@adhdev/daemon-core 1.0.18-rc.1 → 1.0.18-rc.11

package/dist/mesh/coordinator-prompt.d.ts

@@ -68,6 +68,41 @@ export interface CoordinatorOperatingNote {
     category?: 'provider_quirk' | 'pattern_to_avoid' | 'recovery_lesson';
     createdAt?: string;
     sourceCoordinator?: string;
+    /**
+     * Operating-notes lifecycle (minimal first cut). When true the note ALWAYS
+     * rides into the coordinator prompt — it is never dropped by TTL expiry and
+     * survives the injection cap ahead of unpinned notes. Legacy notes without
+     * this field default to false.
+     */
+    pinned?: boolean;
+    /**
+     * Optional explicit expiry ISO timestamp. When set and in the past, an
+     * UNPINNED note is dropped from the injected prompt (read-side only — the
+     * ledger entry is never pruned by age). When absent, the category→TTL map
+     * (see isNoteExpired) governs expiry; pinned notes never expire regardless.
+     */
+    expiresAt?: string;
+    /**
+     * Phase 2 — the ledger id of this note, when known. Threaded from the ledger
+     * entry id at launch so version-supersede can target a specific note and
+     * same-class folding can list the subsumed ids. Repo-declared notes may lack
+     * one; absent is fine (folding/supersede fall back to the subject key).
+     */
+    noteId?: string;
+    /**
+     * Phase 2 (b) version-supersede — an optional note-id or stable subject-key
+     * this note replaces. At injection, any earlier LIVE note whose `noteId` or
+     * `subjectKey` matches this value is hidden from the prompt (the ledger entry
+     * is retained for audit). Optional and lossless: absent = supersedes nothing.
+     */
+    supersedes?: string;
+    /**
+     * Phase 2 (b)/(c) — an optional stable subject-key grouping notes about the
+     * same subject. Drives version-supersede targeting and same-class folding.
+     * When absent, folding derives a key from a leading `[tag]` bracket instead,
+     * so legacy notes still collapse by their conventional tag prefix.
+     */
+    subjectKey?: string;
 }
 export interface CoordinatorPromptContext {
     mesh: LocalMeshEntry;
@@ -102,6 +137,46 @@ export interface CoordinatorPromptContext {
     magiKindPanels?: MagiKindPanelMap;
 }
 export declare function buildCoordinatorSystemPrompt(ctx: CoordinatorPromptContext): string;
+/**
+ * Phase 2 (c) — deterministic same-class fold. Given ranked notes (already
+ * highest-priority first), collapse runs of UNPINNED notes that share the same
+ * category AND subject key into a single injected entry: keep the highest-ranked
+ * (first-seen) note and record the note-ids/count it subsumes so the rendered
+ * line can say "(+N earlier)". Pinned notes never fold — each pinned note is
+ * author-opted-in and shown verbatim. The store is untouched; this is a pure,
+ * model-free text fold at injection time.
+ *
+ * Returns the folded note list (order preserved) with per-entry subsumed info.
+ */
+interface FoldedNote {
+    note: CoordinatorOperatingNote;
+    /** note-ids of same-class notes this entry subsumes (may be empty). */
+    subsumedIds: string[];
+    /** count of subsumed notes (== subsumedIds.length, but counts id-less ones too). */
+    subsumedCount: number;
+}
+/**
+ * Operating-notes lifecycle selection (read-side). Given the effective notes
+ * (oldest-first, ledger order) and the current time, produce the ordered list
+ * that rides into the prompt:
+ *   (i)    ALWAYS include pinned notes.
+ *   (ii)   drop expired UNPINNED notes (per category TTL / explicit expiresAt).
+ *   (iii)  Phase 2 (b) drop any note SUPERSEDED by a later live note (by noteId
+ *          or subjectKey); pinned notes are never dropped by supersede.
+ *   (iv)   rank pinned-first, then durable-category, then recency (newest first).
+ *   (v)    Phase 2 (c) fold same-category/same-subject unpinned runs into one.
+ *   (vi)   Phase 2 (d) fill up to a byte budget AND a count cap; pinned always
+ *          kept even if they alone exceed the byte budget.
+ * Pure + deterministic given `now`. Returns { shown, omittedCount } where `shown`
+ * carries per-entry fold info for the renderer.
+ *
+ * Ranking is stable on the original ledger index so, within a tier, newest notes
+ * lead. The caps keep the leading (highest-priority) entries.
+ */
+export declare function selectOperatingNotesForPrompt(notes: CoordinatorOperatingNote[], now: number, cap?: number, byteBudget?: number): {
+    shown: FoldedNote[];
+    omittedCount: number;
+};
 /**
  * Render the machine-local MAGI kind-panel bindings so the coordinator KNOWS
  * which cross-verification panels (rca / design / claim_audit / freeform) are
@@ -114,3 +189,4 @@ export declare function buildCoordinatorSystemPrompt(ctx: CoordinatorPromptConte
  * That keeps a MAGI-less mesh's prompt byte-identical to before.
  */
 export declare function buildMagiKindPanelsSection(panels: MagiKindPanelMap | undefined | null): string | null;
+export {};

