@adhdev/daemon-core 0.9.82-rc.483 → 0.9.82-rc.485

package/src/mesh/mesh-events-pending.ts

@@ -75,6 +75,18 @@ export interface PendingMeshCoordinatorEvent {
     dispatchedBy?: CoordinatorIdentity;
     /** Present only for unicast scope: the coordinator this event is addressed to. */
     intendedFor?: CoordinatorIdentity;
+    /**
+     * True when this event was stamped as a broadcast SOLELY because no owning
+     * coordinator identity was resolvable at emit time (self-fallback: dispatchedBy
+     * is THIS daemon's own machineId, not a real coordinator). Such a broadcast has
+     * no owner, so the MAGI-REPLICA-COMPLETION-EVENT-LEAK guard — which only exists
+     * to stop a NON-owner coordinator from consuming an OWNED terminal event — must
+     * not apply: an ownerless terminal broadcast is a genuine "deliver to any
+     * coordinator that drains on this machine" event and identity-matching its
+     * self-id dispatchedBy against the drainer would wrongly route it away.
+     * Absent (undefined/false) on a normally-owned event → the leak guard applies.
+     */
+    dispatchedBySelfFallback?: boolean;
 }
 
 /**
@@ -419,7 +431,21 @@ function routeV2EventsForDrainer(
             // matching semantics as unicast (identityDeliversTo), so the true owner —
             // possibly addressed under a different daemon-id form — still receives it.
             if (validated.scope === 'broadcast' && isTerminalTaskEvent(validated.event)) {
-                if (identityDeliversTo(validated.dispatchedBy, drainer)) {
+                // An ownerless self-fallback broadcast (dispatchedBy is this daemon's
+                // own machineId because no coordinator identity existed at emit) has no
+                // coordinator owner — but it must still stay on ITS machine: a replica
+                // completion emitted on machine A must never fan out to a coordinator on
+                // machine B (the MAGI-REPLICA leak). So for a self-fallback event, match
+                // at the MACHINE (daemonId) level — deliver iff the drainer is on the
+                // same machine as the self-dispatcher — instead of the full
+                // identityDeliversTo (which also compares runId/session and would route
+                // the event away from a same-machine coordinator whose id form differs,
+                // the exact symptom for refine:* / agent:generating_completed reaching a
+                // stdio MCP coordinator). Non-self-fallback broadcasts keep the strict
+                // owner check.
+                const deliverSelfFallback = event.dispatchedBySelfFallback
+                    && daemonIdsEquivalent(validated.dispatchedBy.daemonId, drainer.daemonId);
+                if (deliverSelfFallback || identityDeliversTo(validated.dispatchedBy, drainer)) {
                     ctx.batchSeen.add(eventId);
                     bump('v2Delivered');
                     kept.push(event);
@@ -858,6 +884,13 @@ export function stampPendingEventV2(
     });
     if (!stamp) return event; // no coordinator identity at all (no self id) → stays a v1 event
 
+    // Mark an ownerless (self-fallback) broadcast so the drain-side leak guard can
+    // tell it apart from a genuinely owned broadcast terminal event. selfFallback is
+    // true only when no coordinator identity existed and we minted the stamp under
+    // this daemon's own machineId; a broadcast that stays broadcast for that reason
+    // has no owner to leak from and must reach whatever coordinator drains here.
+    const dispatchedBySelfFallback = selfFallback && stamp.scope === 'broadcast';
+
     return {
         ...event,
         protocolVersion: stamp.protocolVersion,
@@ -865,6 +898,7 @@ export function stampPendingEventV2(
         scope: stamp.scope,
         dispatchedBy: stamp.dispatchedBy,
         ...(stamp.intendedFor ? { intendedFor: stamp.intendedFor } : {}),
+        ...(dispatchedBySelfFallback ? { dispatchedBySelfFallback: true } : {}),
     };
 }
 

