@adhdev/daemon-core 1.0.18-rc.10 → 1.0.18-rc.12

package/dist/mesh/mesh-active-work.d.ts

@@ -1,7 +1,7 @@
 import type { MeshLedgerEntry } from './mesh-ledger.js';
 import type { MeshWorkQueueEntry, DirectDispatchRecord } from './mesh-work-queue.js';
 export type MeshActiveWorkSource = 'queue' | 'direct';
-export type MeshActiveWorkStatus = 'pending' | 'assigned' | 'generating' | 'idle' | 'failed' | 'awaiting_approval';
+export type MeshActiveWorkStatus = 'pending' | 'assigned' | 'generating' | 'idle' | 'failed' | 'awaiting_approval' | 'awaiting_choice';
 export interface MeshActiveWorkRecord {
     taskId: string;
     source: MeshActiveWorkSource;

package/dist/mesh/mesh-ledger.d.ts

@@ -15,7 +15,7 @@
 import { EventEmitter } from 'events';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
 import { type MeshLedgerOriginatingCoordinatorV2 } from './contracts.js';
-export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned' | 'event_held' | 'event_held_requeued' | 'task_reclaimed' | 'coordinator_operating_note' | 'coordinator_operating_note_tombstone' | 'mission_created' | 'mission_status_changed' | 'mission_goal_updated' | 'magi_dispatched' | 'magi_synthesis' | 'key_injection' | 'worktree_cleanup_candidate';
+export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'task_question_pending' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned' | 'event_held' | 'event_held_requeued' | 'task_reclaimed' | 'coordinator_operating_note' | 'coordinator_operating_note_tombstone' | 'mission_created' | 'mission_status_changed' | 'mission_goal_updated' | 'magi_dispatched' | 'magi_synthesis' | 'key_injection' | 'worktree_cleanup_candidate';
 export interface MeshLedgerEntry {
     id: string;
     meshId: string;

package/dist/mesh/mesh-node-identity.d.ts

@@ -107,6 +107,29 @@ export declare function resolveEffectiveMeshNodeHealth(node: any): string;
  * replica that can never run.
  */
 export declare function isMeshNodeHealthLaunchable(node: any): boolean;
+/**
+ * Launch FRESHNESS gate — distinct from the health gate above.
+ *
+ * `deriveMeshNodeHealthFromGit` reports a clean-tree node with `behind > 0` as
+ * 'online', so the health gate (isMeshNodeHealthLaunchable) happily lets a STALE
+ * node — one whose branch is N commits behind its upstream — win auto-launch fitness
+ * routing and run a fresh worker against out-of-date code. `behind` is deliberately
+ * NOT folded into deriveMeshNodeHealthFromGit because "behind" is not universally
+ * unhealthy (the MAGI planner and other callers share that resolver); it is only
+ * unhealthy for *spawning new work*. This gate encodes exactly that launch-time axis.
+ *
+ * Returns false (NOT fresh → skip / de-rank) only when git telemetry is PRESENT and
+ * proves staleness:
+ *   - behind count exceeds `maxBehind` (default 0 — any behind blocks), OR
+ *   - a submodule is out of sync (gitlink points off upstream — cannot be caught up
+ *     by a simple worktree ff and would launch against a mismatched submodule).
+ *
+ * When telemetry is absent it returns true (fresh), preserving the online/unknown-pass
+ * philosophy: we never block on missing data, only on data that proves the node stale.
+ */
+export declare function isMeshNodeFreshEnoughToLaunch(node: any, opts?: {
+    maxBehind?: number;
+}): boolean;
 export declare function applyInlineMeshBranchConvergence(mesh: any, node: any, status: Record<string, unknown>): void;
 export declare function summarizeInlineMeshBranchConvergence(nodes: Array<Record<string, unknown>>): Record<string, unknown>;
 export declare function readCachedInlineMeshActiveSessions(node: any): string[];

