@adhdev/daemon-core 1.0.28-rc.15 → 1.0.28-rc.17

package/src/mesh/mesh-reconcile-loop.ts

@@ -64,7 +64,7 @@ import { getQueue, reclaimStrandedAssignedTask, updateTaskStatus } from './mesh-
 import { resolveSessionBusyVerdict, runContinuousAutoFastForwardScan, runPendingCoordinatorCatchupScan } from './mesh-queue-assignment.js';
 import { readLedgerEntries } from './mesh-ledger.js';
 import type { MeshLedgerEntry } from './mesh-ledger.js';
-import { findTerminalLedgerEvidenceForTask, reconcileDirectDispatchCompletionFromTranscript } from './mesh-events-stale.js';
+import { findTerminalLedgerEvidenceForTask, reconcileDirectDispatchCompletionFromTranscript, resolveLiveTurnPendingEvidence } from './mesh-events-stale.js';
 import {
     resolveCoordinatorDaemonIds,
     daemonHostsMesh,
@@ -945,18 +945,24 @@ async function evaluateEarlyIdleTranscriptArm(
 // synth is marked WEAK so the worker's own later emit can still supersede it rather than being
 // dropped as a duplicate. That is the dedup guarantee: at most one [System] completion surfaces.
 //
-// Returns true if a terminal ledger for this task now exists (freshly written OR already present) —
-// the caller then skips its own bare-payload ledger write, which lacked the finalSummary entirely.
+// Returns 'propagated' if a terminal ledger for this task now exists (freshly written OR
+// already present) — the caller then skips its own bare-payload ledger write, which lacked
+// the finalSummary entirely. Returns 'deferred' when the MID-TURN-CAUSAL-ADMISSION guard
+// vetoed the synth on live mid-turn evidence — the caller must HOLD (no row flip, no bare
+// ledger write) and re-evaluate next tick. Returns 'unavailable' when propagation could not
+// run — the caller falls back to its bare ledger write (unchanged legacy behavior).
 function propagateWatchdogTranscriptCompletion(
+    components: DaemonComponents,
     meshId: string,
     row: { id: string; assignedNodeId?: string; assignedSessionId?: string; assignedProviderType?: string; dispatchTimestamp?: string },
     evidence: AssignedTaskTerminalEvidence,
     source: string,
-): boolean {
+    opts?: { boundedBackstop?: boolean },
+): 'propagated' | 'deferred' | 'unavailable' {
     const sessionId = readNonEmptyString(row.assignedSessionId) || evidence.sessionId;
     if (!sessionId || !readNonEmptyString(evidence.finalSummary)) {
         // No routable session or no summary to carry — fall back to the caller's bare ledger write.
-        return false;
+        return 'unavailable';
     }
     try {
         const result = reconcileDirectDispatchCompletionFromTranscript({
@@ -972,15 +978,30 @@ function propagateWatchdogTranscriptCompletion(
             // The watchdog poll already enforced idle + post-dispatch + no-trailing-tool + streak;
             // skip the reconcile's own grace/transcript_not_proven gates (dedup backstops remain).
             preValidatedTranscriptEvidence: true,
+            // MID-TURN-CAUSAL-ADMISSION (rc.16): the transcript poll's structural evidence can
+            // still straddle a genuinely mid-turn LOCAL worker (the incident shape: transcript
+            // reads idle-with-final-assistant while the raw PTY is mid-tool). Route the live
+            // adapter's synchronous probe through the unified choke point. The EARLY-IDLE
+            // caller is an eager path (no opts) → a pending verdict defers; the redrive-deadline
+            // caller passes boundedBackstop (the max-wait net) → the veto yields, preserving the
+            // genuine-final fail-open semantics.
+            causalAdmission: {
+                liveTurnPendingEvidence: resolveLiveTurnPendingEvidence(components, sessionId),
+                boundedBackstop: opts?.boundedBackstop === true,
+            },
             source,
         });
         // reconciled → freshly queued the coordinator completion; alreadyTerminal → a terminal
         // ledger (a real emit that raced in, or a prior watchdog synth) is already present. Either
         // way a finalSummary-bearing completion has been (or will be) delivered; the caller must NOT
         // add its summary-less ledger row on top.
-        return result.reconciled || result.alreadyTerminal === true;
+        if (result.reconciled || result.alreadyTerminal === true) return 'propagated';
+        if (result.reason === 'live_turn_pending_evidence' || result.reason === 'trailing_tool_activity_after_final_assistant') {
+            return 'deferred'; // mid-turn causal evidence — HOLD; do not complete this tick
+        }
+        return 'unavailable';
     } catch {
-        return false; // best-effort — fall back to the caller's bare ledger write
+        return 'unavailable'; // best-effort — fall back to the caller's bare ledger write
     }
 }
 
