@adhdev/mesh-shared 1.0.60-rc.72 → 1.0.60-rc.73

package/src/turn-ipc.ts

@@ -48,2170 +48,54 @@
  * -----------
  * Every request carries `v: 1` so a future incompatible change can be
  * detected by the responder before it tries to interpret the args.
- */
-
-import {
-    isEvidenceIdentifier,
-    isTurnEvidence,
-    isTurnReason,
-    type ProjectedScalars,
-    type TurnAttemptRef,
-    type TurnEvidence,
-    type TurnEvidenceKind,
-    type TurnOutcome,
-    type TurnReason,
-} from './turn-evidence';
-import { isRecord } from './protocol/envelope'
-
-// ─── shared primitives ─────────────────────────────────────────────────────
-
-/** Every request in this file is versioned so a responder can reject a shape it predates. */
-export const TURN_IPC_PROTOCOL_VERSION = 1 as const
-
-function isFiniteNumber(value: unknown): value is number {
-    return typeof value === 'number' && Number.isFinite(value)
-}
-
-function isNonNegativeInt(value: unknown): value is number {
-    return Number.isSafeInteger(value) && (value as number) >= 0
-}
-
-function isOptionalId(value: unknown): boolean {
-    return value === undefined || isEvidenceIdentifier(value)
-}
-
-function hasOnlyKeys(value: Record<string, unknown>, allowed: readonly string[]): boolean {
-    for (const key of Object.keys(value)) {
-        if (!allowed.includes(key)) return false
-    }
-    return true
-}
-
-// ─── error codes ────────────────────────────────────────────────────────────
-
-/**
- * Closed error-code union every command response may carry instead of (or in
- * addition to, for the client-side wrapper) a result.
- *
- *   daemon_required      — no daemon reachable (no IPC/local transport
- *                           connection could be established). Distinct from
- *                           every other failure: it means "there is nobody to
- *                           ask", not "the ask failed."
- *   turn_ledger_unavailable — a daemon answered but its turn ledger is not
- *                           armed yet (mid-boot, mid-migration).
- *   ledger_not_owner     — the daemon that answered does not own the
- *                           attempt/mesh addressed by the request (routing
- *                           mistake, or the owner changed after a reclaim).
- */
-export const TURN_IPC_ERROR_CODES = ['daemon_required', 'turn_ledger_unavailable', 'ledger_not_owner'] as const
-export type TurnIpcErrorCode = typeof TURN_IPC_ERROR_CODES[number]
-
-function makeGuard<T extends readonly string[]>(values: T): (value: unknown) => value is T[number] {
-    const set: ReadonlySet<string> = new Set(values)
-    return (value: unknown): value is T[number] => typeof value === 'string' && set.has(value)
-}
-
-export const isTurnIpcErrorCode = makeGuard(TURN_IPC_ERROR_CODES)
-
-/** Structured failure shape a responder returns instead of a result. Never thrown across the wire — the client maps it to a typed error (see mcp-server/src/ipc/turn-commands.ts). */
-export interface TurnIpcError {
-    code: TurnIpcErrorCode
-    /** Short machine-oriented detail, e.g. which daemon was expected. Never free text describing content. */
-    detail?: string
-}
-
-export function isTurnIpcError(value: unknown): value is TurnIpcError {
-    return isRecord(value) && hasOnlyKeys(value, ['code', 'detail']) && isTurnIpcErrorCode(value.code)
-        && (value.detail === undefined || typeof value.detail === 'string')
-}
-
-// ─── turn_observe ───────────────────────────────────────────────────────────
-
-/** Reducer verdict, mirrored from the C1 reducer's `reduce()` return shape. */
-export const TURN_OBSERVE_VERDICTS = ['applied', 'recorded', 'rejected'] as const
-export type TurnObserveVerdict = typeof TURN_OBSERVE_VERDICTS[number]
-export const isTurnObserveVerdict = makeGuard(TURN_OBSERVE_VERDICTS)
-
-export interface TurnObserveRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    evidence: TurnEvidence
-}
-
-export interface TurnObserveResponse {
-    verdict: TurnObserveVerdict
-    attemptRef: TurnAttemptRef
-    /** Present only when the evidence committed the attempt (verdict 'applied' + a terminal-class kind). */
-    outcome?: TurnOutcome
-}
-
-export function isTurnObserveRequest(value: unknown): value is TurnObserveRequest {
-    return isRecord(value) && hasOnlyKeys(value, ['v', 'evidence'])
-        && value.v === TURN_IPC_PROTOCOL_VERSION
-        && isTurnEvidence(value.evidence)
-}
-
-export function decodeTurnObserveRequest(value: unknown): TurnObserveRequest | null {
-    return isTurnObserveRequest(value) ? value : null
-}
-
-function isTurnAttemptRefValue(value: unknown): value is TurnAttemptRef {
-    return isRecord(value) && hasOnlyKeys(value, ['attemptId', 'generation'])
-        && isEvidenceIdentifier(value.attemptId) && isNonNegativeInt(value.generation)
-}
-
-export function isTurnObserveResponse(value: unknown): value is TurnObserveResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['verdict', 'attemptRef', 'outcome'])
-        && isTurnObserveVerdict(value.verdict)
-        && isTurnAttemptRefValue(value.attemptRef)
-        && (value.outcome === undefined || isTurnOutcomeValue(value.outcome))
-}
-
-const TURN_OUTCOMES_LOCAL = ['completed', 'failed', 'cancelled'] as const
-function isTurnOutcomeValue(value: unknown): value is TurnOutcome {
-    return typeof value === 'string' && (TURN_OUTCOMES_LOCAL as readonly string[]).includes(value)
-}
-
-export function decodeTurnObserveResponse(value: unknown): TurnObserveResponse | null {
-    return isTurnObserveResponse(value) ? value : null
-}
-
-// ─── mesh_record ────────────────────────────────────────────────────────────
-
-/**
- * Structural pin of `seqscribe/mesh-event-projection.ts` `PROJECTED_PAYLOAD_KEYS`
- * (daemon-core; this leaf cannot import it). A test in this package's test
- * suite AND a daemon-core test each assert their list equals this one — see
- * `mesh-shared/test/turn-ipc.test.ts` and the C-W6 report's break-once table.
- * Adding a key here is the SAME assertion as adding it there: non-content
- * (identifier, enum, boolean, or counter), never free text.
- */
-export const MESH_RECORD_PAYLOAD_KEYS = [
-    // Identifiers
-    'taskId', 'deliveryId', 'attemptId', 'missionId', 'checkpointId', 'promptId', 'providerSessionId', 'targetNoteId',
-    // Routing / addressing
-    'nodeId', 'sessionId', 'providerType', 'transport', 'attemptedSessionId', 'holderSessionId',
-    // Outcome enums
-    'reason', 'status', 'outcome', 'terminalKind', 'event',
-    'source', 'intentionalStopReason',
-    // Booleans
-    'retryable', 'rebound', 'forced', 'fallback', 'membershipRemoved', 'requestedForce', 'removedByRemoteDaemon',
-    'completedViaReady', 'intentional', 'weak',
-    // Counters
-    'attempt', 'attemptCount', 'count',
-] as const
-export type MeshRecordPayloadKey = typeof MESH_RECORD_PAYLOAD_KEYS[number]
-
-const MESH_RECORD_PAYLOAD_KEY_SET: ReadonlySet<string> = new Set(MESH_RECORD_PAYLOAD_KEYS)
-
-/** Maximum length of any string value in a `mesh_record` payload (mirrors `MAX_PROJECTED_STRING`). */
-export const MAX_MESH_RECORD_STRING = 200
-
-export interface MeshRecordRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    /** The original ledger `kind` string (daemon-core `MeshLedgerKind`; mesh-shared cannot import that union, so it is an identifier here). */
-    ledgerKind: string
-    nodeId?: string
-    sessionId?: string
-    taskId?: string
-    /** Restricted to `MESH_RECORD_PAYLOAD_KEYS` — an unknown key is a decode failure, not a silently dropped field. */
-    payload: ProjectedScalars
-}
-
-export interface MeshRecordResponse {
-    /** `mesh.<id>.events` append coordinates, for callers that need to reference the entry (e.g. a `ref`'d handoff). */
-    eventId: string
-    seq: number
-}
-
-function isProjectedScalarsValue(value: unknown): value is ProjectedScalars {
-    if (!isRecord(value)) return false
-    for (const v of Object.values(value)) {
-        if (v === null) continue
-        if (typeof v === 'boolean' || typeof v === 'number') continue
-        if (typeof v === 'string') { if (v.length > MAX_MESH_RECORD_STRING) return false; continue }
-        return false
-    }
-    return true
-}
-
-/** Every payload key must be a member of `MESH_RECORD_PAYLOAD_KEYS` — the allow-list boundary at the wire. */
-export function isMeshRecordPayload(value: unknown): value is ProjectedScalars {
-    if (!isProjectedScalarsValue(value)) return false
-    for (const key of Object.keys(value as Record<string, unknown>)) {
-        if (!MESH_RECORD_PAYLOAD_KEY_SET.has(key)) return false
-    }
-    return true
-}
-
-export function isMeshRecordRequest(value: unknown): value is MeshRecordRequest {
-    return isRecord(value) && hasOnlyKeys(value, ['v', 'meshId', 'ledgerKind', 'nodeId', 'sessionId', 'taskId', 'payload'])
-        && value.v === TURN_IPC_PROTOCOL_VERSION
-        && isEvidenceIdentifier(value.meshId)
-        && isEvidenceIdentifier(value.ledgerKind)
-        && isOptionalId(value.nodeId) && isOptionalId(value.sessionId) && isOptionalId(value.taskId)
-        && isMeshRecordPayload(value.payload)
-}
-
-export function decodeMeshRecordRequest(value: unknown): MeshRecordRequest | null {
-    return isMeshRecordRequest(value) ? value : null
-}
-
-export function isMeshRecordResponse(value: unknown): value is MeshRecordResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['eventId', 'seq'])
-        && isEvidenceIdentifier(value.eventId) && isNonNegativeInt(value.seq)
-}
-
-export function decodeMeshRecordResponse(value: unknown): MeshRecordResponse | null {
-    return isMeshRecordResponse(value) ? value : null
-}
-
-// ─── turn_cancel ────────────────────────────────────────────────────────────
-
-export interface TurnCancelRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    /** Exactly one of the two must be present — the decoder rejects both-or-neither. */
-    attemptId?: string
-    taskId?: string
-    reason: TurnReason
-}
-
-export interface TurnCancelResponse {
-    attemptRef: TurnAttemptRef
-    verdict: TurnObserveVerdict
-}
-
-export function isTurnCancelRequest(value: unknown): value is TurnCancelRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'attemptId', 'taskId', 'reason'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION) return false
-    const hasAttempt = value.attemptId !== undefined
-    const hasTask = value.taskId !== undefined
-    if (hasAttempt === hasTask) return false // exactly one of the two
-    if (hasAttempt && !isEvidenceIdentifier(value.attemptId)) return false
-    if (hasTask && !isEvidenceIdentifier(value.taskId)) return false
-    return isTurnReason(value.reason)
-}
-
-export function decodeTurnCancelRequest(value: unknown): TurnCancelRequest | null {
-    return isTurnCancelRequest(value) ? value : null
-}
-
-export function isTurnCancelResponse(value: unknown): value is TurnCancelResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['attemptRef', 'verdict'])
-        && isTurnAttemptRefValue(value.attemptRef) && isTurnObserveVerdict(value.verdict)
-}
-
-export function decodeTurnCancelResponse(value: unknown): TurnCancelResponse | null {
-    return isTurnCancelResponse(value) ? value : null
-}
-
-// ─── operator_status ────────────────────────────────────────────────────────
-
-/**
- * Fire-and-forget operator/tool-call status record — replaces
- * `recordMeshCoordinatorToolCall` (10 sites, `mesh_tool_call_log`) and doubles
- * as the `operator_status` evidence kind's wire shape.
- *
- * NAMING NOTE (flagged for the C-W6 implementer, see report §"mismatch"):
- * the C-W6 brief's DELIVERABLES describes this request as
- * `{taskId, status: MeshTaskStatus, reason}`, but C1's `operator_status`
- * evidence kind (`turn-evidence.ts` `OPERATOR_STATUSES`) is the closed
- * 2-value set `'completed' | 'failed'` — a verdict on an operator ACTION, not
- * a `MeshTaskStatus` (5-value queue-row status: pending/assigned/completed/
- * failed/cancelled). This contract follows `turn-evidence.ts` because that is
- * what the C1 reducer actually consumes for this evidence kind; using the
- * 5-value `MeshTaskStatus` here would let this request carry `pending` or
- * `assigned`, which the reducer has no transition for.
