@adhdev/daemon-core 1.0.18-rc.2 → 1.0.18-rc.20

package/src/mesh/mesh-disk-retention.ts

@@ -0,0 +1,370 @@
+// ---------------------------------------------------------------------------
+// mesh-disk-retention — periodic disk / worktree retention for ~/.adhdev
+// ---------------------------------------------------------------------------
+// Legacy on-disk artifacts under ~/.adhdev accumulated with NO lifetime/GC and
+// grew the data volume until a refine bootstrap failed at 98% disk (mission
+// 86def38d). Immediate reclaim was manual; this module implements the code-level
+// RETENTION so it does not recur.
+//
+// What it prunes (all thresholds defensive — never touches a live/in-use file):
+//   1. JSONL ledger files      ~/.adhdev/mesh-ledger/*.jsonl  older than 30 days
+//      (legacy after the SQLite ledger; zero lifetime before this).
+//   2. session-host runtimes   ~/.adhdev/session-host/*/runtimes/*.json for
+//      TERMINATED (dead) runtimes older than 14 days (live runtimes never touched).
+//   3. DB backups              ~/.adhdev/mesh-ledger/mesh-runtime.db.bak-* older
+//      than 7 days.
+// Plus DETECTION-ONLY orphan-worktree signalling (see mesh-reconcile-loop.ts):
+//   4. a worktree present on disk with no matching live mesh node is reported as a
+//      cleanup_candidate ledger entry — NEVER auto-deleted (that stays manual /
+//      coordinator-driven).
+//
+// The functions are split into PURE core selectors (age/orphan decisions, taking
+// explicit paths + a `now` timestamp so they are deterministic and require no fs
+// mocking in tests) and thin runtime wrappers that resolve the real ~/.adhdev
+// paths and perform the unlink. The pure selectors are the unit-tested surface.
+// ---------------------------------------------------------------------------
+
+import {
+    existsSync,
+    readdirSync,
+    statSync,
+    unlinkSync,
+    readFileSync,
+} from 'fs';
+import { join } from 'path';
+import { getConfigDir } from '../config/config.js';
+import { getLedgerDir, appendLedgerEntry, readLedgerEntries } from './mesh-ledger.js';
+import { isSessionHostLiveRuntime } from '../session-host/runtime-surface.js';
+import type { SessionHostSurfaceRecordLike } from '../session-host/runtime-surface.js';
+import { listWorktrees } from '../git/git-worktree.js';
+import type { LocalMeshEntry } from '../repo-mesh-types.js';
+import { LOG } from '../logging/logger.js';
+
+// ─── Thresholds (all defensive) ────────────────────────────────────────────
+export const DAY_MS = 24 * 60 * 60 * 1000;
+/** JSONL ledger files are legacy after the SQLite ledger — 30-day lifetime. */
+export const LEDGER_JSONL_MAX_AGE_MS = 30 * DAY_MS;
+/** Terminated session-host runtimes: conservative 14-day retention. */
+export const SESSION_HOST_RUNTIME_MAX_AGE_MS = 14 * DAY_MS;
+/** mesh-runtime.db.bak-* backups: 7-day retention. */
+export const DB_BAK_MAX_AGE_MS = 7 * DAY_MS;
+
+// ─── (1) JSONL ledger retention ─────────────────────────────────────────────
+
+/** A file candidate for age-based pruning: absolute path + last-modified epoch ms. */
+export interface AgedFile {
+    path: string;
+    mtimeMs: number;
+}
+
+/**
+ * PURE. Select the JSONL ledger files whose mtime is older than `maxAgeMs`
+ * relative to `now`. A file exactly at the threshold is KEPT (strict `>`), so a
+ * 30-day-old file survives its 30th day and is pruned on the 31st. Deterministic:
+ * no fs access, no clock read.
+ */
+export function selectExpiredLedgerJsonl(
+    files: AgedFile[],
+    now: number,
+    maxAgeMs: number = LEDGER_JSONL_MAX_AGE_MS,
+): AgedFile[] {
+    return files.filter(f => now - f.mtimeMs > maxAgeMs);
+}
+
+// ─── (2) session-host runtime retention ─────────────────────────────────────
+
+/** A parsed session-host runtime file: its path, mtime, and the wrapped record. */
+export interface SessionHostRuntimeFile {
+    path: string;
+    mtimeMs: number;
+    /** The `record` object from the on-disk `{ record, snapshot, updatedAt }` file. */
+    record: SessionHostSurfaceRecordLike | null;
+}
+
+/**
+ * PURE. Select the session-host runtime files safe to delete: ONLY those whose
+ * runtime is terminated/dead (NOT a live runtime — decided by the session-host-core
+ * SSOT `isSessionHostLiveRuntime`) AND older than `maxAgeMs`. A live runtime, or a
+ * dead-but-recent one, is always kept. A file whose record failed to parse is treated
+ * as NON-live but is still age-gated, so a corrupt-but-fresh file is never removed.