package/dist/mesh/mesh-refine-gates.d.ts

@@ -504,6 +504,95 @@ type GitlinkTrivialFastForwardEvaluation = {
  * gate.
  */
 export declare function collectFastForwardGitlinkPaths(repoRoot: string, baseHead: string, branchHead: string): string[];
+export type SubmoduleGitlinkConvergeResult = {
+    /** True when at least one diverged gitlink submodule was rebased onto its base-side commit. */
+    converged: boolean;
+    /**
+     * Set when convergence was declined/aborted (fail-safe → caller keeps the
+     * original defer→blocked_review path). One of:
+     *   no_changed_gitlinks — no gitlink differs base↔branch
+     *   not_diverged        — the gitlink is ff/behind/equal (gate handles it)
+     *   rebase_conflict     — replaying branch-side onto base-side hit a real
+     *                         content conflict inside the submodule (aborted)
+     */
+    reason?: string;
+    /**
+     * Converged gitlinks: path → the rebased submodule commit (SUBNEW) that the
+     * root rebase must resolve the gitlink conflict to. Only populated for paths
+     * whose submodule was successfully rebased (base-side is now a strict ancestor).
+     */
+    resolutions: Array<{
+        path: string;
+        baseCommit: string;
+        branchCommit: string;
+        rebasedCommit: string;
+    }>;
+    /** Per-path outcome for observability/logging. */
+    gitlinks: Array<{
+        path: string;
+        baseCommit?: string;
+        branchCommit?: string;
+        rebasedCommit?: string;
+        action: 'rebased' | 'skipped_not_diverged' | 'rebase_conflict';
+    }>;
+};
+/**
+ * STEP 1 of auto-converging diverged oss-style submodule gitlinks: rebase the
+ * branch-side submodule commit(s) onto the base-side submodule commit INSIDE the
+ * worktree's submodule checkout (detached HEAD), so the base-side commit becomes a
+ * strict ancestor of the rebased tip. Returns the rebased commit per path so the
+ * caller's root rebase can resolve the gitlink conflict to it (STEP 2, see
+ * {@link rootRebaseResolvingGitlinks}). This automates the documented manual
+ * strict-fast-forward bypass and keeps the landed submodule history linear rather
+ * than masking a divergence.
+ *
+ * Fail-safe by construction: it only touches gitlinks that are a genuine sibling
+ * divergence (both commits local, neither an ancestor of the other, shared merge
+ * base). A submodule rebase content conflict aborts, restores the branch-side
+ * checkout, and returns `converged:false` (caller keeps defer→blocked_review). It
+ * never commits the root and NEVER pushes — remote publish is the merge/
+ * reachability stage's job; this stage is local reconciliation only.
+ *
+ * @param worktreeRoot the branch worktree root (its `<path>` submodule checkout is rebased)
+ * @param baseRepoRoot the source/base repo root (reads the base-side gitlink commit)
+ * @param baseHead     the fetched base head (root ref) — source of base-side gitlink commits
+ * @param branchHead   the worktree branch head (root ref) — source of branch-side gitlink commits
+ */
+export declare function convergeDivergedSubmoduleGitlinks(worktreeRoot: string, baseRepoRoot: string, baseHead: string, branchHead: string): SubmoduleGitlinkConvergeResult;
+export type RootRebaseGitlinkResolveResult = {
+    /** True when the root rebase completed (with gitlink conflicts resolved to the converged commits). */
+    ok: boolean;
+    /** New root HEAD after the rebase (only meaningful when ok). */
+    branchHead?: string;
+    /**
+     * Set when the rebase was aborted (fail-safe). One of:
+     *   non_gitlink_conflict — a conflict on a non-submodule path (genuine content conflict)
+     *   unexpected_gitlink   — a gitlink conflicted that we have no converged commit for
+     *   rebase_error         — the rebase failed for a non-conflict reason
+     */
+    reason?: string;
+    /** The paths that conflicted at the point of abort (for diagnostics). */
+    conflictPaths?: string[];
+};
+/**
+ * STEP 2 of auto-converging diverged submodule gitlinks: rebase the worktree root
+ * branch onto `baseHead`, resolving each submodule-gitlink conflict to the
+ * pre-converged commit from {@link convergeDivergedSubmoduleGitlinks}. git's
+ * recursive merge refuses to auto-merge a diverged gitlink ("Recursive merging
+ * with submodules currently only supports trivial cases"), so we drive the rebase
+ * ourselves: on each stop, if the ONLY unmerged paths are gitlinks we have a
+ * converged commit for, we stage those to the converged commit and `--continue`.
+ * Any non-gitlink conflict (or a gitlink with no converged commit) aborts the
+ * rebase and returns `ok:false` → caller keeps the defer→blocked_review path.
+ *
+ * On success the base-side gitlink is a strict ancestor of the resolved branch-side
+ * commit, so the downstream patch-equivalence gate treats it as a trivial
+ * fast-forward and passes.
+ */
+export declare function rootRebaseResolvingGitlinks(worktreeRoot: string, baseHead: string, resolutions: Array<{
+    path: string;
+    rebasedCommit: string;
+}>): RootRebaseGitlinkResolveResult;
 /**
  * Decide whether a merge-tree submodule conflict between base and branch is a
  * trivial gitlink fast-forward (and nothing else).

