@adhdev/daemon-core 1.0.18-rc.20 → 1.0.18-rc.4

package/src/mesh/mesh-ledger.ts

@@ -33,11 +33,6 @@ export type MeshLedgerKind =
     | 'task_failed'
     | 'task_stalled'
     | 'task_approval_needed'
-    // A worker is parked on an AskUserQuestion multi-choice prompt (waiting_choice) —
-    // distinct from task_approval_needed (a yes/no tool-consent modal). The coordinator
-    // answers a question with mesh_answer_question, never mesh_approve (mission f1d25e11).
-    // payload carries the full InteractivePrompt (promptId + questions + options).
-    | 'task_question_pending'
     | 'p2p_dispatch_failed'
     | 'session_launched'
     | 'session_auto_launch'
@@ -93,14 +88,6 @@ export type MeshLedgerKind =
     // payload: { keys: string[], hasDestructive: boolean, result: 'injected'|'refused'|'error',
     //            refused?: string, submits?: boolean, confirmDestructive?: boolean }
     | 'key_injection'
-    // Disk/worktree retention (mission 86def38d): DETECTION-ONLY signal that a git
-    // worktree present on disk has no matching live mesh node — an orphan cleanup
-    // candidate. The reconcile loop emits this so the coordinator can decide whether
-    // to remove it; retention NEVER auto-deletes a worktree (manual/coordinator-driven).
-    // Keyed by worktreePath so a re-emit for the same orphan is idempotent (a prior
-    // unresolved entry within the dedupe window suppresses the repeat).
-    // payload: { worktreePath, branch?, head?, reason: 'no_matching_live_node', state: 'cleanup_candidate' }
-    | 'worktree_cleanup_candidate'
     ;
 
 export interface MeshLedgerEntry {
@@ -330,70 +317,6 @@ export const OPERATING_NOTE_DEDUPE_WINDOW = 40;
 // a coordinator actually sees while still capping unbounded store growth.
 export const OPERATING_NOTE_KEEP_LATEST = 100;
 
-// ─── Operating-note lifecycle: category TTL + expiry (read-side only) ──────────
-// Minimal first cut of the operating-notes lifecycle. Expiry is READ/INJECTION
-// side ONLY — the store prune (keep-latest-100 above) stays purely count-based
-// and NEVER deletes by age, so audit history is preserved. isNoteExpired decides
-// whether an UNPINNED note still rides into a coordinator prompt.
-//
-// Per-category retention (days). A category not listed here — including the
-// uncategorized case — is durable (never expires). provider_quirk is durable
-// because a runtime quirk stays true until the provider changes.
-export const OPERATING_NOTE_CATEGORY_TTL_DAYS: Readonly<Record<string, number>> = {
-    recovery_lesson: 14,
-    pattern_to_avoid: 30,
-    // provider_quirk: durable (intentionally absent → never expires)
-};
-
-const MS_PER_DAY = 24 * 60 * 60 * 1000;
-
-/**
- * Shape isNoteExpired reads. Structural so mesh-ledger stays free of a
- * coordinator-prompt import (CoordinatorOperatingNote satisfies this).
- */
-export interface OperatingNoteExpiryInput {
-    category?: string;
-    pinned?: boolean;
-    createdAt?: string;
-    /** Explicit expiry override; wins over the category TTL when parseable. */
-    expiresAt?: string;
-    /** Fallback creation time (ledger entry timestamp) when createdAt absent. */
-    timestamp?: string;
-}
-
-/**
- * Pure helper: is this UNPINNED operating note expired as of `now` (epoch ms)?
- *
- * Rules:
- *  - pinned notes NEVER expire (always false).
- *  - an explicit, parseable `expiresAt` in the past → expired.
- *  - otherwise the category TTL applies; a durable category (provider_quirk,
- *    uncategorized, or any category not in the TTL map) never expires.
- *  - age is measured from createdAt, falling back to `timestamp` (ledger entry
- *    time). If neither is a valid date, the note is treated as NOT expired
- *    (never silently drop a note we cannot age).
- */
-export function isNoteExpired(note: OperatingNoteExpiryInput, now: number): boolean {
-    if (!note || note.pinned) return false;
-
-    // Explicit expiresAt wins when present and parseable.
-    if (typeof note.expiresAt === 'string') {
-        const exp = new Date(note.expiresAt).getTime();
-        if (!Number.isNaN(exp)) return exp <= now;
-    }
-
-    const ttlDays = note.category ? OPERATING_NOTE_CATEGORY_TTL_DAYS[note.category] : undefined;
-    if (typeof ttlDays !== 'number' || !Number.isFinite(ttlDays)) {
-        // Durable category (provider_quirk / uncategorized / unknown) → never expires.
-        return false;
-    }
-
-    const created = new Date(note.createdAt ?? note.timestamp ?? '').getTime();
-    if (Number.isNaN(created)) return false; // cannot age → keep
-
-    return now - created >= ttlDays * MS_PER_DAY;
-}
-
 // ─── Path Helpers ───────────────────────────────
 
