@adhdev/daemon-core 1.0.18-rc.20 → 1.0.18-rc.4

package/src/mesh/mesh-refine-gates.ts

@@ -1200,306 +1200,6 @@ export function collectFastForwardGitlinkPaths(repoRoot: string, baseHead: strin
     });
 }
 
-/**
- * Whether both commits exist locally in the submodule repo AND neither is an
- * ancestor of the other — i.e. a genuine sibling divergence off a shared merge
- * base. `baseCommit` ancestor-of `branchCommit` (strict fast-forward) returns
- * false: that case needs no rebase (the gate excludes it). Equal commits, a
- * missing commit, or a non-submodule path all return false (nothing to converge
- * / ambiguity stays "not divergent").
- */
-function isSubmoduleDivergedSibling(submoduleRepoPath: string, baseCommit: string, branchCommit: string): boolean {
-    if (!baseCommit || !branchCommit || baseCommit === branchCommit) return false;
-    try {
-        if (!fs.existsSync(submoduleRepoPath)) return false;
-        execFileSync(GIT, ['cat-file', '-e', `${baseCommit}^{commit}`], { cwd: submoduleRepoPath, stdio: 'ignore' });
-        execFileSync(GIT, ['cat-file', '-e', `${branchCommit}^{commit}`], { cwd: submoduleRepoPath, stdio: 'ignore' });
-    } catch {
-        return false; // one of the commits is not available locally — cannot judge divergence
-    }
-    // base ancestor-of branch ⇒ pure fast-forward, not a sibling divergence.
-    try {
-        execFileSync(GIT, ['merge-base', '--is-ancestor', baseCommit, branchCommit], { cwd: submoduleRepoPath, stdio: 'ignore' });
-        return false;
-    } catch { /* not a fast-forward → keep checking */ }
-    // branch ancestor-of base ⇒ branch is strictly behind (base already contains
-    // it); no branch-side commits to replay, not our case.
-    try {
-        execFileSync(GIT, ['merge-base', '--is-ancestor', branchCommit, baseCommit], { cwd: submoduleRepoPath, stdio: 'ignore' });
-        return false;
-    } catch { /* neither ancestor of the other → genuine divergence */ }
-    // Require a real shared merge base so the rebase has a sane replay range.
-    try {
-        const mb = execFileSync(GIT, ['merge-base', baseCommit, branchCommit], { cwd: submoduleRepoPath, encoding: 'utf8' }).trim();
-        return !!mb;
-    } catch {
-        return false;
-    }
-}
-
-export type SubmoduleGitlinkConvergeResult = {
-    /** True when at least one diverged gitlink submodule was rebased onto its base-side commit. */
-    converged: boolean;
-    /**
-     * Set when convergence was declined/aborted (fail-safe → caller keeps the
-     * original defer→blocked_review path). One of:
-     *   no_changed_gitlinks — no gitlink differs base↔branch
-     *   not_diverged        — the gitlink is ff/behind/equal (gate handles it)
-     *   rebase_conflict     — replaying branch-side onto base-side hit a real
-     *                         content conflict inside the submodule (aborted)
-     */
-    reason?: string;
-    /**
-     * Converged gitlinks: path → the rebased submodule commit (SUBNEW) that the
-     * root rebase must resolve the gitlink conflict to. Only populated for paths
-     * whose submodule was successfully rebased (base-side is now a strict ancestor).
-     */
-    resolutions: Array<{ path: string; baseCommit: string; branchCommit: string; rebasedCommit: string }>;
-    /** Per-path outcome for observability/logging. */
-    gitlinks: Array<{
-        path: string;
-        baseCommit?: string;
-        branchCommit?: string;
-        rebasedCommit?: string;
-        action: 'rebased' | 'skipped_not_diverged' | 'rebase_conflict';
-    }>;
-};
-
-/**
- * Best-effort: ensure `commit` exists in the submodule repo at `submoduleRepoPath`
- * by fetching it from the base repo's submodule checkout (a sibling working copy on
- * the same machine) when it is missing. A no-op when the commit is already present
- * or when the source path does not exist. Never throws — a fetch failure just
- * leaves the commit missing and the caller's ancestry check declines to converge.
- */
-function ensureSubmoduleCommitLocal(submoduleRepoPath: string, baseSubmoduleRepoPath: string, commit: string): void {