+ */
+export function selectExpiredSessionHostRuntimes(
+    files: SessionHostRuntimeFile[],
+    now: number,
+    maxAgeMs: number = SESSION_HOST_RUNTIME_MAX_AGE_MS,
+): SessionHostRuntimeFile[] {
+    return files.filter(f => {
+        // Never delete a live runtime, regardless of age.
+        if (isSessionHostLiveRuntime(f.record ?? undefined)) return false;
+        // Terminated/dead: age-gate it.
+        return now - f.mtimeMs > maxAgeMs;
+    });
+}
+
+// ─── (3) DB backup retention ────────────────────────────────────────────────
+
+/** True for a `mesh-runtime.db.bak-*` backup filename (basename only). */
+export function isDbBackupFileName(name: string): boolean {
+    return /^mesh-runtime\.db\.bak-/.test(name);
+}
+
+/** PURE. Select `.bak-*` backups older than `maxAgeMs`. Strict `>` (see ledger). */
+export function selectExpiredDbBackups(
+    files: AgedFile[],
+    now: number,
+    maxAgeMs: number = DB_BAK_MAX_AGE_MS,
+): AgedFile[] {
+    return files.filter(f => now - f.mtimeMs > maxAgeMs);
+}
+
+// ─── (4) orphan worktree detection (detection-only) ─────────────────────────
+
+/** Minimal shape needed to decide whether a worktree path is orphaned. */
+export interface WorktreePathLike {
+    path: string;
+    bare?: boolean;
+}
+
+/** A live mesh node's known workspace paths (self workspace + repoRoot, normalized). */
+export interface LiveNodeWorkspaceLike {
+    workspace?: string;
+    repoRoot?: string;
+}
+
+function normalizePath(p: string): string {
+    // Trim a single trailing separator so "/a/b/" and "/a/b" compare equal.
+    // Case-preserving (git worktree list + meshes.json are both raw paths from the
+    // same daemon, so a case-fold would be over-eager on case-sensitive FS).
+    return p.replace(/[/\\]+$/, '');
+}
+
+/**
+ * PURE. Given the worktrees git reports on disk and the set of live-node workspace
+ * paths, return the worktrees that have NO matching live node — the orphan
+ * cleanup_candidates.
+ *
+ * SAFETY:
+ *  - `mainWorktreePath` (the primary repo checkout, i.e. worktree[0]) is NEVER an
+ *    orphan — it is the base repo, not a mesh clone.
+ *  - `bare` worktrees are skipped (git's internal bookkeeping, not a node checkout).
+ *  - Matching is path-equality after trailing-separator normalization against the
+ *    union of every live node's `workspace` and `repoRoot`.
+ * This is DETECTION ONLY — the caller signals a cleanup_candidate; it must not delete.
+ */
+export function detectOrphanWorktrees(
+    worktrees: WorktreePathLike[],
+    liveNodes: LiveNodeWorkspaceLike[],
+    mainWorktreePath: string,
+): WorktreePathLike[] {
+    const liveePaths = new Set<string>();
+    for (const n of liveNodes) {
+        if (n.workspace) liveePaths.add(normalizePath(n.workspace));
+        if (n.repoRoot) liveePaths.add(normalizePath(n.repoRoot));
+    }
+    const mainNorm = normalizePath(mainWorktreePath);
+    return worktrees.filter(wt => {
+        if (wt.bare) return false;
+        const norm = normalizePath(wt.path);
+        if (norm === mainNorm) return false; // base repo checkout — never an orphan
+        return !liveePaths.has(norm);
+    });
+}
+
+// ─── Runtime wrappers (resolve real paths + perform the unlink) ──────────────
+// These are the side-effecting callers used by the reconcile loop. They are thin:
+// gather → delegate to a PURE selector → unlink. Kept out of the unit tests (which
+// target the deterministic selectors); their I/O is exercised by the daemon at runtime.