package/dist/mesh/mesh-work-queue.d.ts

@@ -337,7 +337,15 @@ export type DependencyFailurePolicy = 'block' | 'cancel';
  * Update the status of a specific task.
  * Used when a session completes, fails, or stalls.
  */
-export declare function updateTaskStatus(meshId: string, taskId: string, status: MeshTaskStatus, opts?: MeshQueueMutationOptions): MeshWorkQueueEntry | null;
+export declare function updateTaskStatus(meshId: string, taskId: string, status: MeshTaskStatus, opts?: {
+    /**
+     * CANCEL-STICKY-TERMINAL: operator/system override to permit a terminal→non-terminal
+     * transition (e.g. an explicit operator reopen). Without this, a write that would flip
+     * a `completed`/`failed`/`cancelled` row back to `pending`/`assigned` is refused as a
+     * no-op. Terminal→terminal and any transition FROM a non-terminal state are unaffected.
+     */
+    force?: boolean;
+} & MeshQueueMutationOptions): MeshWorkQueueEntry | null;
 export declare function recordTaskAutoLaunch(meshId: string, taskId: string, autoLaunch: Omit<NonNullable<MeshWorkQueueEntry['autoLaunch']>, 'updatedAt'>): MeshWorkQueueEntry | null;
 /**
  * Mark a queue task as manually cancelled without deleting audit history.
@@ -345,6 +353,21 @@ export declare function recordTaskAutoLaunch(meshId: string, taskId: string, aut
 export declare function cancelTask(meshId: string, taskId: string, opts?: {
     reason?: string;
 } & MeshQueueMutationOptions): MeshWorkQueueEntry | null;
+/**
+ * CANCEL-STICKY-TERMINAL: the assignment a task carried at cancel time, handed to the cancel
+ * command handler so it can stop the bound worker. cancelTask runs in the pure queue-store
+ * module (no DaemonComponents), so it records the binding here and the handler drains it.
+ */
+export interface CancelledTaskAssignment {
+    sessionId: string;
+    nodeId?: string;
+    providerType?: string;
+}
+/**
+ * Read-and-clear the assignment a just-cancelled task was bound to. Returns undefined when the
+ * cancelled task had no live assignment (nothing to stop). One-shot: the entry is deleted on read.
+ */
+export declare function takeCancelledTaskAssignment(meshId: string, taskId: string): CancelledTaskAssignment | undefined;
 /**
  * Return a queue task to pending for retry. By default, dead session targeting
  * and assigned ownership are cleared so stale assignments do not strand again.

package/dist/providers/cli-provider-instance-types.d.ts

@@ -19,6 +19,7 @@ export type CompletedFinalizationBlock = {
     terminal?: boolean;
     allowTimeout?: boolean;
     holdForTranscript?: boolean;
+    noExternalTranscriptSource?: boolean;
 };
 export type CompletionFinalAssistantEvidence = {
     present: boolean;
@@ -37,6 +38,7 @@ export type ExternalTranscriptProbe = {
 };
 export declare const COMPLETED_FINALIZATION_RETRY_MS = 1000;
 export declare const COMPLETED_FINALIZATION_MAX_WAIT_MS = 30000;
+export declare const CANON_C_MISSING_ASSISTANT_MIN_ELAPSED_MS = 20000;
 export declare const NATIVE_HISTORY_MESH_IDLE_SETTLE_MS = 4000;
 export declare const PTY_PARSED_FINAL_ASSISTANT_QUIET_DWELL_MS = 1200;
 export declare const ANTIGRAVITY_HOLD_QUIET_DWELL_MS = 3000;

package/dist/providers/sdk/v1/builders/cli/detect-status.d.ts

@@ -75,6 +75,20 @@ export interface DetectStatusTuiSpec {
 declare function scopeText(input: CliStatusInput, scope: SpinnerSpec['scope'] | SettledPromptSpec['scope'], windowLines: number | undefined): string;
 declare function spinnerMatches(spec: SpinnerSpec, input: CliStatusInput): boolean;
 declare function settledPromptMatches(spec: SettledPromptSpec, input: CliStatusInput): boolean;
+/**
+ * APPROVAL-PICKER-MISROUTE (mission f1d25e11) defense-in-depth: an
+ * AskUserQuestion multi-choice picker is NOT an approval modal. Its option rows
+ * ("❯ 1. label") can otherwise satisfy the approval button cue and get
+ * mis-classified as `waiting_approval`, so the worker's question is surfaced to
+ * the coordinator as a task_approval_needed (→ mesh_approve, which cannot answer
+ * it). The picker carries a distinctive signature the approval FSM never does:
+ * the claude TUI select footer ("Enter to select … Esc to cancel") together with
+ * the freeform escape hatch ("Type something" / "Chat about this"). When both are
+ * present the screen is a question picker — surfaced separately as
+ * waiting_choice — so the approval matchers must yield. Mirrors the legacy
+ * looksLikeSelectionPicker guard (cli-provider-instance.ts) ported to SDK-v1.
+ */
+export declare function isAskUserQuestionPickerSignature(text: string): boolean;
 declare function modalMatches(spec: ModalSpec, input: CliStatusInput): boolean;
 export declare function buildDetectStatusFromTui(spec: DetectStatusTuiSpec): CliDetectStatusFn;
 export declare const __internal: {