-    if (!commit) return;
-    try {
-        execFileSync(GIT, ['cat-file', '-e', `${commit}^{commit}`], { cwd: submoduleRepoPath, stdio: 'ignore' });
-        return; // already present
-    } catch { /* missing → try to fetch it */ }
-    try {
-        if (!fs.existsSync(submoduleRepoPath) || !fs.existsSync(baseSubmoduleRepoPath)) return;
-        // Fetch the exact object from the base repo's submodule by absolute path. `file://`
-        // fetch of an explicit sha requires uploadpack.allowAnySHA1InWant on some gits;
-        // fetching the base submodule's HEAD/all refs is the portable way to bring the
-        // reachable object in, so fetch all branches and tags from the local path.
-        execFileSync(GIT, ['-c', 'protocol.file.allow=always', 'fetch', '-q', baseSubmoduleRepoPath, '+refs/heads/*:refs/adhdev-refine-base/*'], {
-            cwd: submoduleRepoPath,
-            stdio: ['ignore', 'ignore', 'pipe'],
-        });
-    } catch { /* best-effort; ancestry check will simply decline if still missing */ }
-}
-
-/**
- * STEP 1 of auto-converging diverged oss-style submodule gitlinks: rebase the
- * branch-side submodule commit(s) onto the base-side submodule commit INSIDE the
- * worktree's submodule checkout (detached HEAD), so the base-side commit becomes a
- * strict ancestor of the rebased tip. Returns the rebased commit per path so the
- * caller's root rebase can resolve the gitlink conflict to it (STEP 2, see
- * {@link rootRebaseResolvingGitlinks}). This automates the documented manual
- * strict-fast-forward bypass and keeps the landed submodule history linear rather
- * than masking a divergence.
- *
- * Fail-safe by construction: it only touches gitlinks that are a genuine sibling
- * divergence (both commits local, neither an ancestor of the other, shared merge
- * base). A submodule rebase content conflict aborts, restores the branch-side
- * checkout, and returns `converged:false` (caller keeps defer→blocked_review). It
- * never commits the root and NEVER pushes — remote publish is the merge/
- * reachability stage's job; this stage is local reconciliation only.
- *
- * @param worktreeRoot the branch worktree root (its `<path>` submodule checkout is rebased)
- * @param baseRepoRoot the source/base repo root (reads the base-side gitlink commit)
- * @param baseHead     the fetched base head (root ref) — source of base-side gitlink commits
- * @param branchHead   the worktree branch head (root ref) — source of branch-side gitlink commits
- */
-export function convergeDivergedSubmoduleGitlinks(
-    worktreeRoot: string,
-    baseRepoRoot: string,
-    baseHead: string,
-    branchHead: string,
-): SubmoduleGitlinkConvergeResult {
-    const changed = readChangedGitlinkPaths(worktreeRoot, baseHead, branchHead);
-    if (changed.length === 0) {
-        return { converged: false, reason: 'no_changed_gitlinks', resolutions: [], gitlinks: [] };
-    }
-
-    const gitlinks: SubmoduleGitlinkConvergeResult['gitlinks'] = [];
-    const resolutions: SubmoduleGitlinkConvergeResult['resolutions'] = [];
-    let sawDiverged = false;
-
-    for (const path of changed) {
-        // Base-side commit comes from the base repo's tree; branch-side from the worktree's.
-        const baseCommit = readTreeObject(baseRepoRoot, baseHead, path);
-        const branchCommit = readTreeObject(worktreeRoot, branchHead, path);
-        const submoduleRepoPath = pathResolve(worktreeRoot, path);
-
-        // The base-side submodule commit is recorded by the base workspace but may not
-        // yet exist in the worktree's submodule object store (it was committed locally
-        // in base/<path> and not necessarily fetched here). Make it available via a
-        // best-effort local fetch from the base repo's own submodule checkout so the
-        // ancestry check and rebase can see it. Without this, a genuinely-convergeable
-        // divergence would look "not local" and fall through to blocked_review.
-        if (baseCommit) {
