@adhdev/daemon-core 0.9.82-rc.481 → 0.9.82-rc.483

package/src/mesh/mesh-events-pending.ts

@@ -14,6 +14,7 @@ import {
     coordinatorIdentityFromEmitFields,
     coordinatorIdentityKey,
     isMeshEventScope,
+    isTerminalTaskEvent,
     MESH_PROTOCOL_VERSION_V2,
     shouldDeliverPendingEventToCoordinator,
     type CoordinatorIdentity,
@@ -408,6 +409,25 @@ function routeV2EventsForDrainer(
         // Broadcast → any coordinator; system → daemon handler only (never a
         // coordinator). Delegates to the contract helper for those two scopes.
         if (validated.scope !== 'unicast') {
+            // Defense-in-depth (MAGI-REPLICA-COMPLETION-EVENT-LEAK): a TERMINAL task
+            // event that reached the queue as broadcast is an ownership leak — a
+            // completion/stop belongs to the coordinator that dispatched the task, so
+            // a sibling coordinator that never dispatched it must NOT act on it. The
+            // emit-side stamp now narrows unaddressed terminal events to unicast, but a
+            // legacy/version-skewed/other-path broadcast can still arrive here; filter
+            // it by dispatchedBy vs the drainer using the SAME daemon-form/session
+            // matching semantics as unicast (identityDeliversTo), so the true owner —
+            // possibly addressed under a different daemon-id form — still receives it.
+            if (validated.scope === 'broadcast' && isTerminalTaskEvent(validated.event)) {
+                if (identityDeliversTo(validated.dispatchedBy, drainer)) {
+                    ctx.batchSeen.add(eventId);
+                    bump('v2Delivered');
+                    kept.push(event);
+                } else {
+                    bump('v2RoutedAway');
+                }
+                continue;
+            }
             if (shouldDeliverPendingEventToCoordinator(validated, drainer)) {
                 ctx.batchSeen.add(eventId);
                 bump('v2Delivered');

package/src/mesh/mesh-reconcile-loop.ts

@@ -54,10 +54,11 @@ import {
     peekUnresolvedDelegateForwards,
     ackUnresolvedDelegateForward,
     expireStaleUnresolvedDelegateForwards,
+    registerUnresolvedForwardRetryNudge,
 } from './mesh-unresolved-forward-outbox.js';
 import { readNonEmptyString, readMeshCompletionSummary, buildMeshSystemMessage } from './mesh-events-utils.js';
 import { traceMeshEventStage, traceMeshEventDrop } from './mesh-event-trace.js';
-import { expandDaemonIdForms, daemonIdsEquivalent, sessionIdsEquivalent } from '@adhdev/mesh-shared';
+import { expandDaemonIdForms, daemonIdsEquivalent, sessionIdsEquivalent, meshNodeIdMatches } from '@adhdev/mesh-shared';
 import { getQueue, reclaimStrandedAssignedTask, updateTaskStatus } from './mesh-work-queue.js';
 import { resolveSessionBusyVerdict } from './mesh-queue-assignment.js';
 import { readLedgerEntries } from './mesh-ledger.js';
@@ -841,6 +842,107 @@ function recoverStrandedAssignedDispatches(components: DaemonComponents, meshId:
     }
 }
 