package/src/mesh/mesh-queue-assignment.ts

@@ -76,17 +76,84 @@ export function getMeshWithCache(components: DaemonComponents, meshId: string):
  *
  * Fix: union the local-config nodes with any inline-cache-ONLY nodes, so the claim
  * view matches the command (send_task) view. Base (non-worktree) nodes present in
- * local config stay config-authoritative — their entry is taken verbatim from
- * localMesh, so base node claim/matching is byte-for-byte unchanged. Only nodes
+ * local config stay config-authoritative — their STATIC fields are taken verbatim
+ * from localMesh, so base node claim/matching is byte-for-byte unchanged. Only nodes
  * that exist solely in the inline cache (the cloned worktree nodes) are appended.
  * Identity comparison uses the shared 3-form normalizer (id / nodeId / node_id),
  * identical to every other claim-path consumer — the matching logic is untouched,
  * only which nodes are visible.
+ *
+ * BOOTSTRAP-DEFER VIEW-CONSISTENCY (this fix): for a worktree node that IS registered
+ * in local config, the union previously took the config node verbatim and discarded the
+ * inline-cache entry entirely. But the inline cache holds the FRESHER runtime bootstrap
+ * state — markWorktreeBootstrapTerminalState stamps worktreeBootstrap.status='complete'
+ * synchronously into the inline cache, while local config lags behind the detached async
+ * persist chain (and on the coordinator may never receive it at all). A config-registered
+ * worktree node therefore read a permanently stale 'running' here, so
+ * shouldDeferDispatchForBootstrap deferred its claim forever. We now MERGE the inline
+ * cache's dynamic runtime bootstrap state onto the config node (config keeps its static
+ * fields; worktreeBootstrap is preferred from the inline cache) so EVERY consumer of the
+ * merged view — not just tryAssignQueueTask's gate — observes the terminal stamp.
+ *
+ * RESIDUAL-getMeshWithCache-bootstrap-overlay (precedence guard): the overlay is DIRECTIONAL —
+ * it prefers the inline entry ONLY when the inline runtime state is actually fresher, never
+ * merely because the inline entry carries a status. inlineBootstrapIsFresher() (below) permits
+ * the overlay in exactly two cases, mirroring the mission's "terminal OR strictly newer" rule:
+ *   (1) the inline state is TERMINAL ('complete'/'failed') while the config state is NOT — the
+ *       markWorktreeBootstrapTerminalState synchronous stamp the async config persist has not
+ *       yet caught up to; this is the whole point of the overlay (opens the gate).
+ *   (2) both states are non-terminal but the inline startedAt is STRICTLY newer — a re-driven
+ *       bootstrap whose fresher 'running' epoch the config has not observed.
+ * It REFUSES the overlay when the config state is already terminal and the inline state is a
+ * stale/non-terminal 'running' — otherwise a stale inline 'running' would MASK a genuinely
+ * complete config node and re-defer its claim forever (the exact anti-case this guard closes).
+ * And when both are 'running' with no newer epoch, the config value is kept and the gate still
+ * defers — the half-built-worktree → empty-session defense is preserved: only a terminal-confirmed
+ * inline state, never an ambiguous read, ever opens the gate.
+ */
+const BOOTSTRAP_TERMINAL_STATUSES = new Set(['complete', 'failed']);
+
+function bootstrapEpochMs(bootstrap: any): number {
+    const raw = readNonEmptyString(bootstrap?.startedAt) || readNonEmptyString(bootstrap?.completedAt);
+    if (!raw) return 0;
+    const parsed = Date.parse(raw);
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+
+/**
+ * Directional freshness test for the bootstrap overlay: may the inline runtime state
+ * REPLACE the config runtime state? True only when the inline state is terminal and the
+ * config state is not (the synchronous terminal stamp the async persist lags), or when
+ * both are non-terminal but the inline epoch is strictly newer. A terminal config state is
+ * never overwritten by a non-terminal inline read (the stale-'running'-masks-complete
+ * anti-case), and equal states never trigger a rewrite.
  */
+function inlineBootstrapIsFresher(inlineBootstrap: any, configBootstrap: any): boolean {
+    const inlineStatus = readNonEmptyString(inlineBootstrap?.status);
+    if (!inlineStatus) return false;
+    const configStatus = readNonEmptyString(configBootstrap?.status);
+    const inlineTerminal = BOOTSTRAP_TERMINAL_STATUSES.has(inlineStatus);
+    const configTerminal = !!configStatus && BOOTSTRAP_TERMINAL_STATUSES.has(configStatus);
+    // Config already terminal: only a DIFFERENT terminal inline state (e.g. config 'complete'
+    // vs a later 'failed' re-drive) may supersede it; a non-terminal inline read must never
+    // mask a terminal config state.
+    if (configTerminal) {
+        return inlineTerminal && inlineStatus !== configStatus
+            && bootstrapEpochMs(inlineBootstrap) > bootstrapEpochMs(configBootstrap);
+    }
+    // Config not terminal: an inline terminal state is always fresher (opens the gate).
+    if (inlineTerminal) return true;
+    // Both non-terminal: prefer inline only when its epoch is strictly newer (a re-driven
+    // bootstrap the config has not observed). Equal/older ⇒ keep config, gate still defers.
+    return bootstrapEpochMs(inlineBootstrap) > bootstrapEpochMs(configBootstrap);
+}
+
 function mergeInlineCacheOnlyNodes(localMesh: any, cachedMesh: any): any {
     const localNodes = Array.isArray(localMesh?.nodes) ? localMesh.nodes : [];
     const cachedNodes = Array.isArray(cachedMesh?.nodes) ? cachedMesh.nodes : [];
     if (!cachedNodes.length) return localMesh;
+    // Index inline-cache nodes by identity so we can (a) append cache-only nodes and
+    // (b) prefer the inline runtime bootstrap state on config-registered nodes.
     const cacheOnly = cachedNodes.filter((cachedNode: any) => {
         const cachedId = readMeshNodeId(cachedNode);
         // Unidentifiable cache entries can never be a claim/route target — skip them
@@ -94,8 +161,29 @@ function mergeInlineCacheOnlyNodes(localMesh: any, cachedMesh: any): any {
         if (!cachedId) return false;
         return !localNodes.some((localNode: any) => meshNodeIdMatches(localNode, cachedId));
     });
-    if (!cacheOnly.length) return localMesh;
-    return { ...localMesh, nodes: [...localNodes, ...cacheOnly] };
+    // Overlay the inline cache's fresher worktreeBootstrap state onto any config node that
+    // also exists in the inline cache. inlineBootstrapIsFresher() gates the overlay to the
+    // "terminal OR strictly newer" cases, so a stale inline 'running' can never mask a
+    // terminal config state and the gate's deferral is preserved for a genuine 'running'.
+    let overlaidLocalNodes: any[] = localNodes;
+    let overlaid = false;
+    for (let i = 0; i < localNodes.length; i++) {
+        const localNode = localNodes[i];
+        const localId = readMeshNodeId(localNode);
+        if (!localId) continue;
+        const inlineMatch = cachedNodes.find((cachedNode: any) => meshNodeIdMatches(cachedNode, localId));
+        if (!inlineMatch) continue;
+        if (!inlineBootstrapIsFresher(inlineMatch.worktreeBootstrap, localNode.worktreeBootstrap)) continue;
+        if (!overlaid) {
+            overlaidLocalNodes = [...localNodes];
+            overlaid = true;
+        }
+        // Keep the config node's static fields; overlay only the dynamic worktreeBootstrap
+        // runtime substate (fresher terminal stamp / epoch) — config identity is unchanged.
+        overlaidLocalNodes[i] = { ...localNode, worktreeBootstrap: inlineMatch.worktreeBootstrap };
+    }
+    if (!cacheOnly.length && !overlaid) return localMesh;
+    return { ...localMesh, nodes: [...overlaidLocalNodes, ...cacheOnly] };
 }
 
