@adhdev/daemon-core 1.0.18-rc.9 → 1.0.19

package/src/mesh/mesh-event-forwarding.ts

@@ -16,7 +16,8 @@ import { resolveMeshHostStatus } from './mesh-host-ownership.js';
 import { enqueueUnresolvedDelegateForward, nudgeUnresolvedForwardRetry } from './mesh-unresolved-forward-outbox.js';
 import { traceMeshEventStage, traceMeshEventDrop } from './mesh-event-trace.js';
 import { getLastDisplayMessage } from '../status/snapshot.js';
-import { resolveDelegatedWorkerAutoApprove } from '../repo-mesh-types.js';
+import { delegatedWorkerAutoApproveSettings } from '../repo-mesh-types.js';
+import { loadRepoMeshJsonConfig } from '../config/mesh-json-config.js';
 import { meshNodeIdMatches, daemonIdsEquivalent, expandDaemonIdForms, sessionIdsEquivalent, withStatusProbeMarker, type MeshNodeIdentified } from '@adhdev/mesh-shared';
 import {
     findRecentTerminalLedgerEvidence,
@@ -1071,10 +1072,44 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
         // C2: prefer an exact taskId match when the completion event carries one —
         // it's immune to coordinator↔worker clock skew that can hide the assigned row.
         const eventTaskId = readNonEmptyString(args.metadataEvent.taskId) || undefined;
-        const task = updateSessionTaskStatus(args.meshId, sessionId, outcome, {
-            occurredAt: occurredAtMs != null ? new Date(occurredAtMs).toISOString() : undefined,
-            taskId: eventTaskId,
-        });
+        // WEAK-QUEUE-TENTATIVE (early-completed safety net, symmetric with the direct-dispatch
+        // `tentativeIfDirect` guard below): a `completed` outcome whose evidence is WEAK — a
+        // false-idle / missing_final_assistant emit (the CANON-C decoupled-immediate path that
+        // stamps evidenceLevel=insufficient) — must NOT hard-flip a matched QUEUE row to
+        // terminal. Until this net, only DIRECT dispatches were kept tentative on weak evidence;
+        // a queue-claimed task's session flipped its row to 'completed' unconditionally, so a
+        // worker that dropped to idle ~13s in with no final assistant closed the task early even
+        // though it never produced an answer. Leaving the row 'assigned' hands it to the reconcile
+        // loop's proven net (PHASE 4 records the GENUINE completion once the transcript lands via
+        // findTerminalLedgerEvidenceForTask; PHASE 2.5 reclaims a truly-stranded row back to
+        // 'pending' for re-dispatch, bounded by MAX_STRANDED_RECLAIMS) — never a permanent wedge.
+        //
+        // CRUCIAL SCOPE: this covers only the PREMATURE decoupled-immediate emit
+        // (emittedAfterFinalizationTimeout !== true). A weak completion that already waited out the
+        // full 30s COMPLETED_FINALIZATION_MAX_WAIT_MS window (emittedAfterFinalizationTimeout=true)
+        // is a GENUINE — if answerless — terminal: the worker exhausted its finalization wait and
+        // is done, so it flips 'completed' as before (a tool-only turn that never produced an
+        // assistant bubble must still close its task). A `failed` outcome or a completion with
+        // genuine evidence flips terminal as before too.
+        const completionDiagnostic = args.metadataEvent.completionDiagnostic && typeof args.metadataEvent.completionDiagnostic === 'object'
+            ? args.metadataEvent.completionDiagnostic as Record<string, unknown>
+            : undefined;
+        const emittedAfterFinalizationTimeout = completionDiagnostic?.emittedAfterFinalizationTimeout === true;
+        const weakCompleted = outcome === 'completed'
+            && isWeakCompletionEvidence(args.metadataEvent)
+            && !emittedAfterFinalizationTimeout;
+        const task = weakCompleted
+            ? updateSessionTaskStatus(args.meshId, sessionId, 'assigned', {
+                occurredAt: occurredAtMs != null ? new Date(occurredAtMs).toISOString() : undefined,
+                taskId: eventTaskId,
+            })
+            : updateSessionTaskStatus(args.meshId, sessionId, outcome, {
+                occurredAt: occurredAtMs != null ? new Date(occurredAtMs).toISOString() : undefined,
+                taskId: eventTaskId,
+            });
+        if (weakCompleted && task) {