+// ── PHASE 2.6: assigned-zombie sweep (runtime-store GC, SoT 1-11 (a)) ─────────
+// recoverStrandedAssignedDispatches (PHASE 2.5) can only age a row by its
+// dispatchTimestamp — a row that never got one (a legacy claim, a crashed claim
+// path, a row whose payload drifted) is invisible to it FOREVER: it contributes 0
+// pending (PHASE 3 skips), holds the node-busy gate (hasActiveNodeAssignment), and
+// nothing ever transitions it. This sweep is that missing terminal net, scoped
+// PRECISELY to the rows PHASE 2.5 can never touch (no parseable dispatchTimestamp)
+// so the two nets never race each other over the same row.
+//
+// Conservative by construction:
+//   - age-gated on updatedAt/createdAt (>= ZOMBIE_ASSIGNED_MIN_AGE_MS) so a freshly
+//     claimed row mid-launch is never touched;
+//   - terminal ledger evidence wins first (row flips to the evidenced terminal,
+//     mirroring PHASE 2.5's terminal branch);
+//   - only fails a row whose assigned session is POSITIVELY absent on the daemon
+//     that owns the assigned node — a locally-present session (idle or generating)
+//     is skipped, and a REMOTE node's session (not locally observable) is skipped
+//     entirely rather than guessed dead;
+//   - the failure reason is explicit in both the queue mutation trace and a
+//     task_failed ledger entry, so the transition is auditable, never silent.
+const ZOMBIE_ASSIGNED_MIN_AGE_MS = 30 * 60 * 1000; // 30 min — generous vs. session launch/restart races
+
+export function reconcileZombieAssignedTasks(
+    components: DaemonComponents,
+    mesh: { id: string; nodes?: unknown[] },
+    selfIds: string[],
+): void {
+    const meshId = mesh.id;
+    const assigned = getQueue(meshId, { status: ['assigned'] });
+    if (!assigned.length) return;
+    const nowMs = Date.now();
+
+    // True when THIS daemon is authoritative for the row's assigned node — the only
+    // case where "no local instance" positively means "session no longer exists".
+    // Accepts a daemon-id form match against selfIds, or a mesh-node whose daemonId
+    // resolves to this daemon. Absent assignedNodeId → local (nothing remote to defer to).
+    const assignedNodeIsLocal = (assignedNodeId?: string): boolean => {
+        if (!assignedNodeId) return true;
+        if (selfIds.some(id => daemonIdsEquivalent(id, assignedNodeId))) return true;
+        const nodes = Array.isArray(mesh.nodes) ? mesh.nodes : [];
+        const node = nodes.find(n => meshNodeIdMatches(n as never, assignedNodeId)) as { daemonId?: unknown } | undefined;
+        const nodeDaemonId = readNonEmptyString(node?.daemonId);
+        return !!nodeDaemonId && selfIds.some(id => daemonIdsEquivalent(id, nodeDaemonId));
+    };
+
+    for (const row of assigned) {
+        // Rows WITH a parseable dispatchTimestamp belong to PHASE 2.5 — never double-handle.
+        if (Number.isFinite(Date.parse(row.dispatchTimestamp ?? ''))) continue;
+        const updatedMs = Date.parse(row.updatedAt ?? '');
+        const createdMs = Date.parse(row.createdAt ?? '');
+        const anchorMs = Number.isFinite(updatedMs) ? updatedMs : createdMs;
+        if (!Number.isFinite(anchorMs)) continue;              // cannot age it → leave untouched
+        if (nowMs - anchorMs < ZOMBIE_ASSIGNED_MIN_AGE_MS) continue;
+
+        // A terminal already evidenced in the ledger → flip the row to that terminal
+        // (the completion arrived but the queue flip was lost), same as PHASE 2.5.
+        const terminal = findTerminalLedgerEvidenceForTask({ meshId, taskId: row.id });
+        if (terminal) {
+            const status = terminal.kind === 'task_completed' ? 'completed' : 'failed';
+            updateTaskStatus(meshId, row.id, status);
+            LOG.warn('MeshReconcile', `Zombie assigned task ${row.id} on mesh ${meshId} had ${terminal.kind} ledger evidence — flipped to ${status}`);
+            continue;
+        }
+
+        if (!assignedNodeIsLocal(row.assignedNodeId)) continue; // remote session not locally observable — never guess
+        if (row.assignedSessionId) {
+            const verdict = resolveSessionBusyVerdict(components, row.assignedSessionId);
+            if (verdict !== 'UNKNOWN') continue; // session exists locally (idle or busy) → not a zombie
+        }
+
+        const reason = row.assignedSessionId
+            ? 'assigned_zombie_session_missing'
+            : 'assigned_zombie_no_session_bound';
+        const failed = updateTaskStatus(meshId, row.id, 'failed');
+        if (!failed) continue;
+        try {
+            appendLedgerEntry(meshId, {
+                kind: 'task_failed',
+                nodeId: row.assignedNodeId,
+                sessionId: row.assignedSessionId,
+                payload: {
+                    taskId: row.id,
+                    reason,
+                    source: 'reconcile_zombie_assigned_sweep',
+                    ageMs: nowMs - anchorMs,
+                },
+            });
+        } catch { /* ledger write is best-effort */ }
+        LOG.warn('MeshReconcile', `Failed zombie assigned task ${row.id} on mesh ${meshId} `
+            + `(node=${row.assignedNodeId ?? '?'} session=${row.assignedSessionId ?? '?'}, no dispatchTimestamp, `
+            + `stale ${Math.round((nowMs - anchorMs) / 60000)}m, ${reason})`);
+        traceMeshEventDrop('assigned_zombie_failed', {
+            taskId: row.id,
+            sessionId: row.assignedSessionId,
+            nodeId: row.assignedNodeId,
+            meshId,
+            event: 'agent:generating_completed',
+        }, `${reason} stale=${Math.round((nowMs - anchorMs) / 60000)}m`);
+    }
+}
+
 export async function runMeshReconcileTick(components: DaemonComponents): Promise<void> {
     const localDaemonId = readNonEmptyString(loadConfig().machineId) || undefined;
     // The id-set used to scope the local queue drain (status id + machineId). See
@@ -857,7 +959,11 @@ export async function runMeshReconcileTick(components: DaemonComponents): Promis
     // coordinator's mesh cannot be reached by the coordinator's PHASE 1 pull (it is
     // in no mesh.node), so its completion must be PUSHED to the coordinator. This
     // drains the durable outbox enqueued by forwardUnresolvedDelegateEvent and retries
-    // any push that has not yet been acked. See mesh-unresolved-forward-outbox.ts.
+    // any push that has not yet been acked. Since the spontaneous immediate push was
+    // removed (polling single-model §2.1), this PHASE 0 retry is the ONLY delivery
+    // path for unresolved-delegate events; the enqueue site nudges an early run of it
+    // (scheduleUnresolvedForwardNudge) so happy-path latency stays sub-interval.
+    // See mesh-unresolved-forward-outbox.ts.
     if (dispatchMeshCommand) {
         try {
             await retryUnresolvedDelegateForwards(components);
@@ -897,6 +1003,13 @@ export async function runMeshReconcileTick(components: DaemonComponents): Promis
             } catch (e: any) {
                 LOG.warn('MeshReconcile', `Assigned-stranded watchdog failed for mesh ${mesh.id}: ${e?.message || e}`);
             }
+            // PHASE 2.6 — assigned-zombie sweep: terminal-fails the rows PHASE 2.5
+            // can never age (no dispatchTimestamp) whose session is positively gone.
+            try {
+                reconcileZombieAssignedTasks(components, mesh, selfIds);
+            } catch (e: any) {
+                LOG.warn('MeshReconcile', `Assigned-zombie sweep failed for mesh ${mesh.id}: ${e?.message || e}`);
+            }
         }
     }
 