-            ensureSubmoduleCommitLocal(submoduleRepoPath, pathResolve(baseRepoRoot, path), baseCommit);
-        }
-
-        if (!baseCommit || !branchCommit || !isSubmoduleDivergedSibling(submoduleRepoPath, baseCommit, branchCommit)) {
-            gitlinks.push({ path, baseCommit, branchCommit, action: 'skipped_not_diverged' });
-            continue;
-        }
-        sawDiverged = true;
-
-        // Rebase the branch-side submodule commit(s) onto the base-side commit in a
-        // DETACHED HEAD (never move a submodule branch ref). A conflict aborts and
-        // restores the submodule checkout to the branch-side commit.
-        let rebasedCommit: string | undefined;
-        try {
-            execFileSync(GIT, ['checkout', '-q', '--detach', branchCommit], { cwd: submoduleRepoPath, stdio: ['ignore', 'ignore', 'pipe'] });
-            execFileSync(GIT, ['rebase', baseCommit], { cwd: submoduleRepoPath, stdio: ['ignore', 'pipe', 'pipe'] });
-            rebasedCommit = execFileSync(GIT, ['rev-parse', 'HEAD'], { cwd: submoduleRepoPath, encoding: 'utf8' }).trim();
-        } catch {
-            try { execFileSync(GIT, ['rebase', '--abort'], { cwd: submoduleRepoPath, stdio: 'ignore' }); } catch { /* ignore */ }
-            try { execFileSync(GIT, ['checkout', '-q', '--detach', branchCommit], { cwd: submoduleRepoPath, stdio: 'ignore' }); } catch { /* ignore */ }
-            gitlinks.push({ path, baseCommit, branchCommit, action: 'rebase_conflict' });
-            // Real submodule content conflict → do NOT converge; caller keeps blocked_review.
-            return { converged: false, reason: 'rebase_conflict', resolutions: [], gitlinks };
-        }
-
-        gitlinks.push({ path, baseCommit, branchCommit, rebasedCommit, action: 'rebased' });
-        resolutions.push({ path, baseCommit, branchCommit, rebasedCommit: rebasedCommit! });
-    }
-
-    if (!sawDiverged) {
-        return { converged: false, reason: 'not_diverged', resolutions: [], gitlinks };
-    }
-    return { converged: resolutions.length > 0, resolutions, gitlinks };
-}
-
-export type RootRebaseGitlinkResolveResult = {
-    /** True when the root rebase completed (with gitlink conflicts resolved to the converged commits). */
-    ok: boolean;
-    /** New root HEAD after the rebase (only meaningful when ok). */
-    branchHead?: string;
-    /**
-     * Set when the rebase was aborted (fail-safe). One of:
-     *   non_gitlink_conflict — a conflict on a non-submodule path (genuine content conflict)
-     *   unexpected_gitlink   — a gitlink conflicted that we have no converged commit for
-     *   rebase_error         — the rebase failed for a non-conflict reason
-     */
-    reason?: string;
-    /** The paths that conflicted at the point of abort (for diagnostics). */
-    conflictPaths?: string[];
-};
-
-/**
- * STEP 2 of auto-converging diverged submodule gitlinks: rebase the worktree root
- * branch onto `baseHead`, resolving each submodule-gitlink conflict to the
- * pre-converged commit from {@link convergeDivergedSubmoduleGitlinks}. git's
- * recursive merge refuses to auto-merge a diverged gitlink ("Recursive merging
- * with submodules currently only supports trivial cases"), so we drive the rebase
- * ourselves: on each stop, if the ONLY unmerged paths are gitlinks we have a
- * converged commit for, we stage those to the converged commit and `--continue`.
- * Any non-gitlink conflict (or a gitlink with no converged commit) aborts the
- * rebase and returns `ok:false` → caller keeps the defer→blocked_review path.
- *
- * On success the base-side gitlink is a strict ancestor of the resolved branch-side
- * commit, so the downstream patch-equivalence gate treats it as a trivial
- * fast-forward and passes.
- */
-export function rootRebaseResolvingGitlinks(
-    worktreeRoot: string,
-    baseHead: string,
-    resolutions: Array<{ path: string; rebasedCommit: string }>,
-): RootRebaseGitlinkResolveResult {
-    const resolveByPath = new Map(resolutions.map(r => [r.path, r.rebasedCommit]));
-
-    const runRebase = (args: string[]): { ok: boolean } => {
