@adhdev/daemon-core 0.9.82-rc.507 → 0.9.82-rc.509

package/src/mesh/coordinator-prompt.ts

@@ -31,8 +31,9 @@ import type {
     RepoMeshStatus,
     RepoMeshNodeStatus,
 } from '../repo-mesh-types.js';
-import { mergeAndNormalizePolicy } from '../repo-mesh-types.js';
+import { mergeAndNormalizePolicy, resolveProviderMaxParallel } from '../repo-mesh-types.js';
 import { getDifficultyBrains } from '../config/mesh-config.js';
+import { resolveNodeCapabilitySlots } from './mesh-node-slots.js';
 import { MESH_TASK_DIFFICULTIES } from '@adhdev/mesh-shared';
 import type { MagiKindPanelMap, MagiSlot, MagiTaskKind } from '@adhdev/mesh-shared';
 
@@ -459,19 +460,23 @@ function buildNodeConfigSection(mesh: LocalMeshEntry): string {
         const explicitMachineLabel = typeof (n as any).machineLabel === 'string' ? (n as any).machineLabel : '';
         const explicitLabel = explicitMachineLabel ? ` label: **${explicitMachineLabel}** |` : '';
         const providerPriority = n.policy?.providerPriority?.length ? ` | providers: ${n.policy.providerPriority.join(', ')}` : '';
-        // Per-(node, provider) maxParallel cap. Only maxParallel is enforced by the
-        // queue; routing is governed by required_tags, not provider roles.
-        const providerRoles = Array.isArray(n.policy?.providerRoles)
-            ? (n.policy!.providerRoles as Array<{ providerType?: unknown; maxParallel?: unknown }>)
-                .map(r => {
-                    const type = typeof r?.providerType === 'string' ? r.providerType.trim() : '';
-                    if (!type) return '';
-                    const cap = Number.isFinite(Number(r?.maxParallel)) ? ` (max ${Math.floor(Number(r.maxParallel))})` : '';
-                    return `${type}${cap}`;
-                })
-                .filter(Boolean)
-            : [];
-        const providerRolesSuffix = providerRoles.length ? ` | caps: ${providerRoles.join(', ')}` : '';
+        // Per-(node, provider) maxParallel cap, derived from the node's slots (the
+        // cap summed across a provider's slots). Only maxParallel is enforced by the
+        // queue; routing is governed by required_tags, not slot order.
+        const nodeSlots = resolveNodeCapabilitySlots(n);
+        const seenCapProvider = new Set<string>();
+        const providerCaps: string[] = [];
+        for (const slot of nodeSlots) {
+            const type = typeof slot?.provider === 'string' ? slot.provider.trim() : '';
+            if (!type) continue;
+            const key = type.toLowerCase();
+            if (seenCapProvider.has(key)) continue;
+            seenCapProvider.add(key);
+            const cap = resolveProviderMaxParallel(nodeSlots, type);
+            if (cap === undefined) continue;
+            providerCaps.push(`${type} (max ${cap})`);
+        }
+        const providerRolesSuffix = providerCaps.length ? ` | caps: ${providerCaps.join(', ')}` : '';
         lines.push(`- ${explicitLabel} nodeId: \`${n.id}\` | workspace: \`${n.workspace}\`${n.daemonId ? ` | daemon: \`${n.daemonId}\`` : ''}${providerPriority}${providerRolesSuffix}${suffix}`);
         // Routing tags: what this node advertises for mesh_enqueue_task required_tags.
         // Surfaced so the coordinator can route by-capability (e.g. enqueue a Windows
@@ -804,7 +809,9 @@ Follow these recovery rules:
 1. **If "Retry recommended"**: Check \`mesh_view_queue\` first — the daemon may have auto-requeued. If not, re-launch the session on the same node (\`mesh_launch_session\`), then resend the original task (\`mesh_send_task\`). The system message includes the original task text.
 2. **If "Max retries exceeded"**: Do NOT retry on the same node. Either reassign the task to a different node, or inform the user that the task requires manual intervention.
 3. **If no recovery context**: The stop may be intentional (normal completion). Use \`mesh_read_chat\` once to verify, then move on.
-4. **Always record what happened**: After handling a failure, briefly note the outcome in your report to the user.`;
+4. **Always record what happened**: After handling a failure, briefly note the outcome in your report to the user.
+5. **Stuck-but-done vs actually-stuck**: If a delegated session appears stuck but has already produced a verified final summary or diff, stop polling noisy tool/terminal transcript bubbles. Verify with \`mesh_git_status\` or a checkpoint and proceed to landing.
+6. **Refinery falsely blocks a verified-clean branch — manual fast-forward convergence**: When \`mesh_refine_node\` falsely blocks a verified-clean branch (stale preflight, or the submodule-gitlink trivial-fast-forward misjudgment), bypass the refine tool and converge by strict fast-forward — (1) rebase the submodule commit onto the submodule \`origin/main\`, (2) push the submodule ff-only (verify \`git merge-base --is-ancestor\` first), (3) rebase the root branch and re-bump the submodule pointer so the root diff stays non-empty, (4) push the root ff-only. NEVER force-push or reset; abort and report on any non-fast-forward.`;
 