@@ -1328,6 +1441,42 @@ export function __resetUnresolvedForwardRejectionCountsForTests(): void {
     unresolvedForwardRejectionCounts.clear();
 }
 
+// ── Unresolved-forward reconcile nudge (polling single-model §2.1 (B)) ────────
+// forwardUnresolvedDelegateEvent no longer pushes the event itself — it only
+// persists to the durable outbox and fires a data-free nudge asking THIS loop to
+// run the PHASE 0 retry soon. The nudge is:
+//   - coalesced: one pending timer at a time, so a completion burst schedules a
+//     single early retry pass instead of one per event;
+//   - non-overlapping: skipped while a nudged pass is still in flight (the
+//     periodic tick remains the backstop);
+//   - loss-tolerant: an unregistered/cleared/failed nudge merely means delivery
+//     waits for the next periodic tick (≤ one reconcile interval) — never a loss.
+const UNRESOLVED_FORWARD_NUDGE_DELAY_MS = 250;
+let unresolvedForwardNudgeTimer: NodeJS.Timeout | undefined;
+let unresolvedForwardNudgeRunning = false;
+
+function scheduleUnresolvedForwardNudge(components: DaemonComponents): void {
+    if (!components.dispatchMeshCommand) return; // no transport → periodic tick handles/no-ops
+    if (unresolvedForwardNudgeTimer) return;     // coalesce a burst into one early pass
+    unresolvedForwardNudgeTimer = setTimeout(() => {
+        unresolvedForwardNudgeTimer = undefined;
+        if (unresolvedForwardNudgeRunning) return; // an earlier pass is in flight — tick covers
+        unresolvedForwardNudgeRunning = true;
+        void retryUnresolvedDelegateForwards(components)
+            .catch((e: any) => LOG.warn('MeshReconcile', `Nudged unresolved-forward retry failed: ${e?.message || e}`))
+            .finally(() => { unresolvedForwardNudgeRunning = false; });
+    }, UNRESOLVED_FORWARD_NUDGE_DELAY_MS);
+    // Never keep the process alive solely for a pending nudge.
+    if (typeof unresolvedForwardNudgeTimer.unref === 'function') unresolvedForwardNudgeTimer.unref();
+}
+
+function clearUnresolvedForwardNudge(): void {
+    if (unresolvedForwardNudgeTimer) {
+        clearTimeout(unresolvedForwardNudgeTimer);
+        unresolvedForwardNudgeTimer = undefined;
+    }
+}
+
 async function retryUnresolvedDelegateForwards(components: DaemonComponents): Promise<void> {
     const dispatchMeshCommand = components.dispatchMeshCommand;
     if (!dispatchMeshCommand) return;
@@ -1463,10 +1612,16 @@ export function setupMeshReconcileLoop(components: DaemonComponents): ReconcileL
     }, intervalMs);
     // Don't keep the process alive solely for this timer.
     if (typeof timer.unref === 'function') timer.unref();
+    // Register the unresolved-forward nudge handler: the enqueue site
+    // (forwardUnresolvedDelegateEvent) fires it after persisting an outbox row so
+    // the PHASE 0 retry runs early instead of waiting for the next periodic tick.
+    registerUnresolvedForwardRetryNudge(() => scheduleUnresolvedForwardNudge(components));
     LOG.info('MeshReconcile', `Mesh reconcile loop started (interval ${intervalMs}ms)`);
     return {
         stop() {
             clearInterval(timer);
+            registerUnresolvedForwardRetryNudge(undefined);
+            clearUnresolvedForwardNudge();
             LOG.info('MeshReconcile', 'Mesh reconcile loop stopped');
         },
     };

