@adhdev/daemon-core 0.9.82-rc.481 → 0.9.82-rc.482

package/src/index.ts

@@ -195,7 +195,6 @@ export type { SavedProviderSessionEntry } from './config/saved-sessions.js';
 export {
   listMeshes, getMesh, getMeshByRepo, createMesh, updateMesh, deleteMesh,
   addNode, removeNode, updateNode, normalizeRepoIdentity,
-  listMagiPanels, getMagiPanel, upsertMagiPanel, removeMagiPanel, normalizeMagiPanel,
   listMagiKindPanels, getMagiKindPanel, setMagiKindPanel, removeMagiKindPanel, normalizeMagiSlots,
 } from './config/mesh-config.js';
 export type { CreateMeshOptions, UpdateMeshOptions, AddNodeOptions } from './config/mesh-config.js';
@@ -203,7 +202,7 @@ export type { CreateMeshOptions, UpdateMeshOptions, AddNodeOptions } from './con
 // leaf so the mcp-server — which depends only on @adhdev/daemon-core — can consume
 // them without taking a direct @adhdev/mesh-shared dependency).
 export type {
-  MagiPanel, MagiPanelMember, MagiPanelMap, MagiMode, MagiTaskKind, MagiPanelDefaultKind,
+  MagiMode, MagiTaskKind,
   MagiSlot, MagiKindPanelMap,
   MagiClaim, MagiClaimStance, MagiAgentResponse,
   MagiResponseSource, MagiReplicaGitRef, MagiGitSkew, MagiSynthesizedResponse,

package/src/mesh/contracts.ts

@@ -368,25 +368,31 @@ const TERMINAL_TASK_EVENTS: ReadonlySet<string> = new Set([
 ]);
 
 /**
- * Infrastructure/system events that no coordinator should surface — ledger
- * consistency and dispatch-plane signals. Delivered to the daemon-level handler
- * only (scope 'system').
+ * Coordinator-addressed dispatch-plane alerts. `mesh:dispatch_blocked` is the
+ * Fix (1) actionable dispatch-skip notification: it exists precisely to page the
+ * ORIGINATING coordinator (it carries a why+how coordinatorMessage and is
+ * targetCoordinator*-addressed by its producer), so it routes unicast exactly
+ * like a terminal task event. B2a originally classed it 'system' — that made it
+ * a dead letter: no daemon-level system drain exists, so the blocker never
+ * reached any coordinator and the task sat silently undispatched.
  */
-const SYSTEM_EVENTS: ReadonlySet<string> = new Set([
+const COORDINATOR_ALERT_EVENTS: ReadonlySet<string> = new Set([
   'mesh:dispatch_blocked',
 ]);
 
 /**
  * Default the v2 scope for an event by its producer event name (design decision
- * §3). Terminal task events → unicast (routed to the originating coordinator).
- * Ledger-consistency / dispatch-plane events → system. Everything else — node
- * lifecycle and progress signals — → broadcast, which also matches v1's
- * implicit "deliver to any coordinator" behaviour, so an unstamped v1 event and
- * a v2-stamped-as-broadcast event route identically during rollout.
+ * §3). Terminal task events and coordinator-addressed alerts → unicast (routed
+ * to the originating coordinator). Everything else — node lifecycle and
+ * progress signals — → broadcast, which also matches v1's implicit "deliver to
+ * any coordinator" behaviour, so an unstamped v1 event and a v2-stamped-as-
+ * broadcast event route identically during rollout. No event currently defaults
+ * to 'system'; the scope remains in MESH_EVENT_SCOPES for wire compatibility
+ * (an already-queued or version-skewed 'system' event still routes away from
+ * coordinators).
  */
 export function defaultScopeForEvent(eventName: string): MeshEventScope {
-  if (SYSTEM_EVENTS.has(eventName)) return 'system';
-  if (TERMINAL_TASK_EVENTS.has(eventName)) return 'unicast';
+  if (TERMINAL_TASK_EVENTS.has(eventName) || COORDINATOR_ALERT_EVENTS.has(eventName)) return 'unicast';
   return 'broadcast';
 }
 

package/src/mesh/coordinator-prompt.ts

@@ -649,9 +649,7 @@ const TOOLS_SECTION = `## Available Tools
 | \`mesh_write_mesh_json_config\` | Gated write of \`.adhdev/mesh.json\` (repo coordinator-prompt config) from the mesh entry — dry-run/overwrite like mesh_init |
 | \`mesh_magi_review\` | Cross-verify a read-only investigation across a standing panel of independent mesh agents (different machines/providers) instead of a single worker |
 | \`mesh_magi_collect\` | Collect + synthesize a previously dispatched MAGI fan-out by its consensus group id (async companion to mesh_magi_review wait:false) |
-| \`mesh_magi_panel_set\` | Upsert a named MAGI panel (standing set of independent node×provider members) into machine-local config |
-| \`mesh_magi_panel_list\` | List configured MAGI panels and resolve each member's availability against the current mesh (read-only) |
-| \`mesh_magi_kind_panel_set\` | Bind a task_kind → MAGI kind-panel slots (machine-local, wholesale replacement — approve current-vs-new first) |
+| \`mesh_magi_kind_panel_set\` | Bind a task_kind → MAGI kind-panel slots (the SOLE MAGI panel-resolution surface; machine-local, wholesale replacement — approve current-vs-new first) |
 | \`mesh_magi_kind_panel_list\` | List configured task_kind → MAGI kind-panel slot bindings (machine-local, read-only) |`;
 
 const TOOL_EXPOSURE_PREFLIGHT_SECTION = `## Tool Exposure Preflight
@@ -694,7 +692,7 @@ When the user asks to **set up / configure / onboard** this repo for Repo Mesh (
 