package/dist/mesh/mesh-active-work.d.ts

@@ -1,7 +1,7 @@
 import type { MeshLedgerEntry } from './mesh-ledger.js';
 import type { MeshWorkQueueEntry, DirectDispatchRecord } from './mesh-work-queue.js';
 export type MeshActiveWorkSource = 'queue' | 'direct';
-export type MeshActiveWorkStatus = 'pending' | 'assigned' | 'generating' | 'idle' | 'failed' | 'awaiting_approval';
+export type MeshActiveWorkStatus = 'pending' | 'assigned' | 'generating' | 'idle' | 'failed' | 'awaiting_approval' | 'awaiting_choice';
 export interface MeshActiveWorkRecord {
     taskId: string;
     source: MeshActiveWorkSource;

package/dist/mesh/mesh-disk-retention.d.ts

@@ -0,0 +1,105 @@
+import type { SessionHostSurfaceRecordLike } from '../session-host/runtime-surface.js';
+import type { LocalMeshEntry } from '../repo-mesh-types.js';
+export declare const DAY_MS: number;
+/** JSONL ledger files are legacy after the SQLite ledger — 30-day lifetime. */
+export declare const LEDGER_JSONL_MAX_AGE_MS: number;
+/** Terminated session-host runtimes: conservative 14-day retention. */
+export declare const SESSION_HOST_RUNTIME_MAX_AGE_MS: number;
+/** mesh-runtime.db.bak-* backups: 7-day retention. */
+export declare const DB_BAK_MAX_AGE_MS: number;
+/** A file candidate for age-based pruning: absolute path + last-modified epoch ms. */
+export interface AgedFile {
+    path: string;
+    mtimeMs: number;
+}
+/**
+ * PURE. Select the JSONL ledger files whose mtime is older than `maxAgeMs`
+ * relative to `now`. A file exactly at the threshold is KEPT (strict `>`), so a
+ * 30-day-old file survives its 30th day and is pruned on the 31st. Deterministic:
+ * no fs access, no clock read.
+ */
+export declare function selectExpiredLedgerJsonl(files: AgedFile[], now: number, maxAgeMs?: number): AgedFile[];
+/** A parsed session-host runtime file: its path, mtime, and the wrapped record. */
+export interface SessionHostRuntimeFile {
+    path: string;
+    mtimeMs: number;
+    /** The `record` object from the on-disk `{ record, snapshot, updatedAt }` file. */
+    record: SessionHostSurfaceRecordLike | null;
+}
+/**
+ * PURE. Select the session-host runtime files safe to delete: ONLY those whose
+ * runtime is terminated/dead (NOT a live runtime — decided by the session-host-core
+ * SSOT `isSessionHostLiveRuntime`) AND older than `maxAgeMs`. A live runtime, or a
+ * dead-but-recent one, is always kept. A file whose record failed to parse is treated
+ * as NON-live but is still age-gated, so a corrupt-but-fresh file is never removed.
+ */
+export declare function selectExpiredSessionHostRuntimes(files: SessionHostRuntimeFile[], now: number, maxAgeMs?: number): SessionHostRuntimeFile[];
+/** True for a `mesh-runtime.db.bak-*` backup filename (basename only). */
+export declare function isDbBackupFileName(name: string): boolean;
+/** PURE. Select `.bak-*` backups older than `maxAgeMs`. Strict `>` (see ledger). */
+export declare function selectExpiredDbBackups(files: AgedFile[], now: number, maxAgeMs?: number): AgedFile[];
+/** Minimal shape needed to decide whether a worktree path is orphaned. */
+export interface WorktreePathLike {
+    path: string;
+    bare?: boolean;
+}
+/** A live mesh node's known workspace paths (self workspace + repoRoot, normalized). */