package/src/mesh/mesh-runtime-store.ts

@@ -1557,10 +1557,82 @@ export class MeshRuntimeStore {
 
     /**
      * Prune tool call log entries older than the given age in ms.
-     * Exposed for testing.
+     * Returns the number of rows deleted. Also used by the periodic retention
+     * sweep (pruneMeshRuntimeRetention) — the in-write sweep in recordMeshToolCall
+     * only fires every 200 calls and only covers the rate-limit window, so a
+     * quiet mesh otherwise accumulates rows indefinitely.
      */
-    pruneToolCallLog(olderThanMs: number): void {
-        this.db.prepare('DELETE FROM mesh_tool_call_log WHERE called_at < ?').run(Date.now() - olderThanMs);
+    pruneToolCallLog(olderThanMs: number): number {
+        return this.db.prepare('DELETE FROM mesh_tool_call_log WHERE called_at < ?').run(Date.now() - olderThanMs).changes;
+    }
+
+    /**
+     * Retention prune for mesh_event_ledger (SoT 1-11 (b)). The ledger is append-only
+     * with NO lifecycle GC of its own, so lifecycle events accumulate without bound
+     * (the dominant mesh-runtime.db growth). Every production reader is bounded to a
+     * recent window (readLedgerEntries tail/limit ≤ a few hundred; task-stats /
+     * terminal-evidence scans look at recent tasks), so rows past a generous age only
+     * cost space. Excluded from deletion — retained forever:
+     *   - coordinator_operating_note / _tombstone: runtime-accumulated lessons whose
+     *     whole point is surviving restarts; a tombstone must also outlive the notes
+     *     it retracts.
+     * Timestamps are ISO-8601 TEXT, so the lexicographic `<` cutoff is a correct time
+     * comparison; a malformed timestamp compares greater than any ISO date and is
+     * conservatively retained. Returns rows deleted.
+     */
+    pruneEventLedger(olderThanMs: number): number {
+        const cutoffIso = new Date(Date.now() - Math.max(0, olderThanMs)).toISOString();
+        return this.db.prepare(
+            `DELETE FROM mesh_event_ledger
+             WHERE timestamp < ?
+               AND kind NOT IN ('coordinator_operating_note', 'coordinator_operating_note_tombstone')`
+        ).run(cutoffIso).changes;
+    }
+
+    /**
+     * Retention prune for TERMINAL (completed/cancelled/failed) mesh_queue rows
+     * (SoT 1-11 (b)). Terminal rows are kept as recent history (mesh_task_history,
+     * completion-dedup taskId lookups) but nothing ever deletes them, so the queue
+     * table grows monotonically. Rows past the retention window serve no reader —
+     * every dedup/attribution path operates on recent tasks — EXCEPT as a dependency
+     * anchor: taskDependenciesSatisfied resolves dependsOn by id and treats a MISSING
+     * row as not-completed, so deleting a completed row that a still-live
+     * (pending/assigned) row depends on would permanently strand the dependent.
+     * Those ids are collected first and excluded. Returns rows deleted.
+     */
+    pruneTerminalQueueEntries(olderThanMs: number): number {
+        const cutoffIso = new Date(Date.now() - Math.max(0, olderThanMs)).toISOString();
+        return this.transaction(() => {
+            // Dependency guard: protect every id a live row still depends on.
+            const liveRows = this.db.prepare(
+                `SELECT payload FROM mesh_queue WHERE status IN ('pending', 'assigned')`
+            ).all() as Array<{ payload: string }>;
+            const protectedIds = new Set<string>();
+            for (const row of liveRows) {
+                try {
+                    const entry = JSON.parse(row.payload) as MeshWorkQueueEntry;
+                    if (Array.isArray(entry.dependsOn)) {
+                        for (const dep of entry.dependsOn) {
+                            if (typeof dep === 'string' && dep) protectedIds.add(dep);
+                        }
+                    }