 **Save scopes — label every draft with its scope before asking for approval:**
 - **repo-file (commit target)** — \`.adhdev/refine.json\`, \`.adhdev/worktree_bootstrap.json\`, \`.adhdev/change-impact.json\`, \`.adhdev/mesh.json\`. These are committed to the repository and shared with every machine/contributor.
-- **machine-local** — MAGI kind→panel bindings and named MAGI panels, node providerPriority (\`~/.adhdev/meshes.json\`). These stay on this machine and are NOT committed.
+- **machine-local** — MAGI kind→panel bindings, node providerPriority (\`~/.adhdev/meshes.json\`). These stay on this machine and are NOT committed.
 
 **Guided sequence:**
 1. **Scan (dry-run)** — Call \`mesh_init\` (write=false, the default). It returns per-domain suggested configs for refine / worktree_bootstrap / change-impact, a recommended providerPriority, AND \`currentConfig\` — the currently-saved config per domain (repo files + machine-local \`magiKindPanels\`). Nothing is written.
@@ -702,8 +700,7 @@ When the user asks to **set up / configure / onboard** this repo for Repo Mesh (
 3. **Approve → gated write** — Only after the user approves, call the matching gated-write tool:
    - repo \`.adhdev/*\` config files → \`mesh_init\` with \`write=true\` (and \`overwrite=true\` ONLY for domains the user approved replacing).
    - \`.adhdev/mesh.json\` (coordinator prompt / operating notes) → \`mesh_write_mesh_json_config\` (write=true, overwrite only if approved).
-   - machine-local MAGI kind→panel slots → \`mesh_magi_kind_panel_set\` (write=true). NOTE: a kind binding is a **wholesale replacement** of that kind's slot list — present the current-vs-new slots first.
-   - machine-local named MAGI panels → \`mesh_magi_panel_set\`. providerPriority → apply via node policy update.
+   - machine-local MAGI kind→panel slots → \`mesh_magi_kind_panel_set\` (write=true). NOTE: a kind binding is a **wholesale replacement** of that kind's slot list — present the current-vs-new slots first. providerPriority → apply via node policy update.
 
 **init vs reinit:**
 - **\`mesh_init\`** — for a fresh, never-onboarded repo. Existing config files are kept (existing-wins) unless the user explicitly approves overwrite. Use for first-time setup.

package/src/mesh/mesh-event-forwarding.ts

@@ -6,12 +6,12 @@ import { appendLedgerEntry, buildTaskCompletionEvidence, getSessionRecoveryConte
 import type { SessionRecoveryContext } from './mesh-ledger.js';
 import { updateSessionTaskStatus, enqueueTask, updateDirectDispatchStatus, cleanupTerminalDirectDispatches, getActiveDirectDispatches, hasPendingDependents, getQueue } from './mesh-work-queue.js';
 import { markSessionDeliveriesTerminal, updateSessionDeliveryStatus } from './mesh-delivery-policy.js';
-import { MeshRuntimeStore } from './mesh-runtime-store.js';
+import { MeshRuntimeStore, pruneMeshRuntimeRetention } from './mesh-runtime-store.js';
 import { queuePendingMeshCoordinatorEvent, drainPendingMeshCoordinatorEvents, prunePendingMeshCoordinatorEventsRetention, readV2EnvelopeFromWire, type PendingMeshCoordinatorEvent } from './mesh-events-pending.js';
 import type { ProviderInstance } from '../providers/provider-instance.js';
 import { resolveWorkerDelegateRouting, recordUnroutableDelegateEvent, isUnroutableDelegateRejection } from './mesh-routing.js';
 import { resolveMeshHostStatus } from './mesh-host-ownership.js';
-import { enqueueUnresolvedDelegateForward, peekUnresolvedDelegateForwards, ackUnresolvedDelegateForward } from './mesh-unresolved-forward-outbox.js';
+import { enqueueUnresolvedDelegateForward, nudgeUnresolvedForwardRetry } from './mesh-unresolved-forward-outbox.js';
 import { traceMeshEventStage, traceMeshEventDrop } from './mesh-event-trace.js';
 import { getLastDisplayMessage } from '../status/snapshot.js';
 import { resolveDelegatedWorkerAutoApprove } from '../repo-mesh-types.js';
@@ -189,13 +189,16 @@ function sweepExpiredRemoteIdleSessions(): void {
     try {
         MeshRuntimeStore.getInstance().pruneExpiredRemoteIdleSessions();
     } catch { /* best-effort */ }
-    // Piggyback the pending-event retention prune on the same periodic sweep, but
-    // hourly — this is the maintenance hook that keeps mesh_pending_events from
-    // accumulating stale drained/orphaned rows without bound.
+    // Piggyback the retention prunes on the same periodic sweep, but hourly — this
+    // is the maintenance hook that keeps mesh-runtime.db from accumulating stale
+    // rows without bound: mesh_pending_events (drained/orphaned rows) plus, on the
+    // SAME cadence (SoT 1-11 (b)), the event ledger / tool-call log / terminal
+    // queue retention in pruneMeshRuntimeRetention.
     const now = Date.now();
     if (now - lastPendingEventsPruneAt >= PENDING_EVENTS_PRUNE_INTERVAL_MS) {
         lastPendingEventsPruneAt = now;
         prunePendingMeshCoordinatorEventsRetention();
+        pruneMeshRuntimeRetention();
     }
 }
 