-        try {
-            execFileSync(GIT, args, {
-                cwd: worktreeRoot,
-                stdio: ['ignore', 'pipe', 'pipe'],
-                // A rebase editor prompt would hang; keep it non-interactive.
-                env: { ...process.env, GIT_EDITOR: 'true', GIT_SEQUENCE_EDITOR: 'true' },
-            });
-            return { ok: true };
-        } catch {
-            return { ok: false };
-        }
-    };
-
-    const unmergedPaths = (): string[] => {
-        try {
-            return execFileSync(GIT, ['diff', '--name-only', '--diff-filter=U'], { cwd: worktreeRoot, encoding: 'utf8' })
-                .split('\n').map(s => s.trim()).filter(Boolean);
-        } catch {
-            return [];
-        }
-    };
-
-    const abort = (reason: string, conflictPaths?: string[]): RootRebaseGitlinkResolveResult => {
-        try { execFileSync(GIT, ['rebase', '--abort'], { cwd: worktreeRoot, stdio: 'ignore' }); } catch { /* ignore */ }
-        return { ok: false, reason, conflictPaths };
-    };
-
-    let progress = runRebase(['rebase', baseHead]);
-    let guard = 0;
-    while (!progress.ok) {
-        if (guard++ > 100) return abort('rebase_error');
-        const conflicts = unmergedPaths();
-        if (conflicts.length === 0) {
-            // Failed but no recorded conflicts — a non-conflict rebase error.
-            return abort('rebase_error');
-        }
-        // Every conflicting path must be a gitlink we have a converged commit for.
-        const unresolvable = conflicts.filter(p => !resolveByPath.has(p));
-        if (unresolvable.length > 0) {
-            // Distinguish a genuine (non-gitlink) content conflict from a gitlink we
-            // simply have no converged commit for. `ls-files --stage` reports mode
-            // 160000 for a gitlink at any conflict stage.
-            const unresolvableGitlink = unresolvable.some(p => {
-                try {
-                    const staged = execFileSync(GIT, ['ls-files', '--stage', '--', p], { cwd: worktreeRoot, encoding: 'utf8' });
-                    return /^160000\s/m.test(staged);
-                } catch {
-                    return false;
-                }
-            });
-            const allGitlink = unresolvable.every(p => {
-                try {
-                    const staged = execFileSync(GIT, ['ls-files', '--stage', '--', p], { cwd: worktreeRoot, encoding: 'utf8' });
-                    return /^160000\s/m.test(staged);
-                } catch {
-                    return false;
-                }
-            });
-            // A non-gitlink conflict is the fail-safe case that must clearly signal a
-            // genuine content conflict; a gitlink-only miss is the (rarer) case where a
-            // gitlink conflicted that STEP 1 did not converge.
-            return abort(allGitlink && unresolvableGitlink ? 'unexpected_gitlink' : 'non_gitlink_conflict', conflicts);
-        }
-        // Stage every conflicting gitlink to its converged commit, then continue.
-        for (const p of conflicts) {
-            const commit = resolveByPath.get(p)!;
-            try {
-                execFileSync(GIT, ['checkout', '-q', '--detach', commit], { cwd: pathResolve(worktreeRoot, p), stdio: 'ignore' });
-            } catch { /* the checkout is best-effort; the `add` below stamps the index either way */ }
-            try {
-                execFileSync(GIT, ['add', p], { cwd: worktreeRoot, stdio: 'ignore' });
-            } catch {
-                return abort('rebase_error', conflicts);
-            }
-        }
-        progress = runRebase(['rebase', '--continue']);
-    }
-
-    let branchHead: string | undefined;
-    try {
-        branchHead = execFileSync(GIT, ['rev-parse', 'HEAD'], { cwd: worktreeRoot, encoding: 'utf8' }).trim();
-    } catch { /* leave undefined */ }
-    return { ok: true, branchHead };
-}
-
 /**
  * Decide whether a merge-tree submodule conflict between base and branch is a
  * trivial gitlink fast-forward (and nothing else).