 const ONBOARDING_SECTION = `## Onboarding / Reinit
 
@@ -837,7 +844,7 @@ function buildRulesSection(coordinatorCliType?: string): string {
 
 - **Route, don't implement.** Delegate all code reading, analysis, and execution to node agents. Never read source files or run commands in the coordinator — keep context lean.
 - **Front-load task messages.** Include everything the agent needs (files, problem, expected fix) in \`mesh_enqueue_task\` / \`mesh_send_task\`. Append a structured result request at the end: ask the worker to conclude with a JSON block containing \`status\`, \`changedFiles\`, \`gitStatus\`, \`validationResults\`, \`errors\`, \`nextAction\`. The daemon parses this automatically; you can read it from \`mesh_task_history\`.
-- **Reuse idle sessions.** For follow-up, retry, commit/push, or cleanup on the same issue, send only the delta to the existing idle session. Start fresh only for independent work, provider mismatch, transcript contamination, or required worktree isolation.
+- **Reuse idle sessions.** For follow-up, retry, commit/push, or cleanup on the same issue, send only the delta to the existing idle session. Start a fresh session only when: (a) branch/worktree isolation is required, (b) the existing session had a dispatch failure or provider mismatch, (c) the transcript/runtime is contaminated or interrupted, or (d) the user explicitly asks for a different provider/session. Continuation of the same issue in an already-idle session is allowed and preferred — this rule blocks concurrent unrelated work interleaved into a live (still-generating) session, not sequential same-issue follow-ups.
 - **Worktree affinity.** A worktree is a durable per-branch workspace; keep all of a branch's code_change/fix/review work on its worktree node by targeting \`required_tags: ["worktree=<branch>"]\` or \`target_node_id\`. Get the id/branch from the \`mesh_clone_node\` result or a live \`mesh_status\` — the Configured Nodes snapshot won't list a worktree cloned after launch. Untargeted same-branch follow-ups drift to the base node. Only \`convergence\` (merge/push) runs on the base, never pinned to the worktree.
 - **Classify task difficulty to save tokens.** For each task you enqueue, judge its execution difficulty and pass \`difficulty\`: \`easy\` (extraction, renames, doc tweaks, trivial fixes), \`medium\` (ordinary feature/bugfix work), \`difficult\` (architecture, tricky debugging, multi-file refactors, subtle reasoning), or \`freeform\`. The mesh's per-difficulty brain preset then runs easy tasks on a cheaper model at low reasoning effort and hard tasks on a stronger model at high effort — real token savings on simple work. The current presets are shown in the "Brain presets" section below. You may still pass an explicit \`model\`/\`thinkingLevel\` to override the preset for one task.
 - **Retune node profiles when routing is a poor fit — but only with approval.** A node's capability slots (its provider/model/thinking + difficulty range + capability tags, seen via \`mesh_node_slots_list\`) are what task→node fitness routing matches against. If you notice a persistent mismatch — e.g. every \`difficult\` task lands on a node whose only slot is a cheap model, or a capability a node clearly has isn't declared — you MAY propose a slot change with \`mesh_node_slots_set\` (write=false). That returns current-vs-proposed; present that diff to the user with a one-line reason and apply (write=true) ONLY after they approve. It is a WHOLESALE replacement of the node's slots, so include the slots you want to keep. Never rewrite a node's profile silently or without a clear routing reason.
@@ -845,12 +852,15 @@ function buildRulesSection(coordinatorCliType?: string): string {
 - **Verify via git, not source.** Use \`mesh_git_status\` to confirm side effects. Treat agent summaries as self-reports, not verification.
 - **Limit parallelism.** Start with 1–2 tasks; scale only on success. Never duplicate a session because \`mesh_read_chat\` shows no final message while tool/terminal activity is ongoing. This caps *concurrent* load — it does not mean serialize independent work: when a new, independent request arrives and there is headroom under \`maxParallelTasks\`, dispatch it right away rather than waiting for an in-flight task or a user nudge (read-only diagnosis especially, since it has no merge cost).
 - **Check history first.** Call \`mesh_task_history\` at session start to avoid duplicate work and inform recovery. On failure, read task history before retrying.
+- **Don't reopen already-done work after a resume.** Before reopening a reported issue after context compaction or session resume, check current git state and recent session context. If another session has already completed the work, continue from the existing diff/commit instead of starting a duplicate investigation.
 - **Sequence shared-base-moving merges.** Parallel dispatch is encouraged, but merging one worktree can advance another in-flight worktree's base — especially a shared submodule pointer — turning a clean fast-forward into a diverged rebase (patch-equivalence correctly blocks this). Before merging an in-flight worktree while siblings are also in flight, land in an intentional order, re-clone long-running worktrees from the advanced base, or expect to manually rebase + ff-only the laggards; merging an independent fix mid-flight can strand siblings into a rebase.
 - **Converge branches.** After worktree tasks: refine/fast-forward, or classify as \`pushed_feature_branch_needs_merge\` / \`blocked_review\` / \`cleanup_candidate\` / \`not_mergeable\`. Clean up with \`mesh_remove_node\`.
 - **Refinery is config-driven.** \`mesh_refine_node\` must run validation from \`.adhdev/refine.{json,yaml,yml}\` or \`repo-mesh.refine.*\`. Heuristics are scaffolding only.
 - **Submodule reachability = publish-needed.** \`submodule_reachability_failed\` → classify as \`blocked_review\`, request user approval to push to submodule main, then rerun \`mesh_refine_node\`.
 - **Honor per-node instructions.** When a node carries a 📌 Node instruction in the nodes section, include the relevant parts of that instruction in the task message you send to that node. Don't paraphrase the instruction into your own words — quote it verbatim so the worker agent sees exactly what the user wrote.
 - **Mission status does not update itself.** When a mission's tasks are all done or the work is abandoned, explicitly call \`mesh_mission_upsert\` to set status \`completed\` or \`abandoned\`. Never leave a finished mission in \`active\`. All-cancelled tasks with no further work → \`abandoned\`.
+- **Don't spawn a nested coordinator for simple inspection.** Do not spawn a nested coordinator-like agent for simple inspection tasks. If delegation is required, use explicit provider selection and a fully self-contained, bounded task instruction.
+- **Keep internal traffic out of the transcript.** Internal tool calls, status events, control messages, and debug output must not appear as ordinary user-visible chat transcript content unless explicitly marked user-facing by the producing agent.
 - **Never fabricate tool results.** Always call the actual tool.
 - **Keep the user informed.** One or two sentences after each delegation round.${coordinatorNote}
 