@@ -1062,6 +1083,29 @@ async function recoverStrandedAssignedDispatches(
                     minFinalAssistantAgeMs: ASSIGNED_IDLE_TRANSCRIPT_COMPLETE_MS,
                 });
                 if (terminalEvidence) {
+                    // MID-TURN-CAUSAL-ADMISSION (rc.16): propagate FIRST. When the unified guard
+                    // defers (the LOCAL live adapter still reports the turn pending — transcript
+                    // idle-with-final-assistant can straddle a genuinely mid-turn worker), HOLD
+                    // the entire completion: no row flip, no bare ledger write, no queued event.
+                    // The streak resets so it re-accumulates; the next qualifying tick re-polls
+                    // and re-evaluates, releasing exactly once after the live state clears.
+                    const propagation = propagateWatchdogTranscriptCompletion(
+                        components, meshId, row, terminalEvidence, 'early_idle_transcript_evidence',
+                    );
+                    if (propagation === 'deferred') {
+                        assignedIdleFinalAssistantSince.delete(idleTranscriptStreakKey);
+                        LOG.info('MeshReconcile', `Deferred early transcript completion for task ${row.id} on mesh ${meshId} `
+                            + `(node=${row.assignedNodeId ?? '?'} session=${row.assignedSessionId ?? '?'}): the live adapter still reports `
+                            + `the turn pending (mid-tool / streaming / modal) — holding; the completion re-evaluates next tick`);
+                        traceMeshEventDrop('early_idle_completion_deferred_live_pending', {
+                            taskId: row.id,
+                            sessionId: row.assignedSessionId,
+                            nodeId: row.assignedNodeId,
+                            meshId,
+                            event: 'agent:generating_completed',
+                        });
+                        continue;
+                    }
                     assignedIdleFinalAssistantSince.delete(idleTranscriptStreakKey);
                     updateTaskStatus(meshId, row.id, terminalEvidence.outcome);
                     // WATCHDOG-FINALSUMMARY-LOST: propagate the completion to the coordinator WITH the
@@ -1069,9 +1113,7 @@ async function recoverStrandedAssignedDispatches(
                     // generating_completed produces — instead of only tracing a structural DROP. When
                     // propagation delivered (or a terminal ledger already exists), skip the bare
                     // summary-less ledger write below; only fall back to it if propagation could not run.
-                    const propagated = propagateWatchdogTranscriptCompletion(
-                        meshId, row, terminalEvidence, 'early_idle_transcript_evidence',
-                    );
+                    const propagated = propagation === 'propagated';
                     if (!propagated && !findTerminalLedgerEvidenceForTask({ meshId, taskId: row.id })) {
                         try {
                             appendLedgerEntry(meshId, {
@@ -1388,9 +1430,14 @@ async function recoverStrandedAssignedDispatches(
                 // WATCHDOG-FINALSUMMARY-LOST: propagate the finalSummary-bearing completion to the
                 // coordinator (same [System] notification as the native path); only fall back to the
                 // bare summary-less ledger write when propagation could not run.
-                const propagated = propagateWatchdogTranscriptCompletion(
-                    meshId, row, terminalEvidence, 'redrive_deadline_transcript_evidence',
+                // MID-TURN-CAUSAL-ADMISSION: this is the BOUNDED max-wait net (the 15-min
+                // delivered-no-turn deadline) — boundedBackstop preserves the genuine-final
+                // fail-open semantics against the live-pending veto.
+                const propagation = propagateWatchdogTranscriptCompletion(
+                    components, meshId, row, terminalEvidence, 'redrive_deadline_transcript_evidence',
+                    { boundedBackstop: true },
                 );
+                const propagated = propagation === 'propagated';
                 if (!propagated && !findTerminalLedgerEvidenceForTask({ meshId, taskId: row.id })) {
                     try {
                         appendLedgerEntry(meshId, {

