@adhdev/mesh-shared 1.0.60-rc.9 → 1.0.60

package/src/protocol/envelope.ts

@@ -0,0 +1,75 @@
+/**
+ * protocol/envelope — helpers shared by the three link protocols.
+ *
+ * Wiring-unification Phase A2 (docs/design/2026-09-23-wiring-unification.md).
+ *
+ * Every link (daemon↔server WS, dashboard↔UserSession WS, dashboard↔daemon
+ * P2P DataChannel) is described the same way:
+ *
+ *   - a `const` tuple of message-kind names per direction;
+ *   - a discriminated union of `{ type, ... }` frames derived from it;
+ *   - a `decode<Link><Direction>(raw)` parse-boundary function that checks the
+ *     `type` is a member and the frame carries the MINIMAL shape the union
+ *     promises (an object payload where one is required, the top-level fields
+ *     a payload-less frame is keyed by). Semantic validation — is this session
+ *     id known, is the SDP well formed — stays with the handler that owns it.
+ *
+ * mesh-shared is a dependency-free leaf, so payload types here are STRUCTURAL
+ * mirrors of the richer daemon-core types (`RoutingSessionEntry`,
+ * `DaemonStatusEventPayload`, ...): daemon-core, the server and the web assign
+ * their richer types into these, never the other way round. A type-only import
+ * of daemon-core would make the published `.d.ts` of this package reference a
+ * package that depends on it — a cycle a leaf must not create.
+ */
+
+export type MessageId = string
+
+/** `{ type, payload }` frame with the optional correlation/ordering fields every link uses. */
+export type Envelope<T extends string, P> = {
+    type: T
+    payload: P
+    id?: MessageId
+    timestamp?: number
+}
+
+/** Genuinely dynamic payloads (command arguments and results). Allowed by design; the union stays exhaustive on `type`. */
+export type CommandPayload = Record<string, unknown>
+
+export function isRecord(value: unknown): value is Record<string, unknown> {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+export function isNonEmptyString(value: unknown): value is string {
+    return typeof value === 'string' && value.length > 0
+}
+
+export function isFiniteNumber(value: unknown): value is number {
+    return typeof value === 'number' && Number.isFinite(value)
+}
+
+export function makeTypeGuard<T extends readonly string[]>(names: T): (value: unknown) => value is T[number] {
+    const set: ReadonlySet<string> = new Set(names)
+    return (value: unknown): value is T[number] => typeof value === 'string' && set.has(value)
+}
+
+/**
+ * Compile-time proof that a name tuple and a union have exactly the same
+ * members. Used as `const _: AssertSameMembers<typeof NAMES, Union> = true`.
+ */
+export type AssertSameMembers<Tuple extends readonly string[], Union extends string> =
+    [Exclude<Union, Tuple[number]>, Exclude<Tuple[number], Union>] extends [never, never] ? true : never
+
+/** Narrow a frame's `type` to a union member, or null. */
+export function decodeTypeField<T extends string>(raw: unknown, isType: (value: unknown) => value is T): { type: T; frame: Record<string, unknown> } | null {
+    if (!isRecord(raw)) return null
+    if (!isType(raw.type)) return null
+    return { type: raw.type, frame: raw }
+}
+
+/** Read the optional envelope fields a frame may carry, dropping malformed ones. */
+export function readEnvelopeFields(frame: Record<string, unknown>): { id?: MessageId; timestamp?: number } {
+    return {
+        ...(isNonEmptyString(frame.id) ? { id: frame.id } : {}),
+        ...(isFiniteNumber(frame.timestamp) ? { timestamp: frame.timestamp } : {}),
+    }
+}

package/src/protocol/index.ts

@@ -0,0 +1,17 @@
+/**
+ * protocol — typed wire contracts for the three transport links.
+ *
+ *   ./daemon-server.ts        daemon ↔ Workers server WS
+ *   ./dashboard-server.ts     dashboard ↔ UserSessionDO WS (+ share viewer ↔ SharedSessionDO)
+ *   ./dashboard-daemon-p2p.ts dashboard ↔ daemon DataChannel
+ *
+ * Each exports name tuples, discriminated unions, type guards and a
+ * `decode<Link><Direction>(raw)` parse-boundary function. ../ws-protocol.ts
+ * keeps the pre-existing name-only aliases derived from these.
+ */
+
+export * from './envelope'
+export * from './daemon-server'
+export * from './dashboard-server'
+export * from './dashboard-daemon-p2p'
+export * from './dashboard-wire-version'