package/src/mesh/mesh-remote-event-pull.ts

@@ -60,78 +60,57 @@ export async function pullRemoteNodeQueues(
     // block the other nodes for the rest of the tick. Each node callback is fully
     // self-contained (local/candidate skip, peer-connected pre-check, per-candidate
     // pulls, extract→re-inject) and best-effort — allSettled swallows per-node errors.
-    await Promise.allSettled(mesh.nodes.map(node =>
-        pullPendingEventsFromNode(components, meshId, node, localDaemonId, candidateDaemonIds, pulls)));
-}
-
-// Pull one node's pending coordinator events and re-inject them locally via
-// handleMeshForwardEvent (which runs the delivery-consume + re-queue paths). Factored
-// out of pullRemoteNodeQueues so the reconcile loop can also issue a TARGETED single-node
-// pull on demand — specifically, the DELIVERED-NOT-CONSUMED redrive gate calls this for
-// one node right before it would re-drive, so a worker's already-emitted (but not-yet-
-// pulled) agent:generating_started is consumed IN-PROCESS this tick instead of waiting for
-// the next PHASE 1 pull. That closes the redrive-vs-consume race: the redrive gate reads
-// taskDeliveryConsumed() AFTER this pull has had its chance to flip the delivery row.
-// Returns silently on any skip/error — every caller treats it as best-effort.
-export async function pullPendingEventsFromNode(
-    components: DaemonComponents,
-    meshId: string,
-    node: { daemonId?: string },
-    localDaemonId: string | undefined,
-    candidateDaemonIds: string[],
-    pulls: Array<Record<string, unknown>>,
-): Promise<void> {
-    const dispatchMeshCommand = components.dispatchMeshCommand;
-    if (!dispatchMeshCommand) return;
-    const nodeDaemonId = readNonEmptyString(node.daemonId);
-    // Skip nodes without a daemon, and nodes on THIS daemon (their events are
-    // already in the local queue drained in PHASE 2). "This daemon" is matched
-    // against the full self-identity set (candidateDaemonIds), not just the bare
-    // localDaemonId — a self node can be registered under the config-form daemonId
-    // (`daemon_<machineId>`) which would NOT equal bare localDaemonId, and pulling
-    // from ourselves over P2P is both wasteful and a self-dispatch hazard.
-    if (!nodeDaemonId) return;
-    if (daemonIdsEquivalent(nodeDaemonId, localDaemonId)) return;
-    if (daemonIdListIncludes(candidateDaemonIds, nodeDaemonId)) return;
-
-    // Peer-connected pre-check (EVENT-DELIVERY-DELAY fix(a) + OFFLINE-NODE-FANOUT):
-    // a degraded peer whose DataChannel is not open would sink this pull into
-    // peer.connectQueue and stall until CONNECT_TIMEOUT_MS (90s), formerly freezing
-    // the whole serial loop and delaying completion-event recovery from healthy
-    // nodes. Skip such a node THIS tick and retry next tick — LOSSLESS: an
-    // unconnected peer has not drained anything (drained=0 preserved), so its events
-    // are recovered whole on the next successful tick. Skip = delay, never loss.
-    //   • getter WIRED (cloud) → a null/undefined snapshot means "no peer object
-    //     right now" = NOT connected (a powered-off node whose failPeer just deleted
-    //     the peer each cycle). Treat it EXACTLY like state !== 'connected' and skip;
-    //     dialing here would re-queue for another 90s (the null-race the guard is
-    //     meant to prevent). Only a snapshot with state === 'connected' proceeds.
-    //   • getter UNWIRED (standalone) → DO NOT skip; fall through to the legacy path
-    //     so this stays regression-free (the standalone case the guard's history
-    //     references).
-    const getPeerStatus = components.getMeshPeerConnectionStatus;
-    if (getPeerStatus) {
-        const peerSnapshot = getPeerStatus(nodeDaemonId);
-        if (!peerSnapshot || String(peerSnapshot.state) !== 'connected') return;
-    }
+    await Promise.allSettled(mesh.nodes.map(async (node) => {
+        const nodeDaemonId = readNonEmptyString(node.daemonId);
+        // Skip nodes without a daemon, and nodes on THIS daemon (their events are
+        // already in the local queue drained in PHASE 2). "This daemon" is matched
+        // against the full self-identity set (candidateDaemonIds), not just the bare
+        // localDaemonId — a self node can be registered under the config-form daemonId
+        // (`daemon_<machineId>`) which would NOT equal bare localDaemonId, and pulling
+        // from ourselves over P2P is both wasteful and a self-dispatch hazard.
+        if (!nodeDaemonId) return;
+        if (daemonIdsEquivalent(nodeDaemonId, localDaemonId)) return;
+        if (daemonIdListIncludes(candidateDaemonIds, nodeDaemonId)) return;
 