@@ -1591,43 +1594,6 @@ export function handleMeshForwardEvent(components: DaemonComponents, payload: Re
     });
 }
 
-// ---------------------------------------------------------------------------
-// Per-coordinator forward serialization (P2P send-backpressure relief).
-//
-// When several workers finish at once, each completion runs forwardUnresolvedDelegate
-// Event and fires its own `mesh_forward_event` push. Firing the whole burst
-// concurrently dumps it into the single per-peer P2P DataChannel buffer in one tick,
-// which starves the rpc_ack/rpc_res replies the same channel must carry — a
-// coordinator's inbound `git_status` then times out even though the worker's own
-// forward acks return in ~1s. To cap the concurrent burst we serialize the immediate
-// pushes per coordinator: at most one push is in flight to a given coordinator at a
-// time, the rest run in arrival order behind it. A lone event (idle lane) still
-// dispatches immediately — only a genuine burst is paced. Durability is unchanged:
-// every event is already persisted to the outbox before the push runs, so serializing
-// only delays the best-effort fast path; PHASE 0 retry still covers any gap. This pairs
-// with the DataChannel send-buffer gate in daemon-cloud's mesh manager (writeRequest),
-// which is the hard guarantee; this throttle keeps the burst from piling up there.
-interface CoordinatorForwardLane { tail: Promise<unknown>; depth: number; }
-const coordinatorForwardLanes = new Map<string, CoordinatorForwardLane>();
-function enqueueCoordinatorForwardPush(coordinatorDaemonId: string, run: () => Promise<unknown>): void {
-    let lane = coordinatorForwardLanes.get(coordinatorDaemonId);
-    if (!lane) { lane = { tail: Promise.resolve(), depth: 0 }; coordinatorForwardLanes.set(coordinatorDaemonId, lane); }
-    const wasIdle = lane.depth === 0;
-    lane.depth += 1;
-    const dec = (): void => { lane!.depth -= 1; };
-    if (wasIdle) {
-        // Idle lane → dispatch synchronously, so a lone completion (the common case) has
-        // ZERO added latency and the push call happens in-line. Only a genuine burst —
-        // events arriving while a push is still in flight — is paced (else branch).
-        lane.tail = Promise.resolve(run()).catch(() => {}).then(dec, dec);
-    } else {
-        // Burst: queue behind the in-flight push(es) in arrival order so the whole burst
-        // is not dumped into the shared DataChannel buffer at once. The tail is guarded
-        // so one rejecting push never wedges the lane for the next.
-        lane.tail = lane.tail.then(() => run()).catch(() => {}).then(dec, dec);
-    }
-}
-
 // ---------------------------------------------------------------------------
 // Worker-side fallback forward for unresolved-mesh delegates.
 //
@@ -1641,8 +1607,9 @@ function enqueueCoordinatorForwardPush(coordinatorDaemonId: string, run: () => P
 // the worker's queue — which it can't, because the worker never queued an unroutable
 // event. Live symptom: `WARN [MeshEvents] delivery_unroutable: ... mesh unresolved`.
 //
-// The fix: the routing object still carries coordinatorDaemonId. Forward the raw event
-// straight to that coordinator daemon over P2P (mesh_forward_event). The coordinator
+// The fix: the routing object still carries coordinatorDaemonId. Persist the raw event
+// to the durable worker-side outbox addressed to that coordinator daemon; the reconcile
+// loop's PHASE 0 delivers it (mesh_forward_event, acked, retry-capped). The coordinator
 // hosts the mesh, so it recovers the mesh id by workspace in handleMeshForwardEvent and
 // injects/queues it normally. meshId is intentionally omitted from the payload (the
 // worker has none); workspace is the routing anchor the coordinator resolves from.
@@ -1656,14 +1623,17 @@ function enqueueCoordinatorForwardPush(coordinatorDaemonId: string, run: () => P
 //
 // Returns true when the event was durably accepted for delivery to the coordinator
 // daemon (so the caller skips the delivery_unroutable diagnostic); false when no
-// fallback was possible (no coordinator anchor / no dispatch transport).
+// fallback was possible (no coordinator anchor / no dispatch transport) OR the durable
+// enqueue itself failed — the delivery_unroutable diagnostic is thereby narrowed to
+// "could not even persist to the queue" (a real potential loss), per the polling-
+// single-model design (docs/refactoring/2026-06-16-mesh-completion-polling-single-model.md §2.1/§2.6).
 //
-// Durability: the directed push to the coordinator is the ONLY delivery route for an
-// unresolved-mesh worker (it is in no mesh.node the coordinator can pull). So instead
-// of a fire-and-forget push that drops on one transient P2P failure, the event is
-// persisted to the worker-side outbox FIRST and only acked after a successful push.
-// A best-effort immediate push keeps latency low on the happy path; a failed or
-// un-acked push leaves the durable row for setupMeshReconcileLoop's PHASE 0 to retry.
+// Single delivery path (polling single-model): the spontaneous best-effort immediate
+// push that used to run here was REMOVED. Every unresolved-delegate event is persisted
+// to the outbox and delivered ONLY by setupMeshReconcileLoop's PHASE 0 retry (acked;
+// a failed push leaves the row queued). For happy-path latency the enqueue emits a
+// data-free reconcile NUDGE (nudgeUnresolvedForwardRetry) asking the loop to run the
+// retry soon; a lost nudge costs at most one reconcile interval, never the event.
 function forwardUnresolvedDelegateEvent(
     components: DaemonComponents,
     routing: ReturnType<typeof resolveWorkerDelegateRouting>,
@@ -1718,10 +1688,11 @@ function forwardUnresolvedDelegateEvent(
         return true;
     }
 