+export interface LiveNodeWorkspaceLike {
+    workspace?: string;
+    repoRoot?: string;
+}
+/**
+ * PURE. Given the worktrees git reports on disk and the set of live-node workspace
+ * paths, return the worktrees that have NO matching live node — the orphan
+ * cleanup_candidates.
+ *
+ * SAFETY:
+ *  - `mainWorktreePath` (the primary repo checkout, i.e. worktree[0]) is NEVER an
+ *    orphan — it is the base repo, not a mesh clone.
+ *  - `bare` worktrees are skipped (git's internal bookkeeping, not a node checkout).
+ *  - Matching is path-equality after trailing-separator normalization against the
+ *    union of every live node's `workspace` and `repoRoot`.
+ * This is DETECTION ONLY — the caller signals a cleanup_candidate; it must not delete.
+ */
+export declare function detectOrphanWorktrees(worktrees: WorktreePathLike[], liveNodes: LiveNodeWorkspaceLike[], mainWorktreePath: string): WorktreePathLike[];
+/**
+ * Prune expired legacy JSONL ledger files under ~/.adhdev/mesh-ledger/.
+ * Matches only `*.jsonl` (never the SQLite .db / -wal / -shm files). Returns the
+ * count deleted. Best-effort: individual unlink failures are logged, not thrown.
+ */
+export declare function pruneExpiredLedgerJsonl(now?: number): number;
+/**
+ * Prune expired `mesh-runtime.db.bak-*` backups under ~/.adhdev/mesh-ledger/.
+ * Never touches the live DB (only names matching the .bak- prefix). Returns count.
+ */
+export declare function pruneExpiredDbBackups(now?: number): number;
+/**
+ * Prune terminated session-host runtime files older than 14 days across every
+ * ~/.adhdev/session-host/<app>/runtimes/ directory. A LIVE runtime is never deleted
+ * regardless of age (isSessionHostLiveRuntime SSOT). Returns count deleted.
+ */
+export declare function pruneExpiredSessionHostRuntimes(now?: number): number;
+/**
+ * Run the file-deleting retention passes (JSONL ledger, DB backups, session-host
+ * runtimes) once. Each pass is isolated so one failing pass never blocks the others.
+ * Orphan-worktree DETECTION is driven separately in the reconcile loop (it needs the
+ * live mesh config + git worktree list and emits a ledger signal rather than deleting).
+ */
+export declare function runDiskRetentionSweep(now?: number): {
+    ledgerJsonl: number;
+    dbBackups: number;
+    sessionHostRuntimes: number;
+};
+/**
+ * Detect orphaned worktrees for ONE mesh and emit a `worktree_cleanup_candidate`
+ * ledger signal for each — DETECTION ONLY, never deletes. An orphan is a git worktree
+ * on disk with no matching live mesh node (compared by path). It:
+ *   1. picks a base (non-worktree) node owned by this mesh to anchor `git worktree list`;
+ *   2. diffs the reported worktrees against the union of every node's workspace/repoRoot;
+ *   3. skips the main worktree + bare entries (detectOrphanWorktrees safety);
+ *   4. suppresses a repeat for a worktreePath already signalled within the recent window
+ *      (idempotent re-emit guard), so the hourly sweep doesn't spam the ledger.
+ * Returns the list of newly-signalled orphan paths. Best-effort: git/ledger failures are
+ * logged and yield an empty result, never thrown.
+ */
+export declare function detectAndSignalOrphanWorktrees(mesh: LocalMeshEntry, now?: number): Promise<string[]>;