 export function getLedgerDir(): string {

package/src/mesh/mesh-node-identity.ts

@@ -907,55 +907,6 @@ export function isMeshNodeHealthLaunchable(node: any): boolean {
     return health === 'online' || health === 'unknown';
 }
 
-/** Resolve the git telemetry object a node carries, in the same precedence
- *  resolveEffectiveMeshNodeHealth uses: a fresh `node.git`, else the cached inline
- *  status git (`node.cachedStatus.git`). Returns an empty record when neither is
- *  present (no telemetry). */
-function resolveEffectiveNodeGit(node: any): Record<string, any> {
-    const git = readObjectRecord(node?.git);
-    if (Object.keys(git).length > 0) return git;
-    const cachedStatus = readObjectRecord(node?.cachedStatus);
-    return readObjectRecord(cachedStatus.git);
-}
-
-/**
- * Launch FRESHNESS gate — distinct from the health gate above.
- *
- * `deriveMeshNodeHealthFromGit` reports a clean-tree node with `behind > 0` as
- * 'online', so the health gate (isMeshNodeHealthLaunchable) happily lets a STALE
- * node — one whose branch is N commits behind its upstream — win auto-launch fitness
- * routing and run a fresh worker against out-of-date code. `behind` is deliberately
- * NOT folded into deriveMeshNodeHealthFromGit because "behind" is not universally
- * unhealthy (the MAGI planner and other callers share that resolver); it is only
- * unhealthy for *spawning new work*. This gate encodes exactly that launch-time axis.
- *
- * Returns false (NOT fresh → skip / de-rank) only when git telemetry is PRESENT and
- * proves staleness:
- *   - behind count exceeds `maxBehind` (default 0 — any behind blocks), OR
- *   - a submodule is out of sync (gitlink points off upstream — cannot be caught up
- *     by a simple worktree ff and would launch against a mismatched submodule).
- *
- * When telemetry is absent it returns true (fresh), preserving the online/unknown-pass
- * philosophy: we never block on missing data, only on data that proves the node stale.
- */
-export function isMeshNodeFreshEnoughToLaunch(node: any, opts?: { maxBehind?: number }): boolean {
-    const git = resolveEffectiveNodeGit(node);
-    // No git telemetry at all → cannot prove stale → do not block.
-    if (Object.keys(git).length === 0) return true;
-    // Not a git repo / no branch: leave this to the health gate (it returns 'degraded'
-    // and blocks there); freshness has nothing to add.
-    if (readBooleanValue(git.isGitRepo) === false) return true;
-    const submoduleDrift = getGitSubmoduleDriftState(git);
-    if (submoduleDrift.outOfSync) return false;
-    const behind = readNumberValue(git.behind);
-    // No behind datum reported → treat as fresh (don't infer staleness from absence).
-    if (behind === undefined) return true;
-    const maxBehind = Number.isFinite(opts?.maxBehind as number) && (opts?.maxBehind as number) >= 0
-        ? Math.floor(opts!.maxBehind as number)
-        : 0;
-    return behind <= maxBehind;
-}
-
 function readMeshNodeLabel(status: Record<string, unknown>, node: any): string {
     return readStringValue(status.nodeId, normalizeMeshNodeId(node)) ?? 'unknown';
 }