 // ---------------------------------------------------------------------------
@@ -1880,6 +1968,8 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
                             // MAGI-KIND-PANEL model axis: forward the task's model override so the
                             // remote worker session launches with it (initialModel). Best-effort.
                             ...(typeof task.model === 'string' && task.model.trim() ? { initialModel: task.model.trim() } : {}),
+                            // BRAIN-ROUTING thinking axis: forward the task's thinking level (initialThinkingLevel).
+                            ...(typeof task.thinkingLevel === 'string' && task.thinkingLevel.trim() ? { initialThinkingLevel: task.thinkingLevel.trim() } : {}),
                         });
                     } catch (e: any) {
                         markAutoLaunch(meshId, task.id, { status: 'failed', reason: `remote_launch_dispatch_failed: ${e?.message || String(e)}`, nodeId, providerType: resolved.providerType });
@@ -1912,6 +2002,8 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
                     // MAGI-KIND-PANEL model axis: local launch forwards the task's model
                     // override as initialModel (CLI → modelLaunchArgs; ACP → setConfigOption).
                     ...(typeof task.model === 'string' && task.model.trim() ? { initialModel: task.model.trim() } : {}),
+                    // BRAIN-ROUTING thinking axis: forward the task's thinking level (initialThinkingLevel).
+                    ...(typeof task.thinkingLevel === 'string' && task.thinkingLevel.trim() ? { initialThinkingLevel: task.thinkingLevel.trim() } : {}),
                 });
                 if (!launchResult?.success) {
                     const reason = launchResult?.error || 'launch_cli_failed';

package/src/mesh/mesh-reconcile-loop.ts

@@ -679,6 +679,19 @@ const ASSIGNED_STRANDED_DEADLINE_MS = 5 * 60_000;
 // reclaimed out from under itself.
 const DELIVERED_NO_TURN_DEADLINE_MS = 15 * 60_000;
 