package/dist/mesh/mesh-ledger.d.ts

@@ -15,7 +15,7 @@
 import { EventEmitter } from 'events';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
 import { type MeshLedgerOriginatingCoordinatorV2 } from './contracts.js';
-export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned' | 'event_held' | 'event_held_requeued' | 'task_reclaimed' | 'coordinator_operating_note' | 'coordinator_operating_note_tombstone' | 'mission_created' | 'mission_status_changed' | 'mission_goal_updated' | 'magi_dispatched' | 'magi_synthesis' | 'key_injection';
+export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'task_question_pending' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned' | 'event_held' | 'event_held_requeued' | 'task_reclaimed' | 'coordinator_operating_note' | 'coordinator_operating_note_tombstone' | 'mission_created' | 'mission_status_changed' | 'mission_goal_updated' | 'magi_dispatched' | 'magi_synthesis' | 'key_injection' | 'worktree_cleanup_candidate';
 export interface MeshLedgerEntry {
     id: string;
     meshId: string;
@@ -162,6 +162,33 @@ export declare const OPERATING_NOTE_KIND: MeshLedgerKind;
 export declare const OPERATING_NOTE_TOMBSTONE_KIND: MeshLedgerKind;
 export declare const OPERATING_NOTE_DEDUPE_WINDOW = 40;
 export declare const OPERATING_NOTE_KEEP_LATEST = 100;
+export declare const OPERATING_NOTE_CATEGORY_TTL_DAYS: Readonly<Record<string, number>>;
+/**
+ * Shape isNoteExpired reads. Structural so mesh-ledger stays free of a
+ * coordinator-prompt import (CoordinatorOperatingNote satisfies this).
+ */
+export interface OperatingNoteExpiryInput {
+    category?: string;
+    pinned?: boolean;
+    createdAt?: string;
+    /** Explicit expiry override; wins over the category TTL when parseable. */
+    expiresAt?: string;
+    /** Fallback creation time (ledger entry timestamp) when createdAt absent. */
+    timestamp?: string;
+}
+/**
+ * Pure helper: is this UNPINNED operating note expired as of `now` (epoch ms)?
+ *
+ * Rules:
+ *  - pinned notes NEVER expire (always false).
+ *  - an explicit, parseable `expiresAt` in the past → expired.
+ *  - otherwise the category TTL applies; a durable category (provider_quirk,
+ *    uncategorized, or any category not in the TTL map) never expires.
+ *  - age is measured from createdAt, falling back to `timestamp` (ledger entry
+ *    time). If neither is a valid date, the note is treated as NOT expired
+ *    (never silently drop a note we cannot age).
+ */
+export declare function isNoteExpired(note: OperatingNoteExpiryInput, now: number): boolean;
 export declare function getLedgerDir(): string;
 /**
  * Footer to append to worker task messages so workers output structured results

package/dist/mesh/mesh-node-identity.d.ts

@@ -107,6 +107,29 @@ export declare function resolveEffectiveMeshNodeHealth(node: any): string;
  * replica that can never run.
  */
 export declare function isMeshNodeHealthLaunchable(node: any): boolean;
+/**
+ * Launch FRESHNESS gate — distinct from the health gate above.
+ *
+ * `deriveMeshNodeHealthFromGit` reports a clean-tree node with `behind > 0` as
+ * 'online', so the health gate (isMeshNodeHealthLaunchable) happily lets a STALE
+ * node — one whose branch is N commits behind its upstream — win auto-launch fitness
+ * routing and run a fresh worker against out-of-date code. `behind` is deliberately
+ * NOT folded into deriveMeshNodeHealthFromGit because "behind" is not universally
+ * unhealthy (the MAGI planner and other callers share that resolver); it is only
+ * unhealthy for *spawning new work*. This gate encodes exactly that launch-time axis.
+ *
+ * Returns false (NOT fresh → skip / de-rank) only when git telemetry is PRESENT and
+ * proves staleness:
+ *   - behind count exceeds `maxBehind` (default 0 — any behind blocks), OR
+ *   - a submodule is out of sync (gitlink points off upstream — cannot be caught up
+ *     by a simple worktree ff and would launch against a mismatched submodule).
+ *
+ * When telemetry is absent it returns true (fresh), preserving the online/unknown-pass
+ * philosophy: we never block on missing data, only on data that proves the node stale.
+ */
+export declare function isMeshNodeFreshEnoughToLaunch(node: any, opts?: {
+    maxBehind?: number;
+}): boolean;
 export declare function applyInlineMeshBranchConvergence(mesh: any, node: any, status: Record<string, unknown>): void;
 export declare function summarizeInlineMeshBranchConvergence(nodes: Array<Record<string, unknown>>): Record<string, unknown>;
 export declare function readCachedInlineMeshActiveSessions(node: any): string[];