-    // 1) Persist durably FIRST. Idempotent on fingerprint, so a re-fired completion
-    //    does not duplicate the outbox row. If persistence fails we still attempt the
-    //    push below (degrades to the old at-most-once behaviour rather than dropping
-    //    the chance entirely).
+    // Persist durably. Idempotent on fingerprint, so a re-fired completion does not
+    // duplicate the outbox row. The outbox is the ONLY delivery route now (no
+    // spontaneous push), so a hard persistence failure means the event has nowhere to
+    // live — return false so the caller records the delivery_unroutable diagnostic,
+    // which is thereby narrowed to exactly this "could not even enqueue" real-loss case.
     const persisted = enqueueUnresolvedDelegateForward(coordinatorDaemonId, eventName, payload);
     // EVTTRACE: unresolved-mesh worker persisted its completion to the outbox (no meshId
     // available locally; coordinator will recover it on receive).
@@ -1731,56 +1702,21 @@ function forwardUnresolvedDelegateEvent(
         nodeId: readNonEmptyString(routing.nodeId) || readNonEmptyString(event.meshNodeId),
         event: eventName,
     };
-    traceMeshEventStage('outbox_enqueue', fwdTraceCtx, `coordinatorDaemon=${coordinatorDaemonId} meshId=absent`);
-
-    // 2) Best-effort immediate push for low latency. On success, ack the outbox row so
-    //    the retry loop won't re-send it. On failure, leave it queued — PHASE 0 retries.
-    traceMeshEventStage('forward_send', fwdTraceCtx, 'immediate push');
-    // Serialize per coordinator so a multi-worker completion burst is paced rather than
-    // dumped concurrently into the shared P2P DataChannel buffer (see coordinator
-    // ForwardLanes). dispatchMeshCommand was null-checked above; capture it for the
-    // deferred closure.
-    const dispatchMeshCommand = components.dispatchMeshCommand;
-    enqueueCoordinatorForwardPush(coordinatorDaemonId, () =>
-        Promise.resolve(dispatchMeshCommand(coordinatorDaemonId, 'mesh_forward_event', payload))
-            .then((result: any) => {
-                if (result && result.success === false) {
-                    LOG.warn('MeshEvents', `Immediate forward of ${eventName} to coordinator ${coordinatorDaemonId} rejected (${readNonEmptyString(result.error) || 'no reason'}) — left queued for retry`);
-                    traceMeshEventDrop('immediate_forward_rejected', fwdTraceCtx, readNonEmptyString(result.error) || 'no reason');
-                    return;
-                }
-                // Acked. Mark the durable copy delivered so the retry loop skips it.
-                if (persisted) ackUnresolvedDelegateForwardByFingerprint(coordinatorDaemonId, eventName, payload);
-            })
-            .catch((e: any) => {
-                // Coordinator momentarily unreachable; the durable row stays queued and the
-                // reconcile loop retries it. Trace so the relay attempt is visible.
-                LOG.warn('MeshEvents', `Immediate forward of ${eventName} to coordinator ${coordinatorDaemonId} failed: ${e?.message || e} — left queued for retry`);
-            }));
-    LOG.info('MeshEvents', `Durably forwarded ${eventName} for unresolved-mesh worker at ${routing.workspace || '(no workspace)'} to coordinator daemon ${coordinatorDaemonId}`);
+    if (!persisted) {
+        traceMeshEventDrop('outbox_enqueue_failed', fwdTraceCtx, `coordinatorDaemon=${coordinatorDaemonId}`);
+        return false;
+    }
+    traceMeshEventStage('outbox_enqueue', fwdTraceCtx, `coordinatorDaemon=${coordinatorDaemonId} meshId=${readNonEmptyString(payload.meshId) || 'absent'}`);
+
+    // Data-free reconcile nudge (polling single-model §2.1 (B)): ask the reconcile
+    // loop to run its PHASE 0 outbox retry soon instead of pushing the payload here.
+    // Delivery itself stays on the single acked PHASE 0 path; losing the nudge costs
+    // at most one reconcile interval of latency, never the event.
+    nudgeUnresolvedForwardRetry();
+    LOG.info('MeshEvents', `Durably queued ${eventName} for unresolved-mesh worker at ${routing.workspace || '(no workspace)'} to coordinator daemon ${coordinatorDaemonId} (reconcile PHASE 0 delivers)`);
     return true;
 }
 