package/src/mesh/mesh-node-slots.ts

@@ -0,0 +1,52 @@
+/**
+ * Node capability-slot resolution — the single source of truth for a node's
+ * effective slots (ORCHESTRATION_NODE_SLOTS.md). Every layer that needs a node's
+ * slots (queue claim/launch caps, scheduling-runtime status projection, coordinator
+ * prompt) resolves them here so the "explicit policy.slots, else legacy-derived"
+ * rule is applied identically everywhere.
+ *
+ * Kept as a tiny standalone module (rather than living in mesh-queue-assignment)
+ * so importing slot resolution does not drag in the whole assignment engine and to
+ * avoid an import cycle between the status builder and the assignment engine.
+ */
+import {
+    deriveSlotsFromLegacy,
+    normalizeNodeCapabilitySlots,
+    type NodeCapabilitySlot,
+} from '@adhdev/mesh-shared';
+import { getDifficultyBrains } from '../config/mesh-config.js';
+
+/** Ordered, de-duplicated providerPriority from a node policy (defensive). */
+export function normalizeProviderPriority(policy: unknown): string[] {
+    const raw = policy && typeof policy === 'object' && !Array.isArray(policy)
+        ? (policy as Record<string, unknown>).providerPriority
+        : undefined;
+    if (!Array.isArray(raw)) return [];
+    const seen = new Set<string>();
+    return raw
+        .map(type => typeof type === 'string' ? type.trim() : '')
+        .filter(Boolean)
+        .filter(type => {
+            if (seen.has(type)) return false;
+            seen.add(type);
+            return true;
+        });
+}
+
+/**
+ * Resolve a node's capability slots: explicit `policy.slots` when present, else
+ * derived from the legacy `providerPriority` + machine-global difficultyBrains.
+ * (The former per-provider `providerRoles` cap has been removed; a persisted
+ * meshes.json is migrated to slots on load, so by the time a node reaches routing
+ * its cap already lives on `slots[].maxParallel`.)
+ */
+export function resolveNodeCapabilitySlots(node: any): NodeCapabilitySlot[] {
+    const explicit = normalizeNodeCapabilitySlots(node?.policy?.slots);
+    if (explicit.length) return explicit;
+    let difficultyBrains: any;
+    try { difficultyBrains = getDifficultyBrains(); } catch { difficultyBrains = undefined; }
+    return deriveSlotsFromLegacy({
+        providerPriority: normalizeProviderPriority(node?.policy),
+        difficultyBrains,
+    });
+}