+                } catch { /* unparsable payload → nothing to protect */ }
+            }
+            const candidates = this.db.prepare(
+                `SELECT id FROM mesh_queue
+                 WHERE status IN ('completed', 'cancelled', 'failed') AND updated_at < ?`
+            ).all(cutoffIso) as Array<{ id: string }>;
+            const deletable = candidates.map(r => r.id).filter(id => !protectedIds.has(id));
+            let removed = 0;
+            // Chunk the DELETE to stay well under SQLite's bind-parameter limit.
+            for (let i = 0; i < deletable.length; i += 500) {
+                const chunk = deletable.slice(i, i + 500);
+                removed += this.db.prepare(
+                    `DELETE FROM mesh_queue WHERE id IN (${chunk.map(() => '?').join(',')})`
+                ).run(...chunk).changes;
+            }
+            return removed;
+        });
     }
 
     // ── G2: Event Ledger ────────────────────────────────────────────────────
@@ -2148,3 +2220,46 @@ export class MeshRuntimeStore {
         return removed;
     }
 }
+
+// ─── Mesh runtime retention windows (SoT 1-11 (b) / gap I-10) ────────────────
+// mesh-runtime.db had lifecycle GC only for mesh_pending_events (prunePendingEvents,
+// hourly via the mesh-event maintenance sweep) and fingerprints/tool-call windows;
+// mesh_event_ledger and terminal mesh_queue rows grew without bound. These windows
+// are deliberately CONSERVATIVE — every production reader operates on a recent
+// window far narrower than these, so the deletes trade only dead space:
+//   - Event ledger 30 days: readers are tail/limit-bounded (≤ a few hundred rows) or
+//     recent-task scoped; 30d comfortably exceeds any reconcile/stat/audit horizon.
+//     Operating notes are exempted inside pruneEventLedger (retained forever).
+//   - Tool-call log 14 days: it backs a seconds-scale rate-limit window; 14d keeps a
+//     generous debugging horizon at trivial cost.
+//   - Terminal queue rows 30 days: mesh_task_history / completion-dedup lookups are
+//     recent-task scoped; live dependsOn anchors are exempted inside
+//     pruneTerminalQueueEntries.
+// No VACUUM here by design: reclaiming file pages is not worth stalling the daemon's
+// single writer; freed pages are reused by future inserts.
+export const MESH_EVENT_LEDGER_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;   // 30 days
+export const MESH_TOOL_CALL_LOG_RETENTION_MS = 14 * 24 * 60 * 60 * 1000;  // 14 days
+export const MESH_TERMINAL_QUEUE_RETENTION_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+
+/**
+ * Periodic retention sweep for the mesh-runtime.db tables that previously had no
+ * lifecycle GC (event ledger, tool-call log, terminal queue rows). Runs on the SAME
+ * cadence as the pending-events retention prune (the hourly mesh-event maintenance
+ * sweep in mesh-event-forwarding.ts). Best-effort and idempotent: a store failure
+ * degrades to a no-op with one warn; an empty table costs three cheap DELETEs.
+ */
+export function pruneMeshRuntimeRetention(): { ledger: number; toolCalls: number; terminalQueue: number } {
+    try {
+        const store = MeshRuntimeStore.getInstance();
+        const ledger = store.pruneEventLedger(MESH_EVENT_LEDGER_RETENTION_MS);
+        const toolCalls = store.pruneToolCallLog(MESH_TOOL_CALL_LOG_RETENTION_MS);
+        const terminalQueue = store.pruneTerminalQueueEntries(MESH_TERMINAL_QUEUE_RETENTION_MS);
+        if (ledger + toolCalls + terminalQueue > 0) {
+            LOG.info('MeshRuntimeStore', `Retention prune removed ${ledger} ledger / ${toolCalls} tool-call / ${terminalQueue} terminal-queue row(s)`);
+        }
+        return { ledger, toolCalls, terminalQueue };
+    } catch (e: any) {
+        LOG.warn('MeshRuntimeStore', `Runtime retention prune failed: ${e?.message || e}`);
+        return { ledger: 0, toolCalls: 0, terminalQueue: 0 };
+    }
+}