+            LOG.info('MeshQueue', `Weak completion (${readNonEmptyString(args.metadataEvent.evidenceLevel) || 'missing_final_assistant'}) kept queue task ${task.id} tentative (session ${sessionId}); reconcile owns the genuine terminal`);
+        }
         // Fix A (early-terminal prevention): a false-idle completion (no confirmed final
         // assistant) for a DIRECT dispatch — i.e. no work-queue row matched — must not flip the
         // dispatch row terminal. Leaving it active lets the reconcile loop (PHASE 4) re-read the
@@ -1580,7 +1615,22 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
                                     spawnedSessionVisibility: mesh?.policy?.spawnedSessionVisibility || 'hidden',
                                     // Coordinator-dispatched recovery relaunch: same auto-approve
                                     // policy as the primary worker launch path.
-                                    autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+                                    ...delegatedWorkerAutoApproveSettings(
+                                        mesh?.policy,
+                                        node?.policy,
+                                        components.providerLoader?.getMeta(recoveryContext.failedProviderType),
+                                        // Recovery relaunch: same repo-declared requested mode as the
+                                        // primary path. node.workspace missing → null → provider default.
+                                        (() => {
+                                            const ws = typeof node?.workspace === 'string' && node.workspace.trim() ? node.workspace.trim() : '';
+                                            if (!ws) return null;
+                                            try {
+                                                const r = loadRepoMeshJsonConfig(ws);
+                                                return r.sourceType === 'repo_file' && r.config ? r.config : null;
+                                            } catch { return null; }
+                                        })(),
+                                        recoveryContext.failedProviderType,
+                                    ),
                                     launchedByCoordinator: true,
                                 }
                             }).catch((e: any) => LOG.error('MeshRecovery', `Failed to auto-relaunch session for ${node.id}: ${e?.message}`));
@@ -1754,6 +1804,14 @@ export function buildRelayMetadataEvent(payload: Record<string, unknown>): Recor
         retryOfJobId: readNonEmptyString(payload.retryOfJobId),
         ...(relayModalMessage ? { modalMessage: relayModalMessage } : {}),
         ...(relayModalButtons && relayModalButtons.length > 0 ? { modalButtons: relayModalButtons } : {}),
+        // agent:waiting_choice (mission f1d25e11): carry the FULL structured question
+        // payload across the machine boundary so a REMOTE worker's AskUserQuestion reaches
+        // the coordinator with every question + option intact — the coordinator renders
+        // these and answers with mesh_answer_question. The local in-process forward path
+        // preserves the whole event for free; this mirrors the fields for the remote relay.
+        ...(payload.interactivePrompt && typeof payload.interactivePrompt === 'object' && !Array.isArray(payload.interactivePrompt) ? { interactivePrompt: payload.interactivePrompt } : {}),
+        ...(readNonEmptyString(payload.promptId) ? { promptId: readNonEmptyString(payload.promptId) } : {}),
+        ...(payload.multiSelect === true ? { multiSelect: true } : {}),
         ...(payload.result && typeof payload.result === 'object' && !Array.isArray(payload.result) ? { result: payload.result } : {}),
         ...(payload.completionDiagnostic && typeof payload.completionDiagnostic === 'object' && !Array.isArray(payload.completionDiagnostic) ? { completionDiagnostic: payload.completionDiagnostic } : {}),
         ...(payload.workerResult && typeof payload.workerResult === 'object' && !Array.isArray(payload.workerResult) ? { workerResult: payload.workerResult } : {}),