package/src/mesh/mesh-queue-assignment.ts

@@ -2,7 +2,7 @@ import { existsSync } from 'fs';
 import type { DaemonComponents } from '../boot/daemon-lifecycle.js';
 import { MESH_CONNECT_TIMEOUT_MS } from '../runtime-defaults.js';
 import { loadConfig } from '../config/config.js';
-import { getMesh, getDifficultyBrains } from '../config/mesh-config.js';
+import { getMesh } from '../config/mesh-config.js';
 import { detectCLI } from '../detection/cli-detector.js';
 import { LOG } from '../logging/logger.js';
 import { appendLedgerEntry } from './mesh-ledger.js';
@@ -15,7 +15,8 @@ import { traceMeshEventDrop } from './mesh-event-trace.js';
 import { awaitWithWarmupDeadline, resolveWarmupDeadlineOpts } from './mesh-warmup-deadline.js';
 import { resolveDelegatedWorkerAutoApprove, resolveProviderMaxParallel, resolveNodeSchedulingPriority, normalizeMeshSchedulingStrategy, resolveMaxParallelTasks, resolveMaxReadonlyParallelTasks } from '../repo-mesh-types.js';
 import type { RepoMeshSchedulingStrategy } from '../repo-mesh-types.js';
-import { normalizeMeshNodeId, meshNodeIdMatches, daemonIdsEquivalent, canonicalDaemonId, normalizeMeshWorkspaceForCompare, meshWorkspacesEquivalent, sessionIdsEquivalent, deriveSlotsFromLegacy, normalizeNodeCapabilitySlots, isMeshTaskDifficulty, withStatusProbeMarker, type MeshNodeIdentified, type NodeCapabilitySlot, type MeshTaskDifficulty } from '@adhdev/mesh-shared';
+import { normalizeMeshNodeId, meshNodeIdMatches, daemonIdsEquivalent, canonicalDaemonId, normalizeMeshWorkspaceForCompare, meshWorkspacesEquivalent, sessionIdsEquivalent, normalizeNodeCapabilitySlots, isMeshTaskDifficulty, withStatusProbeMarker, type MeshNodeIdentified, type NodeCapabilitySlot, type MeshTaskDifficulty } from '@adhdev/mesh-shared';
+import { resolveNodeCapabilitySlots } from './mesh-node-slots.js';
 import { findTerminalLedgerEvidenceForTask, hasUnterminalDirectDispatchLedgerEntry } from './mesh-events-stale.js';
 import { readNonEmptyString } from './mesh-events-utils.js';
 import { readMeshNodeDaemonId } from './mesh-node-identity.js';
@@ -23,6 +24,7 @@ import { queuePendingMeshCoordinatorEvent, retractPendingDispatchBlockedEvent }
 import { isWorktreeBootstrapStaleRunning, shouldDeferDispatchForBootstrap } from './worktree-bootstrap-config.js';
 import { isWithinCloneBootstrapGrace } from './mesh-clone-grace.js';
 import { beginTaskDispatchInFlight, endTaskDispatchInFlight } from './mesh-task-inflight.js';
+import { isModelCompatibleWithProvider } from './model-provider-compat.js';
 
 /**
  * CANON: the single canonical coordinator-daemon id this daemon stamps onto every
@@ -504,11 +506,12 @@ export function tryAssignQueueTask(
     }
 