package/src/mesh/mesh-unresolved-forward-outbox.ts

@@ -65,6 +65,36 @@ function getStore(): MeshRuntimeStore | undefined {
     try { return MeshRuntimeStore.getInstance(); } catch { return undefined; }
 }
 
+// ---------------------------------------------------------------------------
+// Reconcile-nudge registry (polling-single-model §2.1 (B)).
+//
+// The spontaneous best-effort immediate push that used to run inline in
+// forwardUnresolvedDelegateEvent was removed: the durable outbox row + the
+// reconcile loop's PHASE 0 retry (acked, retry-capped) is now the ONLY delivery
+// path for an unresolved-delegate event. To keep the happy-path latency low
+// without re-introducing a spontaneous data push, the enqueue site emits a
+// data-free NUDGE: "outbox has work — run the PHASE 0 retry soon". The reconcile
+// loop registers the handler at setup; a lost/unregistered nudge is harmless —
+// the next periodic tick (default 4s) covers it, so nudge loss = bounded delay,
+// never event loss.
+//
+// A registry (rather than a direct import of the reconcile loop) keeps the
+// module graph acyclic: mesh-reconcile-loop already imports from
+// mesh-event-forwarding (via the mesh-events-coordinator barrel), so the
+// forwarding side must not import the loop back.
+// ---------------------------------------------------------------------------
+let retryNudgeHandler: (() => void) | undefined;
+
+/** Register (or clear, with undefined) the PHASE 0 retry nudge handler. */
+export function registerUnresolvedForwardRetryNudge(handler?: () => void): void {
+    retryNudgeHandler = handler;
+}
+
+/** Fire-and-forget nudge: ask the reconcile loop to run the outbox retry soon. */
+export function nudgeUnresolvedForwardRetry(): void {
+    try { retryNudgeHandler?.(); } catch { /* nudge is best-effort; the periodic tick covers */ }
+}
+
 /**
  * Durably enqueue an unresolved-delegate forward for a coordinator daemon. The
  * `forwardPayload` is the flat shape handleMeshForwardEvent reads on the coordinator.

package/src/repo-mesh-types.ts

@@ -14,7 +14,7 @@
 import type { GitRepoStatus, GitCompactSummary } from './git/git-types.js';
 import type { MeshMissionSummary, MeshMissionSlimSummary } from './mesh/mesh-missions.js';
 import type { MeshMagiActivitySummary } from './mesh/mesh-magi-status.js';
-import type { MagiPanelMap, MagiKindPanelMap } from '@adhdev/mesh-shared';
+import type { MagiKindPanelMap } from '@adhdev/mesh-shared';
 