+// DELIVERED-NOT-CONSUMED (remote autoLaunch delivered≠consumed gap): how long a row may sit
+// 'assigned' with a CONFIRMED delivery ('delivered') that was never CONSUMED ('acked' — the
+// worker's agent:generating_started never arrived) before the watchdog re-drives it. Far shorter
+// than DELIVERED_NO_TURN_DEADLINE_MS (15min): a remote autoLaunch marks markAutoLaunch(completed)
+// and returns immediately, relying on agent:ready/reconcile to inject; if the launch→ready→claim
+// window (widened on win32 by the 3–4s git spawn latency) drops the inject, the row sits 'assigned'
+// but the delivery never flips past 'delivered' to 'acked'. The delivered-not-acked state is the
+// cross-daemon consumption signal — positive evidence the worker never started the turn — so we can
+// safely re-open the task after a SHORT grace (well above a normal generating_started round-trip so
+// a merely-slow start is never torn off) instead of waiting the full 15min turn budget. Floored
+// comfortably above the auto-launch cooldown so a legitimate late inject still has room to land.
+const ASSIGNED_DELIVERED_UNCONSUMED_REDRIVE_MS = 25_000;
+
 // RECLAIM-FALSEPOS: how many CONSECUTIVE UNKNOWN busy-verdict ticks (past the delivered-no-turn
 // deadline) must accumulate before a delivered row whose worker session cannot be positively
 // observed is reclaimed. An UNKNOWN verdict means the assigned session is not present in THIS
@@ -728,7 +741,62 @@ function recoverStrandedAssignedDispatches(components: DaemonComponents, meshId:
     for (const row of assigned) {
         const dispatchedAtMs = Date.parse(row.dispatchTimestamp ?? '');
         if (!Number.isFinite(dispatchedAtMs)) continue;              // no dispatch ts → can't age it
-        if (nowMs - dispatchedAtMs < ASSIGNED_STRANDED_DEADLINE_MS) continue;  // still in confirm window
+        const ageMs = nowMs - dispatchedAtMs;
+        // DELIVERED-NOT-CONSUMED short-grace re-drive (remote autoLaunch delivered≠consumed gap).
+        // Runs BEFORE the ASSIGNED_STRANDED_DEADLINE_MS confirm-window gate below because its whole
+        // point is to recover a delivered-but-unconsumed row well inside that window. A remote
+        // autoLaunch marks the dispatch delivered (transport acked) but the worker may never emit
+        // agent:generating_started — the delivery then sits 'delivered' and never flips to 'acked',
+        // so the task is stranded 'assigned' with no live turn. This branch re-opens exactly that
+        // row after a short grace:
+        //   - the delivery IS confirmed handed off (taskHasConfirmedDelivery) but was NEVER consumed
+        //     (!taskDeliveryConsumed → no 'acked'/'completed' delivery) — the cross-daemon "worker
+        //     never started the turn" signal, valid even for a REMOTE session whose local busy
+        //     verdict is UNKNOWN;
+        //   - AND the busy verdict is NOT GENERATING — a locally-present generating session IS
+        //     consuming (ack lost/late), so never touch it (regression guard against tearing a live
+        //     worker off its turn);
+        //   - AND no terminal ledger evidence exists (the completion already landed → leave it).
+        // reclaimStrandedAssignedTask returns the row to 'pending' (bounded by MAX_STRANDED_RECLAIMS)
+        // so PHASE 3 re-dispatches it this same tick onto a fresh idle session — idempotent: it only
+        // mutates a still-'assigned' row, so a completion/ack that raced in already moved the row off
+        // 'assigned' and this is a no-op.
+        if (
+            ageMs >= ASSIGNED_DELIVERED_UNCONSUMED_REDRIVE_MS
+            && ageMs < ASSIGNED_STRANDED_DEADLINE_MS
+            && store.taskHasConfirmedDelivery(meshId, row.id)
+            && !store.taskDeliveryConsumed(meshId, row.id)
+        ) {
+            const terminal = findTerminalLedgerEvidenceForTask({ meshId, taskId: row.id });
+            if (terminal) {
+                const status = terminal.kind === 'task_completed' ? 'completed' : 'failed';
+                updateTaskStatus(meshId, row.id, status);
+                continue;
+            }
+            const verdict = row.assignedSessionId
+                ? resolveSessionBusyVerdict(components, row.assignedSessionId)
+                : 'IDLE_CONFIRMED'; // no session bound → nothing live generating to protect
+            if (verdict !== 'GENERATING') {
+                const redriven = reclaimStrandedAssignedTask(meshId, row.id, {
+                    reason: 'delivered_not_consumed_redrive',
+                    ageMs,
+                });
+                if (redriven) {
+                    LOG.warn('MeshReconcile', `Re-drove delivered-but-unconsumed task ${row.id} on mesh ${meshId} `
+                        + `(node=${row.assignedNodeId ?? '?'} session=${row.assignedSessionId ?? '?'}, delivered but no `
+                        + `generating_started in ${Math.round(ageMs / 1000)}s, verdict ${verdict} → ${redriven.status})`);
+                    traceMeshEventDrop('assigned_delivered_not_consumed_redrive', {
+                        taskId: row.id,
+                        sessionId: row.assignedSessionId,
+                        nodeId: row.assignedNodeId,
+                        meshId,
+                        event: 'agent:generating_started',
+                    }, `delivered_not_consumed ${Math.round(ageMs / 1000)}s → ${redriven.status}`);
+                    continue;
+                }
+            }
+        }
+        if (ageMs < ASSIGNED_STRANDED_DEADLINE_MS) continue;  // still in confirm window
         const terminal = findTerminalLedgerEvidenceForTask({
             meshId,
             taskId: row.id,

package/src/mesh/mesh-runtime-store.ts

@@ -1488,6 +1488,28 @@ export class MeshRuntimeStore {
         return !!row;
     }
 
+    /**
+     * DELIVERED-NOT-CONSUMED re-drive support: true when at least one delivery record for
+     * the task has reached a CONSUMED status ('acked' / 'completed'). Distinct from
+     * {@link taskHasConfirmedDelivery} ('delivered' | 'acked' | 'completed'): a delivery is
+     * flipped to 'delivered' the instant the transport hands the dispatch off, but only
+     * flipped to 'acked' when the worker's agent:generating_started event arrives (see the
+     * generating_started handler in mesh-event-forwarding) — i.e. when the session has
+     * actually begun the turn. That distinction is the cross-daemon consumption signal the
+     * short-grace re-drive uses: a row whose delivery is 'delivered' but never 'acked' was
+     * handed to a REMOTE worker that never started generating — the remote autoLaunch
+     * delivered≠consumed gap — even when the session's busy verdict is UNKNOWN (not locally
+     * observable). Indexed by (mesh_id, task_id).
+     */
+    taskDeliveryConsumed(meshId: string, taskId: string): boolean {
+        const row = this.db.prepare(`
+            SELECT 1 FROM mesh_session_delivery
+            WHERE mesh_id = ? AND task_id = ? AND status IN ('acked','completed')
+            LIMIT 1
+        `).get(meshId, taskId) as { 1: number } | undefined;
+        return !!row;
+    }
+
     expireStaleSessionDeliveries(meshId: string): void {
         const now = new Date().toISOString();
         this.db.prepare(`