     const capabilityTags = buildMeshNodeCapabilityTags(node, providerType);
-    // Per-(node, provider) maxParallel cap (RepoMeshNodePolicy.providerRoles) layers
-    // on top of the global/taskMode caps — stricter wins. Resolved here where the
-    // claiming session's providerType + node policy are both known, then enforced
-    // inside the atomic claim transaction so concurrent claims can't overshoot it.
-    const providerMaxParallel = resolveProviderMaxParallel(node?.policy, providerType);
+    // Per-(node, provider) maxParallel cap (summed across the node's slots for this
+    // provider) layers on top of the global/taskMode caps — stricter wins. Resolved
+    // here where the claiming session's providerType + node policy are both known,
+    // then enforced inside the atomic claim transaction so concurrent claims can't
+    // overshoot it.
+    const providerMaxParallel = resolveProviderMaxParallel(resolveNodeCapabilitySlots(node), providerType);
     // WTDISPATCH-FANOUT: tell the atomic claim whether the claiming node is a worktree
     // clone so a `convergence` task (base-only: merge → push → cleanup) is refused for
     // worktree sessions. Without it, every sibling worktree session on this daemon could
@@ -1279,8 +1282,8 @@ export function __buildSchedulingPoolForTests(
 //
 // A node's capability slots are the single source of truth for routing. When a
 // node has explicit `policy.slots` we use them; otherwise we derive slots from the
-// legacy providerPriority/providerRoles + the machine-global difficultyBrains so
-// existing nodes keep working (back-compat). The fitness scorer ranks a node for a
+// legacy providerPriority + the machine-global difficultyBrains so existing nodes
+// keep working (back-compat). The fitness scorer ranks a node for a
 // specific task by how well its best slot matches the task's difficulty and
 // required tags — with graceful fallback so a task is never blocked by a missing
 // exact match.
@@ -1292,19 +1295,6 @@ interface FitnessTask {
     requiredTags?: string[];
 }
 
-/** Resolve a node's capability slots: explicit policy.slots, else derived from legacy. */
-function resolveNodeCapabilitySlots(node: any): NodeCapabilitySlot[] {
-    const explicit = normalizeNodeCapabilitySlots(node?.policy?.slots);
-    if (explicit.length) return explicit;
-    let difficultyBrains: any;
-    try { difficultyBrains = getDifficultyBrains(); } catch { difficultyBrains = undefined; }
-    return deriveSlotsFromLegacy({
-        providerPriority: normalizeProviderPriority(node?.policy),
-        providerRoles: Array.isArray(node?.policy?.providerRoles) ? node.policy.providerRoles : undefined,
-        difficultyBrains,
-    });
-}
-
 /**
  * Score how well one slot fits a task. Higher = better. A slot whose difficulty
  * range contains the task's difficulty scores highest; a general-purpose slot
@@ -1555,6 +1545,17 @@ function nodeHasLiveSessionPendingClaim(components: DaemonComponents, meshId: st
         const state = inst.getState();
         const settings = state.settings as Record<string, unknown> || {};
         if (readNonEmptyString(settings.meshNodeFor) !== meshId) return false;
+        // DISPATCH-DEADLOCK-COORD-SESSION-SLOT: a coordinator session for THIS mesh
+        // (meshCoordinatorFor === meshId) is never a pending-claim worker — the idle→claim
+        // drain (drainMeshQueue, isIdleSessionState + worker role) never picks it up, because
+        // a coordinator is generating/non-idle and is the dispatcher, not a claimer. The claim
+        // path excludes it structurally; the skip gate must apply the SAME exclusion. Without
+        // this, a node whose only live mesh session is the coordinator makes this gate return
+        // true, so no worker auto-launches and no session ever claims → the task pends forever
+        // with no error/requeue (silent deadlock). The busy-set / non-idle guards below don't
+        // help because the coordinator holds no *assigned* queue task, so it is neither busy
+        // nor terminal here.
+        if (readNonEmptyString(settings.meshCoordinatorFor) === meshId) return false;
         const instNodeId = readNonEmptyString(settings.meshNodeId) || readNonEmptyString(settings.nodeId);
         // Canonical-form match (see nodeHasActiveMeshWork / liveSessionCountForNode): a
         // daemon-id form skew must not make a present session look absent and reopen the
@@ -2056,13 +2057,31 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
                 // Slot-derived model/thinking: an explicit task.model/thinkingLevel
                 // (resolved from the enqueue-time brain) still wins; the matched
                 // slot fills only what the task left blank (ORCHESTRATION_NODE_SLOTS.md).
-                const effectiveModel = (typeof task.model === 'string' && task.model.trim()) ? task.model.trim() : resolved.model;
+                const rawEffectiveModel = (typeof task.model === 'string' && task.model.trim()) ? task.model.trim() : resolved.model;
                 const effectiveThinkingLevel = (typeof task.thinkingLevel === 'string' && task.thinkingLevel.trim()) ? task.thinkingLevel.trim() : resolved.thinkingLevel;
 