- */
-export const OPERATOR_STATUS_VALUES = ['completed', 'failed'] as const
-export type OperatorStatusValue = typeof OPERATOR_STATUS_VALUES[number]
-export const isOperatorStatusValue = makeGuard(OPERATOR_STATUS_VALUES)
-
-export const OPERATOR_STATUS_REASON_VALUES = ['operator_update', 'refine_terminal', 'validation_terminal'] as const
-export type OperatorStatusReasonValue = typeof OPERATOR_STATUS_REASON_VALUES[number]
-export const isOperatorStatusReasonValue = makeGuard(OPERATOR_STATUS_REASON_VALUES)
-
-export interface OperatorStatusRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    taskId: string
-    status: OperatorStatusValue
-    reason: OperatorStatusReasonValue
-}
-
-/** Acknowledgement only — this command is fire-and-forget by design (the daemon owns rate-limiting the underlying log). */
-export interface OperatorStatusResponse {
-    accepted: true
-}
-
-export function isOperatorStatusRequest(value: unknown): value is OperatorStatusRequest {
-    return isRecord(value) && hasOnlyKeys(value, ['v', 'taskId', 'status', 'reason'])
-        && value.v === TURN_IPC_PROTOCOL_VERSION
-        && isEvidenceIdentifier(value.taskId)
-        && isOperatorStatusValue(value.status)
-        && isOperatorStatusReasonValue(value.reason)
-}
-
-export function decodeOperatorStatusRequest(value: unknown): OperatorStatusRequest | null {
-    return isOperatorStatusRequest(value) ? value : null
-}
-
-export function isOperatorStatusResponse(value: unknown): value is OperatorStatusResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['accepted']) && value.accepted === true
-}
-
-export function decodeOperatorStatusResponse(value: unknown): OperatorStatusResponse | null {
-    return isOperatorStatusResponse(value) ? value : null
-}
-
-// ─── turn_query ─────────────────────────────────────────────────────────────
-
-/** Row shape returned by `turn_query` — scalar projection of a `turn_attempts` row (C3 schema), never `data_json`/`payload_json` content. */
-export interface TurnQueryAttemptRow {
-    attemptId: string
-    generation: number
-    meshId?: string
-    taskId?: string
-    sessionId: string
-    nodeId?: string
-    providerType?: string
-    state: string
-    terminalOutcome?: TurnOutcome
-    terminalReason?: TurnReason
-    acceptedAt: number
-    terminalAt?: number
-}
-
-/** Row shape returned by `turn_query` for the event stream — scalar projection of a `turn_events` row, `payload_json` NEVER included. */
-export interface TurnQueryEventRow {
-    eventId: string
-    attemptId?: string
-    generation?: number
-    sessionId: string
-    kind: TurnEvidenceKind
-    source: string
-    verdict: TurnObserveVerdict | 'forwarded'
-    atMs: number
-}
-
-export interface TurnQueryRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    taskId?: string
-    attemptId?: string
-    sessionId?: string
-    state?: string
-    since?: number
-    tail?: number
-}
-
-export interface TurnQueryResponse {
-    attempts: readonly TurnQueryAttemptRow[]
-    events: readonly TurnQueryEventRow[]
-    /** C7-5: set while `mesh.<id>.events` replication is behind for this mesh — the caller must not treat a fleet-scope answer as complete. */
-    replicationPending?: boolean
-}
-
-export function isTurnQueryRequest(value: unknown): value is TurnQueryRequest {
-    return isRecord(value) && hasOnlyKeys(value, ['v', 'meshId', 'taskId', 'attemptId', 'sessionId', 'state', 'since', 'tail'])
-        && value.v === TURN_IPC_PROTOCOL_VERSION
-        && isEvidenceIdentifier(value.meshId)
-        && isOptionalId(value.taskId) && isOptionalId(value.attemptId) && isOptionalId(value.sessionId)
-        && (value.state === undefined || isEvidenceIdentifier(value.state))
-        && (value.since === undefined || isFiniteNumber(value.since))
-        && (value.tail === undefined || isNonNegativeInt(value.tail))
-}
-
-export function decodeTurnQueryRequest(value: unknown): TurnQueryRequest | null {
-    return isTurnQueryRequest(value) ? value : null
-}
-
-const TURN_QUERY_ATTEMPT_ROW_KEYS = [
-    'attemptId', 'generation', 'meshId', 'taskId', 'sessionId', 'nodeId', 'providerType',
-    'state', 'terminalOutcome', 'terminalReason', 'acceptedAt', 'terminalAt',
-] as const
-
-function isTurnQueryAttemptRow(value: unknown): value is TurnQueryAttemptRow {
-    if (!isRecord(value) || !hasOnlyKeys(value, TURN_QUERY_ATTEMPT_ROW_KEYS)) return false
-    if (!isEvidenceIdentifier(value.attemptId) || !isNonNegativeInt(value.generation)) return false
-    if (!isOptionalId(value.meshId) || !isOptionalId(value.taskId)) return false
-    if (!isEvidenceIdentifier(value.sessionId)) return false
-    if (!isOptionalId(value.nodeId) || !isOptionalId(value.providerType)) return false
-    if (typeof value.state !== 'string') return false
-    if (value.terminalOutcome !== undefined && !isTurnOutcomeValue(value.terminalOutcome)) return false
-    if (value.terminalReason !== undefined && !isTurnReason(value.terminalReason)) return false
-    if (!isFiniteNumber(value.acceptedAt)) return false
-    if (value.terminalAt !== undefined && !isFiniteNumber(value.terminalAt)) return false
-    return true
-}
-
-const TURN_QUERY_EVENT_VERDICTS = ['applied', 'recorded', 'rejected', 'forwarded'] as const
-const TURN_QUERY_EVENT_ROW_KEYS = ['eventId', 'attemptId', 'generation', 'sessionId', 'kind', 'source', 'verdict', 'atMs'] as const
-
-function isTurnQueryEventRow(value: unknown): value is TurnQueryEventRow {
-    if (!isRecord(value) || !hasOnlyKeys(value, TURN_QUERY_EVENT_ROW_KEYS)) return false
-    if (!isEvidenceIdentifier(value.eventId)) return false
-    if (!isOptionalId(value.attemptId)) return false
-    if (value.generation !== undefined && !isNonNegativeInt(value.generation)) return false
-    if (!isEvidenceIdentifier(value.sessionId)) return false
-    if (typeof value.kind !== 'string') return false
-    if (typeof value.source !== 'string') return false
-    if (!(TURN_QUERY_EVENT_VERDICTS as readonly string[]).includes(value.verdict as string)) return false
-    if (!isFiniteNumber(value.atMs)) return false
-    return true
-}
-
-export function isTurnQueryResponse(value: unknown): value is TurnQueryResponse {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['attempts', 'events', 'replicationPending'])) return false
-    if (!Array.isArray(value.attempts) || !value.attempts.every(isTurnQueryAttemptRow)) return false
-    if (!Array.isArray(value.events) || !value.events.every(isTurnQueryEventRow)) return false
-    if (value.replicationPending !== undefined && typeof value.replicationPending !== 'boolean') return false
-    return true
-}
-
-export function decodeTurnQueryResponse(value: unknown): TurnQueryResponse | null {
-    return isTurnQueryResponse(value) ? value : null
-}
-
-// ─── mesh_index_query ───────────────────────────────────────────────────────
-
-export const MESH_INDEX_QUERY_WRITER_SCOPES = ['own', 'fleet'] as const
-export type MeshIndexQueryWriterScope = typeof MESH_INDEX_QUERY_WRITER_SCOPES[number]
-export const isMeshIndexQueryWriterScope = makeGuard(MESH_INDEX_QUERY_WRITER_SCOPES)
-
-export interface MeshIndexQueryRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    ledgerKind?: string
-    sessionId?: string
-    taskId?: string
-    writer?: MeshIndexQueryWriterScope
-    since?: number
-    tail?: number
-}
-
-/** Row shape returned by `mesh_index_query` — a `mesh_topic_index` row (C3 schema). */
-export interface MeshTopicIndexRow {
-    writer: string
-    seq: number
-    meshId: string
-    eventId: string
-    kind: string
-    ledgerKind?: string
-    taskId?: string
-    sessionId?: string
-    nodeId?: string
-    atMs: number
-    payload: ProjectedScalars
-}
-
-export interface MeshIndexQueryResponse {
-    rows: readonly MeshTopicIndexRow[]
-    /** C7-5: true while `mesh.<id>.events` replication is behind for this mesh. */
-    replicationPending?: boolean
-}
-
-export function isMeshIndexQueryRequest(value: unknown): value is MeshIndexQueryRequest {
-    return isRecord(value) && hasOnlyKeys(value, ['v', 'meshId', 'ledgerKind', 'sessionId', 'taskId', 'writer', 'since', 'tail'])
-        && value.v === TURN_IPC_PROTOCOL_VERSION
-        && isEvidenceIdentifier(value.meshId)
-        && isOptionalId(value.ledgerKind) && isOptionalId(value.sessionId) && isOptionalId(value.taskId)
-        && (value.writer === undefined || isMeshIndexQueryWriterScope(value.writer))
-        && (value.since === undefined || isFiniteNumber(value.since))
-        && (value.tail === undefined || isNonNegativeInt(value.tail))
-}
-
-export function decodeMeshIndexQueryRequest(value: unknown): MeshIndexQueryRequest | null {
-    return isMeshIndexQueryRequest(value) ? value : null
-}
-
-const MESH_TOPIC_INDEX_ROW_KEYS = [
-    'writer', 'seq', 'meshId', 'eventId', 'kind', 'ledgerKind', 'taskId', 'sessionId', 'nodeId', 'atMs', 'payload',
-] as const
-
-function isMeshTopicIndexRow(value: unknown): value is MeshTopicIndexRow {
-    if (!isRecord(value) || !hasOnlyKeys(value, MESH_TOPIC_INDEX_ROW_KEYS)) return false
-    if (!isEvidenceIdentifier(value.writer) || !isNonNegativeInt(value.seq)) return false
-    if (!isEvidenceIdentifier(value.meshId) || !isEvidenceIdentifier(value.eventId)) return false
-    if (typeof value.kind !== 'string') return false
-    if (!isOptionalId(value.ledgerKind) || !isOptionalId(value.taskId) || !isOptionalId(value.sessionId) || !isOptionalId(value.nodeId)) return false
-    if (!isFiniteNumber(value.atMs)) return false
-    // Rows replay mesh.record entries, so the payload is held to the SAME
-    // allow-list as a mesh_record request — not just "any scalar map" — to
-    // stop a fleet-wide read from surfacing a key that was never reviewed.
-    if (!isMeshRecordPayload(value.payload)) return false
-    return true
-}
-
-export function isMeshIndexQueryResponse(value: unknown): value is MeshIndexQueryResponse {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['rows', 'replicationPending'])) return false
-    if (!Array.isArray(value.rows) || !value.rows.every(isMeshTopicIndexRow)) return false
-    if (value.replicationPending !== undefined && typeof value.replicationPending !== 'boolean') return false
-    return true
-}
-
-export function decodeMeshIndexQueryResponse(value: unknown): MeshIndexQueryResponse | null {
-    return isMeshIndexQueryResponse(value) ? value : null
-}
-
-// ─── mission_upsert / mission_query ────────────────────────────────────────
-//
-// Decision (2026-09-23, design doc §5 C2 update): missions and graph gates
-// have no home in the original six commands — `upsertMeshMission`/
-// `listMeshMissionsForTool` write/read structured state with a free-text
-// `goal`/`title` that cannot fit `mesh_record`'s scalar `ProjectedScalars`
-// allow-list (§ "MESH_RECORD_PAYLOAD_KEYS" above has no text field, on
-// purpose). Two more commands, not a widened allow-list:
-//
-//   - mission_upsert — create/update a mission (mesh-missions.ts
-//     `upsertMeshMission`'s shape).
-//   - mission_query  — list missions for a mesh, optionally filtered by
-//     status (`getMeshMissions`'s shape).
-//
-// WHY FREE TEXT IS FINE HERE, UNLIKE mesh_record's payload: this is LOCAL
-// IPC between mcp-server and the daemon that owns the mission table — both
-// processes run on the operator's own machine. The content boundary this
-// program protects is "the SERVER never receives chat content" (CLAUDE.md);
-// IPC between two local processes was never inside that boundary, the same
-// way a direct in-process function call wasn't. Cross-machine mission text
-// (a worker learning about a mission a coordinator defined) travels as a
-// `mesh.<id>.handoff` ref per C10-1's precedent — mission_upsert/query never
-// themselves cross a machine boundary.
-
-export const MESH_MISSION_STATUSES = ['active', 'paused', 'completed', 'abandoned'] as const
-export type MeshMissionStatusValue = typeof MESH_MISSION_STATUSES[number]
-export const isMeshMissionStatusValue = makeGuard(MESH_MISSION_STATUSES)
-
-export const MESH_MISSION_SOURCES = ['magi', 'coordinator'] as const
-export type MeshMissionSourceValue = typeof MESH_MISSION_SOURCES[number]
-export const isMeshMissionSourceValue = makeGuard(MESH_MISSION_SOURCES)
-
-// H2 (mission brief, wiring-unification Phase H — docs/design/2026-09-23-wiring-
-// unification.md §7c): free text, same "local IPC is inside the boundary" rationale
-// as `goal` above (section note). `MissionBriefWire` is a structural mirror of
-// mesh-shared's own `MissionBrief` (mission-brief.ts) rather than importing it —
-// this file's guards are all hand-rolled structural checks, and importing the type
-// only (not the class) would still couple this wire contract to that module's
-// internal shape; a mirror keeps the two independently reviewable, same as every
-// other wire type in this file.
-export interface MissionBriefWire {
-    goal: string
-    constraints?: readonly string[]
-    doneCriteria?: readonly string[]
-    handoffNotes?: readonly string[]
-    ownedPaths?: readonly string[]
-}
-
-function isStringArray(value: unknown): value is readonly string[] {
-    return Array.isArray(value) && value.every((v) => typeof v === 'string')
-}
-
-function isMissionBriefWire(value: unknown): value is MissionBriefWire {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['goal', 'constraints', 'doneCriteria', 'handoffNotes', 'ownedPaths'])) return false
-    if (typeof value.goal !== 'string' || value.goal.trim().length === 0) return false
-    for (const k of ['constraints', 'doneCriteria', 'handoffNotes', 'ownedPaths'] as const) {
-        if (value[k] !== undefined && !isStringArray(value[k])) return false
-    }
-    return true
-}
-
-export interface MissionUpsertRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    /** Omitted = create a new mission; present = update (must resolve to an existing mission — see mesh-missions.ts MISSION-UPSERT-SILENT-CREATE). */
-    id?: string
-    title: string
-    /** Free text — see file-header note on why this is fine over local IPC. */
-    goal?: string
-    status?: MeshMissionStatusValue
-    source?: MeshMissionSourceValue
-    /**
-     * H2: `undefined` = do not touch the stored brief. `null` = explicitly clear it.