package/src/mesh/mesh-events-utils.ts

@@ -330,6 +330,48 @@ export function buildMeshSystemMessage(args: {
     if (args.event === 'agent:waiting_approval') {
         return `[System] ${args.nodeLabel} is waiting for approval to proceed${metadata}. You may use mesh_read_chat and mesh_approve to handle it.`;
     }
+    if (args.event === 'agent:waiting_choice') {
+        // A multi-choice QUESTION (AskUserQuestion) — NOT an approval. It is answered with
+        // mesh_answer_question (never mesh_approve). Surface the question text + choices
+        // inline so the coordinator can decide without a mesh_read_chat round-trip, and
+        // name the correct tool + promptId (mission f1d25e11).
+        const prompt = args.metadataEvent.interactivePrompt as
+            | { promptId?: unknown; questions?: Array<Record<string, unknown>> }
+            | undefined;
+        const promptId = readNonEmptyString(args.metadataEvent.promptId)
+            || (prompt && readNonEmptyString(prompt.promptId));
+        const lines: string[] = [
+            `[System] ${args.nodeLabel} is asking a question and is waiting for your answer${metadata}.`,
+        ];
+        const questions = Array.isArray(prompt?.questions) ? prompt!.questions! : [];
+        if (questions.length > 0) {
+            for (const q of questions) {
+                const header = readNonEmptyString(q.header);
+                const question = readNonEmptyString(q.question);
+                const multiSelect = q.multiSelect === true;
+                if (question) {
+                    lines.push(`\n**${header ? `${header}: ` : ''}${question}**${multiSelect ? ' (select one or more)' : ''}`);
+                }
+                const options = Array.isArray(q.options) ? q.options : [];
+                options.forEach((opt, i) => {
+                    const record = (opt && typeof opt === 'object') ? opt as Record<string, unknown> : {};
+                    const label = readNonEmptyString(record.label);
+                    if (!label) return;
+                    const description = readNonEmptyString(record.description);
+                    lines.push(`  ${i + 1}. ${label}${description ? ` — ${description}` : ''}`);
+                });
+            }
+        } else {
+            const modalMessage = readNonEmptyString(args.metadataEvent.modalMessage);
+            if (modalMessage) lines.push(`\n${modalMessage}`);
+        }
+        lines.push(
+            `\nAnswer with mesh_answer_question(node_id, session_id${promptId ? `, promptId: "${promptId}"` : ''}, answers). ` +
+            `Do NOT use mesh_approve — that only resolves yes/no consent modals, not a question. ` +
+            `Use mesh_read_chat once if you need the full context first.`,
+        );
+        return lines.join('\n');
+    }
     if (args.event === 'agent:stopped') {
         const rc = args.recoveryContext;
         if (rc && rc.consecutiveNodeFailures > 0) {

package/src/mesh/mesh-ledger.ts

@@ -33,6 +33,11 @@ export type MeshLedgerKind =
     | 'task_failed'
     | 'task_stalled'
     | 'task_approval_needed'
+    // A worker is parked on an AskUserQuestion multi-choice prompt (waiting_choice) —
+    // distinct from task_approval_needed (a yes/no tool-consent modal). The coordinator
+    // answers a question with mesh_answer_question, never mesh_approve (mission f1d25e11).
+    // payload carries the full InteractivePrompt (promptId + questions + options).
+    | 'task_question_pending'
     | 'p2p_dispatch_failed'
     | 'session_launched'
     | 'session_auto_launch'

package/src/mesh/mesh-node-identity.ts

@@ -907,6 +907,55 @@ export function isMeshNodeHealthLaunchable(node: any): boolean {
     return health === 'online' || health === 'unknown';
 }
 
+/** Resolve the git telemetry object a node carries, in the same precedence
+ *  resolveEffectiveMeshNodeHealth uses: a fresh `node.git`, else the cached inline
+ *  status git (`node.cachedStatus.git`). Returns an empty record when neither is
+ *  present (no telemetry). */
+function resolveEffectiveNodeGit(node: any): Record<string, any> {
+    const git = readObjectRecord(node?.git);
+    if (Object.keys(git).length > 0) return git;
+    const cachedStatus = readObjectRecord(node?.cachedStatus);
+    return readObjectRecord(cachedStatus.git);
+}
+
+/**
+ * Launch FRESHNESS gate — distinct from the health gate above.
+ *
+ * `deriveMeshNodeHealthFromGit` reports a clean-tree node with `behind > 0` as
+ * 'online', so the health gate (isMeshNodeHealthLaunchable) happily lets a STALE
+ * node — one whose branch is N commits behind its upstream — win auto-launch fitness
+ * routing and run a fresh worker against out-of-date code. `behind` is deliberately
+ * NOT folded into deriveMeshNodeHealthFromGit because "behind" is not universally
+ * unhealthy (the MAGI planner and other callers share that resolver); it is only
+ * unhealthy for *spawning new work*. This gate encodes exactly that launch-time axis.
+ *
+ * Returns false (NOT fresh → skip / de-rank) only when git telemetry is PRESENT and
+ * proves staleness:
+ *   - behind count exceeds `maxBehind` (default 0 — any behind blocks), OR
+ *   - a submodule is out of sync (gitlink points off upstream — cannot be caught up
+ *     by a simple worktree ff and would launch against a mismatched submodule).
+ *
+ * When telemetry is absent it returns true (fresh), preserving the online/unknown-pass
+ * philosophy: we never block on missing data, only on data that proves the node stale.
+ */
+export function isMeshNodeFreshEnoughToLaunch(node: any, opts?: { maxBehind?: number }): boolean {
+    const git = resolveEffectiveNodeGit(node);
+    // No git telemetry at all → cannot prove stale → do not block.
+    if (Object.keys(git).length === 0) return true;
+    // Not a git repo / no branch: leave this to the health gate (it returns 'degraded'
+    // and blocks there); freshness has nothing to add.
+    if (readBooleanValue(git.isGitRepo) === false) return true;
+    const submoduleDrift = getGitSubmoduleDriftState(git);
+    if (submoduleDrift.outOfSync) return false;
+    const behind = readNumberValue(git.behind);
+    // No behind datum reported → treat as fresh (don't infer staleness from absence).
+    if (behind === undefined) return true;
+    const maxBehind = Number.isFinite(opts?.maxBehind as number) && (opts?.maxBehind as number) >= 0
+        ? Math.floor(opts!.maxBehind as number)
+        : 0;
+    return behind <= maxBehind;
+}
+
 function readMeshNodeLabel(status: Record<string, unknown>, node: any): string {
     return readStringValue(status.nodeId, normalizeMeshNodeId(node)) ?? 'unknown';
 }