+                // CODEX-400 GUARD: the difficulty→brain presets (and MAGI slots) carry
+                // provider-agnostic Anthropic model aliases (opus/sonnet/haiku). Now that
+                // resolved.providerType is definitively known, drop the model if it is a
+                // Claude model but the provider is NOT Anthropic-backed (codex-cli /
+                // antigravity-cli / hermes-cli): forwarding `claude-*` as an initialModel
+                // makes those providers convert it to `-c model='claude-...'`, and a
+                // ChatGPT-account codex then rejects the launch with a 400. Stripping it
+                // lets the provider fall back to its own default model; the provider-neutral
+                // thinkingLevel axis is preserved. This is the single authoritative point
+                // that enforces the invariant across every model source (preset, slot,
+                // explicit) because both remote and local launch consume effectiveModel below.
+                const effectiveModel = isModelCompatibleWithProvider(rawEffectiveModel, resolved.providerType)
+                    ? rawEffectiveModel
+                    : undefined;
+                if (rawEffectiveModel && effectiveModel === undefined) {
+                    LOG.info('MeshQueue', `CODEX-400 GUARD: dropped incompatible launch model '${rawEffectiveModel}' for non-Anthropic provider '${resolved.providerType}' on node ${nodeId} (task ${task.id}); provider will use its own default model`);
+                }
+
                 // Don't spawn a session for a (node, provider) already at its declared
                 // maxParallel cap — it would launch only to fail the claim. The claim
                 // transaction enforces the cap regardless; this just avoids a doomed launch.
-                const providerCap = resolveProviderMaxParallel(node?.policy, resolved.providerType);
+                const providerCap = resolveProviderMaxParallel(resolveNodeCapabilitySlots(node), resolved.providerType);
                 if (
                     providerCap !== undefined
                     && activeProviderAssignedCount(meshId, nodeId, resolved.providerType) >= providerCap

package/src/mesh/mesh-runtime-store.ts

@@ -867,8 +867,8 @@ export class MeshRuntimeStore {
     /**
      * Count active (status='assigned') tasks on a (node, provider) combination,
      * matched by the assignedProviderType stamped on the payload at claim time.
-     * Drives the per-(node, provider) maxParallel cap (RepoMeshNodePolicy
-     * providerRoles). The active-assignment set for a single node is tiny, so
+     * Drives the per-(node, provider) maxParallel cap (summed across a provider's
+     * slots[].maxParallel). The active-assignment set for a single node is tiny, so
      * parsing payloads here is cheap and avoids a schema migration. Pre-cap legacy
      * rows (no provider stamp) and other providers on the same node do not consume
      * this provider's budget, so the cap is fully backward compatible.
@@ -906,7 +906,7 @@ export class MeshRuntimeStore {
             if (this.hasActiveSessionAssignment(meshId, sessionId)) return null;
             const nodeBusy = this.hasActiveNodeAssignment(meshId, nodeId);
 
-            // Per-(node, provider) maxParallel cap (RepoMeshNodePolicy providerRoles).
+            // Per-(node, provider) maxParallel cap (summed slots[].maxParallel).
             // Orthogonal to taskMode: this bounds the (node, provider) resource pool
             // regardless of read-only vs write. When the cap is already met, this
             // session cannot claim any candidate here — return null. This composes

package/src/mesh/mesh-scheduling-runtime.ts

@@ -21,6 +21,7 @@ import {
     resolveProviderMaxParallel,
 } from '../repo-mesh-types.js';
 import { normalizeMeshNodeId } from '@adhdev/mesh-shared';
+import { resolveNodeCapabilitySlots } from './mesh-node-slots.js';
 import type { MeshWorkQueueEntry } from './mesh-work-queue.js';
 import { isTaskReadonly } from './mesh-work-queue.js';
 
@@ -44,7 +45,11 @@ export interface MeshNodeSchedulingRuntime {
     schedulingPriority: number;
     /** Per-node concurrent-session cap, when configured. */
     maxConcurrentSessions?: number;
-    /** Per-(node, provider) caps + consumption, when providerRoles declares any. */
+    /**
+     * Per-(node, provider) caps + consumption, when the node's slots declare a
+     * maxParallel for any provider. (Field name kept for dashboard back-compat;
+     * the cap source is now slots[].maxParallel, not the removed providerRoles.)
+     */
     providerRoles?: MeshNodeProviderSchedulingRuntime[];
     /**
      * True when the node currently cannot claim a NEW write (non-readonly) task —
@@ -147,17 +152,27 @@ export function buildMeshSchedulingRuntime(
         // Write isolation: a node already holding an assigned write task can't take another.
         if ((writeAssignedByNode.get(nodeId) ?? 0) > 0) capReasons.push('node_has_active_assignment');
 