package/dist/providers/types/interactive-prompt.d.ts

@@ -28,6 +28,24 @@ export interface InteractiveAnswer {
 }
 export declare function normalizeInteractivePrompt(raw: unknown): InteractivePrompt | null;
 export declare function normalizeInteractivePromptResponse(raw: unknown): InteractivePromptResponse;
+/**
+ * Resolve a coordinator-friendly answer form into the strict, questionId-keyed
+ * InteractivePromptResponse the TUI/answer machinery consumes (mission f1d25e11).
+ *
+ * mesh_answer_question lets the coordinator answer against the option LABELS or
+ * 1-based INDEXES it saw in the agent:waiting_choice event, without having to
+ * reconstruct the exact questionId → selectedLabels map. This resolves that
+ * ergonomic form against the AUTHORITATIVE active prompt (the daemon holds it),
+ * so index/label resolution and question ordering are correct by construction.
+ *
+ * Accepted `raw` shapes:
+ *   - The strict form ({ promptId, answers: { [questionId]: { selectedLabels } } })
+ *     — passed straight to normalizeInteractivePromptResponse (back-compat).
+ *   - The friendly form ({ promptId, answers: [ { questionId?, select?, freeform? } ] })
+ *     — entries map to questions by questionId, else by array position. `select`
+ *     is a label (string) / 1-based index (number) / array of either.
+ */
+export declare function resolveInteractivePromptResponse(prompt: InteractivePrompt, raw: unknown): InteractivePromptResponse;
 export declare function buildClaudeInteractiveToolResult(response: InteractivePromptResponse): string;
 export interface ClaudeInteractiveTuiPage {
     screenText: string;

package/dist/shared-types.d.ts

@@ -624,7 +624,7 @@ export interface DashboardBootstrapDaemonEntry extends Partial<CloudDaemonSummar
     p2p?: StatusReportPayload['p2p'];
     timestamp?: number;
 }
-export type DaemonStatusEventName = 'agent:generating_started' | 'agent:waiting_approval' | 'agent:generating_completed' | 'agent:stopped' | 'monitor:no_progress' | 'monitor:long_generating';
+export type DaemonStatusEventName = 'agent:generating_started' | 'agent:waiting_approval' | 'agent:waiting_choice' | 'agent:generating_completed' | 'agent:stopped' | 'monitor:no_progress' | 'monitor:long_generating';
 /** Minimal daemon-originated event payload relayed through the server. */
 export interface DaemonStatusEventPayload {
     event: DaemonStatusEventName;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "1.0.18-rc.10",
+  "version": "1.0.18-rc.12",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "1.0.18-rc.10",
-    "@adhdev/session-host-core": "1.0.18-rc.10",
+    "@adhdev/mesh-shared": "1.0.18-rc.12",
+    "@adhdev/session-host-core": "1.0.18-rc.12",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/commands/high-family/mesh-events.ts

@@ -93,10 +93,21 @@ export const meshEventsHandlers: Record<string, HighFamilyHandler> = {
                 ? args.sessionId.trim()
                 : '';
         if (!sessionId) return { success: false, error: 'targetSessionId required' };
-        const response = normalizeInteractivePromptResponse(args?.response ?? args);
+        const rawResponse = args?.response ?? args;
         const instance = ctx.deps.instanceManager.getInstance(sessionId);
         if (!instance) return { success: false, error: `No running instance for session ${sessionId}` };
-        ctx.deps.instanceManager.sendEvent(sessionId, 'interactive_prompt_response', response);
+        // mesh_answer_question (mission f1d25e11) sends a coordinator-friendly answer array
+        // that is resolved against the AUTHORITATIVE active prompt inside the instance
+        // (resolveInteractivePromptResponse). Forward that shape RAW. The legacy strict
+        // (questionId-keyed) form is still validated here so a malformed dashboard-local
+        // answer is rejected before it reaches the instance.
+        const isFriendlyArrayForm = rawResponse
+            && typeof rawResponse === 'object'
+            && Array.isArray((rawResponse as { answers?: unknown }).answers);
+        const payload = isFriendlyArrayForm
+            ? rawResponse
+            : normalizeInteractivePromptResponse(rawResponse);
+        ctx.deps.instanceManager.sendEvent(sessionId, 'interactive_prompt_response', payload);
         return { success: true };
     },
 };