package/src/providers/cli-provider-instance.ts

@@ -42,7 +42,7 @@ import {
     claimAntigravityConversation,
     releaseAntigravityOwner,
 } from './native-history/antigravity-claim-registry.js';
-import { buildChatMessage, buildRuntimeSystemChatMessage, isUserFacingChatMessage, normalizeChatMessages, resolveChatMessageKind, extractFinalSummaryFromMessages, extractFinalSummaryFromMessagesAfter, readChatMessageTimestampMs } from './chat-message-normalization.js';
+import { buildChatMessage, buildRuntimeSystemChatMessage, isUserFacingChatMessage, normalizeChatMessages, resolveChatMessageKind, extractFinalSummaryFromMessages, extractFinalSummaryFromMessagesAfter, readChatMessageTimestampMs, hasTrailingToolActivityAfterFinalAssistant } from './chat-message-normalization.js';
 import { workingDirBasename } from './working-dir.js';
 import { ManualAttendanceTracker } from './manual-attendance.js';
 import { buildCliStructuredInputPrompt } from './cli-provider-input-prompt.js';
@@ -1209,6 +1209,50 @@ export class CliProviderInstance implements ProviderInstance {
         return this.resolveModalParkStatus() !== null;
     }
 
+    /**
+     * MID-TURN-LIVE-STATE-GATE (broader false-idle RCA, mid-turn follow-up): a live,
+     * synchronous re-check of whether this session's CURRENT turn genuinely still has
+     * unresolved work. Public wrapper so the coordinator (mesh-event-forwarding) can
+     * independently re-verify an incoming agent:generating_completed for a LOCAL session
+     * before trusting it — defense-in-depth against a race where the completion emit and the
+     * coordinator's receipt straddle a state change (screen-redraw parse artifact, decoupled-
+     * immediate emit). Reuses the EXACT same discriminators this instance's own finalization
+     * gate (getCompletedFinalizationBlock) uses — hasAdapterPendingResponse() (adapter
+     * isWaitingForResponse / currentTurnScope / isProcessing() / a non-empty partial response)
+     * OR isModalParked() (a live approval/choice modal) — so a session this method reports
+     * pending is, by construction, one the local finalization gate would also refuse to
+     * finalize right now.
+     *
+     * NATIVE-TRAILING-TOOL-GATE (rc.16 follow-up): the three adapter-state discriminators
+     * above are blind to a background shell tool that keeps a turn alive without the adapter
+     * reporting a pending response — e.g. a backgrounded `sleep 40 &` between narration
+     * bubbles on a write-lag native-source provider (claude-cli), which is deliberately
+     * un-floored (noExternalTranscriptSource omitted, mission f2f6da1b owner decision) so its
+     * transcript write-lag emits promptly. That un-flooring is correct for the ordinary
+     * fraction-of-a-second trail, but it also means the growth-hold / busy-lease protections
+     * in getCompletedFinalizationBlock never engage for claude-cli, so an interim final-
+     * LOOKING bubble followed by continuing tool calls can still finalize as a completion
+     * while the transcript demonstrably shows the turn still executing. Close that gap here,
+     * narrowly: for a native-source provider only, reuse the SAME bounded transcript read the
+     * class's own completion judgment already performs (probeNativeTranscriptSignals) and
+     * apply the SAME trailing-tool-activity veto the transcript-synth admission choke point
+     * uses (hasTrailingToolActivityAfterFinalAssistant) — the latest final-looking assistant
+     * bubble followed by tool/terminal activity is interim narration, not a turn end. Fail-open
+     * by construction: a non-native-source class (probe returns null), an unresolved
+     * transcript, or a read error never reaches the veto, so a missing/unavailable transcript
+     * can never wedge a session as "pending" forever.
+     */
+    hasLiveTurnPendingEvidence(): boolean {
+        if (this.hasAdapterPendingResponse() || this.isModalParked()) return true;
+        try {
+            const probe = this.probeNativeTranscriptSignals();
+            if (probe?.snapshot?.available === true && Array.isArray(probe.messages)) {
+                if (hasTrailingToolActivityAfterFinalAssistant(probe.messages as ChatMessage[])) return true;
+            }