+
+function safeUnlink(path: string): boolean {
+    try {
+        unlinkSync(path);
+        return true;
+    } catch (e: any) {
+        LOG.warn('DiskRetention', `Failed to delete ${path}: ${e?.message || e}`);
+        return false;
+    }
+}
+
+function listDirFiles(dir: string): AgedFile[] {
+    if (!existsSync(dir)) return [];
+    const out: AgedFile[] = [];
+    let names: string[];
+    try {
+        names = readdirSync(dir);
+    } catch {
+        return [];
+    }
+    for (const name of names) {
+        const path = join(dir, name);
+        try {
+            const st = statSync(path);
+            if (st.isFile()) out.push({ path, mtimeMs: st.mtimeMs });
+        } catch {
+            // vanished between readdir and stat — skip
+        }
+    }
+    return out;
+}
+
+/**
+ * Prune expired legacy JSONL ledger files under ~/.adhdev/mesh-ledger/.
+ * Matches only `*.jsonl` (never the SQLite .db / -wal / -shm files). Returns the
+ * count deleted. Best-effort: individual unlink failures are logged, not thrown.
+ */
+export function pruneExpiredLedgerJsonl(now: number = Date.now()): number {
+    const dir = getLedgerDir();
+    const jsonl = listDirFiles(dir).filter(f => f.path.endsWith('.jsonl'));
+    const expired = selectExpiredLedgerJsonl(jsonl, now);
+    let deleted = 0;
+    for (const f of expired) if (safeUnlink(f.path)) deleted++;
+    if (deleted > 0) LOG.info('DiskRetention', `Pruned ${deleted} JSONL ledger file(s) older than 30d`);
+    return deleted;
+}
+
+/**
+ * Prune expired `mesh-runtime.db.bak-*` backups under ~/.adhdev/mesh-ledger/.
+ * Never touches the live DB (only names matching the .bak- prefix). Returns count.
+ */
+export function pruneExpiredDbBackups(now: number = Date.now()): number {
+    const dir = getLedgerDir();
+    const baks = listDirFiles(dir).filter(f => isDbBackupFileName(f.path.split(/[/\\]/).pop() || ''));
+    const expired = selectExpiredDbBackups(baks, now);
+    let deleted = 0;
+    for (const f of expired) if (safeUnlink(f.path)) deleted++;
+    if (deleted > 0) LOG.info('DiskRetention', `Pruned ${deleted} mesh-runtime.db.bak-* backup(s) older than 7d`);
+    return deleted;
+}
+
+/**
+ * Prune terminated session-host runtime files older than 14 days across every
+ * ~/.adhdev/session-host/<app>/runtimes/ directory. A LIVE runtime is never deleted
+ * regardless of age (isSessionHostLiveRuntime SSOT). Returns count deleted.
+ */
+export function pruneExpiredSessionHostRuntimes(now: number = Date.now()): number {
+    const root = join(getConfigDir(), 'session-host');
+    if (!existsSync(root)) return 0;
+    let apps: string[];
+    try {
+        apps = readdirSync(root);
+    } catch {
+        return 0;
+    }
+    const candidates: SessionHostRuntimeFile[] = [];
+    for (const app of apps) {
+        const runtimesDir = join(root, app, 'runtimes');
+        if (!existsSync(runtimesDir)) continue;
+        for (const f of listDirFiles(runtimesDir)) {
+            if (!f.path.endsWith('.json')) continue;
+            let record: SessionHostRuntimeFile['record'] = null;
+            try {
+                const parsed = JSON.parse(readFileSync(f.path, 'utf-8'));
+                const rec = parsed && typeof parsed === 'object' ? parsed.record : null;
+                record = rec && typeof rec === 'object' ? (rec as SessionHostSurfaceRecordLike) : null;
+            } catch {
+                // Unparseable → treat as non-live; still age-gated by the selector,
+                // so a corrupt-but-fresh file is preserved.
+                record = null;
+            }
+            candidates.push({ path: f.path, mtimeMs: f.mtimeMs, record });
+        }
+    }
+    const expired = selectExpiredSessionHostRuntimes(candidates, now);
+    let deleted = 0;
+    for (const f of expired) if (safeUnlink(f.path)) deleted++;
+    if (deleted > 0) LOG.info('DiskRetention', `Pruned ${deleted} terminated session-host runtime file(s) older than 14d`);
+    return deleted;
+}
+
+/**
+ * Run the file-deleting retention passes (JSONL ledger, DB backups, session-host
+ * runtimes) once. Each pass is isolated so one failing pass never blocks the others.
+ * Orphan-worktree DETECTION is driven separately in the reconcile loop (it needs the
+ * live mesh config + git worktree list and emits a ledger signal rather than deleting).