-    for (const pendingEventArgs of pulls) {
-        let events: unknown;
-        try {
-            events = await dispatchMeshCommand(nodeDaemonId, 'get_pending_mesh_events', pendingEventArgs);
-        } catch {
-            // Remote pull is best-effort; the node may be offline. Retry next tick.
-            break; // node unreachable — don't bother with the other id form this tick.
+        // Peer-connected pre-check (EVENT-DELIVERY-DELAY fix(a) + OFFLINE-NODE-FANOUT):
+        // a degraded peer whose DataChannel is not open would sink this pull into
+        // peer.connectQueue and stall until CONNECT_TIMEOUT_MS (90s), formerly freezing
+        // the whole serial loop and delaying completion-event recovery from healthy
+        // nodes. Skip such a node THIS tick and retry next tick — LOSSLESS: an
+        // unconnected peer has not drained anything (drained=0 preserved), so its events
+        // are recovered whole on the next successful tick. Skip = delay, never loss.
+        //   • getter WIRED (cloud) → a null/undefined snapshot means "no peer object
+        //     right now" = NOT connected (a powered-off node whose failPeer just deleted
+        //     the peer each cycle). Treat it EXACTLY like state !== 'connected' and skip;
+        //     dialing here would re-queue for another 90s (the null-race the guard is
+        //     meant to prevent). Only a snapshot with state === 'connected' proceeds.
+        //   • getter UNWIRED (standalone) → DO NOT skip; fall through to the legacy path
+        //     so this stays regression-free (the standalone case the guard's history
+        //     references).
+        const getPeerStatus = components.getMeshPeerConnectionStatus;
+        if (getPeerStatus) {
+            const peerSnapshot = getPeerStatus(nodeDaemonId);
+            if (!peerSnapshot || String(peerSnapshot.state) !== 'connected') return;
         }
-        const list = extractPendingEvents(events).filter(e => readNonEmptyString(e?.meshId) === meshId);
-        for (const event of list) {
-            const payload = buildForwardPayloadFromPending(event);
-            if (!payload.event || !payload.meshId) continue;
+
+        for (const pendingEventArgs of pulls) {
+            let events: unknown;
             try {
-                handleMeshForwardEvent(components, payload);
-            } catch { /* best-effort re-inject */ }
+                events = await dispatchMeshCommand(nodeDaemonId, 'get_pending_mesh_events', pendingEventArgs);
+            } catch {
+                // Remote pull is best-effort; the node may be offline. Retry next tick.
+                break; // node unreachable — don't bother with the other id form this tick.
+            }
+            const list = extractPendingEvents(events).filter(e => readNonEmptyString(e?.meshId) === meshId);
+            for (const event of list) {
+                const payload = buildForwardPayloadFromPending(event);
+                if (!payload.event || !payload.meshId) continue;
+                try {
+                    handleMeshForwardEvent(components, payload);
+                } catch { /* best-effort re-inject */ }
+            }
         }
-    }
+    }));
 }
 
 // Pull the read_chat payload out of whatever envelope the transport returned.

package/src/mesh/mesh-runtime-store.ts

@@ -174,27 +174,6 @@ export class MeshRuntimeStore {
         this.instance = undefined;
     }
 
-    /**
-     * VACUUM the SQLite database to reclaim on-disk space. Retention prunes rows
-     * with DELETE, which frees pages inside the file but does NOT shrink it — the
-     * mesh-runtime.db grew to hundreds of MB (mission 86def38d disk-accumulation
-     * bootstrap failure) precisely because the file was never compacted. This
-     * rewrites the DB into a minimal footprint. Best-effort: a VACUUM failure (e.g.
-     * insufficient temp space, a read lock) is logged and swallowed so it can never
-     * block daemon shutdown. Called once on shutdown (see daemon-lifecycle), never
-     * on the hot path — VACUUM takes an exclusive lock and rewrites the whole file.
-     */
-    vacuum(): void {
-        try {
-            // Fold the WAL back into the main DB first so VACUUM reclaims those pages too.
-            try { this.db.pragma('wal_checkpoint(TRUNCATE)'); } catch { /* checkpoint best-effort */ }
-            this.db.exec('VACUUM;');
-            LOG.info('MeshRuntimeStore', 'VACUUM completed on shutdown');
-        } catch (err: any) {
-            LOG.warn('MeshRuntimeStore', `VACUUM on shutdown failed (ignored): ${err?.message || err}`);
-        }
-    }
-
     close(): void {
         this.db.close();
     }

package/src/mesh/mesh-work-queue.ts

@@ -1231,19 +1231,6 @@ function propagateDependencyFailure(meshId: string, failedTaskId: string): MeshW
 
 const DEPENDENCY_FAILURE_TERMINALS = new Set<MeshTaskStatus>(['failed', 'cancelled']);
 