-     * A present object with no usable `goal` is treated by the daemon's own
-     * `normalizeMissionBrief` as "no brief" (see mesh-missions.ts upsertMeshMission) —
-     * this wire guard only checks SHAPE, not that decision.
-     */
-    brief?: MissionBriefWire | null
-}
-
-export interface MeshMissionRecordWire {
-    id: string
-    meshId: string
-    title: string
-    goal: string
-    status: MeshMissionStatusValue
-    source?: MeshMissionSourceValue
-    /** H2: absent = no brief attached to this mission. */
-    brief?: MissionBriefWire
-}
-
-export interface MissionUpsertResponse {
-    mission: MeshMissionRecordWire
-}
-
-function isMeshMissionRecordWire(value: unknown): value is MeshMissionRecordWire {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['id', 'meshId', 'title', 'goal', 'status', 'source', 'brief'])) return false
-    if (!isEvidenceIdentifier(value.id) || !isEvidenceIdentifier(value.meshId)) return false
-    if (typeof value.title !== 'string' || typeof value.goal !== 'string') return false
-    if (!isMeshMissionStatusValue(value.status)) return false
-    if (value.source !== undefined && !isMeshMissionSourceValue(value.source)) return false
-    if (value.brief !== undefined && !isMissionBriefWire(value.brief)) return false
-    return true
-}
-
-export function isMissionUpsertRequest(value: unknown): value is MissionUpsertRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'id', 'title', 'goal', 'status', 'source', 'brief'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION) return false
-    if (!isEvidenceIdentifier(value.meshId)) return false
-    if (value.id !== undefined && !isEvidenceIdentifier(value.id)) return false
-    if (typeof value.title !== 'string' || value.title.trim().length === 0) return false
-    if (value.goal !== undefined && typeof value.goal !== 'string') return false
-    if (value.status !== undefined && !isMeshMissionStatusValue(value.status)) return false
-    if (value.source !== undefined && !isMeshMissionSourceValue(value.source)) return false
-    if (value.brief !== undefined && value.brief !== null && !isMissionBriefWire(value.brief)) return false
-    return true
-}
-
-export function decodeMissionUpsertRequest(value: unknown): MissionUpsertRequest | null {
-    return isMissionUpsertRequest(value) ? value : null
-}
-
-export function isMissionUpsertResponse(value: unknown): value is MissionUpsertResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['mission']) && isMeshMissionRecordWire(value.mission)
-}
-
-export function decodeMissionUpsertResponse(value: unknown): MissionUpsertResponse | null {
-    return isMissionUpsertResponse(value) ? value : null
-}
-
-export interface MissionQueryRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    /** Omitted = every status. */
-    statuses?: readonly MeshMissionStatusValue[]
-    /** Single-mission lookup (mesh-missions.ts `getMeshMission`'s shape) — mutually exclusive with `statuses`. */
-    id?: string
-}
-
-export interface MissionQueryResponse {
-    missions: readonly MeshMissionRecordWire[]
-}
-
-export function isMissionQueryRequest(value: unknown): value is MissionQueryRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'statuses', 'id'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION) return false
-    if (!isEvidenceIdentifier(value.meshId)) return false
-    if (value.id !== undefined && !isEvidenceIdentifier(value.id)) return false
-    if (value.statuses !== undefined) {
-        if (!Array.isArray(value.statuses) || value.statuses.length === 0) return false
-        if (!value.statuses.every(isMeshMissionStatusValue)) return false
-    }
-    return true
-}
-
-export function decodeMissionQueryRequest(value: unknown): MissionQueryRequest | null {
-    return isMissionQueryRequest(value) ? value : null
-}
-
-export function isMissionQueryResponse(value: unknown): value is MissionQueryResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['missions'])
-        && Array.isArray(value.missions) && value.missions.every(isMeshMissionRecordWire)
-}
-
-export function decodeMissionQueryResponse(value: unknown): MissionQueryResponse | null {
-    return isMissionQueryResponse(value) ? value : null
-}
-
-// ─── mission_list_query ─────────────────────────────────────────────────────
-//
-// Wiring-unification Phase C, workstream C-W9b.
-//
-// `mesh-tools-mission.ts`'s own file-header note (2026-09-24, C-W6) flagged
-// this exact gap: `mission_query`'s landed response is `{missions:
-// MeshMissionRecordWire[]}` only — no `verbose`/`includeMagi`/`withStats`/
-// `limit`/`truncated`/`overflowIds`/`historyFold`, all of which
-// `listMeshMissionsForTool` (daemon-core `mesh-missions.ts`) computes for the
-// `mesh_mission_list` tool. Rather than widen `mission_query` itself (an
-// already-landed, already-tested contract other callers rely on for its
-// narrow shape), this is an ADDITIVE sibling command carrying
-// `listMeshMissionsForTool`'s full output shape — request/response fields
-// mirror its options/`MeshMissionListResult` one-for-one (see
-// mesh-missions.ts). `goal`/`goalPreview` are free text, same local-IPC
-// rationale as `mission_upsert`'s `goal` above.
-
-export interface MissionListQueryRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    statuses?: readonly MeshMissionStatusValue[]
-    verbose?: boolean
-    includeMagi?: boolean
-    withStats?: boolean
-    limit?: number
-    historyIdLimit?: number
-    /**
-     * The mesh_status mission projection, computed in the daemon (the MCP no longer
-     * opens the daemon's store for it): 'compact' = `getMeshStatusMissionsCompact`
-     * (live missions goal-elided + folded history), 'verbose' =
-     * `getMeshStatusMissionSummaries({verbose: true})` (live + capped history, full
-     * goal, no stats — stats ride one batched `task_stats_query`). Rows then also
-     * carry `createdAt`/`updatedAt`/`closeCandidateEmittedAt`. When set, every other
-     * option except `historyIdLimit` is ignored. An older daemon rejects the key.
-     */
-    meshStatusView?: 'compact' | 'verbose'
-}
-
-export interface MeshMissionTaskAggregateWire {
-    total: number
-    pending: number
-    assigned: number
-    completed: number
-    failed: number
-    cancelled: number
-    blocked: number
-    lastActivityAt: string | null
-}
-
-export interface MeshMissionStatsWire {
-    missionId: string
-    taskCount: number
-    completed: number
-    failed: number
-    totalDurationMs: number
-    wallClockMs: number | null
-    retries: number
-    incompleteTaskIds: readonly string[]
-}
-
-/** Verbose (full-goal) mission row. `goal` present, `goalPreview`/`goalTruncated` absent. */
-export interface MissionListSummaryVerboseWire {
-    id: string
-    meshId: string
-    title: string
-    goal: string
-    status: MeshMissionStatusValue
-    source?: MeshMissionSourceValue
-    tasks: MeshMissionTaskAggregateWire
-    stats?: MeshMissionStatsWire
-    /** H2: absent = no brief attached. */
-    brief?: MissionBriefWire
-    /** `meshStatusView` rows only. */
-    createdAt?: string
-    updatedAt?: string
-    closeCandidateEmittedAt?: string | null
-}
-
-/** Compact (default) mission row. `goalPreview`/`goalTruncated` present, `goal` absent. */
-export interface MissionListSummarySlimWire {
-    id: string
-    meshId: string
-    title: string
-    goalPreview: string
-    goalTruncated: boolean
-    status: MeshMissionStatusValue
-    source?: MeshMissionSourceValue
-    tasks: MeshMissionTaskAggregateWire
-    stats?: MeshMissionStatsWire
-    /** H2: absent = no brief attached. */
-    brief?: MissionBriefWire
-    /** `meshStatusView` rows only. */
-    createdAt?: string
-    updatedAt?: string
-    closeCandidateEmittedAt?: string | null
-}
-
-export type MissionListSummaryWire = MissionListSummaryVerboseWire | MissionListSummarySlimWire
-
-export interface MeshMissionHistoryFoldWire {
-    count: number
-    byStatus: Record<string, number>
-    missionIds: readonly string[]
-    note: string
-}
-
-export interface MissionListQueryResponse {
-    missions: readonly MissionListSummaryWire[]
-    historyFold: MeshMissionHistoryFoldWire | null
-    truncated: boolean
-    matched: number
-    overflowIds?: readonly string[]
-}
-
-export function isMissionListQueryRequest(value: unknown): value is MissionListQueryRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'statuses', 'verbose', 'includeMagi', 'withStats', 'limit', 'historyIdLimit', 'meshStatusView'])) return false
-    if (value.meshStatusView !== undefined && value.meshStatusView !== 'compact' && value.meshStatusView !== 'verbose') return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION) return false
-    if (!isEvidenceIdentifier(value.meshId)) return false
-    if (value.statuses !== undefined) {
-        if (!Array.isArray(value.statuses) || value.statuses.length === 0) return false
-        if (!value.statuses.every(isMeshMissionStatusValue)) return false
-    }
-    if (value.verbose !== undefined && typeof value.verbose !== 'boolean') return false
-    if (value.includeMagi !== undefined && typeof value.includeMagi !== 'boolean') return false
-    if (value.withStats !== undefined && typeof value.withStats !== 'boolean') return false
-    if (value.limit !== undefined && !isNonNegativeInt(value.limit)) return false
-    if (value.historyIdLimit !== undefined && !isNonNegativeInt(value.historyIdLimit)) return false
-    return true
-}
-
-export function decodeMissionListQueryRequest(value: unknown): MissionListQueryRequest | null {
-    return isMissionListQueryRequest(value) ? value : null
-}
-
-function isMeshMissionTaskAggregateWire(value: unknown): value is MeshMissionTaskAggregateWire {
-    const keys = ['total', 'pending', 'assigned', 'completed', 'failed', 'cancelled', 'blocked', 'lastActivityAt'] as const
-    if (!isRecord(value) || !hasOnlyKeys(value, keys)) return false
-    for (const k of ['total', 'pending', 'assigned', 'completed', 'failed', 'cancelled', 'blocked'] as const) {
-        if (!isNonNegativeInt(value[k])) return false
-    }
-    return value.lastActivityAt === null || typeof value.lastActivityAt === 'string'
-}
-
-function isMeshMissionStatsWire(value: unknown): value is MeshMissionStatsWire {
-    const keys = ['missionId', 'taskCount', 'completed', 'failed', 'totalDurationMs', 'wallClockMs', 'retries', 'incompleteTaskIds'] as const
-    if (!isRecord(value) || !hasOnlyKeys(value, keys)) return false
-    if (!isEvidenceIdentifier(value.missionId)) return false
-    for (const k of ['taskCount', 'completed', 'failed', 'totalDurationMs', 'retries'] as const) {
-        if (!isNonNegativeInt(value[k])) return false
-    }
-    if (value.wallClockMs !== null && !isNonNegativeInt(value.wallClockMs)) return false
-    if (!Array.isArray(value.incompleteTaskIds) || !value.incompleteTaskIds.every(isEvidenceIdentifier)) return false
-    return true
-}
-
-function isMissionListSummaryWire(value: unknown): value is MissionListSummaryWire {
-    if (!isRecord(value)) return false
-    const hasGoal = 'goal' in value
-    const hasPreview = 'goalPreview' in value && 'goalTruncated' in value
-    if (hasGoal === hasPreview) return false // exactly one of the two shapes
-    const baseKeys = ['id', 'meshId', 'title', 'status', 'source', 'tasks', 'stats', 'brief', 'createdAt', 'updatedAt', 'closeCandidateEmittedAt'] as const
-    const allowed = hasGoal ? [...baseKeys, 'goal'] : [...baseKeys, 'goalPreview', 'goalTruncated']
-    if (!hasOnlyKeys(value, allowed)) return false
-    if (!isEvidenceIdentifier(value.id) || !isEvidenceIdentifier(value.meshId)) return false
-    if (typeof value.title !== 'string') return false
-    if (!isMeshMissionStatusValue(value.status)) return false
-    if (value.source !== undefined && !isMeshMissionSourceValue(value.source)) return false
-    if (!isMeshMissionTaskAggregateWire(value.tasks)) return false
-    if (value.stats !== undefined && !isMeshMissionStatsWire(value.stats)) return false
-    if (value.brief !== undefined && !isMissionBriefWire(value.brief)) return false
-    if (hasGoal && typeof value.goal !== 'string') return false
-    if (hasPreview && (typeof value.goalPreview !== 'string' || typeof value.goalTruncated !== 'boolean')) return false
-    if (value.createdAt !== undefined && typeof value.createdAt !== 'string') return false
-    if (value.updatedAt !== undefined && typeof value.updatedAt !== 'string') return false
-    if (value.closeCandidateEmittedAt !== undefined && value.closeCandidateEmittedAt !== null && typeof value.closeCandidateEmittedAt !== 'string') return false
-    return true
-}
-
-function isMeshMissionHistoryFoldWire(value: unknown): value is MeshMissionHistoryFoldWire {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['count', 'byStatus', 'missionIds', 'note'])) return false
-    if (!isNonNegativeInt(value.count)) return false
-    if (!isRecord(value.byStatus) || !Object.values(value.byStatus).every((n) => isNonNegativeInt(n))) return false
-    if (!Array.isArray(value.missionIds) || !value.missionIds.every(isEvidenceIdentifier)) return false
-    return typeof value.note === 'string'
-}
-
-export function isMissionListQueryResponse(value: unknown): value is MissionListQueryResponse {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['missions', 'historyFold', 'truncated', 'matched', 'overflowIds'])) return false
-    if (!Array.isArray(value.missions) || !value.missions.every(isMissionListSummaryWire)) return false
-    if (value.historyFold !== null && !isMeshMissionHistoryFoldWire(value.historyFold)) return false
-    if (typeof value.truncated !== 'boolean') return false
-    if (!isNonNegativeInt(value.matched)) return false
-    if (value.overflowIds !== undefined && (!Array.isArray(value.overflowIds) || !value.overflowIds.every(isEvidenceIdentifier))) return false
-    return true
-}
-
-export function decodeMissionListQueryResponse(value: unknown): MissionListQueryResponse | null {
-    return isMissionListQueryResponse(value) ? value : null
-}
-
-// ─── note_upsert / note_forget ──────────────────────────────────────────────
-//
-// Decision (2026-09-24, C-W6b; implemented C-W8): coordinator operating notes
-// get their own two local-IPC commands. A note's text is coordinator-authored
-// free text, so — exactly like mission_upsert's `goal` — it cannot ride
-// `mesh_record`'s scalar allow-list, and it never needs to: notes live in the
-// owning daemon's `mesh_operating_notes` table (local-only; never on
-// `mesh.<id>.events`). The same "local IPC is inside the boundary" rationale as
-// the mission commands above applies.