+ */
+export function runDiskRetentionSweep(now: number = Date.now()): { ledgerJsonl: number; dbBackups: number; sessionHostRuntimes: number } {
+    let ledgerJsonl = 0;
+    let dbBackups = 0;
+    let sessionHostRuntimes = 0;
+    try { ledgerJsonl = pruneExpiredLedgerJsonl(now); } catch (e: any) { LOG.warn('DiskRetention', `Ledger JSONL prune failed: ${e?.message || e}`); }
+    try { dbBackups = pruneExpiredDbBackups(now); } catch (e: any) { LOG.warn('DiskRetention', `DB backup prune failed: ${e?.message || e}`); }
+    try { sessionHostRuntimes = pruneExpiredSessionHostRuntimes(now); } catch (e: any) { LOG.warn('DiskRetention', `Session-host runtime prune failed: ${e?.message || e}`); }
+    return { ledgerJsonl, dbBackups, sessionHostRuntimes };
+}
+
+// ─── Orphan worktree detection (detection-only, emits cleanup_candidate) ──────
+
+/** How many recent worktree_cleanup_candidate entries to scan for the re-emit guard. */
+const ORPHAN_DEDUPE_WINDOW = 200;
+
+/**
+ * Detect orphaned worktrees for ONE mesh and emit a `worktree_cleanup_candidate`
+ * ledger signal for each — DETECTION ONLY, never deletes. An orphan is a git worktree
+ * on disk with no matching live mesh node (compared by path). It:
+ *   1. picks a base (non-worktree) node owned by this mesh to anchor `git worktree list`;
+ *   2. diffs the reported worktrees against the union of every node's workspace/repoRoot;
+ *   3. skips the main worktree + bare entries (detectOrphanWorktrees safety);
+ *   4. suppresses a repeat for a worktreePath already signalled within the recent window
+ *      (idempotent re-emit guard), so the hourly sweep doesn't spam the ledger.
+ * Returns the list of newly-signalled orphan paths. Best-effort: git/ledger failures are
+ * logged and yield an empty result, never thrown.
+ */
+export async function detectAndSignalOrphanWorktrees(
+    mesh: LocalMeshEntry,
+    now: number = Date.now(),
+): Promise<string[]> {
+    const nodes = Array.isArray(mesh.nodes) ? mesh.nodes : [];
+    // Anchor: a base (non-worktree) node's repoRoot (preferred) or workspace. The base
+    // node is the primary checkout; its git dir enumerates every worktree of the repo.
+    const baseNode = nodes.find(n => !n.isLocalWorktree && (n.repoRoot || n.workspace));
+    const repoRoot = baseNode?.repoRoot || baseNode?.workspace;
+    if (!repoRoot) return []; // no local base checkout for this mesh on this daemon
+
+    let worktrees: WorktreePathLike[];
+    try {
+        worktrees = await listWorktrees(repoRoot);
+    } catch (e: any) {
+        LOG.warn('DiskRetention', `git worktree list failed for mesh ${mesh.id} (${repoRoot}): ${e?.message || e}`);
+        return [];
+    }
+    // git worktree list emits the main worktree first; treat it as the base repo.
+    const mainWorktreePath = worktrees[0]?.path || repoRoot;
+    const liveNodes: LiveNodeWorkspaceLike[] = nodes.map(n => ({ workspace: n.workspace, repoRoot: n.repoRoot }));
+    const orphans = detectOrphanWorktrees(worktrees, liveNodes, mainWorktreePath);
+    if (orphans.length === 0) return [];
+
+    // Re-emit guard: skip a worktreePath already signalled in the recent window so the
+    // hourly sweep is idempotent and does not flood the ledger with duplicates.
+    let recentPaths = new Set<string>();
+    try {
+        const recent = readLedgerEntries(mesh.id, { kind: ['worktree_cleanup_candidate'], tail: ORPHAN_DEDUPE_WINDOW });
+        for (const e of recent) {
+            const p = typeof e.payload?.worktreePath === 'string' ? e.payload.worktreePath : '';
+            if (p) recentPaths.add(p);
+        }
+    } catch {
+        recentPaths = new Set();
+    }
+
+    const signalled: string[] = [];
+    for (const wt of orphans) {
+        if (recentPaths.has(wt.path)) continue;
+        try {
+            appendLedgerEntry(mesh.id, {
+                kind: 'worktree_cleanup_candidate',
+                payload: {
+                    worktreePath: wt.path,
+                    reason: 'no_matching_live_node',
+                    state: 'cleanup_candidate',
+                    detectedAt: new Date(now).toISOString(),
+                },
+            });
+            signalled.push(wt.path);
+        } catch (e: any) {
+            LOG.warn('DiskRetention', `Failed to record orphan worktree signal for ${wt.path}: ${e?.message || e}`);
+        }
+    }
+    if (signalled.length > 0) {
+        LOG.info('DiskRetention', `Detected ${signalled.length} orphan worktree(s) for mesh ${mesh.id} (cleanup_candidate — NOT deleted): ${signalled.join(', ')}`);
+    }
+    return signalled;
+}

package/src/mesh/mesh-event-classify.ts

@@ -8,6 +8,11 @@ const MESH_COORDINATOR_EVENTS = new Set([
     'agent:generating_started',
     'agent:generating_completed',
     'agent:waiting_approval',
+    // A worker parked on an AskUserQuestion multi-choice prompt. DISTINCT from
+    // agent:waiting_approval (a yes/no tool-consent modal): a question is answered
+    // with mesh_answer_question, never mesh_approve (mission f1d25e11). Carries the
+    // full InteractivePrompt payload so the coordinator can render + answer.