package/src/mesh/mesh-queue-assignment.ts

@@ -6,22 +6,20 @@ import { getMesh } from '../config/mesh-config.js';
 import { detectCLI } from '../detection/cli-detector.js';
 import { LOG } from '../logging/logger.js';
 import { appendLedgerEntry } from './mesh-ledger.js';
-import { buildMeshNodeCapabilityTags, nodeSatisfiesRequiredTags, claimNextTask, updateTaskStatus, getQueue, recordTaskAutoLaunch, getActiveDirectDispatches, isTaskReadonly, taskDependenciesSatisfied, meshTaskNotBeforeReady, meshTaskPriorityRank, requeueTask } from './mesh-work-queue.js';
+import { buildMeshNodeCapabilityTags, nodeSatisfiesRequiredTags, claimNextTask, updateTaskStatus, getQueue, recordTaskAutoLaunch, getActiveDirectDispatches, isTaskReadonly, taskDependenciesSatisfied, meshTaskNotBeforeReady, meshTaskPriorityRank } from './mesh-work-queue.js';
 import type { MeshWorkQueueEntry } from './mesh-work-queue.js';
 import { fastForwardMeshNode } from './mesh-fast-forward.js';
 import { createSessionDelivery, updateSessionDeliveryStatus } from './mesh-delivery-policy.js';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
 import { traceMeshEventDrop } from './mesh-event-trace.js';
 import { awaitWithWarmupDeadline, resolveWarmupDeadlineOpts } from './mesh-warmup-deadline.js';
-import { delegatedWorkerAutoApproveSettings, resolveProviderMaxParallel, resolveNodeSchedulingPriority, normalizeMeshSchedulingStrategy, resolveMaxParallelTasks, resolveMaxReadonlyParallelTasks, resolveCoordinatorIdlePushPolicy } from '../repo-mesh-types.js';
-import { loadRepoMeshJsonConfig } from '../config/mesh-json-config.js';
-import type { RepoMeshDeclarativeConfig } from '../config/mesh-json-config.js';
+import { resolveDelegatedWorkerAutoApprove, resolveProviderMaxParallel, resolveNodeSchedulingPriority, normalizeMeshSchedulingStrategy, resolveMaxParallelTasks, resolveMaxReadonlyParallelTasks, resolveCoordinatorIdlePushPolicy } from '../repo-mesh-types.js';
 import type { RepoMeshSchedulingStrategy } from '../repo-mesh-types.js';
 import { normalizeMeshNodeId, meshNodeIdMatches, daemonIdsEquivalent, canonicalDaemonId, expandDaemonIdForms, normalizeMeshWorkspaceForCompare, meshWorkspacesEquivalent, sessionIdsEquivalent, normalizeNodeCapabilitySlots, isMeshTaskDifficulty, withStatusProbeMarker, type MeshNodeIdentified, type NodeCapabilitySlot, type MeshTaskDifficulty } from '@adhdev/mesh-shared';
 import { resolveNodeCapabilitySlots } from './mesh-node-slots.js';
 import { findTerminalLedgerEvidenceForTask, hasUnterminalDirectDispatchLedgerEntry } from './mesh-events-stale.js';
 import { readNonEmptyString } from './mesh-events-utils.js';
-import { readMeshNodeDaemonId, isMeshNodeHealthLaunchable, isMeshNodeFreshEnoughToLaunch } from './mesh-node-identity.js';
+import { readMeshNodeDaemonId, isMeshNodeHealthLaunchable } from './mesh-node-identity.js';
 import { queuePendingMeshCoordinatorEvent, retractPendingDispatchBlockedEvent, drainPendingMeshCoordinatorEvents } from './mesh-events-pending.js';
 import { isWorktreeBootstrapStaleRunning, shouldDeferDispatchForBootstrap } from './worktree-bootstrap-config.js';
 import { isWithinCloneBootstrapGrace } from './mesh-clone-grace.js';
@@ -92,25 +90,6 @@ export function __resetIdleAutoFastForwardForTests(): void {
     autoFastForwardWorkspaceLease.clear();
 }
 