package/src/mesh/mesh-queue-assignment.ts

@@ -13,13 +13,15 @@ import { createSessionDelivery, updateSessionDeliveryStatus } from './mesh-deliv
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
 import { traceMeshEventDrop } from './mesh-event-trace.js';
 import { awaitWithWarmupDeadline, resolveWarmupDeadlineOpts } from './mesh-warmup-deadline.js';
-import { resolveDelegatedWorkerAutoApprove, resolveProviderMaxParallel, resolveNodeSchedulingPriority, normalizeMeshSchedulingStrategy, resolveMaxParallelTasks, resolveMaxReadonlyParallelTasks, resolveCoordinatorIdlePushPolicy } from '../repo-mesh-types.js';
+import { delegatedWorkerAutoApproveSettings, resolveProviderMaxParallel, resolveNodeSchedulingPriority, normalizeMeshSchedulingStrategy, resolveMaxParallelTasks, resolveMaxReadonlyParallelTasks, resolveCoordinatorIdlePushPolicy } from '../repo-mesh-types.js';
+import { loadRepoMeshJsonConfig } from '../config/mesh-json-config.js';
+import type { RepoMeshDeclarativeConfig } from '../config/mesh-json-config.js';
 import type { RepoMeshSchedulingStrategy } from '../repo-mesh-types.js';
 import { normalizeMeshNodeId, meshNodeIdMatches, daemonIdsEquivalent, canonicalDaemonId, expandDaemonIdForms, normalizeMeshWorkspaceForCompare, meshWorkspacesEquivalent, sessionIdsEquivalent, normalizeNodeCapabilitySlots, isMeshTaskDifficulty, withStatusProbeMarker, type MeshNodeIdentified, type NodeCapabilitySlot, type MeshTaskDifficulty } from '@adhdev/mesh-shared';
 import { resolveNodeCapabilitySlots } from './mesh-node-slots.js';
 import { findTerminalLedgerEvidenceForTask, hasUnterminalDirectDispatchLedgerEntry } from './mesh-events-stale.js';
 import { readNonEmptyString } from './mesh-events-utils.js';
-import { readMeshNodeDaemonId, isMeshNodeHealthLaunchable } from './mesh-node-identity.js';
+import { readMeshNodeDaemonId, isMeshNodeHealthLaunchable, isMeshNodeFreshEnoughToLaunch } from './mesh-node-identity.js';
 import { queuePendingMeshCoordinatorEvent, retractPendingDispatchBlockedEvent, drainPendingMeshCoordinatorEvents } from './mesh-events-pending.js';
 import { isWorktreeBootstrapStaleRunning, shouldDeferDispatchForBootstrap } from './worktree-bootstrap-config.js';
 import { isWithinCloneBootstrapGrace } from './mesh-clone-grace.js';
@@ -90,6 +92,25 @@ export function __resetIdleAutoFastForwardForTests(): void {
     autoFastForwardWorkspaceLease.clear();
 }
 