-        // Per-(node, provider) caps, with live consumption.
+        // Per-(node, provider) caps, with live consumption. Derived from the node's
+        // resolved capability slots (explicit policy.slots, else legacy-derived): the
+        // distinct providers named by slots that declare a maxParallel cap, each cap
+        // summed across that provider's slots by resolveProviderMaxParallel.
         let providerRoles: MeshNodeProviderSchedulingRuntime[] | undefined;
-        const declaredRoles = Array.isArray(policy?.providerRoles) ? policy!.providerRoles! : [];
-        if (declaredRoles.length) {
+        const slots = resolveNodeCapabilitySlots(rawNode);
+        const cappedProviders: string[] = [];
+        const seenProvider = new Set<string>();
+        for (const slot of slots) {
+            const providerType = typeof slot?.provider === 'string' ? slot.provider.trim() : '';
+            if (!providerType) continue;
+            const key = providerType.toLowerCase();
+            if (seenProvider.has(key)) continue;
+            seenProvider.add(key);
+            if (resolveProviderMaxParallel(slots, providerType) !== undefined) cappedProviders.push(providerType);
+        }
+        if (cappedProviders.length) {
             const byProvider = providerCountByNode.get(nodeId);
             providerRoles = [];
-            for (const role of declaredRoles) {
-                if (!role || typeof role !== 'object') continue;
-                const providerType = typeof role.providerType === 'string' ? role.providerType.trim() : '';
-                if (!providerType) continue;
-                const maxParallel = resolveProviderMaxParallel(policy, providerType);
+            for (const providerType of cappedProviders) {
+                const maxParallel = resolveProviderMaxParallel(slots, providerType);
                 const activeAssigned = byProvider?.get(providerType) ?? 0;
                 const capReached = maxParallel !== undefined && activeAssigned >= maxParallel;
                 providerRoles.push({

package/src/mesh/mesh-work-queue.ts

@@ -612,8 +612,8 @@ export interface MeshWorkQueueEntry {
     assignedSessionId?: string;
     /**
      * Provider type of the session that claimed the task. Recorded so the queue
-     * can enforce per-(node, provider) maxParallel caps (RepoMeshNodePolicy
-     * providerRoles) by counting active assignments grouped by node + provider.
+     * can enforce per-(node, provider) maxParallel caps (summed slots[].maxParallel)
+     * by counting active assignments grouped by node + provider.
      */
     assignedProviderType?: string;
     /** Human/operator reason for terminal cancellation. */
@@ -1095,7 +1095,7 @@ export function getMeshQueueRevision(meshId: string): string {
  *
  * `opts.providerType` is stamped onto the claimed entry (assignedProviderType) so
  * per-(node, provider) caps can be counted. `opts.providerMaxParallel`, when set,
- * is the enforced per-(node, provider) cap from RepoMeshNodePolicy.providerRoles:
+ * is the enforced per-(node, provider) cap (summed slots[].maxParallel):
  * a task is not assigned to this (node, provider) once it already has that many
  * active assignments. This composes with the global/taskMode caps (stricter wins).
  */