package/src/commands/med-family/mesh-queue.ts

@@ -9,6 +9,67 @@
  */
 import { readStringValue } from '../router.js';
 import type { MedFamilyContext, MedFamilyHandler } from './types.js';
+import { LOG } from '../../logging/logger.js';
+import type { CancelledTaskAssignment } from '../../mesh/mesh-work-queue.js';
+
+/**
+ * CANCEL-STICKY-TERMINAL (authoritative cancel): stop the worker a just-cancelled task was
+ * bound to. Mirrors the transport-aware stop mesh-event-forwarding's stopStaleMeshWorker
+ * performs for reclaimed workers, but runs from the command layer using ctx.deps (which the
+ * pure queue-store module lacks): local adapter → stop_cli directly; otherwise resolve the
+ * worker node's daemon id from mesh config and dispatch stop_cli over P2P/relay. Fully
+ * best-effort — a failed stop only loses the belt-and-suspenders; the cancelled row is already
+ * terminal and cannot be resurrected (updateTaskStatus terminal guard).
+ */
+async function stopCancelledTaskWorker(
+    ctx: MedFamilyContext,
+    meshId: string,
+    prior: CancelledTaskAssignment,
+): Promise<void> {
+    const { sessionId, nodeId, providerType } = prior;
+    const stopArgs: Record<string, unknown> = {
+        targetSessionId: sessionId,
+        ...(providerType ? { cliType: providerType } : {}),
+        mode: 'hard',
+        reason: 'mesh_task_cancelled',
+    };
+    try {
+        const cliManager = ctx.deps.cliManager as any;
+        const isLocal = cliManager?.adapters?.has?.(sessionId) === true;
+        if (isLocal) {
+            if (!stopArgs.cliType) {
+                const localType = cliManager?.adapters?.get?.(sessionId)?.cliType;
+                if (localType) stopArgs.cliType = localType;
+            }
+            await Promise.resolve(cliManager?.handleCliCommand?.('stop_cli', stopArgs))
+                .catch((e: any) => LOG.warn('MeshQueue', `Local stop of cancelled worker ${sessionId} failed: ${e?.message || e}`));
+            return;
+        }
+        // Remote: resolve the worker node's daemon id from mesh config, then dispatch stop_cli.
+        const dispatch = ctx.deps.dispatchMeshCommand;
+        let daemonId: string | undefined;
+        if (nodeId) {
+            try {
+                const [{ getMesh }, { meshNodeIdMatches }, { readMeshNodeDaemonId }] = await Promise.all([
+                    import('../../config/mesh-config.js'),
+                    import('@adhdev/mesh-shared'),
+                    import('../../mesh/mesh-node-identity.js'),
+                ]);
+                const mesh = getMesh(meshId) as { nodes?: any[] } | undefined;
+                const node = mesh?.nodes?.find((n: any) => meshNodeIdMatches(n, nodeId));
+                daemonId = node ? readMeshNodeDaemonId(node) || undefined : undefined;
+            } catch { /* best-effort resolution */ }
+        }
+        if (daemonId && dispatch) {
+            await Promise.resolve(dispatch(daemonId, 'stop_cli', stopArgs))
+                .catch((e: any) => LOG.warn('MeshQueue', `Remote stop of cancelled worker ${sessionId} on daemon ${daemonId} failed: ${e?.message || e}`));
+        } else {
+            LOG.warn('MeshQueue', `Cannot stop cancelled worker ${sessionId}: no local adapter and no resolvable remote daemon id (node ${nodeId ?? '?'}). Row is already terminal; if the worker completes it strand-fails harmlessly.`);
+        }
+    } catch (e: any) {
+        LOG.warn('MeshQueue', `stopCancelledTaskWorker error for ${sessionId}: ${e?.message || e}`);
+    }
+}
 
 export const meshQueueHandlers: Record<string, MedFamilyHandler> = {
     get_mesh_queue: async (_ctx: MedFamilyContext, args: any) => {
@@ -50,10 +111,22 @@ export const meshQueueHandlers: Record<string, MedFamilyHandler> = {
         const ownerFailure = await ctx.requireMeshHostMutationOwner(meshId, args?.inlineMesh, 'queue cancellation');
         if (ownerFailure) return ownerFailure;
         try {
-            const { cancelTask } = await import('../../mesh/mesh-work-queue.js');
+            const { cancelTask, takeCancelledTaskAssignment } = await import('../../mesh/mesh-work-queue.js');
             const reason = typeof args?.reason === 'string' ? args.reason : undefined;
             const task = cancelTask(meshId, taskId, { reason });
             if (!task) return { success: false, error: `Queue task '${taskId}' not found` };
+            // CANCEL-STICKY-TERMINAL (authoritative cancel): stop the worker that was bound to the
+            // now-cancelled task. cancelTask already cleared the queue's assignment fields (so the
+            // reclaim watchdog no longer sees it as a live assignment), but a still-running worker
+            // keeps emitting delivery/turn signals that re-ignite reclaim. cancelTask runs in the
+            // pure queue-store module (no DaemonComponents), so the transport-aware stop is done
+            // here where ctx.deps holds cliManager / dispatchMeshCommand. Best-effort: a failed
+            // stop only loses the belt-and-suspenders — the row is already terminal and un-revivable
+            // thanks to the updateTaskStatus terminal guard.
+            const prior = takeCancelledTaskAssignment(meshId, taskId);
+            if (prior?.sessionId) {
+                void stopCancelledTaskWorker(ctx, meshId, prior);
+            }
             return { success: true, task };
         } catch (e: any) {
             return { success: false, error: e.message };

package/src/commands/router-refine.ts

@@ -36,8 +36,10 @@ import {
     RefineExecFileAsync,
     RefineStageOutcome,
     classifyPatchEquivalenceFailure,
+    convergeDivergedSubmoduleGitlinks,
     recordMeshRefineStage,
     resolveRefineryAutoPublishSubmoduleMainCommits,
+    rootRebaseResolvingGitlinks,
     runMeshRefineEffectiveDiffGate,
     runMeshRefinePatchEquivalenceGate,
     runMeshRefineSubmoduleReachabilityGate,
@@ -539,6 +541,9 @@ async function computeBranchBaseDivergence(
 export async function refineSyncBaseStage(self: DaemonCommandRouter, ctx: RefineContext): Promise<RefineStageOutcome> {
             const { repoRoot, baseHead, node, branch, baseBranch, refineStages, execFileAsync } = ctx;
             let branchHead = ctx.branchHead;
+            // Converged submodule gitlink resolutions (path → rebased commit) from STEP 1;
+            // consumed by the gitlink-aware root rebase (STEP 2) to resolve gitlink conflicts.
+            let gitlinkResolutions: Array<{ path: string; rebasedCommit: string }> = [];
             const syncStarted = Date.now();
             const divergence = await computeBranchBaseDivergence(execFileAsync, node.workspace, baseHead, branchHead);
 