+/**
+ * Load the repo-shared `.adhdev/mesh.json` for a node's workspace, tolerating a
+ * missing/invalid file (returns null → resolver falls back to provider-spec
+ * defaults, i.e. exactly the pre-providerDefaults behavior). Only the
+ * `providerDefaults` zone influences the delegated-worker MODE selection; it never
+ * touches the ENABLE decision. When a node carries no workspace path (should not
+ * happen for a launchable node, but be defensive), we skip the read entirely.
+ */
+function loadRepoConfigForNode(node: any): RepoMeshDeclarativeConfig | null {
+    const workspace = typeof node?.workspace === 'string' && node.workspace.trim() ? node.workspace.trim() : '';
+    if (!workspace) return null;
+    try {
+        const result = loadRepoMeshJsonConfig(workspace);
+        return result.sourceType === 'repo_file' && result.config ? result.config : null;
+    } catch {
+        return null;
+    }
+}
+
 export function getMeshWithCache(components: DaemonComponents, meshId: string): any | undefined {
     const localMesh = getMesh(meshId);
     const cachedMesh = components.router?.getCachedInlineMesh(meshId);
@@ -690,7 +711,7 @@ export function tryAssignQueueTask(
         if (inst && typeof inst.updateSettings === 'function') {
             // Adopting a (possibly manually-opened) local session as a worker: apply the
             // delegated-worker auto-approve policy here too, so a session that was launched
-            // without autoApprove still auto-approves once the coordinator dispatches a task
+            // without an auto-approve boolean/mode still resolves the delegated policy once dispatched
             // to it (the "approval notification fires only for certain delegated sessions"
             // case). updateSettings preserves runtime mesh keys; passing autoApprove keeps it.
             //
@@ -704,7 +725,13 @@ export function tryAssignQueueTask(
                 meshNodeFor: meshId,
                 meshNodeId: nodeId,
                 launchedByCoordinator: true,
-                autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+                ...delegatedWorkerAutoApproveSettings(
+                    mesh?.policy,
+                    node?.policy,
+                    components.providerLoader?.getMeta(providerType),
+                    loadRepoConfigForNode(node),
+                    providerType,
+                ),
                 ...(localDaemonId ? { meshCoordinatorDaemonId: localDaemonId } : {}),
                 // COMPLETION-PROPAGATION F5: (re)stamp the coordinator SESSION anchor from THIS
                 // task's sourceCoordinatorSessionId with PRIORITY — a manually-launched (or reused)
@@ -1694,8 +1721,20 @@ function liveSessionCountForNode(components: DaemonComponents, meshId: string, n
  * free claimer, and is excluded — so a read-only auto-launch onto a busy-but-no-idle node
  * is still allowed. A node with NO live mesh session at all (dead, or never launched) does
  * not match, preserving the legitimate first-session spawn.
+ *
+ * PROVIDER-MATCH gate (DISPATCH-DEADLOCK-PROVIDER-MISMATCH): a live session only suppresses
+ * this launch if it could ACTUALLY claim THIS task. A session whose providerType does not
+ * satisfy the task's requiredTags (e.g. a claude-cli coordinator/worker session on a node,
+ * while the pending task is required_tags: [provider=codex-cli]) is NOT a pending claimer for
+ * this task — claimNextQueueTask's nodeSatisfiesRequiredTags gate would reject its claim. Left
+ * unchecked, such a mismatched session made this gate return true for a task it can never claim,
+ * so the required-provider worker never auto-launched AND no session could claim → nobody made
+ * progress → permanent silent deadlock. Mirror the claim path: build the session's own
+ * capability tags (its providerType pinned onto the node) and only count it as a pending claimer
+ * when those tags satisfy task.requiredTags. `node` is passed in so the tag set reflects this
+ * node's os/arch/worktree/converge context, matching claimNextQueueTask exactly.
  */
-function nodeHasLiveSessionPendingClaim(components: DaemonComponents, meshId: string, nodeId: string): boolean {
+function nodeHasLiveSessionPendingClaim(components: DaemonComponents, meshId: string, nodeId: string, task: MeshWorkQueueEntry, node: any): boolean {
     // (A) AUTOLAUNCH-CLAIM-CHURN remote-awareness: a task whose auto-launch record targets this
     // node and is still inside its await-claim window (base or backoff) already has a session on
     // its way to claim — even when that session is REMOTE and thus invisible to the local
@@ -1734,7 +1773,20 @@ function nodeHasLiveSessionPendingClaim(components: DaemonComponents, meshId: st
         if (isTerminalSessionStatus(status)) return false; // dead → no claimer here, allow launch
         const sessionId = readNonEmptyString(state.instanceId);
         if (sessionId && busySessionIds.has(sessionId)) return false; // busy with its own assigned task
-        return true; // live + unassigned → will claim the pending task itself
+        // PROVIDER-MATCH gate (DISPATCH-DEADLOCK-PROVIDER-MISMATCH): only count this session as a
+        // pending claimer if its own provider could satisfy THIS task's requiredTags. A session
+        // whose providerType does not match (e.g. a claude-cli session while task requires
+        // provider=codex-cli) can never claim this task via claimNextQueueTask's
+        // nodeSatisfiesRequiredTags gate, so it must not suppress the required-provider launch —
+        // otherwise the task deadlocks (mismatched session blocks launch, yet cannot claim). Mirror
+        // the claim path: pin the session's providerType onto this node and check the tags.
+        if (task.requiredTags?.length) {
+            const sessionProviderType = state.type || readNonEmptyString(settings.providerType);
+            if (sessionProviderType && !nodeSatisfiesRequiredTags(task.requiredTags, buildMeshNodeCapabilityTags(node, sessionProviderType))) {
+                return false; // provider mismatch → this session can't claim this task; not a pending claimer
+            }
+        }
+        return true; // live + unassigned + provider-capable → will claim the pending task itself
     });
 }
 