-/**
- * Load the repo-shared `.adhdev/mesh.json` for a node's workspace, tolerating a
- * missing/invalid file (returns null → resolver falls back to provider-spec
- * defaults, i.e. exactly the pre-providerDefaults behavior). Only the
- * `providerDefaults` zone influences the delegated-worker MODE selection; it never
- * touches the ENABLE decision. When a node carries no workspace path (should not
- * happen for a launchable node, but be defensive), we skip the read entirely.
- */
-function loadRepoConfigForNode(node: any): RepoMeshDeclarativeConfig | null {
-    const workspace = typeof node?.workspace === 'string' && node.workspace.trim() ? node.workspace.trim() : '';
-    if (!workspace) return null;
-    try {
-        const result = loadRepoMeshJsonConfig(workspace);
-        return result.sourceType === 'repo_file' && result.config ? result.config : null;
-    } catch {
-        return null;
-    }
-}
-
 export function getMeshWithCache(components: DaemonComponents, meshId: string): any | undefined {
     const localMesh = getMesh(meshId);
     const cachedMesh = components.router?.getCachedInlineMesh(meshId);
@@ -711,7 +690,7 @@ export function tryAssignQueueTask(
         if (inst && typeof inst.updateSettings === 'function') {
             // Adopting a (possibly manually-opened) local session as a worker: apply the
             // delegated-worker auto-approve policy here too, so a session that was launched
-            // without an auto-approve boolean/mode still resolves the delegated policy once dispatched
+            // without autoApprove still auto-approves once the coordinator dispatches a task
             // to it (the "approval notification fires only for certain delegated sessions"
             // case). updateSettings preserves runtime mesh keys; passing autoApprove keeps it.
             //
@@ -725,13 +704,7 @@ export function tryAssignQueueTask(
                 meshNodeFor: meshId,
                 meshNodeId: nodeId,
                 launchedByCoordinator: true,
-                ...delegatedWorkerAutoApproveSettings(
-                    mesh?.policy,
-                    node?.policy,
-                    components.providerLoader?.getMeta(providerType),
-                    loadRepoConfigForNode(node),
-                    providerType,
-                ),
+                autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
                 ...(localDaemonId ? { meshCoordinatorDaemonId: localDaemonId } : {}),
                 // COMPLETION-PROPAGATION F5: (re)stamp the coordinator SESSION anchor from THIS
                 // task's sourceCoordinatorSessionId with PRIORITY — a manually-launched (or reused)
@@ -958,105 +931,6 @@ function isTargetNodeTransientlyUnresolved(mesh: any, task: MeshWorkQueueEntry):
     return isWithinCloneBootstrapGrace(targetNodeId);
 }
 