-/**
- * CANCEL-STICKY-TERMINAL: the terminal task statuses. A row in one of these states is a
- * historical record — no live dispatch owns it — and must NEVER be flipped back to an
- * active (`pending`/`assigned`) state by a late writer. The canonical live example is a
- * cancel that races the dispatch-failure `.catch` (mesh-queue-assignment.ts): that catch
- * fires-and-forgets an unconditional `updateTaskStatus(...,'pending')`, resolving AFTER
- * the cancel commits, which resurrected the cancelled row → it got re-claimed and the
- * reclaim watchdog re-drove the same prompt. Guarding the write side (see
- * {@link updateTaskStatus}) applies the same terminal-row protection
- * {@link reclaimStrandedAssignedTask} already enforces to EVERY status writer at once.
- */
-const TERMINAL_TASK_STATUSES = new Set<MeshTaskStatus>(['completed', 'failed', 'cancelled']);
-
 /**
  * G3 (step ①) — fire-and-forget mission_close_candidate detection for the missions of
  * the given task ids. Called after any task-status mutation (completion / failure /
@@ -1280,33 +1267,12 @@ export function updateTaskStatus(
     meshId: string,
     taskId: string,
     status: MeshTaskStatus,
-    opts?: {
-        /**
-         * CANCEL-STICKY-TERMINAL: operator/system override to permit a terminal→non-terminal
-         * transition (e.g. an explicit operator reopen). Without this, a write that would flip
-         * a `completed`/`failed`/`cancelled` row back to `pending`/`assigned` is refused as a
-         * no-op. Terminal→terminal and any transition FROM a non-terminal state are unaffected.
-         */
-        force?: boolean;
-    } & MeshQueueMutationOptions,
+    opts?: MeshQueueMutationOptions,
 ): MeshWorkQueueEntry | null {
     requireMeshHostQueueOwner(opts);
     const result = withQueueLock(meshId, () => {
         const entry = MeshRuntimeStore.getInstance().findQueueEntryById(meshId, taskId);
         if (!entry) return null;
-        // CANCEL-STICKY-TERMINAL: never resurrect a terminal row into an active state. A late
-        // fire-and-forget writer (canonically the dispatch-failure `.catch` requeue to
-        // 'pending' in mesh-queue-assignment.ts, which resolves AFTER a cancel commits) must
-        // not undo a cancel/completion/failure — that revival let the row be re-claimed and the
-        // reclaim watchdog re-drive the same prompt. Refuse the transition as a no-op unless an
-        // explicit operator override is passed. This is the write-side sibling of the
-        // status!=='assigned' guard reclaimStrandedAssignedTask already applies.
-        if (!opts?.force
-            && TERMINAL_TASK_STATUSES.has(entry.status)
-            && !TERMINAL_TASK_STATUSES.has(status)) {
-            LOG.debug('MeshQueue', `Refusing updateTaskStatus(${taskId} → ${status}) on mesh ${meshId}: row is terminal (${entry.status}). A late writer (e.g. dispatch-failure requeue) must not resurrect a cancelled/completed/failed task. Pass force to override.`);
-            return { entry, cascaded: [] as MeshWorkQueueEntry[] };
-        }
         entry.status = status;
         MeshRuntimeStore.getInstance().updateQueueEntry(entry);
         // Any transition OFF `assigned` ends the single-flight dispatch window (terminal
@@ -1347,67 +1313,18 @@ export function cancelTask(
         const entry = MeshRuntimeStore.getInstance().findQueueEntryById(meshId, taskId);
         if (!entry) return null;
         const now = new Date().toISOString();
-        // CANCEL-STICKY-TERMINAL (authoritative cancel): capture the prior assignment BEFORE
-        // clearing it, so the caller can stop the bound live worker. Leaving assignedNodeId/
-        // SessionId/ProviderType on the cancelled row let the still-running worker keep emitting
-        // delivery/turn signals that re-ignited the reclaim watchdog (observed: nonce 6→9,
-        // needing two cancels + a manual session stop). Clearing them also drops this row from
-        // the status==='assigned' counters so it can never be treated as live again.
-        const priorAssignment: CancelledTaskAssignment | undefined = entry.assignedSessionId
-            ? {
-                sessionId: entry.assignedSessionId,
-                nodeId: entry.assignedNodeId,
-                providerType: entry.assignedProviderType,
-            }
-            : undefined;
         entry.status = 'cancelled';
         entry.cancelledAt = now;
         if (opts?.reason) entry.cancelReason = opts.reason;
-        delete entry.assignedNodeId;
-        delete entry.assignedSessionId;
-        delete entry.assignedProviderType;
-        delete entry.dispatchTimestamp;
-        // Belt-and-suspenders: bump the dispatch nonce so any in-flight inject the
-        // now-orphaned worker later echoes carries a stale nonce and is rejected by the
-        // coordinator's stale-nonce guard — same mechanism reclaimStrandedAssignedTask uses.
-        entry.dispatchNonce = (entry.dispatchNonce || 0) + 1;
         MeshRuntimeStore.getInstance().updateQueueEntry(entry);
         endTaskDispatchInFlight(meshId, taskId);
         const cascaded = propagateDependencyFailure(meshId, taskId);
-        return { entry, cascaded, priorAssignment };
+        return { entry, cascaded };
     });
     if (result) scheduleMissionCloseCandidateCheck(meshId, [result.entry, ...result.cascaded]);
-    // Surface the prior binding to the caller (out-of-band from the persisted row, so it is
-    // never serialized) so the cancel command handler — which holds DaemonComponents — can
-    // stop the now-orphaned worker via the transport-aware stopStaleMeshWorker helper.
-    if (result?.priorAssignment) lastCancelledTaskAssignment.set(`${meshId}::${taskId}`, result.priorAssignment);
     return result ? result.entry : null;
 }
 