+    'agent:waiting_choice',
     'agent:stopped',
     'agent:ready',
     'monitor:no_progress',
@@ -26,6 +31,7 @@ const MESH_COORDINATOR_EVENTS = new Set([
 export const EVENT_TO_LEDGER_KIND: Record<string, MeshLedgerKind> = {
     'agent:generating_completed': 'task_completed',
     'agent:waiting_approval': 'task_approval_needed',
+    'agent:waiting_choice': 'task_question_pending',
     'agent:stopped': 'task_failed',
     'monitor:no_progress': 'task_stalled',
 };
@@ -45,6 +51,11 @@ export const MESH_FORCE_INJECT_EVENTS: ReadonlySet<string> = new Set([
     'agent:generating_completed',
     'agent:stopped',
     'agent:waiting_approval',
+    // A worker's question (waiting_choice) is real-time and the coordinator may be
+    // generating when it arrives; force-inject it like approval so the busy coordinator
+    // learns it must answer (mesh_answer_question) rather than the nudge sitting in the
+    // adapter's outbound queue until the coordinator idles on its own (mission f1d25e11).
+    'agent:waiting_choice',
     'refine:completed',
     'refine:failed',
     'worktree_bootstrap_complete',
@@ -71,6 +82,14 @@ export function shouldForceInjectMeshEvent(eventName: unknown): boolean {
 //     require, and why a stale/resolved approval nudge can simply be dropped.
 export const MESH_APPROVAL_EVENTS: ReadonlySet<string> = new Set([
     'agent:waiting_approval',
+    // agent:waiting_choice (a worker's AskUserQuestion) shares the approval class's
+    // real-time-nudge / level-backed contract: its authoritative state is recorded at
+    // LEVEL the moment it is processed (task_question_pending → mesh_status
+    // awaiting_choice), so the pending event is only a NUDGE and can be delivered to a
+    // busy coordinator's inbox (and dropped) without data loss — the level state
+    // re-derives it. It is therefore exempt from the idle-edge hold completions require,
+    // exactly like an approval nudge (mission f1d25e11).
+    'agent:waiting_choice',
 ]);
 
 export function isMeshApprovalEvent(eventName: unknown): boolean {

package/src/mesh/mesh-event-forwarding.ts

@@ -16,7 +16,8 @@ import { resolveMeshHostStatus } from './mesh-host-ownership.js';
 import { enqueueUnresolvedDelegateForward, nudgeUnresolvedForwardRetry } from './mesh-unresolved-forward-outbox.js';
 import { traceMeshEventStage, traceMeshEventDrop } from './mesh-event-trace.js';
 import { getLastDisplayMessage } from '../status/snapshot.js';
-import { resolveDelegatedWorkerAutoApprove } from '../repo-mesh-types.js';
+import { delegatedWorkerAutoApproveSettings } from '../repo-mesh-types.js';
+import { loadRepoMeshJsonConfig } from '../config/mesh-json-config.js';
 import { meshNodeIdMatches, daemonIdsEquivalent, expandDaemonIdForms, sessionIdsEquivalent, withStatusProbeMarker, type MeshNodeIdentified } from '@adhdev/mesh-shared';
 import {
     findRecentTerminalLedgerEvidence,
@@ -1071,10 +1072,44 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
         // C2: prefer an exact taskId match when the completion event carries one —
         // it's immune to coordinator↔worker clock skew that can hide the assigned row.