+        } catch { /* fail open — a probe error must never fabricate pending evidence */ }
+        return false;
+    }
+
     /**
      * PTY-OVERTRUST-DRAIN (Defect B). The deliverability/drain status the mesh
      * reconcile loop must consult — the RAW adapter turn-state, with the
@@ -1824,7 +1868,24 @@ export class CliProviderInstance implements ProviderInstance {
         // `completionHasFinalAssistantMessage(...) && !hasAdapterPendingResponse()` pairing already
         // used by the no-progress monitor reconcile path.
         const turnClosed = !this.hasAdapterPendingResponse();
-        if (this.completionHasFinalAssistantMessage(parsedMessages, turnStartedAt)) {
+        // TX-FSM Stage 2.1 (KIMI-PARSED-RACE): a native-source provider that ALSO ships a
+        // tui.transcriptPty scrape (kimi, like opencode/cursor-cli) keeps that scrape purely
+        // for LIVE status convenience — the manifest itself says "Chat is authoritative from
+        // nativeHistory; this PTY extraction only keeps live status available". But the parsed
+        // scrape carries no tool-activity concept at all (transcriptPty only extracts
+        // assistant/user text bullets), so an interim narration bullet Kimi renders just before
+        // firing a tool call ("코드와 로그를 병행으로 확인하겠습니다.") satisfies
+        // completionHasFinalAssistantMessage identically to a genuine final answer — and this
+        // early-return fires BEFORE the richer external-native evidence below is ever consulted,
+        // defeating the trailing-tool-activity veto and quiet-dwell guard added below it for
+        // this exact defect (live Kimi declaring completion on an interim transcript while the
+        // PTY kept generating). Skip the parsed short-circuit for the lease-gated canary
+        // (busyLeaseGateEnabled: kimi/codex-cli today) so the authoritative native transcript is
+        // judged first; codex-cli ships no transcriptPty so this is a no-op for it. Falls back to
+        // the parsed evidence below when the native transcript is unresolved (fail-open, same as
+        // before Stage 2.1).
+        const preferNativeOverParsed = (this.adapter as any)?.chatMessagesOwnedExternally === true && this.busyLeaseGateEnabled();
+        if (!preferNativeOverParsed && this.completionHasFinalAssistantMessage(parsedMessages, turnStartedAt)) {
             return {
                 present: turnClosed,
                 messages: Array.isArray(parsedMessages) ? parsedMessages : [],
@@ -1850,8 +1911,19 @@ export class CliProviderInstance implements ProviderInstance {
             // the injected task's onTurnStarted fires, currentTurnStartedAt/currentTurnTaskId
             // bind to it and a real final bubble still fires completion normally.
             const injectedTaskGenerating = this.injectedTaskHasStartedGenerating();
+            // TX-FSM Stage 2.1 (KIMI-PARSED-RACE, trailing-tool-activity veto): mirrors the
+            // mesh coordinator's pollAssignedTaskTerminalEvidence guard (ledger 84594b15) on
+            // the WORKER's own local evidence. A native-source transcript that captures
+            // tool.call/tool.result as kind:'tool' bubbles (kimi's nativeHistory.records, after
+            // the provider-manifest fix) proves the last VISIBLE assistant bubble was narration
+            // ("Let me check the logs...") that fired a tool call, not the turn's genuine final
+            // answer. A provider whose native transcript never records tool activity (nothing to
+            // veto on) is unaffected — this can only ever turn a false present:true into false,
+            // never the reverse.
+            const trailingToolActivity = hasTrailingToolActivityAfterFinalAssistant(externalMessages as any);
             const present = injectedTaskGenerating
                 && turnClosed
+                && !trailingToolActivity
                 && this.completionHasFinalAssistantMessage(externalMessages, turnStartedAt);
             // Dashboard tail-repair cache: this runs on EVERY completion check
             // (mesh AND non-mesh — the non-mesh path suppresses the
@@ -1873,6 +1945,18 @@ export class CliProviderInstance implements ProviderInstance {
             };
         }
 