-
-export const OPERATING_NOTE_CATEGORIES = ['provider_quirk', 'pattern_to_avoid', 'recovery_lesson'] as const
-export type OperatingNoteCategory = typeof OPERATING_NOTE_CATEGORIES[number]
-export const isOperatingNoteCategory = makeGuard(OPERATING_NOTE_CATEGORIES)
-
-export interface NoteUpsertRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    /** Free text (local IPC — see the section note). */
-    text: string
-    category?: OperatingNoteCategory
-    pinned?: boolean
-    /** Explicit expiry, ISO-8601. */
-    expiresAt?: string
-    /** Note id (or subject key) this note supersedes. */
-    supersedes?: string
-    subjectKey?: string
-    /** Best-effort identity of the recording coordinator (session id / daemon id / host). */
-    sourceCoordinator?: string
-}
-
-export interface NoteUpsertResponse {
-    noteId: string
-    /** True when the same text was already among the recent live notes (no new note). */
-    deduped: boolean
-    createdAt: string
-}
-
-function isOptionalShortString(value: unknown, max = 512): boolean {
-    return value === undefined || (typeof value === 'string' && value.trim().length > 0 && value.length <= max)
-}
-
-export function isNoteUpsertRequest(value: unknown): value is NoteUpsertRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'text', 'category', 'pinned', 'expiresAt', 'supersedes', 'subjectKey', 'sourceCoordinator'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION) return false
-    if (!isEvidenceIdentifier(value.meshId)) return false
-    if (typeof value.text !== 'string' || value.text.trim().length === 0) return false
-    if (value.category !== undefined && !isOperatingNoteCategory(value.category)) return false
-    if (value.pinned !== undefined && typeof value.pinned !== 'boolean') return false
-    if (value.expiresAt !== undefined && (typeof value.expiresAt !== 'string' || Number.isNaN(Date.parse(value.expiresAt)))) return false
-    return isOptionalShortString(value.supersedes) && isOptionalShortString(value.subjectKey) && isOptionalShortString(value.sourceCoordinator)
-}
-
-export function decodeNoteUpsertRequest(value: unknown): NoteUpsertRequest | null {
-    return isNoteUpsertRequest(value) ? value : null
-}
-
-export function isNoteUpsertResponse(value: unknown): value is NoteUpsertResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['noteId', 'deduped', 'createdAt'])
-        && isEvidenceIdentifier(value.noteId) && typeof value.deduped === 'boolean' && typeof value.createdAt === 'string'
-}
-
-export function decodeNoteUpsertResponse(value: unknown): NoteUpsertResponse | null {
-    return isNoteUpsertResponse(value) ? value : null
-}
-
-export interface NoteForgetRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    /** At least one of `noteId` / `text` (a text forget retracts every note with that exact text, and any recorded later). */
-    noteId?: string
-    text?: string
-    reason?: string
-}
-
-export interface NoteForgetResponse {
-    /** Live notes this forget hid. */
-    matched: number
-    tombstoneId: string
-}
-
-export function isNoteForgetRequest(value: unknown): value is NoteForgetRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'noteId', 'text', 'reason'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION) return false
-    if (!isEvidenceIdentifier(value.meshId)) return false
-    if (value.noteId !== undefined && !isEvidenceIdentifier(value.noteId)) return false
-    if (value.text !== undefined && (typeof value.text !== 'string' || value.text.trim().length === 0)) return false
-    if (value.noteId === undefined && value.text === undefined) return false
-    return value.reason === undefined || typeof value.reason === 'string'
-}
-
-export function decodeNoteForgetRequest(value: unknown): NoteForgetRequest | null {
-    return isNoteForgetRequest(value) ? value : null
-}
-
-export function isNoteForgetResponse(value: unknown): value is NoteForgetResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['matched', 'tombstoneId'])
-        && typeof value.matched === 'number' && Number.isInteger(value.matched) && value.matched >= 0
-        && isEvidenceIdentifier(value.tombstoneId)
-}
-
-export function decodeNoteForgetResponse(value: unknown): NoteForgetResponse | null {
-    return isNoteForgetResponse(value) ? value : null
-}
-
-// ─── tool_call_record ───────────────────────────────────────────────────────
-//
-// Wiring-unification Phase C, workstream C-W9b
-// (docs/design/2026-09-23-wiring-unification.md §5 C2 "MCP server" paragraph,
-// 2026-09-24 14:00 stamp "C-W9").
-//
-// Replaces `recordMeshToolCall`/`recordMeshCoordinatorToolCall`
-// (`daemon-core/src/mesh/mesh-direct-dispatch.ts`) — an in-process,
-// per-mesh-tool-call rate-limit/advisory bump mcp-server called directly
-// against its own store handle. Every field is an identifier, a closed enum,
-// a boolean or a counter — squarely inside `mesh_record`'s content boundary,
-// but this is its own command (not a `mesh_record` payload) because it is a
-// COUNTER MUTATION with a computed return value (`rateLimitExceeded`,
-// `callsInWindow`, `advisory`), not an append-only scalar record.
-
-export const TOOL_CALLER_ROLES = ['coordinator', 'unknown'] as const
-export type ToolCallerRole = typeof TOOL_CALLER_ROLES[number]
-export const isToolCallerRole = makeGuard(TOOL_CALLER_ROLES)
-
-export interface ToolCallRecordRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    /** The mesh tool name, e.g. `mesh_status` (identifier, not free text — always a fixed tool-name string). */
-    tool: string
-    sessionId?: string
-    callerRole: ToolCallerRole
-}
-
-export interface ToolCallRecordResponse {
-    rateLimitExceeded: boolean
-    callsInWindow: number
-    /** Short machine-oriented advisory string, or null. Never free text describing content. */
-    advisory: string | null
-}
-
-export function isToolCallRecordRequest(value: unknown): value is ToolCallRecordRequest {
-    return isRecord(value) && hasOnlyKeys(value, ['v', 'meshId', 'tool', 'sessionId', 'callerRole'])
-        && value.v === TURN_IPC_PROTOCOL_VERSION
-        && isEvidenceIdentifier(value.meshId)
-        && isEvidenceIdentifier(value.tool)
-        && isOptionalId(value.sessionId)
-        && isToolCallerRole(value.callerRole)
-}
-
-export function decodeToolCallRecordRequest(value: unknown): ToolCallRecordRequest | null {
-    return isToolCallRecordRequest(value) ? value : null
-}
-
-export function isToolCallRecordResponse(value: unknown): value is ToolCallRecordResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['rateLimitExceeded', 'callsInWindow', 'advisory'])
-        && typeof value.rateLimitExceeded === 'boolean'
-        && isNonNegativeInt(value.callsInWindow)
-        && (value.advisory === null || typeof value.advisory === 'string')
-}
-
-export function decodeToolCallRecordResponse(value: unknown): ToolCallRecordResponse | null {
-    return isToolCallRecordResponse(value) ? value : null
-}
-
-// ─── ledger_query ───────────────────────────────────────────────────────────
-//
-// Wiring-unification Phase C, workstream C-W9b.
-//
-// Replaces the remaining bare `readLedgerEntries(meshId, opts)` /
-// `getLedgerSummary(meshId)` in-process reads that `turn_query` cannot serve
-// (§5 C2's `mesh-tools-mission.ts` file-header note, 2026-09-24: "general
-// ledger browsing by arbitrary `kind`/`since`/`node` filters —
-// `turn_query`'s shape... has no free-form kind-list or node filter, so this
-// is a real API mismatch, not a mechanical rename"). `turn_query` stays
-// scoped to the turn-ledger's own attempt/event rows; `ledger_query` is the
-// general record browse surface (C-W9a: the daemon's `mesh_local_records` plus
-// the turn ledger's task outcomes, `readLocalRecords`) `meshTaskHistory` /
-// `meshLedgerQuery` / the MAGI ledger-scan helpers need.
-//
-// CONTENT BOUNDARY: `MeshLedgerEntry.payload` (daemon-core `mesh-ledger.ts`)
-// is `Record<string, unknown>` — genuinely unbounded JSON (a MAGI synthesis
-// object, a graph plan, a free-text checkpoint message), NOT constrained to
-// `mesh_record`'s scalar allow-list. This is fine for the SAME reason
-// `mission_upsert`'s `goal` and `note_upsert`'s `text` are fine (see that
-// section's note above): this is local IPC between mcp-server and the
-// daemon that owns the ledger, both on the operator's own machine — never a
-// cross-machine or server hop. `entryPayload` below is therefore an
-// intentionally-unvalidated `Record<string, unknown>` passthrough, exactly
-// like `MissionUpsertRequest.goal` is unvalidated free text.
-
-export interface LedgerQueryRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    /** One or more ledger `kind` strings (daemon-core `MeshLedgerKind`; mesh-shared cannot import that union, so these are identifiers here). Omitted = every kind. */
-    kind?: readonly string[]
-    /** ISO-8601 or epoch-ms-as-string — passed through to `readLedgerEntries`'s `since` (parsed via `new Date()`). */
-    since?: string
-    /** Filter to entries whose nodeId is equivalent to this daemon id (matched via `daemonIdsEquivalent` daemon-side, not raw `===`). */
-    node?: string
-    tail?: number
-    /** Also return `getLedgerSummary(meshId)` alongside the entries — saves a second round trip for callers that want both (the common case: every existing call site fetches both together). */
-    includeSummary?: boolean
-}
-
-export interface LedgerQueryEntryWire {
-    id: string
-    meshId: string
-    timestamp: string
-    kind: string
-    nodeId?: string
-    sessionId?: string
-    providerType?: string
-    taskId?: string
-    /** Unbounded JSON passthrough — see file section's CONTENT BOUNDARY note. */
-    payload: Record<string, unknown>
-}
-
-export interface LedgerQuerySummaryWire {
-    meshId: string
-    totalEntries: number
-    taskDispatched: number
-    taskCompleted: number
-    taskFailed: number
-    taskStalled: number
-    sessionLaunched: number
-    checkpointCreated: number
-    lastActivityAt: string | null
-    recentFailures: number
-}
-
-export interface LedgerQueryResponse {
-    entries: readonly LedgerQueryEntryWire[]
-    summary?: LedgerQuerySummaryWire
-}
-
-export function isLedgerQueryRequest(value: unknown): value is LedgerQueryRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'kind', 'since', 'node', 'tail', 'includeSummary'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION) return false
-    if (!isEvidenceIdentifier(value.meshId)) return false
-    if (value.kind !== undefined && (!Array.isArray(value.kind) || value.kind.length === 0 || !value.kind.every(isEvidenceIdentifier))) return false
-    if (value.since !== undefined && typeof value.since !== 'string') return false
-    if (!isOptionalId(value.node)) return false
-    if (value.tail !== undefined && !isNonNegativeInt(value.tail)) return false
-    if (value.includeSummary !== undefined && typeof value.includeSummary !== 'boolean') return false
-    return true
-}
-
-export function decodeLedgerQueryRequest(value: unknown): LedgerQueryRequest | null {
-    return isLedgerQueryRequest(value) ? value : null
-}
-
-const LEDGER_QUERY_ENTRY_KEYS = ['id', 'meshId', 'timestamp', 'kind', 'nodeId', 'sessionId', 'providerType', 'taskId', 'payload'] as const
-
-function isLedgerQueryEntryWire(value: unknown): value is LedgerQueryEntryWire {
-    if (!isRecord(value) || !hasOnlyKeys(value, LEDGER_QUERY_ENTRY_KEYS)) return false
-    if (!isEvidenceIdentifier(value.id) || !isEvidenceIdentifier(value.meshId)) return false
-    if (typeof value.timestamp !== 'string' || typeof value.kind !== 'string') return false
-    if (!isOptionalId(value.nodeId) || !isOptionalId(value.sessionId) || !isOptionalId(value.providerType) || !isOptionalId(value.taskId)) return false
-    if (!isRecord(value.payload)) return false
-    return true
-}
-
-function isLedgerQuerySummaryWire(value: unknown): value is LedgerQuerySummaryWire {
-    const keys = ['meshId', 'totalEntries', 'taskDispatched', 'taskCompleted', 'taskFailed', 'taskStalled', 'sessionLaunched', 'checkpointCreated', 'lastActivityAt', 'recentFailures'] as const
-    if (!isRecord(value) || !hasOnlyKeys(value, keys)) return false
-    if (!isEvidenceIdentifier(value.meshId)) return false
-    for (const k of ['totalEntries', 'taskDispatched', 'taskCompleted', 'taskFailed', 'taskStalled', 'sessionLaunched', 'checkpointCreated', 'recentFailures'] as const) {
-        if (!isNonNegativeInt(value[k])) return false
-    }
-    if (value.lastActivityAt !== null && typeof value.lastActivityAt !== 'string') return false
-    return true
-}
-
-export function isLedgerQueryResponse(value: unknown): value is LedgerQueryResponse {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['entries', 'summary'])) return false
-    if (!Array.isArray(value.entries) || !value.entries.every(isLedgerQueryEntryWire)) return false
-    if (value.summary !== undefined && !isLedgerQuerySummaryWire(value.summary)) return false
-    return true
-}
-
-export function decodeLedgerQueryResponse(value: unknown): LedgerQueryResponse | null {
-    return isLedgerQueryResponse(value) ? value : null
-}
-
-// ─── C-W9a: local records, queue composites, active work ────────────────────
-//
-// Wiring-unification Phase C, workstream C-W9a (the 2026-09-24 14:00 stamp
-// "Left for C-W9"): the event ledger and its JSONL mirror are gone, and every
-// mcp-server call that still reached the daemon's `mesh-runtime.db` in-process
-// — record appends, queue mutations, the queue/active-work reads that fed
-// `buildMeshActiveWork`, recovery hints — moves behind the commands below,
-// executed in the daemon that owns the store.