package/src/session-launch.ts

@@ -0,0 +1,245 @@
+/**
+ * session-launch — how a session was launched: provider, model and thinking
+ * level, and WHERE each value came from.
+ *
+ * Wiring-unification Phase E (docs/design/2026-09-23-wiring-unification.md §7,
+ * RC5). Before this record the only trace of a session's model was a display
+ * string in recent-activity (`buildLegacyModelModeSummaryMetadata`), so nobody
+ * could answer "did I pick this model, did the dashboard restore it from last
+ * time, did a mesh slot choose it, or is it just the provider default?" — and
+ * after a daemon restart not even the value survived.
+ *
+ * The daemon owns the record (daemon-core `SessionRegistry`); this file holds the
+ * shape and the pure readers so daemon-core, web-core, the server and the MCP
+ * server all read one definition. It is a dependency-free leaf, like the rest of
+ * mesh-shared.
+ *
+ * ★Server content boundary (CLAUDE.md): the full record rides P2P only. The
+ * server path carries exactly two derived fields — `model` (an identifier,
+ * passed through {@link sanitizeModelIdentifier}) and `modelSource` (an enum,
+ * passed through {@link isModelAxisSource}). Never widen that to the record.
+ */
+
+/**
+ * Where a model / thinking-level value came from.
+ *
+ * `restore` is deliberately NOT a member: a hosted session re-attached after a
+ * daemon restart keeps the ORIGINAL source (the user still picked that model);
+ * only `SessionLaunchRecord.launchedBy` records that the session came back via
+ * restore.
+ */
+import { readString } from './json'
+
+export const MODEL_AXIS_SOURCES = [
+    /** Picked explicitly for this launch (dashboard dropdown, coordinator dialog). */
+    'user',
+    /** The dashboard dialog restored it from the last launch (browser-local memory). */
+    'remembered',
+    /** A mesh capability slot supplied it (or a difficulty preset the slot outranked). */
+    'mesh_slot',
+    /** An explicit per-task model / thinking level on a mesh queue task. */
+    'task_override',
+    /** Nothing was requested; the provider's default is known (discovery / manifest). */
+    'provider_default',
+    /** A value was requested without saying where it came from, or nothing is known. */
+    'unspecified',
+] as const
+
+export type ModelAxisSource = typeof MODEL_AXIS_SOURCES[number]
+
+export function isModelAxisSource(value: unknown): value is ModelAxisSource {
+    return typeof value === 'string' && (MODEL_AXIS_SOURCES as readonly string[]).includes(value)
+}
+
+/**
+ * Which surface started the session. `restore` means "re-attached to a hosted
+ * runtime that outlived a daemon restart" — the axis sources are preserved.
+ */
+export const SESSION_LAUNCHED_BY = ['dashboard', 'mesh', 'cli', 'api', 'restore'] as const
+
+export type SessionLaunchedBy = typeof SESSION_LAUNCHED_BY[number]
+
+export function isSessionLaunchedBy(value: unknown): value is SessionLaunchedBy {
+    return typeof value === 'string' && (SESSION_LAUNCHED_BY as readonly string[]).includes(value)
+}
+
+/** How a value entered the axis history. */
+export type ModelSelectionVia = 'launch' | 'change_model' | 'observed'
+
+export interface ModelSelectionHistoryEntry {
+    at: number
+    value: string
+    via: ModelSelectionVia
+}
+
+/** One axis (model, or thinking level) of a session launch. */
+export interface ModelSelection {
+    /** What the caller asked for. Absent = nothing requested. */
+    requested?: string
+    source: ModelAxisSource
+    /**
+     * The value actually handed to the provider: after `modelLaunchValueMap`
+     * (CLI `--model` template) or the ACP `setConfigOption` call. Absent when the
+     * request was not applied (no template, the config call failed) or nothing
+     * was requested.
+     */
+    launchValue?: string
+    /**
+     * The provider default this session is expected to run with when nothing was
+     * requested (`source === 'provider_default'` only): discovery `models[0]`,
+     * else the manifest's first option. Nothing was passed to the provider.
+     */
+    resolvedDefault?: string
+    /** Last explicit runtime change (`change_model` / `set_thought_level`). */
+    current?: string
+    /** Last value the provider itself reported (statusline, native history). */
+    observed?: string
+    observedAt?: number
+    /** Every value change in order. The last entry is the value in force. */
+    history: ModelSelectionHistoryEntry[]
+}
+
+export interface SessionLaunchRecord {
+    sessionId: string
+    providerType: string
+    providerVersion?: string
+    providerChannel?: 'stable' | 'preview'
+    /** `restore` = re-attached after a daemon restart; the axis sources stay the original ones. */
+    launchedBy: SessionLaunchedBy