+        // TX-FSM Stage 2.1: the native transcript is unresolved (no session pinned yet, file
+        // not yet written) for a provider whose parsed short-circuit was skipped above — fall
+        // back to the parsed evidence now rather than reporting present:false forever. Fail-open,
+        // identical to the pre-Stage-2.1 behaviour for this narrow (transcript-unavailable) case.
+        if (preferNativeOverParsed && this.completionHasFinalAssistantMessage(parsedMessages, turnStartedAt)) {
+            return {
+                present: turnClosed,
+                messages: Array.isArray(parsedMessages) ? parsedMessages : [],
+                source: 'parsed',
+            };
+        }
+
         return {
             present: false,
             messages: Array.isArray(parsedMessages) ? parsedMessages : [],
@@ -2336,6 +2420,43 @@ export class CliProviderInstance implements ProviderInstance {
             } catch { /* defensive: dwell read is best-effort — fall through to emit */ }
         }
 
+        // TX-FSM Stage 2.2 (KIMI-POST-FINAL-WEDGE): quiet-dwell protection for a
+        // lease-gated NATIVE-SOURCE provider's OWN evidence
+        // (source==='external-native', reached because preferNativeOverParsed skipped the
+        // parsed short-circuit above). Use the authoritative transcript file's mtime snapshot,
+        // produced by the SAME native-history read that supplied finalAssistantEvidence above,
+        // rather than raw PTY output recency. Kimi repaints its idle prompt/status after the
+        // genuine final answer, so lastOutputAt may advance forever even though wire.jsonl is
+        // quiet; using that cosmetic clock wedged the pending completion. Conversely, before a
+        // tool.call lands the interim narration itself has just advanced wire.jsonl, so the
+        // transcript clock preserves the narrow pre-tool quiet-dwell protection.
+        //
+        // The snapshot is bounded and fail-open: ageMs below the existing dwell holds and
+        // retries; a quiet transcript releases, while an unavailable/unresolved/clockless
+        // snapshot cannot block completion. Deliberately NOT scoped to
+        // allowMissingAssistantTimeout: this defect surfaces on a plain interactive session's
+        // own idle/completion notification just as much as a mesh worker's, so restricting it to
+        // autonomous mesh sessions would leave every non-mesh kimi session unprotected. A
+        // provider outside the lease canary (or without adapterOwnsMessagesElsewhere) never
+        // reaches this branch — untouched.
+        if (adapterOwnsMessagesElsewhere
+            && finalAssistantEvidence.source === 'external-native'
+            && this.busyLeaseGateEnabled()) {
+            try {
+                const snapshot = this.lastTranscriptSignalSnapshot;
+                const transcriptAgeMs = snapshot?.available === true
+                    && typeof snapshot.detail?.ageMs === 'number'
+                    && Number.isFinite(snapshot.detail.ageMs)
+                    ? snapshot.detail.ageMs
+                    : undefined;
+                if (typeof transcriptAgeMs === 'number') {
+                    if (transcriptAgeMs < PTY_PARSED_FINAL_ASSISTANT_QUIET_DWELL_MS) {
+                        return { reason: 'native_source_final_assistant_quiet_dwell', terminal: false };
+                    }
+                }
+            } catch { /* defensive: transcript dwell is best-effort — fail open */ }
+        }
+
         return null;
     }
 
@@ -3150,10 +3271,16 @@ export class CliProviderInstance implements ProviderInstance {
         // the settle window — so the single sample reads 'idle' even though the turn is still in
         // flight (it re-enters generating ~0.5s later). Require instead that the session stayed
         // CONTINUOUSLY idle since the debounce was armed: (1) no entry into a busy phase
-        // (busyEpoch unchanged), and (2) no new raw PTY output (lastOutputAt did not advance).
-        // Either signal ⇒ the idle was not continuous ⇒ cancel; the still-live turn re-arms its
-        // own completion when it genuinely finishes. This only ever cancels (never emits more),
-        // so shared behaviour for claude/codex/antigravity is strictly stricter, never looser.
+        // (busyEpoch unchanged), and (2) on the FIRST settle check, no new raw PTY output
+        // (lastOutputAt did not advance).
+        //
+        // Once a finalization block has claimed the pending completion (loggedBlockReason is
+        // set), its own bounded retry/evidence policy owns release. Re-applying the raw-output
+        // cancellation on every retry lets cosmetic idle redraws (notably Kimi's prompt/status
+        // repaint) delete the pending after a genuine final assistant has landed. The adapter
+        // emits no second idle edge for that already-idle turn, so deletion becomes a permanent
+        // internal-generating wedge. Busy re-entry remains an unconditional cancel above:
+        // busyEpoch is the structural continuity signal and must win even after a hold.
         if (typeof pending.busyEpochAtArm === 'number' && this.busyEpoch !== pending.busyEpochAtArm) {
             LOG.info('CLI', `[${this.type}] cancelled pending completed (busy re-entry during settle: epoch ${pending.busyEpochAtArm}→${this.busyEpoch})`);
             if (this.completionTraceOn()) this.recordCompletionGateTrace('cancel', {
@@ -3169,7 +3296,8 @@ export class CliProviderInstance implements ProviderInstance {
             return;
         }
         const latestOutputAt = typeof (latestStatus as any)?.lastOutputAt === 'number' ? (latestStatus as any).lastOutputAt as number : undefined;
-        if (typeof pending.lastOutputAtArm === 'number'
+        if (!pending.loggedBlockReason
+            && typeof pending.lastOutputAtArm === 'number'
             && typeof latestOutputAt === 'number'
             && latestOutputAt > pending.lastOutputAtArm) {
             LOG.info('CLI', `[${this.type}] cancelled pending completed (new PTY output during settle: ${pending.lastOutputAtArm}→${latestOutputAt})`);