-// Ack a just-pushed outbox entry by re-deriving its row from the same coordinator +
-// event + payload. We don't thread the row id back from enqueue (the immediate push is
-// fire-then-ack), so locate it among the undrained entries by matching coordinator and
-// the flat payload's forward identity. A miss is harmless — the retry loop's own
-// receiver-side dedup suppresses a duplicate delivery.
-function ackUnresolvedDelegateForwardByFingerprint(
-    coordinatorDaemonId: string,
-    eventName: string,
-    payload: Record<string, unknown>,
-): void {
-    const match = peekUnresolvedDelegateForwards().find(entry =>
-        daemonIdsEquivalent(entry.coordinatorDaemonId, coordinatorDaemonId)
-        && readNonEmptyString(entry.payload.event) === eventName
-        && readNonEmptyString(entry.payload.targetSessionId || entry.payload.sessionId || entry.payload.instanceId)
-            === readNonEmptyString(payload.targetSessionId || payload.sessionId || payload.instanceId)
-        && readNonEmptyString(entry.payload.workspace) === readNonEmptyString(payload.workspace),
-    );
-    if (match) ackUnresolvedDelegateForward(match.id);
-}
-
 /**
  * NOTIF-HELD-DRAIN (Fix 2): event-driven coordinator drain. The reconcile loop delivers a
  * worker's queued completion to an IDLE local coordinator only on its periodic poll. When a

package/src/mesh/mesh-reconcile-loop.ts

@@ -54,10 +54,11 @@ import {
     peekUnresolvedDelegateForwards,
     ackUnresolvedDelegateForward,
     expireStaleUnresolvedDelegateForwards,
+    registerUnresolvedForwardRetryNudge,
 } from './mesh-unresolved-forward-outbox.js';
 import { readNonEmptyString, readMeshCompletionSummary, buildMeshSystemMessage } from './mesh-events-utils.js';
 import { traceMeshEventStage, traceMeshEventDrop } from './mesh-event-trace.js';
-import { expandDaemonIdForms, daemonIdsEquivalent, sessionIdsEquivalent } from '@adhdev/mesh-shared';
+import { expandDaemonIdForms, daemonIdsEquivalent, sessionIdsEquivalent, meshNodeIdMatches } from '@adhdev/mesh-shared';
 import { getQueue, reclaimStrandedAssignedTask, updateTaskStatus } from './mesh-work-queue.js';
 import { resolveSessionBusyVerdict } from './mesh-queue-assignment.js';
 import { readLedgerEntries } from './mesh-ledger.js';
@@ -841,6 +842,107 @@ function recoverStrandedAssignedDispatches(components: DaemonComponents, meshId:
     }
 }
 