-//
-// CONTENT BOUNDARY: like `mission_upsert`'s `goal`, `note_upsert`'s `text` and
-// `ledger_query`'s entry payloads, several fields here are free text or
-// unbounded JSON (a task message, a MAGI synthesis, a queue row with its
-// message, an active-work record with its task summary). This is fine for the
-// same reason: local IPC between the mcp-server and the daemon on the
-// operator's own machine — never a cross-machine or server hop. Those fields
-// are documented as passthroughs and validated only for shape (object/array),
-// exactly like `LedgerQueryEntryWire.payload`. Nothing here is ever published
-// to a topic: `record_local`'s topic leg is the daemon's `mesh.record`
-// allow-list projection, which drops free text by construction.
-
-function isRecordArray(value: unknown): value is readonly Record<string, unknown>[] {
-    return Array.isArray(value) && value.every(isRecord)
-}
-
-function isOptionalRecord(value: unknown): boolean {
-    return value === undefined || isRecord(value)
-}
-
-function isOptionalBoolean(value: unknown): boolean {
-    return value === undefined || typeof value === 'boolean'
-}
-
-function isOptionalString(value: unknown): boolean {
-    return value === undefined || typeof value === 'string'
-}
-
-/** A queue row as the daemon's `getQueue` returns it — a JSON passthrough (see the section note). */
-export type QueueEntryWire = Record<string, unknown> & { id: string; status: string }
-
-function isQueueEntryWire(value: unknown): value is QueueEntryWire {
-    return isRecord(value) && isEvidenceIdentifier(value.id) && typeof value.status === 'string'
-}
-
-// ── record_local ──
-//
-// `meshRecord(meshId, kind, scalars, { local: true })` over IPC: the scalar
-// projection goes to `mesh.<id>.events` (content-free), the FULL payload lands
-// in the daemon's `mesh_local_records` (local-only). Replaces every mcp-server
-// `appendLedgerEntry` (dispatch / MAGI question+synthesis / checkpoint message /
-// reconcile records). `payload` is free-form JSON (see the section note).
-
-export interface RecordLocalRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    /** A `MeshLedgerKind` (daemon-core); an identifier here (mesh-shared cannot import that union). */
-    kind: string
-    nodeId?: string
-    sessionId?: string
-    providerType?: string
-    taskId?: string
-    payload: Record<string, unknown>
-}
-
-export interface RecordLocalResponse {
-    eventId: string
-    timestamp: string
-    storedLocally: boolean
-    published: boolean
-}
-
-export function isRecordLocalRequest(value: unknown): value is RecordLocalRequest {
-    return isRecord(value) && hasOnlyKeys(value, ['v', 'meshId', 'kind', 'nodeId', 'sessionId', 'providerType', 'taskId', 'payload'])
-        && value.v === TURN_IPC_PROTOCOL_VERSION
-        && isEvidenceIdentifier(value.meshId)
-        && isEvidenceIdentifier(value.kind)
-        && isOptionalId(value.nodeId) && isOptionalId(value.sessionId) && isOptionalId(value.providerType) && isOptionalId(value.taskId)
-        && isRecord(value.payload)
-}
-
-export function decodeRecordLocalRequest(value: unknown): RecordLocalRequest | null {
-    return isRecordLocalRequest(value) ? value : null
-}
-
-export function isRecordLocalResponse(value: unknown): value is RecordLocalResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['eventId', 'timestamp', 'storedLocally', 'published'])
-        && isEvidenceIdentifier(value.eventId) && typeof value.timestamp === 'string'
-        && typeof value.storedLocally === 'boolean' && typeof value.published === 'boolean'
-}
-
-export function decodeRecordLocalResponse(value: unknown): RecordLocalResponse | null {
-    return isRecordLocalResponse(value) ? value : null
-}
-
-// ── queue_query ──
-
-export interface QueueQueryRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    /** Status filter (queue statuses); omitted = every row. */
-    statuses?: readonly string[]
-    /** One row by id (returns 0 or 1 entries). */
-    taskId?: string
-    /** Project for a VIEW surface: the persisted input envelope → `inputSummary` (summarizeQueueEntryInputForView). */
-    view?: boolean
-    /**
-     * Also return the per-status row counts of the WHOLE mesh queue (columns only,
-     * no payload parse) — lets a view read only the rows it shows yet report
-     * mesh-wide counts. An older daemon rejects the key.
-     */
-    withCounts?: boolean
-    /** With `withCounts`: also count terminal rows whose `updated_at` is older than this age. */
-    historicalOlderThanMs?: number
-    /**
-     * Also return `dependencyHeads`: id/status/blockedReason/cancelReason of every
-     * row the returned entries list in `dependsOn` that is not itself returned —
-     * enough to annotate dependency state without reading the whole queue.
-     */
-    withDependencyHeads?: boolean
-}
-
-/** A dependency row reduced to the fields dependency-state annotation reads. */
-export interface QueueDependencyHeadWire {
-    id: string
-    status: string
-    blockedReason?: string
-    cancelReason?: string
-}
-
-export interface QueueQueryResponse {
-    entries: readonly QueueEntryWire[]
-    /** `withCounts`: row count per status over the whole mesh queue. */
-    counts?: Record<string, number>
-    /** `withCounts` + `historicalOlderThanMs`: terminal rows older than that age. */
-    oldHistoricalCount?: number
-    /** `withDependencyHeads`. */
-    dependencyHeads?: readonly QueueDependencyHeadWire[]
-}
-
-export function isQueueQueryRequest(value: unknown): value is QueueQueryRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'statuses', 'taskId', 'view', 'withCounts', 'historicalOlderThanMs', 'withDependencyHeads'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION || !isEvidenceIdentifier(value.meshId)) return false
-    if (value.statuses !== undefined && (!Array.isArray(value.statuses) || !value.statuses.every(isEvidenceIdentifier))) return false
-    if (value.historicalOlderThanMs !== undefined && !isNonNegativeInt(value.historicalOlderThanMs)) return false
-    return isOptionalId(value.taskId) && isOptionalBoolean(value.view)
-        && isOptionalBoolean(value.withCounts) && isOptionalBoolean(value.withDependencyHeads)
-}
-
-export function decodeQueueQueryRequest(value: unknown): QueueQueryRequest | null {
-    return isQueueQueryRequest(value) ? value : null
-}
-
-function isQueueDependencyHeadWire(value: unknown): value is QueueDependencyHeadWire {
-    return isRecord(value) && hasOnlyKeys(value, ['id', 'status', 'blockedReason', 'cancelReason'])
-        && typeof value.id === 'string' && typeof value.status === 'string'
-        && (value.blockedReason === undefined || typeof value.blockedReason === 'string')
-        && (value.cancelReason === undefined || typeof value.cancelReason === 'string')
-}
-
-export function isQueueQueryResponse(value: unknown): value is QueueQueryResponse {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['entries', 'counts', 'oldHistoricalCount', 'dependencyHeads'])) return false
-    if (!Array.isArray(value.entries) || !value.entries.every(isQueueEntryWire)) return false
-    if (value.counts !== undefined && (!isRecord(value.counts) || !Object.values(value.counts).every(isNonNegativeInt))) return false
-    if (value.oldHistoricalCount !== undefined && !isNonNegativeInt(value.oldHistoricalCount)) return false
-    if (value.dependencyHeads !== undefined && (!Array.isArray(value.dependencyHeads) || !value.dependencyHeads.every(isQueueDependencyHeadWire))) return false
-    return true
-}
-
-export function decodeQueueQueryResponse(value: unknown): QueueQueryResponse | null {
-    return isQueueQueryResponse(value) ? value : null
-}
-
-// ── queue_enqueue ──
-//
-// `enqueueTask(meshId, message, options)` + (when `decision` is given) the
-// single-surface `recordSingleEnqueueDecision` for the new task id, in the
-// daemon. `options` is `MeshEnqueueTaskOptions` (daemon-core) as a JSON
-// passthrough; the daemon's enqueue guards (message, task-mode, difficulty,
-// dependency cycle) run unchanged and a refusal comes back as the error.
-
-export interface QueueEnqueueRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    /** Free text (the task message — see the section note). */
-    message: string
-    options?: Record<string, unknown>
-    /** `recordSingleEnqueueDecision` args minus `taskId` (the daemon fills it). */
-    decision?: Record<string, unknown>
-}
-
-export interface QueueEnqueueResponse {
-    entry: QueueEntryWire
-}
-
-export function isQueueEnqueueRequest(value: unknown): value is QueueEnqueueRequest {
-    return isRecord(value) && hasOnlyKeys(value, ['v', 'meshId', 'message', 'options', 'decision'])
-        && value.v === TURN_IPC_PROTOCOL_VERSION && isEvidenceIdentifier(value.meshId)
-        && typeof value.message === 'string'
-        && isOptionalRecord(value.options) && isOptionalRecord(value.decision)
-}
-
-export function decodeQueueEnqueueRequest(value: unknown): QueueEnqueueRequest | null {
-    return isQueueEnqueueRequest(value) ? value : null
-}
-
-export function isQueueEnqueueResponse(value: unknown): value is QueueEnqueueResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['entry']) && isQueueEntryWire(value.entry)
-}
-
-export function decodeQueueEnqueueResponse(value: unknown): QueueEnqueueResponse | null {
-    return isQueueEnqueueResponse(value) ? value : null
-}
-
-// ── queue_enqueue_graph ──
-//
-// The atomic batch enqueue, both paths, with its audit trail — in the daemon:
-//   - `mode: 'compat'` → `enqueueTaskGraph(meshId, specs)`;
-//   - `mode: 'graph'`  → `commitMeshGraphPlan(plan)` + `recordGraphEnqueueCommitted`.
-// A failure records `recordGraphEnqueueRolledBack` (graph) or
-// `recordGraphEnqueueValidationFailed` (compat) from the catch — the daemon
-// writes the audit AFTER the failed transaction, exactly as design :752-753
-// requires — and answers `{ ok: false, refusalCode?, message, extra? }` (a
-// domain refusal is a RESULT here, not a transport error, so the caller keeps
-// its code/extra for the tool response). NOT `code`/`error`: those two keys
-// belong to the command envelope (`{ success, error, code }`) the client
-// unwraps, so a result must never reuse them.
-
-export interface QueueEnqueueGraphRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    mode: 'compat' | 'graph'
-    /** compat: `MeshTaskGraphEntrySpec[]` (JSON passthrough). */
-    specs?: readonly Record<string, unknown>[]
-    /** graph: `commitMeshGraphPlan` input minus `meshId` (JSON passthrough). */
-    plan?: Record<string, unknown>
-    /** Audit context: batchId / missionId / coordinatorSessionId / onDependencyFailure / orchestrationDecision / taskCount. */
-    audit?: Record<string, unknown>
-}
-
-export type QueueEnqueueGraphResponse =
-    | { ok: true; tasks: readonly QueueEntryWire[]; graph?: Record<string, unknown> }
-    | { ok: false; refusalCode?: string; message: string; extra?: Record<string, unknown> }
-
-export function isQueueEnqueueGraphRequest(value: unknown): value is QueueEnqueueGraphRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'mode', 'specs', 'plan', 'audit'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION || !isEvidenceIdentifier(value.meshId)) return false
-    if (value.mode === 'compat') return isRecordArray(value.specs) && value.plan === undefined && isOptionalRecord(value.audit)
-    if (value.mode === 'graph') return isRecord(value.plan) && value.specs === undefined && isOptionalRecord(value.audit)
-    return false
-}
-
-export function decodeQueueEnqueueGraphRequest(value: unknown): QueueEnqueueGraphRequest | null {
-    return isQueueEnqueueGraphRequest(value) ? value : null
-}
-
-export function isQueueEnqueueGraphResponse(value: unknown): value is QueueEnqueueGraphResponse {
-    if (!isRecord(value)) return false
-    if (value.ok === true) {
-        return hasOnlyKeys(value, ['ok', 'tasks', 'graph']) && Array.isArray(value.tasks) && value.tasks.every(isQueueEntryWire)
-            && isOptionalRecord(value.graph)
-    }
-    if (value.ok === false) {
-        return hasOnlyKeys(value, ['ok', 'refusalCode', 'message', 'extra']) && typeof value.message === 'string'
-            && isOptionalString(value.refusalCode) && isOptionalRecord(value.extra)
-    }
-    return false
-}
-
-export function decodeQueueEnqueueGraphResponse(value: unknown): QueueEnqueueGraphResponse | null {
-    return isQueueEnqueueGraphResponse(value) ? value : null
-}
-
-// ── queue_cancel ──
-
-export interface QueueCancelRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    taskId: string
-    /** Operator reason (free text, local IPC). */
-    reason?: string
-}
-
-export interface QueueCancelResponse {
-    /** The cancelled row, or null when no such task. */
-    task: QueueEntryWire | null
-    /** The row as it was BEFORE the cancel (its assignment is what a caller stops). */
-    before: QueueEntryWire | null
-}
-
-export function isQueueCancelRequest(value: unknown): value is QueueCancelRequest {
-    return isRecord(value) && hasOnlyKeys(value, ['v', 'meshId', 'taskId', 'reason'])
-        && value.v === TURN_IPC_PROTOCOL_VERSION && isEvidenceIdentifier(value.meshId) && isEvidenceIdentifier(value.taskId)
-        && isOptionalString(value.reason)
-}
-
-export function decodeQueueCancelRequest(value: unknown): QueueCancelRequest | null {
-    return isQueueCancelRequest(value) ? value : null
-}
-
-export function isQueueCancelResponse(value: unknown): value is QueueCancelResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['task', 'before'])
-        && (value.task === null || isQueueEntryWire(value.task))
-        && (value.before === null || isQueueEntryWire(value.before))
-}
-
-export function decodeQueueCancelResponse(value: unknown): QueueCancelResponse | null {
-    return isQueueCancelResponse(value) ? value : null
-}
-
-// ── queue_requeue ──
-
-export interface QueueRequeueRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    taskId: string
-    /** `requeueTask` options (reason / targetNodeId / targetSessionId / clear* / force / message / maxRetries / notBefore), JSON passthrough. */
-    options?: Record<string, unknown>
-}
-
-export interface QueueRequeueResponse {
-    task: QueueEntryWire | null
-}
-
-export function isQueueRequeueRequest(value: unknown): value is QueueRequeueRequest {
-    return isRecord(value) && hasOnlyKeys(value, ['v', 'meshId', 'taskId', 'options'])
-        && value.v === TURN_IPC_PROTOCOL_VERSION && isEvidenceIdentifier(value.meshId) && isEvidenceIdentifier(value.taskId)
-        && isOptionalRecord(value.options)
-}
-
-export function decodeQueueRequeueRequest(value: unknown): QueueRequeueRequest | null {
-    return isQueueRequeueRequest(value) ? value : null
-}
-
-export function isQueueRequeueResponse(value: unknown): value is QueueRequeueResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['task']) && (value.task === null || isQueueEntryWire(value.task))
-}
-
-export function decodeQueueRequeueResponse(value: unknown): QueueRequeueResponse | null {
-    return isQueueRequeueResponse(value) ? value : null
-}
-
-// ── direct_dispatch_record ──
-//
-// The post-dispatch bookkeeping of `mesh_send_task`'s direct arms, in the
-// daemon: `recordDirectDispatchTask` (materialise the queue row, stamped with
-// the already-open `mesh_direct` attempt) and `recordDirectDispatchDecision`
-// (GRAPH-MEASUREMENT-DIRECT). Each step is best-effort and reported separately
-// — a dispatch that already happened must never fail on its bookkeeping.