@@ -571,25 +576,87 @@ export async function refineSyncBaseStage(self: DaemonCommandRouter, ctx: Refine
                 const preRebasePe = await runMeshRefinePatchEquivalenceGate(repoRoot, baseHead, branchHead);
                 const alreadyMerged = !preRebasePe.actualPatchId && !!preRebasePe.expectedPatchId;
                 const submoduleConflict = preRebasePe.actionableHint?.kind === 'submodule_conflict';
-                if (alreadyMerged || submoduleConflict) {
+                if (alreadyMerged) {
                     recordMeshRefineStage(refineStages, 'sync_base', 'passed', syncStarted, {
                         ahead: divergence.ahead,
                         behind: divergence.behind,
                         rebased: false,
-                        reason: alreadyMerged ? 'already_merged_via_other_path_skip_rebase' : 'submodule_conflict_defer_to_patch_equivalence',
+                        reason: 'already_merged_via_other_path_skip_rebase',
                     });
                     return { kind: 'continue', ctx };
                 }
+                if (submoduleConflict) {
+                    // DS3: a "submodule conflict" here means base and branch advanced the
+                    // SAME submodule to DIVERGED sibling commits (neither an ancestor of the
+                    // other), so the gitlink stays in the diff and patch-equivalence fails.
+                    // Attempt to auto-converge it (STEP 1): rebase the branch-side submodule
+                    // commit onto the base-side commit INSIDE the worktree submodule, so the
+                    // base-side commit becomes a strict ancestor of the rebased tip. The root
+                    // rebase below (STEP 2) then resolves the gitlink conflict to that rebased
+                    // commit. Together this automates the documented manual strict-ff bypass
+                    // and keeps the landed oss history linear. On any real submodule content
+                    // conflict it backs out cleanly → we FALL BACK to the historical
+                    // defer→patch_equivalence path below.
+                    const converge = convergeDivergedSubmoduleGitlinks(node.workspace, repoRoot, baseHead, branchHead);
+                    if (converge.converged) {
+                        gitlinkResolutions = converge.resolutions;
+                        recordMeshRefineStage(refineStages, 'submodule_gitlink_converge', 'passed', syncStarted, {
+                            reason: 'submodule_diverged_auto_rebased',
+                            gitlinks: converge.gitlinks,
+                        });
+                        LOG.info('Mesh', `[Refinery] Auto-converged diverged submodule gitlink(s) onto base for node ${node.id}: `
+                            + converge.resolutions.map(r => `${r.path}→${r.rebasedCommit.slice(0, 12)}`).join(', '));
+                        // Fall through (do NOT return) → the gitlink-aware root rebase below runs.
+                    } else {
+                        // Fail-safe: convergence declined (conflict / unreachable / not a real
+                        // divergence) → preserve the historical defer→blocked_review behavior.
+                        recordMeshRefineStage(refineStages, 'submodule_gitlink_converge', 'skipped', syncStarted, {
+                            reason: 'submodule_conflict_defer_to_patch_equivalence',
+                            convergeReason: converge.reason,
+                            gitlinks: converge.gitlinks,
+                        });
+                        recordMeshRefineStage(refineStages, 'sync_base', 'passed', syncStarted, {
+                            ahead: divergence.ahead,
+                            behind: divergence.behind,
+                            rebased: false,
+                            reason: 'submodule_conflict_defer_to_patch_equivalence',
+                        });
+                        return { kind: 'continue', ctx };
+                    }
+                }
             } catch { /* fail-open: on gate error, fall through to the rebase */ }
 