package/src/mesh/mesh-work-queue.ts

@@ -3,13 +3,13 @@ import { requireMeshHostQueueOwner } from './mesh-host-ownership.js';
 import type { RepoMeshDaemonRole } from '../repo-mesh-types.js';
 import { MESH_CONVERGE_REFINE_TAG, resolveAutoConvergeCodeChange } from '../repo-mesh-types.js';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
-import { getMesh } from '../config/mesh-config.js';
+import { getMesh, getDifficultyBrains } from '../config/mesh-config.js';
 import { LOG } from '../logging/logger.js';
 import { appendLedgerEntry } from './mesh-ledger.js';
 import type { MeshLedgerKind } from './mesh-ledger.js';
 import { createSessionDelivery } from './mesh-delivery-policy.js';
 import { isTaskDispatchInFlight, endTaskDispatchInFlight } from './mesh-task-inflight.js';
-import { sessionIdsEquivalent } from '@adhdev/mesh-shared';
+import { sessionIdsEquivalent, isMeshTaskDifficulty, type MeshTaskDifficulty } from '@adhdev/mesh-shared';
 
 export type MeshTaskStatus = 'pending' | 'assigned' | 'completed' | 'failed' | 'cancelled';
 export type MeshActiveTaskStatus = Extract<MeshTaskStatus, 'pending' | 'assigned'>;
@@ -584,6 +584,13 @@ export interface MeshWorkQueueEntry {
      * that cannot honor the model still runs the task (never a fatal launch error).
      */
     model?: string;
+    /**
+     * BRAIN-ROUTING (thinking axis): standard reasoning level ('low'|'medium'|'high')
+     * for the session that executes this task. When the task auto-launches, this is
+     * passed to launch_cli as `initialThinkingLevel` (CLI → thinkingLaunchArgs; ACP →
+     * setConfigOption('thought_level')). Rides in payload JSON. Best-effort like model.
+     */
+    thinkingLevel?: string;
     /**
      * M1: why this task is held back (e.g. "dependency_failed:<taskId>").
      * Only set by the system on dependency failure under the 'block' policy;
@@ -862,6 +869,16 @@ export function enqueueTask(
         consensusGroupId?: string;
         /** MAGI-KIND-PANEL: model override forwarded to the executing session's launch (initialModel). */
         model?: string;
+        /** BRAIN-ROUTING: standard thinking level forwarded to launch (initialThinkingLevel). */
+        thinkingLevel?: string;
+        /**
+         * BRAIN-ROUTING: task execution difficulty ('easy'|'medium'|'difficult'|
+         * 'freeform'). When set, the mesh's difficulty→brain preset fills in model /
+         * thinkingLevel that were not passed explicitly (an explicit model/thinkingLevel
+         * wins). Purely a convenience resolver — the stored task still carries the
+         * resolved model/thinkingLevel, so downstream launch is unchanged.
+         */
+        difficulty?: string;
         /** Explicit task id for batch/template flows (M5). Random UUID when omitted. */
         id?: string;
         /** (3) Originating coordinator session id (for session-anchored completion routing). */
@@ -881,6 +898,21 @@ export function enqueueTask(
     const maxRetries = typeof opts?.maxRetries === 'number' && Number.isFinite(opts.maxRetries) && opts.maxRetries >= 0
         ? Math.floor(opts.maxRetries)
         : undefined;
+    // BRAIN-ROUTING: resolve the difficulty preset into effective model / thinking
+    // level. An explicit opts.model / opts.thinkingLevel always wins; the preset only
+    // fills what the caller left blank. Best-effort — a missing/invalid difficulty or
+    // an unconfigured preset just leaves the explicit values (or none) in place.
+    let effectiveModel = typeof opts?.model === 'string' && opts.model.trim() ? opts.model.trim() : undefined;
+    let effectiveThinkingLevel = typeof opts?.thinkingLevel === 'string' && opts.thinkingLevel.trim() ? opts.thinkingLevel.trim() : undefined;
+    if (isMeshTaskDifficulty(opts?.difficulty)) {
+        try {
+            const preset = getDifficultyBrains()[opts!.difficulty as MeshTaskDifficulty];
+            if (preset) {
+                if (!effectiveModel && preset.model) effectiveModel = preset.model;
+                if (!effectiveThinkingLevel && preset.thinkingLevel) effectiveThinkingLevel = preset.thinkingLevel;
+            }
+        } catch { /* preset read is best-effort — never block enqueue */ }
+    }
     const result = withQueueLock(meshId, () => {
         if (MeshRuntimeStore.getInstance().findQueueEntryById(meshId, id)) {
             throw new Error(`duplicate_task_id: task '${id}' already exists in mesh '${meshId}'`);
@@ -917,7 +949,8 @@ export function enqueueTask(
             ...(maxRetries !== undefined ? { maxRetries } : {}),
             ...(typeof opts?.missionId === 'string' && opts.missionId.trim() ? { missionId: opts.missionId.trim() } : {}),
             ...(typeof opts?.consensusGroupId === 'string' && opts.consensusGroupId.trim() ? { consensusGroupId: opts.consensusGroupId.trim() } : {}),
-            ...(typeof opts?.model === 'string' && opts.model.trim() ? { model: opts.model.trim() } : {}),
+            ...(effectiveModel ? { model: effectiveModel } : {}),
+            ...(effectiveThinkingLevel ? { thinkingLevel: effectiveThinkingLevel } : {}),
             ...(typeof opts?.sourceCoordinatorSessionId === 'string' && opts.sourceCoordinatorSessionId.trim()
                 ? { sourceCoordinatorSessionId: opts.sourceCoordinatorSessionId.trim() }
                 : {}),