+// ── PHASE 2.6: assigned-zombie sweep (runtime-store GC, SoT 1-11 (a)) ─────────
+// recoverStrandedAssignedDispatches (PHASE 2.5) can only age a row by its
+// dispatchTimestamp — a row that never got one (a legacy claim, a crashed claim
+// path, a row whose payload drifted) is invisible to it FOREVER: it contributes 0
+// pending (PHASE 3 skips), holds the node-busy gate (hasActiveNodeAssignment), and
+// nothing ever transitions it. This sweep is that missing terminal net, scoped
+// PRECISELY to the rows PHASE 2.5 can never touch (no parseable dispatchTimestamp)
+// so the two nets never race each other over the same row.
+//
+// Conservative by construction:
+//   - age-gated on updatedAt/createdAt (>= ZOMBIE_ASSIGNED_MIN_AGE_MS) so a freshly
+//     claimed row mid-launch is never touched;
+//   - terminal ledger evidence wins first (row flips to the evidenced terminal,
+//     mirroring PHASE 2.5's terminal branch);
+//   - only fails a row whose assigned session is POSITIVELY absent on the daemon
+//     that owns the assigned node — a locally-present session (idle or generating)
+//     is skipped, and a REMOTE node's session (not locally observable) is skipped
+//     entirely rather than guessed dead;
+//   - the failure reason is explicit in both the queue mutation trace and a
+//     task_failed ledger entry, so the transition is auditable, never silent.
+const ZOMBIE_ASSIGNED_MIN_AGE_MS = 30 * 60 * 1000; // 30 min — generous vs. session launch/restart races
+
+export function reconcileZombieAssignedTasks(
+    components: DaemonComponents,
+    mesh: { id: string; nodes?: unknown[] },
+    selfIds: string[],
+): void {
+    const meshId = mesh.id;
+    const assigned = getQueue(meshId, { status: ['assigned'] });
+    if (!assigned.length) return;
+    const nowMs = Date.now();
+
+    // True when THIS daemon is authoritative for the row's assigned node — the only
+    // case where "no local instance" positively means "session no longer exists".
+    // Accepts a daemon-id form match against selfIds, or a mesh-node whose daemonId
+    // resolves to this daemon. Absent assignedNodeId → local (nothing remote to defer to).
+    const assignedNodeIsLocal = (assignedNodeId?: string): boolean => {
+        if (!assignedNodeId) return true;
+        if (selfIds.some(id => daemonIdsEquivalent(id, assignedNodeId))) return true;
+        const nodes = Array.isArray(mesh.nodes) ? mesh.nodes : [];
+        const node = nodes.find(n => meshNodeIdMatches(n as never, assignedNodeId)) as { daemonId?: unknown } | undefined;
+        const nodeDaemonId = readNonEmptyString(node?.daemonId);
+        return !!nodeDaemonId && selfIds.some(id => daemonIdsEquivalent(id, nodeDaemonId));
+    };
+
+    for (const row of assigned) {
+        // Rows WITH a parseable dispatchTimestamp belong to PHASE 2.5 — never double-handle.
+        if (Number.isFinite(Date.parse(row.dispatchTimestamp ?? ''))) continue;
+        const updatedMs = Date.parse(row.updatedAt ?? '');
+        const createdMs = Date.parse(row.createdAt ?? '');
+        const anchorMs = Number.isFinite(updatedMs) ? updatedMs : createdMs;
+        if (!Number.isFinite(anchorMs)) continue;              // cannot age it → leave untouched
+        if (nowMs - anchorMs < ZOMBIE_ASSIGNED_MIN_AGE_MS) continue;
+
+        // A terminal already evidenced in the ledger → flip the row to that terminal
+        // (the completion arrived but the queue flip was lost), same as PHASE 2.5.
+        const terminal = findTerminalLedgerEvidenceForTask({ meshId, taskId: row.id });
+        if (terminal) {
+            const status = terminal.kind === 'task_completed' ? 'completed' : 'failed';
+            updateTaskStatus(meshId, row.id, status);
+            LOG.warn('MeshReconcile', `Zombie assigned task ${row.id} on mesh ${meshId} had ${terminal.kind} ledger evidence — flipped to ${status}`);
+            continue;
+        }
+
+        if (!assignedNodeIsLocal(row.assignedNodeId)) continue; // remote session not locally observable — never guess
+        if (row.assignedSessionId) {
+            const verdict = resolveSessionBusyVerdict(components, row.assignedSessionId);
+            if (verdict !== 'UNKNOWN') continue; // session exists locally (idle or busy) → not a zombie
+        }
+
+        const reason = row.assignedSessionId
+            ? 'assigned_zombie_session_missing'
+            : 'assigned_zombie_no_session_bound';
+        const failed = updateTaskStatus(meshId, row.id, 'failed');
+        if (!failed) continue;
+        try {
+            appendLedgerEntry(meshId, {
+                kind: 'task_failed',
+                nodeId: row.assignedNodeId,
+                sessionId: row.assignedSessionId,
+                payload: {
+                    taskId: row.id,
+                    reason,
+                    source: 'reconcile_zombie_assigned_sweep',
+                    ageMs: nowMs - anchorMs,
+                },
+            });
+        } catch { /* ledger write is best-effort */ }
+        LOG.warn('MeshReconcile', `Failed zombie assigned task ${row.id} on mesh ${meshId} `
+            + `(node=${row.assignedNodeId ?? '?'} session=${row.assignedSessionId ?? '?'}, no dispatchTimestamp, `
+            + `stale ${Math.round((nowMs - anchorMs) / 60000)}m, ${reason})`);
+        traceMeshEventDrop('assigned_zombie_failed', {
+            taskId: row.id,
+            sessionId: row.assignedSessionId,
+            nodeId: row.assignedNodeId,
+            meshId,
+            event: 'agent:generating_completed',
+        }, `${reason} stale=${Math.round((nowMs - anchorMs) / 60000)}m`);
+    }
+}
+
 export async function runMeshReconcileTick(components: DaemonComponents): Promise<void> {
     const localDaemonId = readNonEmptyString(loadConfig().machineId) || undefined;
     // The id-set used to scope the local queue drain (status id + machineId). See
@@ -857,7 +959,11 @@ export async function runMeshReconcileTick(components: DaemonComponents): Promis
     // coordinator's mesh cannot be reached by the coordinator's PHASE 1 pull (it is
     // in no mesh.node), so its completion must be PUSHED to the coordinator. This
     // drains the durable outbox enqueued by forwardUnresolvedDelegateEvent and retries
-    // any push that has not yet been acked. See mesh-unresolved-forward-outbox.ts.
+    // any push that has not yet been acked. Since the spontaneous immediate push was
+    // removed (polling single-model §2.1), this PHASE 0 retry is the ONLY delivery
+    // path for unresolved-delegate events; the enqueue site nudges an early run of it
+    // (scheduleUnresolvedForwardNudge) so happy-path latency stays sub-interval.
+    // See mesh-unresolved-forward-outbox.ts.
     if (dispatchMeshCommand) {
         try {
             await retryUnresolvedDelegateForwards(components);
@@ -897,6 +1003,13 @@ export async function runMeshReconcileTick(components: DaemonComponents): Promis
             } catch (e: any) {
                 LOG.warn('MeshReconcile', `Assigned-stranded watchdog failed for mesh ${mesh.id}: ${e?.message || e}`);
             }
+            // PHASE 2.6 — assigned-zombie sweep: terminal-fails the rows PHASE 2.5
+            // can never age (no dispatchTimestamp) whose session is positively gone.
+            try {
+                reconcileZombieAssignedTasks(components, mesh, selfIds);
+            } catch (e: any) {
+                LOG.warn('MeshReconcile', `Assigned-zombie sweep failed for mesh ${mesh.id}: ${e?.message || e}`);
+            }
         }
     }
 
@@ -1328,6 +1441,42 @@ export function __resetUnresolvedForwardRejectionCountsForTests(): void {
     unresolvedForwardRejectionCounts.clear();
 }
 