         const eventTaskId = readNonEmptyString(args.metadataEvent.taskId) || undefined;
-        const task = updateSessionTaskStatus(args.meshId, sessionId, outcome, {
-            occurredAt: occurredAtMs != null ? new Date(occurredAtMs).toISOString() : undefined,
-            taskId: eventTaskId,
-        });
+        // WEAK-QUEUE-TENTATIVE (early-completed safety net, symmetric with the direct-dispatch
+        // `tentativeIfDirect` guard below): a `completed` outcome whose evidence is WEAK — a
+        // false-idle / missing_final_assistant emit (the CANON-C decoupled-immediate path that
+        // stamps evidenceLevel=insufficient) — must NOT hard-flip a matched QUEUE row to
+        // terminal. Until this net, only DIRECT dispatches were kept tentative on weak evidence;
+        // a queue-claimed task's session flipped its row to 'completed' unconditionally, so a
+        // worker that dropped to idle ~13s in with no final assistant closed the task early even
+        // though it never produced an answer. Leaving the row 'assigned' hands it to the reconcile
+        // loop's proven net (PHASE 4 records the GENUINE completion once the transcript lands via
+        // findTerminalLedgerEvidenceForTask; PHASE 2.5 reclaims a truly-stranded row back to
+        // 'pending' for re-dispatch, bounded by MAX_STRANDED_RECLAIMS) — never a permanent wedge.
+        //
+        // CRUCIAL SCOPE: this covers only the PREMATURE decoupled-immediate emit
+        // (emittedAfterFinalizationTimeout !== true). A weak completion that already waited out the
+        // full 30s COMPLETED_FINALIZATION_MAX_WAIT_MS window (emittedAfterFinalizationTimeout=true)
+        // is a GENUINE — if answerless — terminal: the worker exhausted its finalization wait and
+        // is done, so it flips 'completed' as before (a tool-only turn that never produced an
+        // assistant bubble must still close its task). A `failed` outcome or a completion with
+        // genuine evidence flips terminal as before too.
+        const completionDiagnostic = args.metadataEvent.completionDiagnostic && typeof args.metadataEvent.completionDiagnostic === 'object'
+            ? args.metadataEvent.completionDiagnostic as Record<string, unknown>
+            : undefined;
+        const emittedAfterFinalizationTimeout = completionDiagnostic?.emittedAfterFinalizationTimeout === true;
+        const weakCompleted = outcome === 'completed'
+            && isWeakCompletionEvidence(args.metadataEvent)
+            && !emittedAfterFinalizationTimeout;
+        const task = weakCompleted
+            ? updateSessionTaskStatus(args.meshId, sessionId, 'assigned', {
+                occurredAt: occurredAtMs != null ? new Date(occurredAtMs).toISOString() : undefined,
+                taskId: eventTaskId,
+            })
+            : updateSessionTaskStatus(args.meshId, sessionId, outcome, {
+                occurredAt: occurredAtMs != null ? new Date(occurredAtMs).toISOString() : undefined,
+                taskId: eventTaskId,
+            });
+        if (weakCompleted && task) {
+            LOG.info('MeshQueue', `Weak completion (${readNonEmptyString(args.metadataEvent.evidenceLevel) || 'missing_final_assistant'}) kept queue task ${task.id} tentative (session ${sessionId}); reconcile owns the genuine terminal`);
+        }
         // Fix A (early-terminal prevention): a false-idle completion (no confirmed final
         // assistant) for a DIRECT dispatch — i.e. no work-queue row matched — must not flip the
         // dispatch row terminal. Leaving it active lets the reconcile loop (PHASE 4) re-read the
@@ -1580,7 +1615,22 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
                                     spawnedSessionVisibility: mesh?.policy?.spawnedSessionVisibility || 'hidden',
                                     // Coordinator-dispatched recovery relaunch: same auto-approve
                                     // policy as the primary worker launch path.
-                                    autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+                                    ...delegatedWorkerAutoApproveSettings(
+                                        mesh?.policy,
+                                        node?.policy,
+                                        components.providerLoader?.getMeta(recoveryContext.failedProviderType),
+                                        // Recovery relaunch: same repo-declared requested mode as the
+                                        // primary path. node.workspace missing → null → provider default.
+                                        (() => {
+                                            const ws = typeof node?.workspace === 'string' && node.workspace.trim() ? node.workspace.trim() : '';
+                                            if (!ws) return null;
+                                            try {
+                                                const r = loadRepoMeshJsonConfig(ws);
+                                                return r.sourceType === 'repo_file' && r.config ? r.config : null;
+                                            } catch { return null; }
+                                        })(),
+                                        recoveryContext.failedProviderType,
+                                    ),
                                     launchedByCoordinator: true,
                                 }
                             }).catch((e: any) => LOG.error('MeshRecovery', `Failed to auto-relaunch session for ${node.id}: ${e?.message}`));
@@ -1754,6 +1804,14 @@ export function buildRelayMetadataEvent(payload: Record<string, unknown>): Recor
         retryOfJobId: readNonEmptyString(payload.retryOfJobId),
         ...(relayModalMessage ? { modalMessage: relayModalMessage } : {}),
         ...(relayModalButtons && relayModalButtons.length > 0 ? { modalButtons: relayModalButtons } : {}),
+        // agent:waiting_choice (mission f1d25e11): carry the FULL structured question
+        // payload across the machine boundary so a REMOTE worker's AskUserQuestion reaches
+        // the coordinator with every question + option intact — the coordinator renders
+        // these and answers with mesh_answer_question. The local in-process forward path
+        // preserves the whole event for free; this mirrors the fields for the remote relay.