package/src/providers/cli-provider-instance.ts

@@ -312,6 +312,7 @@ export class CliProviderInstance implements ProviderInstance {
     private presentationMode: 'terminal' | 'chat';
     private providerSessionId?: string;
     private launchMode: 'new' | 'resume' | 'manual';
+    private initialThinkingLevel?: string;
     private readonly startedAt = Date.now();
     private onProviderSessionResolved?: (info: {
         instanceId: string;
@@ -332,6 +333,10 @@ export class CliProviderInstance implements ProviderInstance {
             providerSessionId?: string;
             launchMode?: 'new' | 'resume' | 'manual';
             extraEnv?: Record<string, string>;
+            /** BRAIN-ROUTING: standard thinking level to apply post-launch via the
+             *  provider's thinkingControlId (runtime-control providers like hermes).
+             *  Providers using thinkingLaunchArgs get it at spawn instead and ignore this. */
+            initialThinkingLevel?: string;
             onProviderSessionResolved?: (info: {
                 instanceId: string;
                 providerType: string;
@@ -347,6 +352,7 @@ export class CliProviderInstance implements ProviderInstance {
         this.presentationMode = 'chat';
         this.providerSessionId = options?.providerSessionId;
         this.launchMode = options?.launchMode || 'new';
+        this.initialThinkingLevel = options?.initialThinkingLevel;
         this.onProviderSessionResolved = options?.onProviderSessionResolved;
         this.adapter = createCliAdapter(provider as CliProviderModule, workingDir, cliArgs, options?.extraEnv || {}, transportFactory) as ProviderCliAdapter;
         if (this.providerSessionId) {
@@ -392,6 +398,7 @@ export class CliProviderInstance implements ProviderInstance {
  // PTY spawn
         await this.adapter.spawn();
         await this.enforceFreshSessionLaunchIfNeeded();
+        await this.applyInitialThinkingLevelViaControl();
         this.maybeAppendRuntimeRecoveryMessage(this.adapter.getRuntimeMetadata());
         if (this.providerSessionId && this.shouldHydrateExistingProviderHistory()) {
             this.restorePersistedHistoryFromCurrentSession();
@@ -1209,6 +1216,45 @@ export class CliProviderInstance implements ProviderInstance {
         this.applyProviderResponse(parsed.payload, { phase: 'immediate' });
     }
 
+    /**
+     * BRAIN-ROUTING (runtime-control thinking axis): for a provider that selects
+     * reasoning effort via a runtime control instead of a launch arg (e.g. hermes
+     * `reasoning`), apply the requested initialThinkingLevel after spawn by invoking
+     * that control's setScript. The provider names the control via thinkingControlId.
+     * The standard level is mapped through thinkingLevelMap first (same as the
+     * launch-arg path). Best-effort: any failure logs and never blocks launch.
+     */
+    private async applyInitialThinkingLevelViaControl(): Promise<void> {
+        const level = typeof this.initialThinkingLevel === 'string' ? this.initialThinkingLevel.trim() : '';
+        if (!level) return;
+        const controlId = (this.provider as any).thinkingControlId;
+        if (!controlId) return; // provider uses thinkingLaunchArgs (or has no support)
+        const controls: any[] = Array.isArray((this.provider as any).controls) ? (this.provider as any).controls : [];
+        const control = controls.find(c => c && c.id === controlId);
+        if (!control || !control.setScript) return;
+        // Map the standard level to the provider's own vocabulary (unchanged if absent).
+        const map = (this.provider as any).thinkingLevelMap as Record<string, string> | undefined;
+        const mapped = (map && typeof map[level] === 'string' && map[level].trim()) ? map[level].trim() : level;
+        try {
+            await waitForCliAdapterReady(this.adapter);
+            const raw = await this.adapter.invokeScript(control.setScript, { value: mapped });
+            const parsed = parseCliScriptResult(raw);
+            if (!parsed.success) {
+                LOG.warn('CLI', `[${this.type}] thinking control '${controlId}' set to '${mapped}' failed: ${parsed.payload?.error || 'unknown'}`);
+                return;
+            }
+            const cliCommand = getCliScriptCommand(parsed.payload);
+            if (cliCommand?.type === 'send_message' && cliCommand.text) {
+                await this.adapter.sendMessage(cliCommand.text);
+            } else if (cliCommand?.type === 'pty_write' && cliCommand.text) {
+                await this.adapter.writeRaw(cliCommand.text + '\r');
+            }
+            LOG.info('CLI', `[${this.type}] applied thinking level '${mapped}' via control '${controlId}'`);
+        } catch (e: any) {
+            LOG.warn('CLI', `[${this.type}] thinking control apply threw: ${e?.message || e}`);
+        }
+    }
+
     private completionHasFinalAssistantMessage(messages: unknown, turnStartedAt?: number): boolean {
         const visibleMessages = (Array.isArray(messages) ? messages : [])
             .filter((message: any) => isUserFacingChatMessage(message as ChatMessage));