package/dist/mesh/mesh-refine-gates.d.ts

@@ -504,6 +504,95 @@ type GitlinkTrivialFastForwardEvaluation = {
  * gate.
  */
 export declare function collectFastForwardGitlinkPaths(repoRoot: string, baseHead: string, branchHead: string): string[];
+export type SubmoduleGitlinkConvergeResult = {
+    /** True when at least one diverged gitlink submodule was rebased onto its base-side commit. */
+    converged: boolean;
+    /**
+     * Set when convergence was declined/aborted (fail-safe → caller keeps the
+     * original defer→blocked_review path). One of:
+     *   no_changed_gitlinks — no gitlink differs base↔branch
+     *   not_diverged        — the gitlink is ff/behind/equal (gate handles it)
+     *   rebase_conflict     — replaying branch-side onto base-side hit a real
+     *                         content conflict inside the submodule (aborted)
+     */
+    reason?: string;
+    /**
+     * Converged gitlinks: path → the rebased submodule commit (SUBNEW) that the
+     * root rebase must resolve the gitlink conflict to. Only populated for paths
+     * whose submodule was successfully rebased (base-side is now a strict ancestor).
+     */
+    resolutions: Array<{
+        path: string;
+        baseCommit: string;
+        branchCommit: string;
+        rebasedCommit: string;
+    }>;
+    /** Per-path outcome for observability/logging. */
+    gitlinks: Array<{
+        path: string;
+        baseCommit?: string;
+        branchCommit?: string;
+        rebasedCommit?: string;
+        action: 'rebased' | 'skipped_not_diverged' | 'rebase_conflict';
+    }>;
+};
+/**
+ * STEP 1 of auto-converging diverged oss-style submodule gitlinks: rebase the
+ * branch-side submodule commit(s) onto the base-side submodule commit INSIDE the
+ * worktree's submodule checkout (detached HEAD), so the base-side commit becomes a
+ * strict ancestor of the rebased tip. Returns the rebased commit per path so the
+ * caller's root rebase can resolve the gitlink conflict to it (STEP 2, see
+ * {@link rootRebaseResolvingGitlinks}). This automates the documented manual
+ * strict-fast-forward bypass and keeps the landed submodule history linear rather
+ * than masking a divergence.
+ *
+ * Fail-safe by construction: it only touches gitlinks that are a genuine sibling
+ * divergence (both commits local, neither an ancestor of the other, shared merge
+ * base). A submodule rebase content conflict aborts, restores the branch-side
+ * checkout, and returns `converged:false` (caller keeps defer→blocked_review). It
+ * never commits the root and NEVER pushes — remote publish is the merge/
+ * reachability stage's job; this stage is local reconciliation only.
+ *
+ * @param worktreeRoot the branch worktree root (its `<path>` submodule checkout is rebased)
+ * @param baseRepoRoot the source/base repo root (reads the base-side gitlink commit)
+ * @param baseHead     the fetched base head (root ref) — source of base-side gitlink commits
+ * @param branchHead   the worktree branch head (root ref) — source of branch-side gitlink commits
+ */
+export declare function convergeDivergedSubmoduleGitlinks(worktreeRoot: string, baseRepoRoot: string, baseHead: string, branchHead: string): SubmoduleGitlinkConvergeResult;
+export type RootRebaseGitlinkResolveResult = {
+    /** True when the root rebase completed (with gitlink conflicts resolved to the converged commits). */
+    ok: boolean;
+    /** New root HEAD after the rebase (only meaningful when ok). */
+    branchHead?: string;
+    /**
+     * Set when the rebase was aborted (fail-safe). One of:
+     *   non_gitlink_conflict — a conflict on a non-submodule path (genuine content conflict)
+     *   unexpected_gitlink   — a gitlink conflicted that we have no converged commit for
+     *   rebase_error         — the rebase failed for a non-conflict reason
+     */
+    reason?: string;
+    /** The paths that conflicted at the point of abort (for diagnostics). */
+    conflictPaths?: string[];
+};
+/**
+ * STEP 2 of auto-converging diverged submodule gitlinks: rebase the worktree root
+ * branch onto `baseHead`, resolving each submodule-gitlink conflict to the
+ * pre-converged commit from {@link convergeDivergedSubmoduleGitlinks}. git's
+ * recursive merge refuses to auto-merge a diverged gitlink ("Recursive merging
+ * with submodules currently only supports trivial cases"), so we drive the rebase
+ * ourselves: on each stop, if the ONLY unmerged paths are gitlinks we have a
+ * converged commit for, we stage those to the converged commit and `--continue`.
+ * Any non-gitlink conflict (or a gitlink with no converged commit) aborts the
+ * rebase and returns `ok:false` → caller keeps the defer→blocked_review path.
+ *
+ * On success the base-side gitlink is a strict ancestor of the resolved branch-side
+ * commit, so the downstream patch-equivalence gate treats it as a trivial
+ * fast-forward and passes.
+ */
+export declare function rootRebaseResolvingGitlinks(worktreeRoot: string, baseHead: string, resolutions: Array<{
+    path: string;
+    rebasedCommit: string;
+}>): RootRebaseGitlinkResolveResult;
 /**
  * Decide whether a merge-tree submodule conflict between base and branch is a
  * trivial gitlink fast-forward (and nothing else).