+        ...(payload.interactivePrompt && typeof payload.interactivePrompt === 'object' && !Array.isArray(payload.interactivePrompt) ? { interactivePrompt: payload.interactivePrompt } : {}),
+        ...(readNonEmptyString(payload.promptId) ? { promptId: readNonEmptyString(payload.promptId) } : {}),
+        ...(payload.multiSelect === true ? { multiSelect: true } : {}),
         ...(payload.result && typeof payload.result === 'object' && !Array.isArray(payload.result) ? { result: payload.result } : {}),
         ...(payload.completionDiagnostic && typeof payload.completionDiagnostic === 'object' && !Array.isArray(payload.completionDiagnostic) ? { completionDiagnostic: payload.completionDiagnostic } : {}),
         ...(payload.workerResult && typeof payload.workerResult === 'object' && !Array.isArray(payload.workerResult) ? { workerResult: payload.workerResult } : {}),

package/src/mesh/mesh-events-utils.ts

@@ -330,6 +330,48 @@ export function buildMeshSystemMessage(args: {
     if (args.event === 'agent:waiting_approval') {
         return `[System] ${args.nodeLabel} is waiting for approval to proceed${metadata}. You may use mesh_read_chat and mesh_approve to handle it.`;
     }
+    if (args.event === 'agent:waiting_choice') {
+        // A multi-choice QUESTION (AskUserQuestion) — NOT an approval. It is answered with
+        // mesh_answer_question (never mesh_approve). Surface the question text + choices
+        // inline so the coordinator can decide without a mesh_read_chat round-trip, and
+        // name the correct tool + promptId (mission f1d25e11).
+        const prompt = args.metadataEvent.interactivePrompt as
+            | { promptId?: unknown; questions?: Array<Record<string, unknown>> }
+            | undefined;
+        const promptId = readNonEmptyString(args.metadataEvent.promptId)
+            || (prompt && readNonEmptyString(prompt.promptId));
+        const lines: string[] = [
+            `[System] ${args.nodeLabel} is asking a question and is waiting for your answer${metadata}.`,
+        ];
+        const questions = Array.isArray(prompt?.questions) ? prompt!.questions! : [];
+        if (questions.length > 0) {
+            for (const q of questions) {
+                const header = readNonEmptyString(q.header);
+                const question = readNonEmptyString(q.question);
+                const multiSelect = q.multiSelect === true;
+                if (question) {
+                    lines.push(`\n**${header ? `${header}: ` : ''}${question}**${multiSelect ? ' (select one or more)' : ''}`);
+                }
+                const options = Array.isArray(q.options) ? q.options : [];
+                options.forEach((opt, i) => {
+                    const record = (opt && typeof opt === 'object') ? opt as Record<string, unknown> : {};
+                    const label = readNonEmptyString(record.label);
+                    if (!label) return;
+                    const description = readNonEmptyString(record.description);
+                    lines.push(`  ${i + 1}. ${label}${description ? ` — ${description}` : ''}`);
+                });
+            }
+        } else {
+            const modalMessage = readNonEmptyString(args.metadataEvent.modalMessage);
+            if (modalMessage) lines.push(`\n${modalMessage}`);
+        }
+        lines.push(
+            `\nAnswer with mesh_answer_question(node_id, session_id${promptId ? `, promptId: "${promptId}"` : ''}, answers). ` +
+            `Do NOT use mesh_approve — that only resolves yes/no consent modals, not a question. ` +
+            `Use mesh_read_chat once if you need the full context first.`,
+        );
+        return lines.join('\n');
+    }
     if (args.event === 'agent:stopped') {
         const rc = args.recoveryContext;
         if (rc && rc.consecutiveNodeFailures > 0) {

package/src/mesh/mesh-ledger.ts

@@ -33,6 +33,11 @@ export type MeshLedgerKind =
     | 'task_failed'
     | 'task_stalled'
     | 'task_approval_needed'
+    // A worker is parked on an AskUserQuestion multi-choice prompt (waiting_choice) —
+    // distinct from task_approval_needed (a yes/no tool-consent modal). The coordinator
+    // answers a question with mesh_answer_question, never mesh_approve (mission f1d25e11).