-// ---------------------------------------------------------------------------
-// DEAD-TARGET-SELFHEAL: unpin a queue task hard-pinned to a session/node that has
-// died (absent from the live mesh) so a live idle session can claim it, instead of
-// leaving it stranded 'pending' forever behind the target_session_constraint skip.
-// ---------------------------------------------------------------------------
-
-// Conservative age gate before a pinned-but-dead target is unpinned. A target that is
-// merely briefly unassigned or momentarily reconnecting must not be reclaimed on the
-// tick it drops out of view; we require the task to have been idle (no updatedAt bump)
-// for at least this window first. Sized to comfortably outlast a transient P2P blip /
-// reconnect while staying well inside the reclaim cadence of the rest of the file
-// (AUTO_LAUNCH_AWAIT_CLAIM_MS is 90s; the stranded-reclaim watchdog fires on similar
-// scales), so a real reconnect wins the race and the self-heal only fires on a target
-// that is genuinely gone.
-const DEAD_TARGET_GRACE_MS = 60_000;
-
-interface DeadTargetVerdict {
-    /** The pinned target is confirmed dead and past the grace window → safe to unpin. */
-    dead: boolean;
-    /** True when the target NODE itself is absent from the live mesh (clear targetNodeId too). */
-    nodeDead: boolean;
-    /** Short reason string for the ledger/requeue. */
-    reason: string;
-}
-
-/**
- * Decide whether a task's hard target pin (targetSessionId and/or targetNodeId) points at
- * something that has DIED — i.e. is absent from the live mesh snapshot — and has been so
- * long enough (DEAD_TARGET_GRACE_MS since the task's last update) that unpinning is safe.
- *
- * Two definitive death signals, deliberately conservative to never race a reconnecting node:
- *
- *  (1) NODE dead — the task pins a targetNodeId that matches NO node in the live mesh
- *      (the same `meshNodeIdMatches`-over-mesh.nodes signal the targetPinUnmatched relabel
- *      uses at the empty-candidate site). A pinned session on an absent node is unreachable
- *      regardless, so the session pin is dead too. `nodeDead` ⇒ clear targetNodeId as well.
- *      Excluded: a target that is only TRANSIENTLY unresolved (a freshly-cloned worktree
- *      still propagating / bootstrapping) — isTargetNodeTransientlyUnresolved gates it out.
- *
- *  (2) SESSION dead on a LIVE LOCAL node — the target node IS present and is THIS daemon's
- *      node, but the pinned session is absent from the local instance manager
- *      (resolveSessionBusyVerdict === 'UNKNOWN'). Local session visibility is complete, so
- *      absence here is genuine death, not a busy/generating flip. We KEEP targetNodeId (only
- *      the session died; the node is healthy and can host a replacement claim).
- *
- * A live REMOTE node whose session is not in our idle view is NOT treated as dead: absence
- * from the remote-idle mirror is explicitly UNKNOWN liveness (the session may be busy or its
- * agent:ready pull merely lost), so unpinning it could race healthy in-flight work. Returns
- * dead=false in that case, leaving the existing skip in place.
- */
-function resolveDeadTargetVerdict(components: DaemonComponents, meshId: string, mesh: any, task: MeshWorkQueueEntry): DeadTargetVerdict {
-    const NOT_DEAD: DeadTargetVerdict = { dead: false, nodeDead: false, reason: '' };
-    const targetSessionId = readNonEmptyString(task.targetSessionId);
-    const targetNodeId = readNonEmptyString(task.targetNodeId);
-    if (!targetSessionId && !targetNodeId) return NOT_DEAD;
-
-    // Age gate: never reclaim a pin younger than the grace window (guards against a target
-    // that has only just dropped out of view for a momentary reconnect).
-    const lastUpdateMs = Date.parse(task.updatedAt || task.createdAt || '');
-    if (Number.isFinite(lastUpdateMs) && Date.now() - lastUpdateMs < DEAD_TARGET_GRACE_MS) return NOT_DEAD;
-
-    const nodes: any[] = Array.isArray(mesh?.nodes) ? mesh.nodes : [];
-
-    // (1) NODE-dead — a pinned node absent from the live mesh, and NOT merely transiently
-    // unresolved (a propagating/bootstrapping clone). This is a permanent routing miss.
-    if (targetNodeId) {
-        const nodePresent = nodes.some(n => meshNodeIdMatches(n, targetNodeId));
-        if (!nodePresent) {
-            if (isTargetNodeTransientlyUnresolved(mesh, task)) return NOT_DEAD;
-            return { dead: true, nodeDead: true, reason: 'dead_target_node_absent' };
-        }
-    }
-
-    // (2) SESSION-dead on a LIVE LOCAL node. Only meaningful when a session is pinned.
-    if (targetSessionId) {
-        // Resolve the pinned target's node (if any) to decide whether we can trust local
-        // absence. Without a targetNodeId, fall back to whichever live node hosts the session