package/src/providers/contracts.ts

@@ -604,6 +604,53 @@ export interface ProviderModule {
    * request never fails a launch). Absent → no launch-time model selection for CLI.
    */
   modelLaunchArgs?: string[];
+  /**
+   * BRAIN-ROUTING (model axis): suggested model values for this provider, surfaced
+   * as dropdown options in the new-session dialog (e.g. claude ['opus','sonnet',
+   * 'haiku']; codex ['gpt-5.5','gpt-5-codex']). Advisory only — the UI allows free
+   * text too, so the list going stale never blocks a model the provider accepts.
+   */
+  modelOptions?: string[];
+  /**
+   * BRAIN-ROUTING (thinking axis): template for expanding an `initialThinkingLevel`
+   * selection into launch args for a CLI provider, parallel to modelLaunchArgs.
+   * `{{level}}` is substituted with the provider-appropriate reasoning-effort value
+   * (already mapped from the standard low|medium|high level, see thinkingLevelMap).
+   * Examples: claude-cli `['--effort', '{{level}}']` → `--effort high`; codex-cli
+   * `['-c', 'model_reasoning_effort={{level}}']`. Applied at session launch when
+   * `initialThinkingLevel` is passed AND this provider is a plain CLI. A CLI provider
+   * with no template silently ignores the thinking level (best-effort; never fails a
+   * launch). ACP providers instead route thinking through setConfigOption('thought_level').
+   */
+  thinkingLaunchArgs?: string[];
+  /**
+   * BRAIN-ROUTING (thinking axis): optional per-provider mapping from the standard
+   * thinking levels (`low`|`medium`|`high`) to this provider's own reasoning-effort
+   * vocabulary, used to fill `{{level}}` in thinkingLaunchArgs. e.g. claude-cli might
+   * map `{ high: 'max' }`; codex-cli `{ high: 'xhigh' }`. A level absent from the map
+   * passes through unchanged (so `medium` → `medium` by default).
+   */
+  thinkingLevelMap?: Partial<Record<'low' | 'medium' | 'high', string>>;
+  /**
+   * BRAIN-ROUTING (thinking axis): the reasoning-effort values this provider actually
+   * accepts, surfaced as the thinking-level dropdown options in the new-session
+   * dialog (e.g. claude ['low','medium','high','max']; codex ['minimal','low',
+   * 'medium','high','xhigh']). Absent → the UI falls back to the standard
+   * low/medium/high. These are the provider's OWN vocabulary and are passed through
+   * verbatim as initialThinkingLevel (not remapped by thinkingLevelMap, which only
+   * translates the mesh's standard low/medium/high presets).
+   */
+  thinkingLevelOptions?: string[];
+  /**
+   * BRAIN-ROUTING (thinking axis, runtime-control providers): the `controls[].id`
+   * of a runtime reasoning-effort control to drive for the thinking level when the
+   * provider has no `thinkingLaunchArgs` (e.g. hermes-cli's `reasoning` select,
+   * which types `/reasoning <level>` into the PTY via its setScript). At launch,
+   * initialThinkingLevel (after thinkingLevelMap) is applied by invoking that
+   * control's setScript with `{ value: <level> }`. Ignored if the id doesn't match a
+   * control. Providers that use thinkingLaunchArgs don't need this.
+   */
+  thinkingControlId?: string;
   /** Delay before submitting typed CLI input (provider-specific TUI tuning) */
   sendDelayMs?: number;
   /** Submit key used after typing into CLI PTY (default: carriage return) */

package/src/providers/provider-schema.ts

@@ -66,6 +66,12 @@ const KNOWN_PROVIDER_FIELDS = new Set<string>([
   'providerVersion',
   'status',
   'details',
+  'modelLaunchArgs',
+  'modelOptions',
+  'thinkingLaunchArgs',
+  'thinkingLevelMap',
+  'thinkingLevelOptions',
+  'thinkingControlId',
   'sendDelayMs',
   'sendKey',
   'submitStrategy',