-
-export interface DirectDispatchRecordRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    taskId: string
-    /** Free text (the authored task message — the materialised row keeps it). */
-    message: string
-    /** `recordDirectDispatchTask` options minus `id` (JSON passthrough). */
-    task?: Record<string, unknown>
-    /** `recordDirectDispatchDecision` args minus `taskId` (JSON passthrough). */
-    decision?: Record<string, unknown>
-}
-
-export interface DirectDispatchRecordResponse {
-    taskRecorded: boolean
-    decisionRecorded: boolean
-}
-
-export function isDirectDispatchRecordRequest(value: unknown): value is DirectDispatchRecordRequest {
-    return isRecord(value) && hasOnlyKeys(value, ['v', 'meshId', 'taskId', 'message', 'task', 'decision'])
-        && value.v === TURN_IPC_PROTOCOL_VERSION && isEvidenceIdentifier(value.meshId) && isEvidenceIdentifier(value.taskId)
-        && typeof value.message === 'string' && isOptionalRecord(value.task) && isOptionalRecord(value.decision)
-}
-
-export function decodeDirectDispatchRecordRequest(value: unknown): DirectDispatchRecordRequest | null {
-    return isDirectDispatchRecordRequest(value) ? value : null
-}
-
-export function isDirectDispatchRecordResponse(value: unknown): value is DirectDispatchRecordResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['taskRecorded', 'decisionRecorded'])
-        && typeof value.taskRecorded === 'boolean' && typeof value.decisionRecorded === 'boolean'
-}
-
-export function decodeDirectDispatchRecordResponse(value: unknown): DirectDispatchRecordResponse | null {
-    return isDirectDispatchRecordResponse(value) ? value : null
-}
-
-// ── graph_audit_record ──
-//
-// The coordinator-gate / node-patch provenance records the `mesh_graph_*`
-// tools write after a gate action (design :740-750), written by the daemon's
-// allow-listed recorders (mesh-graph-provenance.ts) — the mcp-server never
-// builds the record payload itself. `fields` is the recorder's argument object.
-
-export const GRAPH_AUDIT_EVENTS = ['gate_claimed', 'gate_released', 'gate_abandoned', 'node_patched'] as const
-export type GraphAuditEvent = typeof GRAPH_AUDIT_EVENTS[number]
-export const isGraphAuditEvent = makeGuard(GRAPH_AUDIT_EVENTS)
-
-export interface GraphAuditRecordRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    event: GraphAuditEvent
-    fields: Record<string, unknown>
-}
-
-export interface GraphAuditRecordResponse {
-    recorded: boolean
-}
-
-export function isGraphAuditRecordRequest(value: unknown): value is GraphAuditRecordRequest {
-    return isRecord(value) && hasOnlyKeys(value, ['v', 'meshId', 'event', 'fields'])
-        && value.v === TURN_IPC_PROTOCOL_VERSION && isEvidenceIdentifier(value.meshId)
-        && isGraphAuditEvent(value.event) && isRecord(value.fields)
-}
-
-export function decodeGraphAuditRecordRequest(value: unknown): GraphAuditRecordRequest | null {
-    return isGraphAuditRecordRequest(value) ? value : null
-}
-
-export function isGraphAuditRecordResponse(value: unknown): value is GraphAuditRecordResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['recorded']) && typeof value.recorded === 'boolean'
-}
-
-export function decodeGraphAuditRecordResponse(value: unknown): GraphAuditRecordResponse | null {
-    return isGraphAuditRecordResponse(value) ? value : null
-}
-
-// ── active_work_query ──
-//
-// The active-work view, COMPUTED in the daemon: it reads the queue, the open
-// direct dispatches (`mesh_direct` attempts) and its local records (+ turn
-// outcomes), and runs `buildMeshActiveWork` over them with the caller's live
-// node probe results. `includeInputs` also returns the records + dispatches it
-// used (the transcript-reconcile pass and the stale-direct prune read them);
-// `compute: false` returns only those inputs. `includeSchedulingRuntime` adds
-// `buildMeshSchedulingRuntime(mesh, queue)` for the caller's `mesh` snapshot.
-// `queue` lets a caller substitute its own annotated queue view.
-
-export interface ActiveWorkQueryRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    /** Live node probe results (`buildMeshActiveWork`'s `nodes`), JSON passthrough. */
-    nodes?: readonly Record<string, unknown>[]
-    /** Substitute queue rows (default: the daemon's `getQueue`). */
-    queue?: readonly Record<string, unknown>[]
-    /** Record tail fed to active work (default 200). */
-    recordTail?: number
-    includeTerminalDirect?: boolean
-    /** Default true. */
-    compute?: boolean
-    includeInputs?: boolean
-    includeSummary?: boolean
-    includeSchedulingRuntime?: boolean
-    /**
-     * The caller's mesh snapshot for the scheduling runtime, JSON passthrough.
-     * Optional since the daemon resolves its own mesh record when it is absent;
-     * an older daemon rejects `includeSchedulingRuntime` without it (the caller's
-     * feature-detect signal to resend with the mesh).
-     */
-    mesh?: Record<string, unknown>
-}
-
-export interface ActiveWorkQueryResponse {
-    /** `MeshActiveWorkEvidence` (daemon-core), JSON passthrough; absent when `compute: false`. */
-    activeWork?: Record<string, unknown>
-    records?: readonly Record<string, unknown>[]
-    directDispatches?: readonly Record<string, unknown>[]
-    /** `MeshLedgerSummary`-shaped record summary. */
-    summary?: Record<string, unknown>
-    schedulingRuntime?: Record<string, unknown>
-}
-
-export function isActiveWorkQueryRequest(value: unknown): value is ActiveWorkQueryRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'nodes', 'queue', 'recordTail', 'includeTerminalDirect', 'compute', 'includeInputs', 'includeSummary', 'includeSchedulingRuntime', 'mesh'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION || !isEvidenceIdentifier(value.meshId)) return false
-    if (value.nodes !== undefined && !isRecordArray(value.nodes)) return false
-    if (value.queue !== undefined && !isRecordArray(value.queue)) return false
-    if (value.recordTail !== undefined && !isNonNegativeInt(value.recordTail)) return false
-    return isOptionalBoolean(value.includeTerminalDirect) && isOptionalBoolean(value.compute) && isOptionalBoolean(value.includeInputs)
-        && isOptionalBoolean(value.includeSummary) && isOptionalBoolean(value.includeSchedulingRuntime) && isOptionalRecord(value.mesh)
-}
-
-export function decodeActiveWorkQueryRequest(value: unknown): ActiveWorkQueryRequest | null {
-    return isActiveWorkQueryRequest(value) ? value : null
-}
-
-export function isActiveWorkQueryResponse(value: unknown): value is ActiveWorkQueryResponse {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['activeWork', 'records', 'directDispatches', 'summary', 'schedulingRuntime'])) return false
-    if (value.records !== undefined && !isRecordArray(value.records)) return false
-    if (value.directDispatches !== undefined && !isRecordArray(value.directDispatches)) return false
-    return isOptionalRecord(value.activeWork) && isOptionalRecord(value.summary) && isOptionalRecord(value.schedulingRuntime)
-}
-
-export function decodeActiveWorkQueryResponse(value: unknown): ActiveWorkQueryResponse | null {
-    return isActiveWorkQueryResponse(value) ? value : null
-}
-
-// ── recovery_context_query ──
-//
-// `getSessionRecoveryContext` (daemon-core `mesh-local-records.ts`) in the
-// daemon. `lastTaskMessage` / `advice` are free text (local IPC).
-
-export interface RecoveryContextQueryRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    nodeId?: string
-    sessionId?: string
-    maxRetries?: number
-    /**
-     * Batch: one context per node id, computed over ONE record read (answers
-     * `contexts`). Exclusive with `nodeId`/`sessionId`. An older daemon rejects it.
-     */
-    nodeIds?: readonly string[]
-}
-
-export interface RecoveryContextQueryResponse {
-    /** Single mode (nodeId/sessionId). */
-    context?: Record<string, unknown>
-    /** Batch mode (`nodeIds`): context per node id. */
-    contexts?: Record<string, Record<string, unknown>>
-}
-
-export function isRecoveryContextQueryRequest(value: unknown): value is RecoveryContextQueryRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'nodeId', 'sessionId', 'maxRetries', 'nodeIds'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION || !isEvidenceIdentifier(value.meshId)) return false
-    if (!isOptionalId(value.nodeId) || !isOptionalId(value.sessionId)) return false
-    if (value.maxRetries !== undefined && !isNonNegativeInt(value.maxRetries)) return false
-    if (value.nodeIds !== undefined) {
-        if (!Array.isArray(value.nodeIds) || value.nodeIds.length === 0 || !value.nodeIds.every(isEvidenceIdentifier)) return false
-        return value.nodeId === undefined && value.sessionId === undefined
-    }
-    return value.nodeId !== undefined || value.sessionId !== undefined
-}
-
-export function decodeRecoveryContextQueryRequest(value: unknown): RecoveryContextQueryRequest | null {
-    return isRecoveryContextQueryRequest(value) ? value : null
-}
-
-function isRecoveryContextWire(value: unknown): boolean {
-    return isRecord(value) && typeof value.consecutiveNodeFailures === 'number'
-}
-
-export function isRecoveryContextQueryResponse(value: unknown): value is RecoveryContextQueryResponse {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['context', 'contexts'])) return false
-    if (value.context === undefined && value.contexts === undefined) return false
-    if (value.context !== undefined && !isRecoveryContextWire(value.context)) return false
-    if (value.contexts !== undefined && (!isRecord(value.contexts) || !Object.values(value.contexts).every(isRecoveryContextWire))) return false
-    return true
-}
-
-export function decodeRecoveryContextQueryResponse(value: unknown): RecoveryContextQueryResponse | null {
-    return isRecoveryContextQueryResponse(value) ? value : null
-}
-
-// ─── graph_gate_claim / graph_gate_release / graph_gate_abandon / graph_node_patch / graph_view_query ──
-//
-// Wiring-unification Phase C, workstream C-W9c (2026-09-24 19:00 stamp
-// "mcp-server graph gates/plan/patch ... still call daemon-core in-process").
-//
-// `mesh-tools-graph.ts`'s five graph-orchestration tools (the gate claim
-// / release / abandon verbs, now `mesh_graph_gate`, `mesh_graph_node_patch`, `mesh_graph_view`) called
-// daemon-core's MeshRuntimeStore-backed graph module in-process
-// (`claimMeshGraphGate` / `releaseMeshGraphGate` / `abandonMeshGraphGate` /
-// `patchGraphNodeAndRetry` / `buildMeshGraphViews`, all in `mesh-graph-gates.ts` /
-// `mesh-graph-transition-runner.ts` / `mesh-graph-view.ts`), plus the read-only
-// git-based `collectGateConvergenceEvidence` probe. These five commands move
-// every one of those calls into the daemon that owns the graph rows.
-//
-// CONTENT BOUNDARY: a gate/node-patch result is exposed to the CALLER as
-// identifiers, enums, counts and a `result`/`evidence`/`patches` passthrough
-// the coordinator itself supplied on the request (release/patch echo back only
-// what they were given) — never anything the daemon derives from chat content.
-// `MeshGraphGateRow` / `MeshGraphView` are large, evolving daemon-core shapes;
-// rather than duplicate their structure here (the same risk `active_work_query`'s
-// `activeWork` avoided), the gate/graph payload is a JSON passthrough
-// (`Record<string, unknown>`), exactly like `ActiveWorkQueryResponse.activeWork`.