-        // is unknowable here; treat that as a LOCAL check only (a session id we cannot see
-        // locally on a node we cannot resolve remotely stays UNKNOWN → not dead).
-        const node = targetNodeId
-            ? nodes.find(n => meshNodeIdMatches(n, targetNodeId))
-            : undefined;
-        // A pinned session on a REMOTE live node: absence from our view is UNKNOWN, not death.
-        // Only a LOCAL node (or no node pin at all — same-daemon assumption) lets us conclude
-        // death from local instance-manager absence.
-        const nodeIsLocal = node ? isLocalAutoLaunchNode(node) : true;
-        if (nodeIsLocal) {
-            const verdict = resolveSessionBusyVerdict(components, targetSessionId);
-            if (verdict === 'UNKNOWN') {
-                // Session absent from the complete local session view → genuinely gone.
-                return { dead: true, nodeDead: false, reason: 'dead_target_session_absent' };
-            }
-            // GENERATING / IDLE_CONFIRMED → the session is alive (possibly busy). Never disturb.
-        }
-    }
-
-    return NOT_DEAD;
-}
-
 /**
  * FALSE-BLOCKER-CLONE-QUEUE (stale-event clear): once a task whose actionable blocker we
  * previously paged either gets claimed or transitions to a self-resolving state, re-arm the
@@ -1721,20 +1595,8 @@ function liveSessionCountForNode(components: DaemonComponents, meshId: string, n
  * free claimer, and is excluded — so a read-only auto-launch onto a busy-but-no-idle node
  * is still allowed. A node with NO live mesh session at all (dead, or never launched) does
  * not match, preserving the legitimate first-session spawn.
- *
- * PROVIDER-MATCH gate (DISPATCH-DEADLOCK-PROVIDER-MISMATCH): a live session only suppresses
- * this launch if it could ACTUALLY claim THIS task. A session whose providerType does not
- * satisfy the task's requiredTags (e.g. a claude-cli coordinator/worker session on a node,
- * while the pending task is required_tags: [provider=codex-cli]) is NOT a pending claimer for
- * this task — claimNextQueueTask's nodeSatisfiesRequiredTags gate would reject its claim. Left
- * unchecked, such a mismatched session made this gate return true for a task it can never claim,
- * so the required-provider worker never auto-launched AND no session could claim → nobody made
- * progress → permanent silent deadlock. Mirror the claim path: build the session's own
- * capability tags (its providerType pinned onto the node) and only count it as a pending claimer
- * when those tags satisfy task.requiredTags. `node` is passed in so the tag set reflects this
- * node's os/arch/worktree/converge context, matching claimNextQueueTask exactly.
  */
-function nodeHasLiveSessionPendingClaim(components: DaemonComponents, meshId: string, nodeId: string, task: MeshWorkQueueEntry, node: any): boolean {
+function nodeHasLiveSessionPendingClaim(components: DaemonComponents, meshId: string, nodeId: string): boolean {
     // (A) AUTOLAUNCH-CLAIM-CHURN remote-awareness: a task whose auto-launch record targets this
     // node and is still inside its await-claim window (base or backoff) already has a session on
     // its way to claim — even when that session is REMOTE and thus invisible to the local
@@ -1773,20 +1635,7 @@ function nodeHasLiveSessionPendingClaim(components: DaemonComponents, meshId: st
         if (isTerminalSessionStatus(status)) return false; // dead → no claimer here, allow launch
         const sessionId = readNonEmptyString(state.instanceId);
         if (sessionId && busySessionIds.has(sessionId)) return false; // busy with its own assigned task
-        // PROVIDER-MATCH gate (DISPATCH-DEADLOCK-PROVIDER-MISMATCH): only count this session as a
-        // pending claimer if its own provider could satisfy THIS task's requiredTags. A session
-        // whose providerType does not match (e.g. a claude-cli session while task requires
-        // provider=codex-cli) can never claim this task via claimNextQueueTask's
-        // nodeSatisfiesRequiredTags gate, so it must not suppress the required-provider launch —
-        // otherwise the task deadlocks (mismatched session blocks launch, yet cannot claim). Mirror
-        // the claim path: pin the session's providerType onto this node and check the tags.
-        if (task.requiredTags?.length) {
-            const sessionProviderType = state.type || readNonEmptyString(settings.providerType);
-            if (sessionProviderType && !nodeSatisfiesRequiredTags(task.requiredTags, buildMeshNodeCapabilityTags(node, sessionProviderType))) {
-                return false; // provider mismatch → this session can't claim this task; not a pending claimer
-            }
-        }
-        return true; // live + unassigned + provider-capable → will claim the pending task itself
+        return true; // live + unassigned → will claim the pending task itself
     });
 }
 