package/src/providers/sdk/v1/schemas/cli/provider.schema.json

@@ -129,6 +129,35 @@
       "items": { "type": "string" },
       "description": "Template for expanding an initialModel selection into launch args. '{{model}}' is substituted with the model string (e.g. ['--model', '{{model}}'] → --model opus). Applied at launch when a model is requested for this CLI provider (MAGI kind-panel model axis). Absent → no launch-time model selection."
     },
+    "modelOptions": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "Suggested model values shown as dropdown options in the new-session dialog (brain-routing model axis), e.g. ['opus','sonnet','haiku']. Advisory — the UI still accepts free text, so a stale list never blocks an accepted model."
+    },
+    "thinkingLaunchArgs": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "Template for expanding an initialThinkingLevel selection into launch args (brain-routing thinking axis, parallel to modelLaunchArgs). '{{level}}' is substituted with the provider-mapped reasoning-effort value (e.g. ['--effort', '{{level}}'] → --effort high; ['-c', 'model_reasoning_effort={{level}}']). Applied at launch when a thinking level is requested. Absent → no launch-time thinking selection."
+    },
+    "thinkingLevelMap": {
+      "type": "object",
+      "properties": {
+        "low": { "type": "string" },
+        "medium": { "type": "string" },
+        "high": { "type": "string" }
+      },
+      "additionalProperties": false,
+      "description": "Optional map from the standard thinking levels (low/medium/high) to this provider's own reasoning-effort vocabulary, used to fill {{level}} in thinkingLaunchArgs. A level absent from the map passes through unchanged."
+    },
+    "thinkingLevelOptions": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "Reasoning-effort values this provider accepts, shown as the thinking-level dropdown in the new-session dialog (e.g. ['low','medium','high','max']). Absent → the UI falls back to standard low/medium/high. Provider's own vocabulary, passed through verbatim."
+    },
+    "thinkingControlId": {
+      "type": "string",
+      "description": "For a provider with no thinkingLaunchArgs but a runtime reasoning-effort control (e.g. hermes 'reasoning'), the controls[].id to drive at launch for the thinking level. The control's setScript is invoked with { value: <mapped level> }."
+    },
     "scriptCallBudgetMs": {
       "type": "integer",
       "minimum": 1,

package/src/repo-mesh-types.ts

@@ -14,7 +14,7 @@
 import type { GitRepoStatus, GitCompactSummary } from './git/git-types.js';
 import type { MeshMissionSummary, MeshMissionSlimSummary } from './mesh/mesh-missions.js';
 import type { MeshMagiActivitySummary } from './mesh/mesh-magi-status.js';
-import type { MagiKindPanelMap } from '@adhdev/mesh-shared';
+import type { MagiKindPanelMap, DifficultyBrainMap } from '@adhdev/mesh-shared';
 
 // ─── Core Mesh Types ────────────────────────────
 
@@ -822,6 +822,15 @@ export interface LocalMeshConfig {
      * Optional; absent on pre-feature configs.
      */
     magiKindPanels?: MagiKindPanelMap;
+    /**
+     * BRAIN-ROUTING: per-task-difficulty brain presets (machine-local), sibling of
+     * magiKindPanels. Keyed by difficulty (easy / medium / difficult / freeform);
+     * each maps to a BrainSlot (provider? / model? / thinkingLevel?). The coordinator
+     * classifies a task's difficulty at enqueue; the matching preset fills in the
+     * task's model / thinking level (an explicit task value wins). Optional; a mesh
+     * with none seeded uses DEFAULT_DIFFICULTY_BRAINS on first read.
+     */
+    difficultyBrains?: DifficultyBrainMap;
 }
 
 export interface LocalMeshEntry {

package/src/shared-types.ts

@@ -555,6 +555,10 @@ export interface AvailableProviderInfo {
     lastVerification?: MachineProviderCheckResult;
     /** Provider-declared Repo Mesh coordinator/MCP behavior. */
     meshCoordinator?: ProviderMeshCoordinatorConfig;
+    /** BRAIN-ROUTING: suggested model values for the new-session model dropdown. */
+    modelOptions?: string[];
+    /** BRAIN-ROUTING: reasoning-effort values for the new-session thinking dropdown. */
+    thinkingLevelOptions?: string[];
     /**
      * Provider trust classification — derived from the on-disk layer the
      * manifest came from and the shape of the manifest. Dashboards use

package/src/status/snapshot.ts

@@ -153,6 +153,8 @@ function buildAvailableProviders(
         status?: string;
         details?: string;
         links?: Record<string, string>;
+        modelOptions?: string[];
+        thinkingLevelOptions?: string[];
     }> = providerLoader.getAvailableProviderInfos?.() || providerLoader.getAll();
     // Trust helpers come from daemon-core; resolve them lazily so the
     // status snapshot path stays loadable in older bundles that don't
@@ -189,6 +191,8 @@ function buildAvailableProviders(
             ...(sourceLayer ? { sourceLayer } : {}),
             ...(sourceName ? { sourceName } : {}),
             ...(provider.providerVersion ? { providerVersion: provider.providerVersion } : {}),
+            ...(Array.isArray(provider.modelOptions) && provider.modelOptions.length ? { modelOptions: provider.modelOptions } : {}),
+            ...(Array.isArray(provider.thinkingLevelOptions) && provider.thinkingLevelOptions.length ? { thinkingLevelOptions: provider.thinkingLevelOptions } : {}),
             ...(provider.binary ? { binary: provider.binary } : {}),
             ...(provider.status ? { status: provider.status } : {}),
             ...(provider.details ? { details: provider.details } : {}),