package/src/mesh/model-provider-compat.ts

@@ -0,0 +1,73 @@
+/**
+ * Provider ↔ model compatibility guard for brain/slot-derived launch models.
+ *
+ * WHY THIS EXISTS: the difficulty→brain presets (and MAGI slots) carry
+ * provider-agnostic model strings like `opus`/`sonnet`/`haiku`, which are
+ * Anthropic (Claude) model names. When a task lands on a node whose provider is
+ * NOT Anthropic-backed — `codex-cli` (ChatGPT), `antigravity-cli`, `hermes-cli`
+ * — forwarding a `claude-*` model as the launch arg makes that provider convert
+ * it to e.g. `-c model='claude-...'`, and a ChatGPT-account codex then rejects
+ * the launch with a 400. The model string was never meant to be forced onto a
+ * provider that can't honor it (presets are "best-effort at launch").
+ *
+ * The invariant this enforces: **an Anthropic (`claude-*`) model is never passed
+ * as a launch argument to a non-Anthropic provider.** When a preset/slot model is
+ * incompatible with the resolved provider, drop the model (the provider then uses
+ * its own default) and keep only the provider-neutral axis (thinkingLevel).
+ *
+ * This is deliberately conservative: it only strips a model that is *known* to be
+ * Anthropic when the provider is *known* to be non-Anthropic. Unknown models and
+ * unknown providers pass through unchanged so a legitimately provider-specific
+ * model (e.g. an operator who configured `gpt-5-codex` on a codex slot) is not
+ * clobbered.
+ */
+
+/**
+ * Provider types that are Anthropic-backed (accept `claude-*` / opus/sonnet/haiku
+ * model names). Everything else is treated as non-Anthropic for the guard.
+ */
+const ANTHROPIC_PROVIDER_TYPES: ReadonlySet<string> = new Set([
+    'claude-cli',
+]);
+
+/**
+ * True when `providerType` is an Anthropic-backed provider (Claude). Matching is
+ * case-insensitive and tolerant of surrounding whitespace. An empty/undefined
+ * provider is treated as non-Anthropic (unknown → don't assume Claude).
+ */
+export function isAnthropicProvider(providerType: string | undefined | null): boolean {
+    const p = typeof providerType === 'string' ? providerType.trim().toLowerCase() : '';
+    return p.length > 0 && ANTHROPIC_PROVIDER_TYPES.has(p);
+}
+
+/**
+ * True when `model` names an Anthropic (Claude) model — the provider-agnostic
+ * brain-preset aliases (`opus`/`sonnet`/`haiku`) or any explicit `claude-*` id.
+ * Case-insensitive. Non-Anthropic and unknown models return false so they pass
+ * the compatibility check unchanged.
+ */
+export function isAnthropicModel(model: string | undefined | null): boolean {
+    const m = typeof model === 'string' ? model.trim().toLowerCase() : '';
+    if (!m) return false;
+    if (m.startsWith('claude') || m.startsWith('anthropic')) return true;
+    // Provider-agnostic brain-preset aliases (DEFAULT_DIFFICULTY_BRAINS) are Claude
+    // model families; a bare `opus`/`sonnet`/`haiku` (optionally with a suffix like
+    // `opus-4` or `sonnet-4-5`) means an Anthropic model.
+    return /^(opus|sonnet|haiku)(\b|[-_])/.test(m);
+}
+
+/**
+ * Compatibility check for a brain/slot-derived launch model against the provider
+ * it would launch on. Returns false ONLY for the concrete failure mode we guard:
+ * an Anthropic model routed to a non-Anthropic provider. Everything else
+ * (no model, non-Anthropic model, Anthropic provider, unknown provider) is
+ * compatible so nothing legitimate is stripped.
+ */
+export function isModelCompatibleWithProvider(
+    model: string | undefined | null,
+    providerType: string | undefined | null,
+): boolean {
+    if (!isAnthropicModel(model)) return true;      // non-Claude model → no constraint
+    if (isAnthropicProvider(providerType)) return true; // Claude model on Claude provider → fine
+    return false;                                    // Claude model on non-Claude provider → block
+}

package/src/providers/cli-provider-instance-types.ts

@@ -105,6 +105,21 @@ export const COMPLETED_FINALIZATION_MAX_WAIT_MS = 30_000;
 // hold only covers the approval-resolved valley; widening this settle window to 4000ms
 // covers that race AND the ~3s waiting_approval valley within the settle bound.
 export const NATIVE_HISTORY_MESH_IDLE_SETTLE_MS = 4000;
+// (FALSE-IDLE-MIDTURN codex/PTY) Minimum quiet dwell required after the LAST raw PTY
+// output before a PTY-PARSED (non-native-history) provider's on-screen "final" assistant
+// bubble may be trusted as a turn-complete reply. codex parses its assistant text from the
+// terminal screen, so a completion-gate poll that lands MID-STREAM — while the screen still
+// shows a partial sentence fragment ("...하겠습니다") and the FSM momentarily reads idle —
+// satisfies completionHasFinalAssistantMessage (present=true) and would clean-emit an early
+// completion. The busyEpoch/lastOutputAt continuity guard in the flush only CANCELS when new
+// output ARRIVES during the settle; it cannot catch a turn that fell quiet just before the
+// arm and is still mid-turn. Require instead that the screen has been QUIET for at least this
+// long since the last output: a genuinely finished turn's tail is stable well past this bound,
+// while a mid-stream fragment is by definition still receiving output (or just did). Bounded,
+// non-terminal HOLD — a real completion re-passes the gate one retry later once the dwell is
+// met. Scoped (at the call site) to autonomous mesh sessions, so interactive sessions are
+// untouched.
+export const PTY_PARSED_FINAL_ASSISTANT_QUIET_DWELL_MS = 1200;
 // (FALSE-IDLE-BACKGROUND-CMD) Hard cap on how long a pending completion may be HELD
 // solely because the claude-cli transcript still shows an unresolved run_in_background
 // bash job (backgroundTaskActive). The hold is the correct behaviour while the job is