package/dist/mesh/mesh-runtime-store.d.ts

@@ -23,6 +23,17 @@ export declare class MeshRuntimeStore {
     private static loggedGetInstanceFailure;
     static getInstance(): MeshRuntimeStore;
     static resetForTests(): void;
+    /**
+     * VACUUM the SQLite database to reclaim on-disk space. Retention prunes rows
+     * with DELETE, which frees pages inside the file but does NOT shrink it — the
+     * mesh-runtime.db grew to hundreds of MB (mission 86def38d disk-accumulation
+     * bootstrap failure) precisely because the file was never compacted. This
+     * rewrites the DB into a minimal footprint. Best-effort: a VACUUM failure (e.g.
+     * insufficient temp space, a read lock) is logged and swallowed so it can never
+     * block daemon shutdown. Called once on shutdown (see daemon-lifecycle), never
+     * on the hot path — VACUUM takes an exclusive lock and rewrites the whole file.
+     */
+    vacuum(): void;
     close(): void;
     transaction<T>(fn: () => T): T;
     private migrate;

package/dist/mesh/mesh-work-queue.d.ts

@@ -337,7 +337,15 @@ export type DependencyFailurePolicy = 'block' | 'cancel';
  * Update the status of a specific task.
  * Used when a session completes, fails, or stalls.
  */
-export declare function updateTaskStatus(meshId: string, taskId: string, status: MeshTaskStatus, opts?: MeshQueueMutationOptions): MeshWorkQueueEntry | null;
+export declare function updateTaskStatus(meshId: string, taskId: string, status: MeshTaskStatus, opts?: {
+    /**
+     * CANCEL-STICKY-TERMINAL: operator/system override to permit a terminal→non-terminal
+     * transition (e.g. an explicit operator reopen). Without this, a write that would flip
+     * a `completed`/`failed`/`cancelled` row back to `pending`/`assigned` is refused as a
+     * no-op. Terminal→terminal and any transition FROM a non-terminal state are unaffected.
+     */
+    force?: boolean;
+} & MeshQueueMutationOptions): MeshWorkQueueEntry | null;
 export declare function recordTaskAutoLaunch(meshId: string, taskId: string, autoLaunch: Omit<NonNullable<MeshWorkQueueEntry['autoLaunch']>, 'updatedAt'>): MeshWorkQueueEntry | null;
 /**
  * Mark a queue task as manually cancelled without deleting audit history.
@@ -345,6 +353,21 @@ export declare function recordTaskAutoLaunch(meshId: string, taskId: string, aut
 export declare function cancelTask(meshId: string, taskId: string, opts?: {
     reason?: string;
 } & MeshQueueMutationOptions): MeshWorkQueueEntry | null;
+/**
+ * CANCEL-STICKY-TERMINAL: the assignment a task carried at cancel time, handed to the cancel
+ * command handler so it can stop the bound worker. cancelTask runs in the pure queue-store
+ * module (no DaemonComponents), so it records the binding here and the handler drains it.
+ */
+export interface CancelledTaskAssignment {
+    sessionId: string;
+    nodeId?: string;
+    providerType?: string;
+}
+/**
+ * Read-and-clear the assignment a just-cancelled task was bound to. Returns undefined when the
+ * cancelled task had no live assignment (nothing to stop). One-shot: the entry is deleted on read.
+ */
+export declare function takeCancelledTaskAssignment(meshId: string, taskId: string): CancelledTaskAssignment | undefined;
 /**
  * Return a queue task to pending for retry. By default, dead session targeting
  * and assigned ownership are cleared so stale assignments do not strand again.