+// ── Unresolved-forward reconcile nudge (polling single-model §2.1 (B)) ────────
+// forwardUnresolvedDelegateEvent no longer pushes the event itself — it only
+// persists to the durable outbox and fires a data-free nudge asking THIS loop to
+// run the PHASE 0 retry soon. The nudge is:
+//   - coalesced: one pending timer at a time, so a completion burst schedules a
+//     single early retry pass instead of one per event;
+//   - non-overlapping: skipped while a nudged pass is still in flight (the
+//     periodic tick remains the backstop);
+//   - loss-tolerant: an unregistered/cleared/failed nudge merely means delivery
+//     waits for the next periodic tick (≤ one reconcile interval) — never a loss.
+const UNRESOLVED_FORWARD_NUDGE_DELAY_MS = 250;
+let unresolvedForwardNudgeTimer: NodeJS.Timeout | undefined;
+let unresolvedForwardNudgeRunning = false;
+
+function scheduleUnresolvedForwardNudge(components: DaemonComponents): void {
+    if (!components.dispatchMeshCommand) return; // no transport → periodic tick handles/no-ops
+    if (unresolvedForwardNudgeTimer) return;     // coalesce a burst into one early pass
+    unresolvedForwardNudgeTimer = setTimeout(() => {
+        unresolvedForwardNudgeTimer = undefined;
+        if (unresolvedForwardNudgeRunning) return; // an earlier pass is in flight — tick covers
+        unresolvedForwardNudgeRunning = true;
+        void retryUnresolvedDelegateForwards(components)
+            .catch((e: any) => LOG.warn('MeshReconcile', `Nudged unresolved-forward retry failed: ${e?.message || e}`))
+            .finally(() => { unresolvedForwardNudgeRunning = false; });
+    }, UNRESOLVED_FORWARD_NUDGE_DELAY_MS);
+    // Never keep the process alive solely for a pending nudge.
+    if (typeof unresolvedForwardNudgeTimer.unref === 'function') unresolvedForwardNudgeTimer.unref();
+}
+
+function clearUnresolvedForwardNudge(): void {
+    if (unresolvedForwardNudgeTimer) {
+        clearTimeout(unresolvedForwardNudgeTimer);
+        unresolvedForwardNudgeTimer = undefined;
+    }
+}
+
 async function retryUnresolvedDelegateForwards(components: DaemonComponents): Promise<void> {
     const dispatchMeshCommand = components.dispatchMeshCommand;
     if (!dispatchMeshCommand) return;
@@ -1463,10 +1612,16 @@ export function setupMeshReconcileLoop(components: DaemonComponents): ReconcileL
     }, intervalMs);
     // Don't keep the process alive solely for this timer.
     if (typeof timer.unref === 'function') timer.unref();
+    // Register the unresolved-forward nudge handler: the enqueue site
+    // (forwardUnresolvedDelegateEvent) fires it after persisting an outbox row so
+    // the PHASE 0 retry runs early instead of waiting for the next periodic tick.
+    registerUnresolvedForwardRetryNudge(() => scheduleUnresolvedForwardNudge(components));
     LOG.info('MeshReconcile', `Mesh reconcile loop started (interval ${intervalMs}ms)`);
     return {
         stop() {
             clearInterval(timer);
+            registerUnresolvedForwardRetryNudge(undefined);
+            clearUnresolvedForwardNudge();
             LOG.info('MeshReconcile', 'Mesh reconcile loop stopped');
         },
     };

package/src/mesh/mesh-runtime-store.ts

@@ -1557,10 +1557,82 @@ export class MeshRuntimeStore {
 
     /**
      * Prune tool call log entries older than the given age in ms.
-     * Exposed for testing.
+     * Returns the number of rows deleted. Also used by the periodic retention
+     * sweep (pruneMeshRuntimeRetention) — the in-write sweep in recordMeshToolCall
+     * only fires every 200 calls and only covers the rate-limit window, so a
+     * quiet mesh otherwise accumulates rows indefinitely.
      */
-    pruneToolCallLog(olderThanMs: number): void {
-        this.db.prepare('DELETE FROM mesh_tool_call_log WHERE called_at < ?').run(Date.now() - olderThanMs);
+    pruneToolCallLog(olderThanMs: number): number {
+        return this.db.prepare('DELETE FROM mesh_tool_call_log WHERE called_at < ?').run(Date.now() - olderThanMs).changes;
+    }
+
+    /**
+     * Retention prune for mesh_event_ledger (SoT 1-11 (b)). The ledger is append-only
+     * with NO lifecycle GC of its own, so lifecycle events accumulate without bound
+     * (the dominant mesh-runtime.db growth). Every production reader is bounded to a
+     * recent window (readLedgerEntries tail/limit ≤ a few hundred; task-stats /
+     * terminal-evidence scans look at recent tasks), so rows past a generous age only
+     * cost space. Excluded from deletion — retained forever:
+     *   - coordinator_operating_note / _tombstone: runtime-accumulated lessons whose
+     *     whole point is surviving restarts; a tombstone must also outlive the notes
+     *     it retracts.
+     * Timestamps are ISO-8601 TEXT, so the lexicographic `<` cutoff is a correct time
+     * comparison; a malformed timestamp compares greater than any ISO date and is
+     * conservatively retained. Returns rows deleted.
+     */
+    pruneEventLedger(olderThanMs: number): number {
+        const cutoffIso = new Date(Date.now() - Math.max(0, olderThanMs)).toISOString();
+        return this.db.prepare(
+            `DELETE FROM mesh_event_ledger
+             WHERE timestamp < ?
+               AND kind NOT IN ('coordinator_operating_note', 'coordinator_operating_note_tombstone')`
+        ).run(cutoffIso).changes;
+    }
+
+    /**
+     * Retention prune for TERMINAL (completed/cancelled/failed) mesh_queue rows
+     * (SoT 1-11 (b)). Terminal rows are kept as recent history (mesh_task_history,
+     * completion-dedup taskId lookups) but nothing ever deletes them, so the queue
+     * table grows monotonically. Rows past the retention window serve no reader —
+     * every dedup/attribution path operates on recent tasks — EXCEPT as a dependency
+     * anchor: taskDependenciesSatisfied resolves dependsOn by id and treats a MISSING
+     * row as not-completed, so deleting a completed row that a still-live
+     * (pending/assigned) row depends on would permanently strand the dependent.
+     * Those ids are collected first and excluded. Returns rows deleted.
+     */
+    pruneTerminalQueueEntries(olderThanMs: number): number {
+        const cutoffIso = new Date(Date.now() - Math.max(0, olderThanMs)).toISOString();
+        return this.transaction(() => {
+            // Dependency guard: protect every id a live row still depends on.
+            const liveRows = this.db.prepare(
+                `SELECT payload FROM mesh_queue WHERE status IN ('pending', 'assigned')`
+            ).all() as Array<{ payload: string }>;
+            const protectedIds = new Set<string>();
+            for (const row of liveRows) {
+                try {
+                    const entry = JSON.parse(row.payload) as MeshWorkQueueEntry;
+                    if (Array.isArray(entry.dependsOn)) {
+                        for (const dep of entry.dependsOn) {
+                            if (typeof dep === 'string' && dep) protectedIds.add(dep);
+                        }
+                    }
+                } catch { /* unparsable payload → nothing to protect */ }
+            }
+            const candidates = this.db.prepare(
+                `SELECT id FROM mesh_queue
+                 WHERE status IN ('completed', 'cancelled', 'failed') AND updated_at < ?`
+            ).all(cutoffIso) as Array<{ id: string }>;
+            const deletable = candidates.map(r => r.id).filter(id => !protectedIds.has(id));
+            let removed = 0;
+            // Chunk the DELETE to stay well under SQLite's bind-parameter limit.
+            for (let i = 0; i < deletable.length; i += 500) {
+                const chunk = deletable.slice(i, i + 500);
+                removed += this.db.prepare(
+                    `DELETE FROM mesh_queue WHERE id IN (${chunk.map(() => '?').join(',')})`
+                ).run(...chunk).changes;
+            }
+            return removed;
+        });
     }
 