+    // payload carries the full InteractivePrompt (promptId + questions + options).
+    | 'task_question_pending'
     | 'p2p_dispatch_failed'
     | 'session_launched'
     | 'session_auto_launch'
@@ -88,6 +93,14 @@ export type MeshLedgerKind =
     // payload: { keys: string[], hasDestructive: boolean, result: 'injected'|'refused'|'error',
     //            refused?: string, submits?: boolean, confirmDestructive?: boolean }
     | 'key_injection'
+    // Disk/worktree retention (mission 86def38d): DETECTION-ONLY signal that a git
+    // worktree present on disk has no matching live mesh node — an orphan cleanup
+    // candidate. The reconcile loop emits this so the coordinator can decide whether
+    // to remove it; retention NEVER auto-deletes a worktree (manual/coordinator-driven).
+    // Keyed by worktreePath so a re-emit for the same orphan is idempotent (a prior
+    // unresolved entry within the dedupe window suppresses the repeat).
+    // payload: { worktreePath, branch?, head?, reason: 'no_matching_live_node', state: 'cleanup_candidate' }
+    | 'worktree_cleanup_candidate'
     ;
 
 export interface MeshLedgerEntry {
@@ -317,6 +330,70 @@ export const OPERATING_NOTE_DEDUPE_WINDOW = 40;
 // a coordinator actually sees while still capping unbounded store growth.
 export const OPERATING_NOTE_KEEP_LATEST = 100;
 
+// ─── Operating-note lifecycle: category TTL + expiry (read-side only) ──────────
+// Minimal first cut of the operating-notes lifecycle. Expiry is READ/INJECTION
+// side ONLY — the store prune (keep-latest-100 above) stays purely count-based
+// and NEVER deletes by age, so audit history is preserved. isNoteExpired decides
+// whether an UNPINNED note still rides into a coordinator prompt.
+//
+// Per-category retention (days). A category not listed here — including the
+// uncategorized case — is durable (never expires). provider_quirk is durable
+// because a runtime quirk stays true until the provider changes.
+export const OPERATING_NOTE_CATEGORY_TTL_DAYS: Readonly<Record<string, number>> = {
+    recovery_lesson: 14,
+    pattern_to_avoid: 30,
+    // provider_quirk: durable (intentionally absent → never expires)
+};
+
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+
+/**
+ * Shape isNoteExpired reads. Structural so mesh-ledger stays free of a
+ * coordinator-prompt import (CoordinatorOperatingNote satisfies this).
+ */
+export interface OperatingNoteExpiryInput {
+    category?: string;
+    pinned?: boolean;
+    createdAt?: string;
+    /** Explicit expiry override; wins over the category TTL when parseable. */
+    expiresAt?: string;
+    /** Fallback creation time (ledger entry timestamp) when createdAt absent. */
+    timestamp?: string;
+}
+
+/**
+ * Pure helper: is this UNPINNED operating note expired as of `now` (epoch ms)?
+ *
+ * Rules:
+ *  - pinned notes NEVER expire (always false).
+ *  - an explicit, parseable `expiresAt` in the past → expired.
+ *  - otherwise the category TTL applies; a durable category (provider_quirk,
+ *    uncategorized, or any category not in the TTL map) never expires.
+ *  - age is measured from createdAt, falling back to `timestamp` (ledger entry
+ *    time). If neither is a valid date, the note is treated as NOT expired
+ *    (never silently drop a note we cannot age).
+ */
+export function isNoteExpired(note: OperatingNoteExpiryInput, now: number): boolean {
+    if (!note || note.pinned) return false;
+
+    // Explicit expiresAt wins when present and parseable.
+    if (typeof note.expiresAt === 'string') {
+        const exp = new Date(note.expiresAt).getTime();
+        if (!Number.isNaN(exp)) return exp <= now;
+    }
+
+    const ttlDays = note.category ? OPERATING_NOTE_CATEGORY_TTL_DAYS[note.category] : undefined;
+    if (typeof ttlDays !== 'number' || !Number.isFinite(ttlDays)) {
+        // Durable category (provider_quirk / uncategorized / unknown) → never expires.
+        return false;
+    }
+
+    const created = new Date(note.createdAt ?? note.timestamp ?? '').getTime();
+    if (Number.isNaN(created)) return false; // cannot age → keep
+
+    return now - created >= ttlDays * MS_PER_DAY;
+}
+
 // ─── Path Helpers ───────────────────────────────
 
 export function getLedgerDir(): string {