package/dist/providers/cli-provider-instance-types.d.ts

@@ -19,6 +19,7 @@ export type CompletedFinalizationBlock = {
     terminal?: boolean;
     allowTimeout?: boolean;
     holdForTranscript?: boolean;
+    noExternalTranscriptSource?: boolean;
 };
 export type CompletionFinalAssistantEvidence = {
     present: boolean;
@@ -37,8 +38,11 @@ export type ExternalTranscriptProbe = {
 };
 export declare const COMPLETED_FINALIZATION_RETRY_MS = 1000;
 export declare const COMPLETED_FINALIZATION_MAX_WAIT_MS = 30000;
+export declare const CANON_C_MISSING_ASSISTANT_MIN_ELAPSED_MS = 20000;
 export declare const NATIVE_HISTORY_MESH_IDLE_SETTLE_MS = 4000;
 export declare const PTY_PARSED_FINAL_ASSISTANT_QUIET_DWELL_MS = 1200;
+export declare const ANTIGRAVITY_HOLD_QUIET_DWELL_MS = 3000;
+export declare const ANTIGRAVITY_HOLD_HARD_CAP_MS: number;
 export declare const BACKGROUND_TASK_HOLD_MAX_MS: number;
 export declare const USER_INPUT_ACK_DEDUP_WINDOW_MS = 60000;
 export declare const STARTUP_GRACE_IDLE_COLLAPSE_WINDOW_MS = 12000;

package/dist/providers/cli-provider-instance.d.ts

@@ -201,6 +201,7 @@ export declare class CliProviderInstance implements ProviderInstance {
     private generatingDebounceTimer;
     private generatingDebouncePending;
     private lastApprovalEventFingerprint;
+    private lastInteractivePromptEventKey;
     private autoApproveBusy;
     private autoApproveBusyTimer;
     private lastAutoApprovalSignature;
@@ -473,6 +474,7 @@ export declare class CliProviderInstance implements ProviderInstance {
     private completionFinalSummary;
     private buildCompletedFinalizationDiagnostic;
     private hasAdapterPendingResponse;
+    private antigravityHoldPtyStillActive;
     private shouldSuppressStaleParsedBusyStatus;
     private getCompletedFinalizationBlock;
     private hasApprovalResolutionEvidence;

package/dist/providers/sdk/v1/builders/cli/detect-status.d.ts

@@ -75,6 +75,20 @@ export interface DetectStatusTuiSpec {
 declare function scopeText(input: CliStatusInput, scope: SpinnerSpec['scope'] | SettledPromptSpec['scope'], windowLines: number | undefined): string;
 declare function spinnerMatches(spec: SpinnerSpec, input: CliStatusInput): boolean;
 declare function settledPromptMatches(spec: SettledPromptSpec, input: CliStatusInput): boolean;
+/**
+ * APPROVAL-PICKER-MISROUTE (mission f1d25e11) defense-in-depth: an
+ * AskUserQuestion multi-choice picker is NOT an approval modal. Its option rows
+ * ("❯ 1. label") can otherwise satisfy the approval button cue and get
+ * mis-classified as `waiting_approval`, so the worker's question is surfaced to
+ * the coordinator as a task_approval_needed (→ mesh_approve, which cannot answer
+ * it). The picker carries a distinctive signature the approval FSM never does:
+ * the claude TUI select footer ("Enter to select … Esc to cancel") together with
+ * the freeform escape hatch ("Type something" / "Chat about this"). When both are
+ * present the screen is a question picker — surfaced separately as
+ * waiting_choice — so the approval matchers must yield. Mirrors the legacy
+ * looksLikeSelectionPicker guard (cli-provider-instance.ts) ported to SDK-v1.
+ */
+export declare function isAskUserQuestionPickerSignature(text: string): boolean;
 declare function modalMatches(spec: ModalSpec, input: CliStatusInput): boolean;
 export declare function buildDetectStatusFromTui(spec: DetectStatusTuiSpec): CliDetectStatusFn;
 export declare const __internal: {