-
-export interface GraphGateClaimRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    gateId: string
-    coordinatorSessionId: string
-    leaseSeconds?: number
-    extendDeadlineSeconds?: number
-    /** Also collect `collectGateConvergenceEvidence` on a successful claim (mesh_graph_gate action=claim's own behavior). */
-    probeConvergenceEvidence?: boolean
-}
-
-export interface GraphGateClaimResponse {
-    claimed: boolean
-    /** gate_not_found / gate_not_eligible / gate_not_awaiting / gate_lease_held / gate_claim_race / gate_terminal:<state> / gate_not_claimable, when `claimed: false`. */
-    reason?: string
-    /** `MeshGraphGateRow`, JSON passthrough; present whenever the core found the gate. */
-    gate?: Record<string, unknown>
-    leaseGeneration?: number
-    fencingToken?: string
-    leaseExpiresAt?: string
-    deadlineAt?: string
-    ambiguousExternalOutcome?: boolean
-    previousLeaseOwnerSessionId?: string
-    /** `GateConvergenceEvidence`, JSON passthrough; present only when requested and found. */
-    convergenceEvidence?: Record<string, unknown>
-}
-
-export function isGraphGateClaimRequest(value: unknown): value is GraphGateClaimRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'gateId', 'coordinatorSessionId', 'leaseSeconds', 'extendDeadlineSeconds', 'probeConvergenceEvidence'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION || !isEvidenceIdentifier(value.meshId) || !isEvidenceIdentifier(value.gateId) || !isEvidenceIdentifier(value.coordinatorSessionId)) return false
-    if (value.leaseSeconds !== undefined && !isFiniteNumber(value.leaseSeconds)) return false
-    if (value.extendDeadlineSeconds !== undefined && !isFiniteNumber(value.extendDeadlineSeconds)) return false
-    return isOptionalBoolean(value.probeConvergenceEvidence)
-}
-
-export function decodeGraphGateClaimRequest(value: unknown): GraphGateClaimRequest | null {
-    return isGraphGateClaimRequest(value) ? value : null
-}
-
-export function isGraphGateClaimResponse(value: unknown): value is GraphGateClaimResponse {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['claimed', 'reason', 'gate', 'leaseGeneration', 'fencingToken', 'leaseExpiresAt', 'deadlineAt', 'ambiguousExternalOutcome', 'previousLeaseOwnerSessionId', 'convergenceEvidence'])) return false
-    if (typeof value.claimed !== 'boolean') return false
-    return isOptionalRecord(value.gate) && isOptionalRecord(value.convergenceEvidence) && isOptionalBoolean(value.ambiguousExternalOutcome)
-}
-
-export function decodeGraphGateClaimResponse(value: unknown): GraphGateClaimResponse | null {
-    return isGraphGateClaimResponse(value) ? value : null
-}
-
-export interface GraphGateReleaseRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    gateId: string
-    fencingToken: string
-    leaseGeneration: number
-    idempotencyKey: string
-    outcome: string
-    /** Action-specific structured result/evidence the CALLER supplied — JSON passthrough, echoed back unmodified. */
-    result?: unknown
-    evidence?: unknown
-    patches?: readonly { node: string, baseSpecPatch: Record<string, unknown> }[]
-}
-
-// `releaseMeshGraphGate` THROWS for every rejection (its whole transaction must
-// roll back — mesh-graph-gates.ts file header). The daemon handler catches
-// that and reports it as a RESULT, not an IPC-level failure (the same
-// success:true-carries-a-refusal shape `queue_enqueue_graph` already uses) —
-// `mesh_graph_gate` action=release's tool layer classifies `refusalCode` by prefix
-// exactly as it did the in-process thrown message.
-export type GraphGateReleaseResponse =
-    | {
-        released: true
-        duplicate: boolean
-        gate?: Record<string, unknown>
-        materializedNodeIds: readonly string[]
-        downstreamNodeCount?: number
-        graphCompleted?: boolean
-    }
-    | { released: false, refusalCode?: string, message: string }
-
-export function isGraphGateReleaseRequest(value: unknown): value is GraphGateReleaseRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'gateId', 'fencingToken', 'leaseGeneration', 'idempotencyKey', 'outcome', 'result', 'evidence', 'patches'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION || !isEvidenceIdentifier(value.meshId) || !isEvidenceIdentifier(value.gateId)) return false
-    if (typeof value.fencingToken !== 'string' || !value.fencingToken) return false
-    if (!isFiniteNumber(value.leaseGeneration)) return false
-    if (typeof value.idempotencyKey !== 'string' || !value.idempotencyKey) return false
-    if (typeof value.outcome !== 'string' || !value.outcome) return false
-    if (value.patches !== undefined) {
-        if (!Array.isArray(value.patches)) return false
-        for (const p of value.patches) {
-            if (!isRecord(p) || typeof p.node !== 'string' || !p.node || !isRecord(p.baseSpecPatch)) return false
-        }
-    }
-    return true
-}
-
-export function decodeGraphGateReleaseRequest(value: unknown): GraphGateReleaseRequest | null {
-    return isGraphGateReleaseRequest(value) ? value : null
-}
-
-export function isGraphGateReleaseResponse(value: unknown): value is GraphGateReleaseResponse {
-    if (!isRecord(value)) return false
-    if (value.released === true) {
-        if (!hasOnlyKeys(value, ['released', 'duplicate', 'gate', 'materializedNodeIds', 'downstreamNodeCount', 'graphCompleted'])) return false
-        if (typeof value.duplicate !== 'boolean') return false
-        if (!Array.isArray(value.materializedNodeIds) || !value.materializedNodeIds.every((n) => typeof n === 'string')) return false
-        if (value.downstreamNodeCount !== undefined && !isNonNegativeInt(value.downstreamNodeCount)) return false
-        return isOptionalRecord(value.gate) && isOptionalBoolean(value.graphCompleted)
-    }
-    if (value.released === false) {
-        return hasOnlyKeys(value, ['released', 'refusalCode', 'message']) && typeof value.message === 'string' && isOptionalString(value.refusalCode)
-    }
-    return false
-}
-
-export function decodeGraphGateReleaseResponse(value: unknown): GraphGateReleaseResponse | null {
-    return isGraphGateReleaseResponse(value) ? value : null
-}
-
-export interface GraphGateAbandonRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    gateId: string
-    reason: string
-    coordinatorSessionId?: string
-    force?: boolean
-}
-
-export interface GraphGateAbandonResponse {
-    abandoned: boolean
-    /** gate_not_found / gate_lease_held / gate_abandon_race / gate_terminal:<state> / gate_not_abandonable, when `abandoned: false`. */
-    reason?: string
-    gate?: Record<string, unknown>
-    cancelledNodeIds: readonly string[]
-    cancelledTaskIds: readonly string[]
-    graphStatus?: string
-}
-
-export function isGraphGateAbandonRequest(value: unknown): value is GraphGateAbandonRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'gateId', 'reason', 'coordinatorSessionId', 'force'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION || !isEvidenceIdentifier(value.meshId) || !isEvidenceIdentifier(value.gateId)) return false
-    if (typeof value.reason !== 'string' || !value.reason) return false
-    if (value.coordinatorSessionId !== undefined && !isEvidenceIdentifier(value.coordinatorSessionId)) return false
-    return isOptionalBoolean(value.force)
-}
-
-export function decodeGraphGateAbandonRequest(value: unknown): GraphGateAbandonRequest | null {
-    return isGraphGateAbandonRequest(value) ? value : null
-}
-
-export function isGraphGateAbandonResponse(value: unknown): value is GraphGateAbandonResponse {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['abandoned', 'reason', 'gate', 'cancelledNodeIds', 'cancelledTaskIds', 'graphStatus'])) return false
-    if (typeof value.abandoned !== 'boolean') return false
-    if (!Array.isArray(value.cancelledNodeIds) || !value.cancelledNodeIds.every((n) => typeof n === 'string')) return false
-    if (!Array.isArray(value.cancelledTaskIds) || !value.cancelledTaskIds.every((n) => typeof n === 'string')) return false
-    return isOptionalRecord(value.gate)
-}
-
-export function decodeGraphGateAbandonResponse(value: unknown): GraphGateAbandonResponse | null {
-    return isGraphGateAbandonResponse(value) ? value : null
-}
-
-export interface GraphNodePatchRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    node: string
-    graphId?: string
-    /** Only {@link MESH_NODE_PATCH_KEYS}-shaped keys are permitted; the daemon enforces the allow-list. */
-    baseSpecPatch: Record<string, unknown>
-}
-
-// `patchGraphNodeAndRetry` THROWS for every rejection (mesh-graph-transition-runner.ts) —
-// same released:false treatment as `GraphGateReleaseResponse` above.
-export type GraphNodePatchResponse =
-    | {
-        patched: true
-        graphId: string
-        nodeId: string
-        ref?: string
-        queueTaskId?: string
-        materializationVersion: number
-        state: string
-        /** `SettleOutcome['kind']` — materialized / deferred / skipped / error. */
-        outcomeKind: string
-        /** Present when `outcomeKind === 'skipped'`. */
-        skippedReason?: string
-        blockedReason?: string
-    }
-    | { patched: false, refusalCode?: string, message: string }
-
-export function isGraphNodePatchRequest(value: unknown): value is GraphNodePatchRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'node', 'graphId', 'baseSpecPatch'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION || !isEvidenceIdentifier(value.meshId)) return false
-    if (typeof value.node !== 'string' || !value.node) return false
-    if (value.graphId !== undefined && !isEvidenceIdentifier(value.graphId)) return false
-    return isRecord(value.baseSpecPatch) && Object.keys(value.baseSpecPatch).length > 0
-}
-
-export function decodeGraphNodePatchRequest(value: unknown): GraphNodePatchRequest | null {
-    return isGraphNodePatchRequest(value) ? value : null
-}
-
-export function isGraphNodePatchResponse(value: unknown): value is GraphNodePatchResponse {
-    if (!isRecord(value)) return false
-    if (value.patched === true) {
-        if (!hasOnlyKeys(value, ['patched', 'graphId', 'nodeId', 'ref', 'queueTaskId', 'materializationVersion', 'state', 'outcomeKind', 'skippedReason', 'blockedReason'])) return false
-        if (!isEvidenceIdentifier(value.graphId) || !isEvidenceIdentifier(value.nodeId)) return false
-        if (!isNonNegativeInt(value.materializationVersion)) return false
-        return typeof value.state === 'string' && typeof value.outcomeKind === 'string'
-    }
-    if (value.patched === false) {
-        return hasOnlyKeys(value, ['patched', 'refusalCode', 'message']) && typeof value.message === 'string' && isOptionalString(value.refusalCode)
-    }
-    return false
-}
-
-export function decodeGraphNodePatchResponse(value: unknown): GraphNodePatchResponse | null {
-    return isGraphNodePatchResponse(value) ? value : null
-}
-
-export interface GraphViewQueryRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    graphId?: string
-    batchId?: string
-    /** Default true: only graphs that still need attention. */
-    activeOnly?: boolean
-    limit?: number
-    /** Attach `collectGateConvergenceEvidence` to the first few waiting gates (mesh_graph_view's G4 opt-in probe). */
-    probeGateEvidence?: boolean
-}
-
-export interface GraphViewQueryResponse {
-    /** `MeshGraphView[]`, JSON passthrough — see this section's content-boundary note. */
-    graphs: readonly Record<string, unknown>[]
-}
-
-export function isGraphViewQueryRequest(value: unknown): value is GraphViewQueryRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'graphId', 'batchId', 'activeOnly', 'limit', 'probeGateEvidence'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION || !isEvidenceIdentifier(value.meshId)) return false
-    if (value.graphId !== undefined && !isEvidenceIdentifier(value.graphId)) return false
-    if (value.batchId !== undefined && !isEvidenceIdentifier(value.batchId)) return false
-    if (value.limit !== undefined && !isNonNegativeInt(value.limit)) return false
-    return isOptionalBoolean(value.activeOnly) && isOptionalBoolean(value.probeGateEvidence)
-}
-
-export function decodeGraphViewQueryRequest(value: unknown): GraphViewQueryRequest | null {
-    return isGraphViewQueryRequest(value) ? value : null
-}
-
-export function isGraphViewQueryResponse(value: unknown): value is GraphViewQueryResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['graphs']) && isRecordArray(value.graphs)
-}
-
-export function decodeGraphViewQueryResponse(value: unknown): GraphViewQueryResponse | null {
-    return isGraphViewQueryResponse(value) ? value : null
-}
-
-// ─── task_stats_query ───────────────────────────────────────────────────────
-//
-// C-W9c: replaces the in-process `computeMeshTaskStats` / `computeMeshMissionStats`
-// (daemon-core `mesh-task-stats.ts`) — both scan the daemon's queue + local
-// records, so both move behind one command. Exactly one of `taskIds` /
-// `missionId` selects the per-task mode; `missionId` alone with `rollup: true`
-// additionally returns the mission-level aggregate.
-
-export interface TaskStatsQueryRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    taskIds?: readonly string[]
-    missionId?: string
-    tail?: number
-    /** Also compute `computeMeshMissionStats` — requires `missionId`. */
-    rollup?: boolean
-    /**
-     * Batch rollups: `computeMeshMissionStats` for every id, over ONE queue read and
-     * ONE record read (answers `missions`, `tasks` empty). Exclusive with
-     * `taskIds`/`missionId`. An older daemon rejects the key.