 // ─── Core Mesh Types ────────────────────────────
 
@@ -527,7 +527,7 @@ const DIRTY_WORKSPACE_BEHAVIORS = new Set<RepoMeshPolicy['dirtyWorkspaceBehavior
 
 /** Min/max bounds for the global write-task parallel cap. */
 export const MESH_MAX_PARALLEL_TASKS_MIN = 1;
-export const MESH_MAX_PARALLEL_TASKS_MAX = 8;
+export const MESH_MAX_PARALLEL_TASKS_MAX = 64;
 
 /**
  * Default multiplier applied to the write cap to derive the read-only diagnosis
@@ -814,18 +814,12 @@ export interface RepoMeshCoordinatorConfig {
 export interface LocalMeshConfig {
     meshes: LocalMeshEntry[];
     /**
-     * MAGI cross-verification panels (machine-local). Keyed by panel name; each
-     * binds concrete `(node × provider)` members — machine-dependent facts — so
-     * panels live here in meshes.json, never in the repo-shared .adhdev/mesh.json.
-     * Optional: absent on configs written before MAGI existed.
-     */
-    magiPanels?: MagiPanelMap;
-    /**
-     * MAGI-KIND-PANEL: per-task_kind panel bindings (machine-local). Keyed by
-     * task_kind (rca / design / claim_audit / freeform); each maps to ≥1
-     * `(node × provider × model?)` slot. A `mesh_magi_review` invoked with a bare
-     * `task_kind` resolves its panel from here — an unconfigured kind is a hard
-     * error, never a synthesized fallback. Optional; absent on pre-feature configs.
+     * MAGI-KIND-PANEL: per-task_kind panel bindings (machine-local), the SOLE MAGI
+     * panel-resolution surface (the former named-panel `magiPanels` map was removed).
+     * Keyed by task_kind (rca / design / claim_audit / freeform); each maps to ≥1
+     * `(node × provider × model?)` slot. A `mesh_magi_review` resolves its panel from
+     * here — an unconfigured kind is a hard error, never a synthesized fallback.
+     * Optional; absent on pre-feature configs.
      */
     magiKindPanels?: MagiKindPanelMap;
 }

package/src/types.ts

@@ -5,7 +5,13 @@
  * When modifying this file, also update interface contracts in AGENT_PROTOCOL.md.
  */
 import type { StatusReportPayload, AvailableProviderInfo } from './shared-types.js';
-import type { ChatMessageKind } from './providers/chat-message-normalization.js';
+import type {
+  ChatMessageKind,
+  ChatMessageVisibility,
+  ChatMessageTranscriptVisibility,
+  ChatMessageAudience,
+  ChatMessageSource,
+} from './providers/chat-message-normalization.js';
 
 // ── Daemon Status ──
 
@@ -54,11 +60,20 @@ export interface ChatMessage {
   /** Optional: fiber metadata */
   _type?: string;
   _sub?: string;
-  /** Transcript visibility/audience contract for separating chat-visible content from internal/debug runtime rows. */
-  visibility?: 'visible' | 'user' | 'chat' | 'hidden' | 'debug' | 'internal' | (string & {});
-  transcriptVisibility?: 'visible' | 'user' | 'chat' | 'hidden' | 'debug' | 'internal' | (string & {});
-  audience?: 'chat' | 'debug' | 'trace' | 'internal' | (string & {});
-  source?: 'assistant_text' | 'tool_call' | 'terminal_command' | 'runtime_activity' | 'runtime_status' | 'provider_chrome' | 'control' | (string & {});
+  /**
+   * Transcript visibility/audience contract for separating chat-visible content
+   * from internal/debug runtime rows. These reference the canonical named unions
+   * declared alongside the classifier (chat-message-normalization.ts) so the known
+   * values have one source of truth instead of a hand-inlined copy that drifts.
+   * Each alias keeps the `| (string & {})` escape hatch: the read-chat contract
+   * (read-chat-contract.ts) preserves ANY producer-supplied string verbatim, so
+   * the type must stay open — it documents the known values without forbidding
+   * provider-specific extensions.
+   */
+  visibility?: ChatMessageVisibility;
+  transcriptVisibility?: ChatMessageTranscriptVisibility;
+  audience?: ChatMessageAudience;
+  source?: ChatMessageSource;
   userFacing?: boolean;
   internal?: boolean;
   isInternal?: boolean;