package/dist/providers/types/interactive-prompt.d.ts

@@ -28,6 +28,24 @@ export interface InteractiveAnswer {
 }
 export declare function normalizeInteractivePrompt(raw: unknown): InteractivePrompt | null;
 export declare function normalizeInteractivePromptResponse(raw: unknown): InteractivePromptResponse;
+/**
+ * Resolve a coordinator-friendly answer form into the strict, questionId-keyed
+ * InteractivePromptResponse the TUI/answer machinery consumes (mission f1d25e11).
+ *
+ * mesh_answer_question lets the coordinator answer against the option LABELS or
+ * 1-based INDEXES it saw in the agent:waiting_choice event, without having to
+ * reconstruct the exact questionId → selectedLabels map. This resolves that
+ * ergonomic form against the AUTHORITATIVE active prompt (the daemon holds it),
+ * so index/label resolution and question ordering are correct by construction.
+ *
+ * Accepted `raw` shapes:
+ *   - The strict form ({ promptId, answers: { [questionId]: { selectedLabels } } })
+ *     — passed straight to normalizeInteractivePromptResponse (back-compat).
+ *   - The friendly form ({ promptId, answers: [ { questionId?, select?, freeform? } ] })
+ *     — entries map to questions by questionId, else by array position. `select`
+ *     is a label (string) / 1-based index (number) / array of either.
+ */
+export declare function resolveInteractivePromptResponse(prompt: InteractivePrompt, raw: unknown): InteractivePromptResponse;
 export declare function buildClaudeInteractiveToolResult(response: InteractivePromptResponse): string;
 export interface ClaudeInteractiveTuiPage {
     screenText: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "1.0.18-rc.1",
+  "version": "1.0.18-rc.11",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "1.0.18-rc.1",
-    "@adhdev/session-host-core": "1.0.18-rc.1",
+    "@adhdev/mesh-shared": "1.0.18-rc.11",
+    "@adhdev/session-host-core": "1.0.18-rc.11",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/boot/daemon-lifecycle.ts

@@ -39,6 +39,7 @@ import type { IdeProviderInstance } from '../providers/ide-provider-instance.js'
 import { createDefaultGitCommandServices } from '../git/git-commands.js';
 import { setupMeshEventForwarding } from '../mesh/mesh-events.js';
 import { setupMeshReconcileLoop } from '../mesh/mesh-reconcile-loop.js';
+import { MeshRuntimeStore } from '../mesh/mesh-runtime-store.js';
 import { loadMeshCoordinatorRegistry } from '../mesh/coordinator-registry.js';
 import { applyProcessHardening } from './process-hardening.js';
 import { installProviderProcessShim } from '../providers/sdk/v1/sandbox/require-whitelist.js';
@@ -503,4 +504,13 @@ export async function shutdownDaemonComponents(components: DaemonComponents): Pr
         try { m.disconnect(); } catch { /* noop */ }
     }
     cdpManagers.clear();
+
+    // 7. VACUUM the mesh runtime DB. Retention prunes rows with DELETE (frees pages
+    // inside the file but never shrinks it); the mesh-runtime.db grew to hundreds of
+    // MB (mission 86def38d disk-accumulation bootstrap failure) because it was never
+    // compacted. Do this LAST, after all writers (reconcile loop, CLIs, instances)
+    // are stopped, so nothing contends for the exclusive VACUUM lock. Best-effort —
+    // vacuum() swallows its own errors; the try/catch guards the getInstance() throw
+    // when the store never opened (degraded JSONL-only mode).
+    try { MeshRuntimeStore.getInstance().vacuum(); } catch { /* store unavailable — nothing to vacuum */ }
 }