel's slots (the SOLE MAGI slot normalizer): provider
+ * required per slot, trims strings, drops empties, clamps replica counts, and carries
+ * an optional per-slot `model`. Throws on structurally invalid input (empty list / no
+ * provider) so the write returns a clear error. Returns the normalized slot array.
  */
 export function normalizeMagiSlots(slots: unknown): MagiSlot[] {
     if (!Array.isArray(slots) || slots.length === 0) {