@@ -2039,11 +1888,6 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
     }
     if (!pending.length) return false;
 
-    // Launch-freshness threshold: reuse the auto-fast-forward policy's maxBehind (default
-    // 0 → any behind blocks) so the launch gate and the repair path agree on how far
-    // behind is tolerable. Resolved once per pass and shared across every candidate node.
-    const freshnessGate = { maxBehind: resolveAutoFastForwardPolicy(mesh).maxBehind };
-
     // Write cap + read-only cap resolved through the shared helpers from the
     // MACHINE-LOCAL stored mesh policy (no repo-file overlay). These are the same
     // resolvers the observability projection uses, so the enforced and exposed
@@ -2085,32 +1929,6 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
             continue;
         }
         if (task.targetSessionId) {
-            // DEAD-TARGET-SELFHEAL: before the unconditional target_session_constraint skip,
-            // check whether the pinned session/node has DIED (absent from the live mesh). A
-            // hard-pinned task whose target is gone can NEVER re-enter 'assigned' (the claim
-            // gate refuses every non-matching session) and this skip fires forever with no
-            // liveness check — the triple-walled stranded-pending defect. If the pin is
-            // confirmed dead past the grace window, requeue it (clearing the dead session
-            // pin, and the node pin too when the NODE itself is gone) so a live idle session
-            // can claim it. requeueTask counts toward maxTaskRetries → bounded self-heal that
-            // auto-fails past the cap (the desired terminal state, unblocking dependents).
-            const deadTarget = resolveDeadTargetVerdict(components, meshId, mesh, task);
-            if (deadTarget.dead) {
-                const requeued = requeueTask(meshId, task.id, {
-                    reason: deadTarget.reason,
-                    clearTargetSession: true,
-                    // Keep the node pin if only the SESSION died on a still-live node; clear it
-                    // when the NODE itself is absent (nothing to pin to).
-                    clearTargetNode: deadTarget.nodeDead,
-                });
-                if (requeued) {
-                    LOG.warn('MeshQueue', `DEAD-TARGET-SELFHEAL: task ${task.id} (mesh ${meshId}) was pinned to a dead target (${deadTarget.reason}); requeued${deadTarget.nodeDead ? ' and unpinned node' : ''} (requeueCount=${requeued.requeueCount ?? '?'}, status=${requeued.status}).`);
-                }
-                // Keep the skip for THIS tick (the requeue already flipped the row to
-                // pending/failed); a later tick assigns/launches the now-unpinned task.
-                markAutoLaunch(meshId, task.id, { status: 'skipped', reason: 'target_session_dead_requeued' });
-                continue;
-            }
             markAutoLaunch(meshId, task.id, { status: 'skipped', reason: 'target_session_constraint' });
             continue;
         }
@@ -2267,18 +2085,6 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
                 markAutoLaunch(meshId, task.id, { status: 'skipped', reason: 'node_not_launch_ready', nodeId });
                 continue;
             }
-            // FRESHNESS gate (distinct from the health gate above): a clean-tree node that
-            // is `behind` its upstream reads as 'online' and passes isLaunchableNode, so
-            // without this it could win fitness routing and run a fresh worker against
-            // stale code. Skip a node whose git telemetry proves it stale (behind >
-            // maxBehind, or a submodule out of sync). Reuse the auto-fast-forward policy's
-            // maxBehind threshold so "how far behind is tolerable" is configured in ONE
-            // place. Telemetry-absent nodes pass (never block on missing data). The 4s
-            // reconcile retries once the node's auto-ff repair path catches it up.
-            if (!isMeshNodeFreshEnoughToLaunch(node, freshnessGate)) {
-                markAutoLaunch(meshId, task.id, { status: 'skipped', reason: 'node_stale_behind_upstream', nodeId });
-                continue;
-            }
             const launchTarget = resolveAutoLaunchTarget(components, node);
             if (launchTarget.mode === 'skip') {
                 // Remote node we can't reach (no transport / no coordinator daemonId).
@@ -2298,7 +2104,7 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
             // busy-but-no-idle node is still allowed. Skip with a transient (non-actionable)
             // reason so the coordinator is not paged; the 4s reconcile retries, and once the
             // existing session goes terminal this gate clears and a legitimate launch proceeds.
-            if (nodeHasLiveSessionPendingClaim(components, meshId, nodeId, task, node)) {
+            if (nodeHasLiveSessionPendingClaim(components, meshId, nodeId)) {
                 markAutoLaunch(meshId, task.id, { status: 'skipped', reason: 'node_has_live_session_pending_claim', nodeId });
                 continue;
             }
@@ -2370,14 +2176,8 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
                     spawnedSessionVisibility: mesh?.policy?.spawnedSessionVisibility || 'hidden',
                     // Coordinator-dispatched worker: auto-approve unless mesh/node policy
                     // opts out (default true). Lands in settingsOverride and beats the
-                    // global per-provider-type boolean/mode through explicit opposite-key clearing.
-                    ...delegatedWorkerAutoApproveSettings(
-                        mesh?.policy,
-                        node?.policy,
-                        components.providerLoader?.getMeta(resolved.providerType),
-                        loadRepoConfigForNode(node),
-                        resolved.providerType,
-                    ),
+                    // global per-provider-type autoApprove config (see shouldAutoApprove).
+                    autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
                     launchedByCoordinator: true,
                     autoLaunchedForQueueTaskId: task.id,
                 };
@@ -3042,3 +2842,4 @@ export function runIdleMaintenanceThenAssignQueue(components: DaemonComponents,
             });
     });
 }
+