             // behind>0: strictly-behind OR diverged. Rebase the branch onto the pinned
             // baseHead. A conflict aborts and terminates blocked_review (retryable=false —
             // a real content conflict needs human resolution, not a base-movement retry).
+            //
+            // When STEP 1 converged a diverged submodule gitlink, use the gitlink-aware
+            // root rebase (STEP 2): git's recursive merge refuses to auto-merge the still-
+            // diverged intermediate gitlink, so we drive the rebase and resolve each
+            // submodule-gitlink conflict to the converged commit. A non-gitlink conflict
+            // aborts and falls through to the same blocked_review handling as a plain
+            // rebase conflict below (via the thrown gitlinkRebaseError).
             const rebaseStarted = Date.now();
             try {
-                execFileSync('git', ['rebase', baseHead], { cwd: node.workspace, stdio: ['ignore', 'pipe', 'pipe'] });
+                if (gitlinkResolutions.length > 0) {
+                    const gitlinkRebase = rootRebaseResolvingGitlinks(node.workspace, baseHead, gitlinkResolutions);
+                    if (!gitlinkRebase.ok) {
+                        // Surface as a rebase failure so the shared blocked_review handling
+                        // (submodule-hint recovery included) runs — nothing was left mid-rebase
+                        // (rootRebaseResolvingGitlinks aborts on failure).
+                        const err: any = new Error(`gitlink-aware rebase aborted: ${gitlinkRebase.reason || 'unknown'}`);
+                        err.gitlinkRebaseReason = gitlinkRebase.reason;
+                        err.gitlinkRebaseConflicts = gitlinkRebase.conflictPaths;
+                        err.alreadyAborted = true;
+                        throw err;
+                    }
+                } else {
+                    execFileSync('git', ['rebase', baseHead], { cwd: node.workspace, stdio: ['ignore', 'pipe', 'pipe'] });
+                }
             } catch (rebaseErr: any) {
-                try { execFileSync('git', ['rebase', '--abort'], { cwd: node.workspace, stdio: 'ignore' }); } catch { /* ignore */ }
+                if (!rebaseErr?.alreadyAborted) {
+                    try { execFileSync('git', ['rebase', '--abort'], { cwd: node.workspace, stdio: 'ignore' }); } catch { /* ignore */ }
+                }
                 // A rebase conflict on a submodule/gitlink divergence is a SPECIAL case the
                 // patch-equivalence gate describes with a rich actionable hint (which
                 // submodule, base vs branch commit, how to resolve). Run that gate against

package/src/commands/router.ts

@@ -227,6 +227,14 @@ const MESH_FORWARDABLE_SESSION_COMMANDS = new Set([
     // MUTATES the worker PTY, so forwarding to the real owner (not a wrong local session) is
     // doubly important. The daemon re-enforces the destructive-key confirm gate after the forward.
     'send_keys',
+    // interactive_prompt_response (mesh_answer_question, mission f1d25e11): the coordinator
+    // answers a REMOTE worker's AskUserQuestion (waiting_choice). The answer must reach the
+    // OWNING worker session's live instance — its activeInteractivePrompt (the authoritative
+    // prompt the labels/indexes resolve against) and its adapter.setInteractivePromptResponse
+    // live only there. Without forwarding, the coordinator's local high-family handler returns
+    // 'No running instance for session …' and the question is never answered — the exact
+    // remote-worker forwarding gap of mission 6938892f, now closed for questions too.
+    'interactive_prompt_response',
 ]);
 
 function normalizeCommandSource(source: string): CommandLogEntry['source'] {

package/src/mesh/coordinator-prompt.ts

@@ -1007,7 +1007,8 @@ const TOOLS_SECTION = `## Available Tools
 | \`mesh_fast_forward_node\` | Safely dry-run or explicitly execute an obvious clean fast-forward without launching an agent session |
 | \`mesh_restart_daemon\` | Update a node's daemon to the latest published version on its channel and restart it (the dashboard "preview update" path, as a mesh command) |
 | \`mesh_checkpoint\` | Create a git checkpoint on a node |
-| \`mesh_approve\` | Approve/reject a pending agent action |
+| \`mesh_approve\` | Approve/reject a pending agent action (a yes/no tool-consent modal) |
+| \`mesh_answer_question\` | Answer a delegated session's multi-choice QUESTION (AskUserQuestion / status awaiting_choice). NOT an approval — it offers labelled options (possibly multi-select or freeform). Pass the promptId from the agent:waiting_choice event + one answer per question (select by option label or 1-based index). Use this, never mesh_approve, for a question |
 | \`mesh_list_pending_approvals\` | List every session across the mesh awaiting an approval decision (the approval inbox) — read-only; enumerate all blocked sessions at once, then drive a mesh_approve for each |
 | \`mesh_clone_node\` | Create a worktree node for isolated parallel branch work |
 | \`mesh_refine_node\` | Validate and merge a completed worktree node back into its base branch |

package/src/mesh/mesh-active-work.ts

@@ -5,7 +5,7 @@ import { deleteDirectDispatchesByTaskId } from './mesh-work-queue.js';
 import { meshNodeIdMatches, daemonIdsEquivalent, sessionIdsEquivalent } from '@adhdev/mesh-shared';
 
 export type MeshActiveWorkSource = 'queue' | 'direct';
-export type MeshActiveWorkStatus = 'pending' | 'assigned' | 'generating' | 'idle' | 'failed' | 'awaiting_approval';
+export type MeshActiveWorkStatus = 'pending' | 'assigned' | 'generating' | 'idle' | 'failed' | 'awaiting_approval' | 'awaiting_choice';
 