-/**
- * CANCEL-STICKY-TERMINAL: the assignment a task carried at cancel time, handed to the cancel
- * command handler so it can stop the bound worker. cancelTask runs in the pure queue-store
- * module (no DaemonComponents), so it records the binding here and the handler drains it.
- */
-export interface CancelledTaskAssignment {
-    sessionId: string;
-    nodeId?: string;
-    providerType?: string;
-}
-
-const lastCancelledTaskAssignment = new Map<string, CancelledTaskAssignment>();
-
-/**
- * Read-and-clear the assignment a just-cancelled task was bound to. Returns undefined when the
- * cancelled task had no live assignment (nothing to stop). One-shot: the entry is deleted on read.
- */
-export function takeCancelledTaskAssignment(meshId: string, taskId: string): CancelledTaskAssignment | undefined {
-    const key = `${meshId}::${taskId}`;
-    const value = lastCancelledTaskAssignment.get(key);
-    if (value) lastCancelledTaskAssignment.delete(key);
-    return value;
-}
-
 /**
  * Return a queue task to pending for retry. By default, dead session targeting
  * and assigned ownership are cleared so stale assignments do not strand again.

package/src/providers/chat-message-normalization.ts

@@ -156,59 +156,6 @@ export function selectFinalAssistantTurnEndMessage(
   return null;
 }
 
-/**
- * EARLY-IDLE-COMPLETION-FALSE-POSITIVE — trailing tool/terminal activity detector.
- *
- * True when the transcript's LAST non-empty user-facing assistant bubble is followed
- * by one or more TOOL / TERMINAL activity bubbles (a tool_use/command the assistant
- * fired AFTER its text) — i.e. the assistant emitted a preamble ("Let me explore…"),
- * then started running Read/Grep, so the turn is still executing and its answer has
- * not landed. Callers that would otherwise promote that preamble to a turn-end summary
- * off a momentary (startup-grace / inter-tool) idle read use this as a veto.
- *
- * Deliberately NARROW so the pure-PTY completion rescue is preserved:
- *   - Only TOOL/TERMINAL activity trailing the assistant vetoes. A trailing THOUGHT or
- *     status bubble does NOT (a finished turn can end on an internal thought), matching
- *     selectFinalAssistantTurnEndMessage's skip set minus the "still-working" signals.
- *   - A genuinely FINISHED worker (final assistant last, no trailing tool activity —
- *     the kimi pure-PTY continuous-idle shape) returns false, so its early completion
- *     is untouched.
- *
- * Returns false when there is no final assistant bubble at all (the caller's
- * selectFinalAssistantTurnEndMessage already handles that as "not a turn end").
- */
-export function hasTrailingToolActivityAfterFinalAssistant(
-  messages: ChatMessage[] | null | undefined,
-): boolean {
-  if (!Array.isArray(messages) || messages.length === 0) return false;
-  let sawTrailingToolActivity = false;
-  for (let i = messages.length - 1; i >= 0; i--) {
-    const msg = messages[i];
-    if (!msg) continue;
-    const classification = classifyChatMessageVisibility(msg);
-    // A trailing user-facing assistant/model bubble with real text ends the scan:
-    // whether we saw a tool AFTER it is the verdict.
-    if (classification.isUserFacing && (msg.role === 'assistant' || msg.role === 'model')) {
-      if (flattenContent(msg.content).trim()) return sawTrailingToolActivity;
-      // Empty streaming assistant bubble — keep scanning back past it, same as
-      // selectFinalAssistantTurnEndMessage (which returns null here); an empty tail
-      // isn't a turn end, so there is nothing to veto.
-      return false;
-    }
-    if (classification.isUserFacing) {
-      // A trailing user bubble (freshly dispatched task, no reply) → no assistant
-      // turn end below it to veto.
-      return false;
-    }
-    // Non-user-facing activity/internal bubble sitting AFTER the (not-yet-seen)
-    // assistant bubble. Only tool/terminal activity signals an in-flight turn.
-    if (classification.kind === 'tool' || classification.kind === 'terminal') {
-      sawTrailingToolActivity = true;
-    }
-  }
-  return false;
-}
-
 export const BUILTIN_CHAT_MESSAGE_KINDS = ['standard', 'thought', 'tool', 'terminal', 'system'] as const;
 
 export type BuiltinChatMessageKind = typeof BUILTIN_CHAT_MESSAGE_KINDS[number];