@@ -1987,6 +2039,11 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
     }
     if (!pending.length) return false;
 
+    // Launch-freshness threshold: reuse the auto-fast-forward policy's maxBehind (default
+    // 0 → any behind blocks) so the launch gate and the repair path agree on how far
+    // behind is tolerable. Resolved once per pass and shared across every candidate node.
+    const freshnessGate = { maxBehind: resolveAutoFastForwardPolicy(mesh).maxBehind };
+
     // Write cap + read-only cap resolved through the shared helpers from the
     // MACHINE-LOCAL stored mesh policy (no repo-file overlay). These are the same
     // resolvers the observability projection uses, so the enforced and exposed
@@ -2210,6 +2267,18 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
                 markAutoLaunch(meshId, task.id, { status: 'skipped', reason: 'node_not_launch_ready', nodeId });
                 continue;
             }
+            // FRESHNESS gate (distinct from the health gate above): a clean-tree node that
+            // is `behind` its upstream reads as 'online' and passes isLaunchableNode, so
+            // without this it could win fitness routing and run a fresh worker against
+            // stale code. Skip a node whose git telemetry proves it stale (behind >
+            // maxBehind, or a submodule out of sync). Reuse the auto-fast-forward policy's
+            // maxBehind threshold so "how far behind is tolerable" is configured in ONE
+            // place. Telemetry-absent nodes pass (never block on missing data). The 4s
+            // reconcile retries once the node's auto-ff repair path catches it up.
+            if (!isMeshNodeFreshEnoughToLaunch(node, freshnessGate)) {
+                markAutoLaunch(meshId, task.id, { status: 'skipped', reason: 'node_stale_behind_upstream', nodeId });
+                continue;
+            }
             const launchTarget = resolveAutoLaunchTarget(components, node);
             if (launchTarget.mode === 'skip') {
                 // Remote node we can't reach (no transport / no coordinator daemonId).
@@ -2229,7 +2298,7 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
             // busy-but-no-idle node is still allowed. Skip with a transient (non-actionable)
             // reason so the coordinator is not paged; the 4s reconcile retries, and once the
             // existing session goes terminal this gate clears and a legitimate launch proceeds.
-            if (nodeHasLiveSessionPendingClaim(components, meshId, nodeId)) {
+            if (nodeHasLiveSessionPendingClaim(components, meshId, nodeId, task, node)) {
                 markAutoLaunch(meshId, task.id, { status: 'skipped', reason: 'node_has_live_session_pending_claim', nodeId });
                 continue;
             }
@@ -2301,8 +2370,14 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
                     spawnedSessionVisibility: mesh?.policy?.spawnedSessionVisibility || 'hidden',
                     // Coordinator-dispatched worker: auto-approve unless mesh/node policy
                     // opts out (default true). Lands in settingsOverride and beats the
-                    // global per-provider-type autoApprove config (see shouldAutoApprove).
-                    autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+                    // global per-provider-type boolean/mode through explicit opposite-key clearing.
+                    ...delegatedWorkerAutoApproveSettings(
+                        mesh?.policy,
+                        node?.policy,
+                        components.providerLoader?.getMeta(resolved.providerType),
+                        loadRepoConfigForNode(node),
+                        resolved.providerType,
+                    ),
                     launchedByCoordinator: true,
                     autoLaunchedForQueueTaskId: task.id,
                 };
@@ -2967,4 +3042,3 @@ export function runIdleMaintenanceThenAssignQueue(components: DaemonComponents,
             });
     });
 }
-