-     */
-    missionIds?: readonly string[]
-}
-
-export interface TaskStatsQueryResponse {
-    /** `MeshTaskStats[]`, JSON passthrough. */
-    tasks: readonly Record<string, unknown>[]
-    /** `MeshMissionStats`, JSON passthrough; present only when `rollup: true` was requested and satisfiable. */
-    mission?: Record<string, unknown>
-    /** Batch mode: `MeshMissionStats` per requested mission id, JSON passthrough. */
-    missions?: Record<string, Record<string, unknown>>
-}
-
-export function isTaskStatsQueryRequest(value: unknown): value is TaskStatsQueryRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'taskIds', 'missionId', 'tail', 'rollup', 'missionIds'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION || !isEvidenceIdentifier(value.meshId)) return false
-    if (value.taskIds !== undefined) {
-        if (!Array.isArray(value.taskIds) || value.taskIds.length === 0 || !value.taskIds.every(isEvidenceIdentifier)) return false
-    }
-    if (value.missionId !== undefined && !isEvidenceIdentifier(value.missionId)) return false
-    if (value.tail !== undefined && !isNonNegativeInt(value.tail)) return false
-    if (value.missionIds !== undefined) {
-        if (!Array.isArray(value.missionIds) || value.missionIds.length === 0 || !value.missionIds.every(isEvidenceIdentifier)) return false
-        if (value.taskIds !== undefined || value.missionId !== undefined) return false
-    }
-    if (value.rollup === true && value.missionId === undefined) return false
-    return isOptionalBoolean(value.rollup)
-}
-
-export function decodeTaskStatsQueryRequest(value: unknown): TaskStatsQueryRequest | null {
-    return isTaskStatsQueryRequest(value) ? value : null
-}
-
-export function isTaskStatsQueryResponse(value: unknown): value is TaskStatsQueryResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['tasks', 'mission', 'missions']) && isRecordArray(value.tasks) && isOptionalRecord(value.mission)
-        && (value.missions === undefined || (isRecord(value.missions) && Object.values(value.missions).every(isRecord)))
-}
-
-export function decodeTaskStatsQueryResponse(value: unknown): TaskStatsQueryResponse | null {
-    return isTaskStatsQueryResponse(value) ? value : null
-}
-
-// ─── prune_stale_direct ─────────────────────────────────────────────────────
-//
-// C-W9c: replaces the in-process `pruneStaleDirectDispatches` call
-// (`mesh_cleanup_sessions` mode=prune_stale_direct, `mesh-tools-session.ts`). Unlike the other
-// C-W9 commands this one does NOT take its inputs (queue/records/direct
-// dispatches) on the wire — the daemon already reads them itself
-// (`getQueue`/`readLocalRecords`/`getActiveDirectDispatches`), so the request
-// carries only the decision knobs. `closeDispatches` (the C-W8 `turn_cancel`
-// callback) also runs daemon-side now, since it is the same process.
-
-export interface PruneStaleDirectRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    execute?: boolean
-    includeTerminal?: boolean
-    source?: string
-}
-
-export interface PruneStaleDirectResponse {
-    mode: 'execute' | 'dry_run'
-    includeTerminal: boolean
-    candidateCount: number
-    /** `MeshActiveWorkRecord[]`, JSON passthrough. */
-    prunable: readonly Record<string, unknown>[]
-    prunedCount: number
-    preservedUnacknowledged: readonly Record<string, unknown>[]
-    preservedLedgerOnly: readonly Record<string, unknown>[]
-    preservedNotOrphan: readonly Record<string, unknown>[]
-}
-
-export function isPruneStaleDirectRequest(value: unknown): value is PruneStaleDirectRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'execute', 'includeTerminal', 'source'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION || !isEvidenceIdentifier(value.meshId)) return false
-    if (value.source !== undefined && typeof value.source !== 'string') return false
-    return isOptionalBoolean(value.execute) && isOptionalBoolean(value.includeTerminal)
-}
-
-export function decodePruneStaleDirectRequest(value: unknown): PruneStaleDirectRequest | null {
-    return isPruneStaleDirectRequest(value) ? value : null
-}
-
-export function isPruneStaleDirectResponse(value: unknown): value is PruneStaleDirectResponse {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['mode', 'includeTerminal', 'candidateCount', 'prunable', 'prunedCount', 'preservedUnacknowledged', 'preservedLedgerOnly', 'preservedNotOrphan'])) return false
-    if (value.mode !== 'execute' && value.mode !== 'dry_run') return false
-    if (typeof value.includeTerminal !== 'boolean') return false
-    if (!isNonNegativeInt(value.candidateCount) || !isNonNegativeInt(value.prunedCount)) return false
-    return isRecordArray(value.prunable) && isRecordArray(value.preservedUnacknowledged)
-        && isRecordArray(value.preservedLedgerOnly) && isRecordArray(value.preservedNotOrphan)
-}
-
-export function decodePruneStaleDirectResponse(value: unknown): PruneStaleDirectResponse | null {
-    return isPruneStaleDirectResponse(value) ? value : null
-}
-
-// ─── orphaned_pin_notify ────────────────────────────────────────────────────
-//
-// C-W9c: replaces the in-process `notifyCoordinatorOfOrphanedPins` call
-// (`mesh_queue_cancel` tool, `mesh-tools-queue.ts`, CANCEL-ORPHANS-PINNED-TASK).
-// The core reads the daemon's live queue (`getQueue`) and, when it finds
-// orphans, calls `notifyMeshCoordinator` to page the coordinator — both are
-// daemon-only concerns, so the whole call moves, not just its queue read.
-// `title` is a task-message-derived label (first line, truncated) — free text,
-// hence local IPC only, same rationale as `record_local`'s payload.
-
-export interface OrphanedPinNotifyRequest {
-    v: typeof TURN_IPC_PROTOCOL_VERSION
-    meshId: string
-    stoppedSessionId: string
-    excludeTaskId?: string
-    cause?: string
-    nodeId?: string
-    coordinatorSessionId?: string
-}
+ *
+ * LAYOUT
+ * -------
+ * This module holds the error codes and the command registry; the per-command
+ * contracts live in ./turn-ipc-{turn,mission,queue,graph}.ts (re-exported here)
+ * over the shared guard primitives in ./turn-ipc-guards.ts.
+ */
 
-export interface OrphanedPinnedTaskWire {
-    taskId: string
-    title: string
-    targetSessionId: string
-    targetNodeId?: string
-    missionId?: string
-}
+import { isRecord } from './protocol/envelope'
+import { hasOnlyKeys, makeGuard } from './turn-ipc-guards';
 
-export interface OrphanedPinNotifyResponse {
-    orphans: readonly OrphanedPinnedTaskWire[]
-}
+export { TURN_IPC_PROTOCOL_VERSION } from './turn-ipc-guards';
+export * from './turn-ipc-turn';
+export * from './turn-ipc-mission';
+export * from './turn-ipc-queue';
+export * from './turn-ipc-graph';
 
-function isOrphanedPinnedTaskWire(value: unknown): value is OrphanedPinnedTaskWire {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['taskId', 'title', 'targetSessionId', 'targetNodeId', 'missionId'])) return false
-    if (!isEvidenceIdentifier(value.taskId) || !isEvidenceIdentifier(value.targetSessionId)) return false
-    if (typeof value.title !== 'string') return false
-    if (value.targetNodeId !== undefined && !isEvidenceIdentifier(value.targetNodeId)) return false
-    return value.missionId === undefined || isEvidenceIdentifier(value.missionId)
-}
+// ─── error codes ────────────────────────────────────────────────────────────
 
-export function isOrphanedPinNotifyRequest(value: unknown): value is OrphanedPinNotifyRequest {
-    if (!isRecord(value) || !hasOnlyKeys(value, ['v', 'meshId', 'stoppedSessionId', 'excludeTaskId', 'cause', 'nodeId', 'coordinatorSessionId'])) return false
-    if (value.v !== TURN_IPC_PROTOCOL_VERSION || !isEvidenceIdentifier(value.meshId) || !isEvidenceIdentifier(value.stoppedSessionId)) return false
-    if (value.excludeTaskId !== undefined && !isEvidenceIdentifier(value.excludeTaskId)) return false
-    if (value.cause !== undefined && typeof value.cause !== 'string') return false
-    if (value.nodeId !== undefined && !isEvidenceIdentifier(value.nodeId)) return false
-    return value.coordinatorSessionId === undefined || isEvidenceIdentifier(value.coordinatorSessionId)
-}
+/**
+ * Closed error-code union every command response may carry instead of (or in
+ * addition to, for the client-side wrapper) a result.
+ *
+ *   daemon_required      — no daemon reachable (no IPC/local transport
+ *                           connection could be established). Distinct from
+ *                           every other failure: it means "there is nobody to
+ *                           ask", not "the ask failed."
+ *   turn_ledger_unavailable — a daemon answered but its turn ledger is not
+ *                           armed yet (mid-boot, mid-migration).
+ *   ledger_not_owner     — the daemon that answered does not own the
+ *                           attempt/mesh addressed by the request (routing
+ *                           mistake, or the owner changed after a reclaim).
+ */
+export const TURN_IPC_ERROR_CODES = ['daemon_required', 'turn_ledger_unavailable', 'ledger_not_owner'] as const
+export type TurnIpcErrorCode = typeof TURN_IPC_ERROR_CODES[number]
 
-export function decodeOrphanedPinNotifyRequest(value: unknown): OrphanedPinNotifyRequest | null {
-    return isOrphanedPinNotifyRequest(value) ? value : null
-}
+export const isTurnIpcErrorCode = makeGuard(TURN_IPC_ERROR_CODES)
 
-export function isOrphanedPinNotifyResponse(value: unknown): value is OrphanedPinNotifyResponse {
-    return isRecord(value) && hasOnlyKeys(value, ['orphans']) && Array.isArray(value.orphans) && value.orphans.every(isOrphanedPinnedTaskWire)
+/** Structured failure shape a responder returns instead of a result. Never thrown across the wire — the client maps it to a typed error (see mcp-server/src/ipc/turn-commands.ts). */
+export interface TurnIpcError {
+    code: TurnIpcErrorCode
+    /** Short machine-oriented detail, e.g. which daemon was expected. Never free text describing content. */
+    detail?: string
 }
 
-export function decodeOrphanedPinNotifyResponse(value: unknown): OrphanedPinNotifyResponse | null {
-    return isOrphanedPinNotifyResponse(value) ? value : null
+export function isTurnIpcError(value: unknown): value is TurnIpcError {
+    return isRecord(value) && hasOnlyKeys(value, ['code', 'detail']) && isTurnIpcErrorCode(value.code)
+        && (value.detail === undefined || typeof value.detail === 'string')
 }
 
 // ─── command registry ───────────────────────────────────────────────────────
@@ -2257,74 +141,3 @@ export const TURN_IPC_COMMANDS = [
 ] as const
 export type TurnIpcCommand = typeof TURN_IPC_COMMANDS[number]
 export const isTurnIpcCommand = makeGuard(TURN_IPC_COMMANDS)
-
-/** Request type keyed by command name — for a generically-typed dispatcher on either end. */
-export interface TurnIpcRequestByCommand {
-    turn_observe: TurnObserveRequest
-    mesh_record: MeshRecordRequest
-    turn_cancel: TurnCancelRequest
-    operator_status: OperatorStatusRequest
-    turn_query: TurnQueryRequest
-    mesh_index_query: MeshIndexQueryRequest
-    mission_upsert: MissionUpsertRequest
-    mission_query: MissionQueryRequest
-    note_upsert: NoteUpsertRequest
-    note_forget: NoteForgetRequest
-    tool_call_record: ToolCallRecordRequest
-    ledger_query: LedgerQueryRequest
-    mission_list_query: MissionListQueryRequest
-    record_local: RecordLocalRequest
-    queue_query: QueueQueryRequest
-    queue_enqueue: QueueEnqueueRequest
-    queue_enqueue_graph: QueueEnqueueGraphRequest
-    queue_cancel: QueueCancelRequest
-    queue_requeue: QueueRequeueRequest
-    direct_dispatch_record: DirectDispatchRecordRequest
-    graph_audit_record: GraphAuditRecordRequest
-    active_work_query: ActiveWorkQueryRequest
-    recovery_context_query: RecoveryContextQueryRequest
-    graph_gate_claim: GraphGateClaimRequest
-    graph_gate_release: GraphGateReleaseRequest
-    graph_gate_abandon: GraphGateAbandonRequest
-    graph_node_patch: GraphNodePatchRequest
-    graph_view_query: GraphViewQueryRequest
-    task_stats_query: TaskStatsQueryRequest
-    prune_stale_direct: PruneStaleDirectRequest
-    orphaned_pin_notify: OrphanedPinNotifyRequest
-}
-
-/** Response type keyed by command name — for a generically-typed dispatcher on either end. */
-export interface TurnIpcResponseByCommand {
-    turn_observe: TurnObserveResponse
-    mesh_record: MeshRecordResponse
-    turn_cancel: TurnCancelResponse
-    operator_status: OperatorStatusResponse
-    turn_query: TurnQueryResponse
-    mission_upsert: MissionUpsertResponse
-    mission_query: MissionQueryResponse
-    mesh_index_query: MeshIndexQueryResponse
-    note_upsert: NoteUpsertResponse
-    note_forget: NoteForgetResponse
-    tool_call_record: ToolCallRecordResponse
-    ledger_query: LedgerQueryResponse
-    mission_list_query: MissionListQueryResponse
-    record_local: RecordLocalResponse
-    queue_query: QueueQueryResponse
-    queue_enqueue: QueueEnqueueResponse
-    queue_enqueue_graph: QueueEnqueueGraphResponse
-    queue_cancel: QueueCancelResponse
-    queue_requeue: QueueRequeueResponse
-    direct_dispatch_record: DirectDispatchRecordResponse
-    graph_audit_record: GraphAuditRecordResponse
-    active_work_query: ActiveWorkQueryResponse
-    recovery_context_query: RecoveryContextQueryResponse
-    graph_gate_claim: GraphGateClaimResponse
-    graph_gate_release: GraphGateReleaseResponse
-    graph_gate_abandon: GraphGateAbandonResponse
-    graph_node_patch: GraphNodePatchResponse
-    graph_view_query: GraphViewQueryResponse
-    task_stats_query: TaskStatsQueryResponse
-    prune_stale_direct: PruneStaleDirectResponse
-    orphaned_pin_notify: OrphanedPinNotifyResponse
-}
-