     // ── G2: Event Ledger ────────────────────────────────────────────────────
@@ -2148,3 +2220,46 @@ export class MeshRuntimeStore {
         return removed;
     }
 }
+
+// ─── Mesh runtime retention windows (SoT 1-11 (b) / gap I-10) ────────────────
+// mesh-runtime.db had lifecycle GC only for mesh_pending_events (prunePendingEvents,
+// hourly via the mesh-event maintenance sweep) and fingerprints/tool-call windows;
+// mesh_event_ledger and terminal mesh_queue rows grew without bound. These windows
+// are deliberately CONSERVATIVE — every production reader operates on a recent
+// window far narrower than these, so the deletes trade only dead space:
+//   - Event ledger 30 days: readers are tail/limit-bounded (≤ a few hundred rows) or
+//     recent-task scoped; 30d comfortably exceeds any reconcile/stat/audit horizon.
+//     Operating notes are exempted inside pruneEventLedger (retained forever).
+//   - Tool-call log 14 days: it backs a seconds-scale rate-limit window; 14d keeps a
+//     generous debugging horizon at trivial cost.
+//   - Terminal queue rows 30 days: mesh_task_history / completion-dedup lookups are
+//     recent-task scoped; live dependsOn anchors are exempted inside
+//     pruneTerminalQueueEntries.
+// No VACUUM here by design: reclaiming file pages is not worth stalling the daemon's
+// single writer; freed pages are reused by future inserts.
+export const MESH_EVENT_LEDGER_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;   // 30 days
+export const MESH_TOOL_CALL_LOG_RETENTION_MS = 14 * 24 * 60 * 60 * 1000;  // 14 days
+export const MESH_TERMINAL_QUEUE_RETENTION_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+
+/**
+ * Periodic retention sweep for the mesh-runtime.db tables that previously had no
+ * lifecycle GC (event ledger, tool-call log, terminal queue rows). Runs on the SAME
+ * cadence as the pending-events retention prune (the hourly mesh-event maintenance
+ * sweep in mesh-event-forwarding.ts). Best-effort and idempotent: a store failure
+ * degrades to a no-op with one warn; an empty table costs three cheap DELETEs.
+ */
+export function pruneMeshRuntimeRetention(): { ledger: number; toolCalls: number; terminalQueue: number } {
+    try {
+        const store = MeshRuntimeStore.getInstance();
+        const ledger = store.pruneEventLedger(MESH_EVENT_LEDGER_RETENTION_MS);
+        const toolCalls = store.pruneToolCallLog(MESH_TOOL_CALL_LOG_RETENTION_MS);
+        const terminalQueue = store.pruneTerminalQueueEntries(MESH_TERMINAL_QUEUE_RETENTION_MS);
+        if (ledger + toolCalls + terminalQueue > 0) {
+            LOG.info('MeshRuntimeStore', `Retention prune removed ${ledger} ledger / ${toolCalls} tool-call / ${terminalQueue} terminal-queue row(s)`);
+        }
+        return { ledger, toolCalls, terminalQueue };
+    } catch (e: any) {
+        LOG.warn('MeshRuntimeStore', `Runtime retention prune failed: ${e?.message || e}`);
+        return { ledger: 0, toolCalls: 0, terminalQueue: 0 };
+    }
+}