 export interface MeshActiveWorkRecord {
     taskId: string;
@@ -135,6 +135,10 @@ export function sessionStatusFromNodes(nodes: any[] | undefined, nodeId?: string
     if (!session) return { staleReason: 'direct task session is not present in live session records' };
     if (typeof session === 'string') return {};
     const raw = `${readString(session.status) || ''} ${readString(session.lifecycle) || ''} ${readString(session.state) || ''} ${readString(session.activeChat?.status) || ''}`.toLowerCase();
+    // A question picker surfaces as waiting_choice — distinct from an approval modal.
+    // Check it first so a question worker is not mislabeled awaiting_approval and
+    // pulled into the approval inbox (mission f1d25e11).
+    if (raw.includes('waiting_choice') || raw.includes('choice')) return { status: 'awaiting_choice' };
     if (raw.includes('approval')) return { status: 'awaiting_approval' };
     if (raw.includes('generating') || raw.includes('running') || raw.includes('busy')) return { status: 'generating' };
     if (raw.includes('failed') || raw.includes('stopped') || raw.includes('terminated') || raw.includes('exited')) return { status: 'failed' };
@@ -166,6 +170,10 @@ function terminalMatchesDispatch(terminal: MeshLedgerEntry, dispatch: MeshLedger
 
 function statusFromTerminal(entry: MeshLedgerEntry): MeshActiveWorkStatus {
     if (entry.kind === 'task_approval_needed') return 'awaiting_approval';
+    // A question (waiting_choice) is a distinct blocked state — kept OUT of
+    // awaiting_approval so it is not surfaced in the approval inbox / mesh_approve
+    // flow (mission f1d25e11). Answered via mesh_answer_question.
+    if (entry.kind === 'task_question_pending') return 'awaiting_choice';
     if (entry.kind === 'task_completed') return 'idle';
     return 'failed';
 }
@@ -331,6 +339,7 @@ export function buildMeshActiveWorkSummary(activeWork: MeshActiveWorkRecord[]):
         idle: 0,
         failed: 0,
         awaiting_approval: 0,
+        awaiting_choice: 0,
     };
     const sourceCounts: Record<MeshActiveWorkSource, number> = { queue: 0, direct: 0 };
     for (const item of activeWork) {
@@ -380,6 +389,7 @@ export function buildMeshActiveWork(opts: BuildMeshActiveWorkOptions): { activeW
             ? sessionStatusFromNodes(opts.nodes, queueNodeId ?? undefined, queueSessionId ?? undefined)
             : {};
         const queueStatus: MeshActiveWorkStatus = queueLive.status === 'awaiting_approval'
+            || queueLive.status === 'awaiting_choice'
             || queueLive.status === 'generating'
             ? queueLive.status
             : task.status;

package/src/mesh/mesh-event-classify.ts

@@ -8,6 +8,11 @@ const MESH_COORDINATOR_EVENTS = new Set([
     'agent:generating_started',
     'agent:generating_completed',
     'agent:waiting_approval',
+    // A worker parked on an AskUserQuestion multi-choice prompt. DISTINCT from
+    // agent:waiting_approval (a yes/no tool-consent modal): a question is answered
+    // with mesh_answer_question, never mesh_approve (mission f1d25e11). Carries the
+    // full InteractivePrompt payload so the coordinator can render + answer.
+    'agent:waiting_choice',
     'agent:stopped',
     'agent:ready',
     'monitor:no_progress',
@@ -26,6 +31,7 @@ const MESH_COORDINATOR_EVENTS = new Set([
 export const EVENT_TO_LEDGER_KIND: Record<string, MeshLedgerKind> = {
     'agent:generating_completed': 'task_completed',
     'agent:waiting_approval': 'task_approval_needed',
+    'agent:waiting_choice': 'task_question_pending',
     'agent:stopped': 'task_failed',
     'monitor:no_progress': 'task_stalled',
 };
@@ -45,6 +51,11 @@ export const MESH_FORCE_INJECT_EVENTS: ReadonlySet<string> = new Set([
     'agent:generating_completed',
     'agent:stopped',
     'agent:waiting_approval',
+    // A worker's question (waiting_choice) is real-time and the coordinator may be
+    // generating when it arrives; force-inject it like approval so the busy coordinator
+    // learns it must answer (mesh_answer_question) rather than the nudge sitting in the
+    // adapter's outbound queue until the coordinator idles on its own (mission f1d25e11).
+    'agent:waiting_choice',
     'refine:completed',
     'refine:failed',
     'worktree_bootstrap_complete',
@@ -71,6 +82,14 @@ export function shouldForceInjectMeshEvent(eventName: unknown): boolean {
 //     require, and why a stale/resolved approval nudge can simply be dropped.
 export const MESH_APPROVAL_EVENTS: ReadonlySet<string> = new Set([
     'agent:waiting_approval',
+    // agent:waiting_choice (a worker's AskUserQuestion) shares the approval class's
+    // real-time-nudge / level-backed contract: its authoritative state is recorded at
+    // LEVEL the moment it is processed (task_question_pending → mesh_status
+    // awaiting_choice), so the pending event is only a NUDGE and can be delivered to a
+    // busy coordinator's inbox (and dropped) without data loss — the level state
+    // re-derives it. It is therefore exempt from the idle-edge hold completions require,
+    // exactly like an approval nudge (mission f1d25e11).
+    'agent:waiting_choice',
 ]);
 
 export function isMeshApprovalEvent(eventName: unknown): boolean {