+    launchedAt: number
+    workspace?: string
+    model: ModelSelection
+    thinkingLevel: ModelSelection
+    autoApproveModeId?: string
+    /**
+     * Reserved by the design (§7 E1) for sanitized launch argv. Not populated:
+     * argv carries coordinator system-prompt text and config paths, and the
+     * session-host record already keeps the raw argv for restore.
+     */
+    cliArgs?: string[]
+}
+
+/** History is bounded; the first `launch` entry is always kept. */
+export const MODEL_SELECTION_HISTORY_LIMIT = 20
+
+/** The value in force now: the latest change, else the launch-time value. */
+export function effectiveModelSelectionValue(selection: ModelSelection | null | undefined): string | undefined {
+    if (!selection) return undefined
+    const last = Array.isArray(selection.history) ? selection.history[selection.history.length - 1] : undefined
+    return last?.value
+        ?? selection.current
+        ?? selection.observed
+        ?? launchModelSelectionValue(selection)
+}
+
+/** The value the session started with (what was passed, else asked for, else the default). */
+export function launchModelSelectionValue(selection: ModelSelection | null | undefined): string | undefined {
+    if (!selection) return undefined
+    const launch = Array.isArray(selection.history)
+        ? selection.history.find((entry) => entry.via === 'launch')
+        : undefined
+    return launch?.value ?? selection.launchValue ?? selection.requested ?? selection.resolvedDefault
+}
+
+export interface ModelSelectionDisplay {
+    /** The value in force now. */
+    value: string
+    /** The value the session launched with, when it differs from `value`. */
+    changedFrom?: string
+    source: ModelAxisSource
+}
+
+/** Pure projection for UI chips: "sonnet · chosen", "sonnet → opus (changed)". */
+export function describeModelSelection(selection: ModelSelection | null | undefined): ModelSelectionDisplay | undefined {
+    const value = effectiveModelSelectionValue(selection)
+    if (!selection || !value) return undefined
+    const launched = launchModelSelectionValue(selection)
+    return {
+        value,
+        ...(launched && launched !== value ? { changedFrom: launched } : {}),
+        source: isModelAxisSource(selection.source) ? selection.source : 'unspecified',
+    }
+}
+
+/**
+ * The only form a model / thinking value may take on the server path: an
+ * identifier (`claude-opus-4-1`, `gpt-5.6-sol`, `openai/gpt-4o`, `opus[1m]`,
+ * `high`). No whitespace, bounded length — a free-text sentence cannot pass.
+ * Human labels (`Gemini 3.7 Flash (High)`) are P2P-only and are dropped here.
+ */
+const MODEL_IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/@[\]+-]{0,95}$/
+
+export function sanitizeModelIdentifier(value: unknown): string | undefined {
+    if (typeof value !== 'string') return undefined
+    const trimmed = value.trim()
+    return MODEL_IDENTIFIER_PATTERN.test(trimmed) ? trimmed : undefined
+}
+
+function readFiniteNumber(value: unknown): number | undefined {
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined
+}
+
+function parseModelSelection(raw: unknown): ModelSelection | undefined {
+    if (!raw || typeof raw !== 'object') return undefined
+    const record = raw as Record<string, unknown>
+    const history: ModelSelectionHistoryEntry[] = []
+    if (Array.isArray(record.history)) {
+        for (const entry of record.history) {
+            if (!entry || typeof entry !== 'object') continue
+            const e = entry as Record<string, unknown>
+            const value = readString(e.value)
+            const at = readFiniteNumber(e.at)
+            const via = e.via === 'launch' || e.via === 'change_model' || e.via === 'observed' ? e.via : undefined
+            if (value && at !== undefined && via) history.push({ at, value, via })
+        }
+    }
+    const requested = readString(record.requested)
+    const launchValue = readString(record.launchValue)
+    const resolvedDefault = readString(record.resolvedDefault)
+    const current = readString(record.current)
+    const observed = readString(record.observed)
+    const observedAt = readFiniteNumber(record.observedAt)
+    return {
+        source: isModelAxisSource(record.source) ? record.source : 'unspecified',
+        ...(requested ? { requested } : {}),
+        ...(launchValue ? { launchValue } : {}),
+        ...(resolvedDefault ? { resolvedDefault } : {}),
+        ...(current ? { current } : {}),
+        ...(observed ? { observed } : {}),
+        ...(observedAt !== undefined ? { observedAt } : {}),
+        history: history.slice(-MODEL_SELECTION_HISTORY_LIMIT),
+    }
+}
+
+/**
+ * Validate a record that crossed a process or storage boundary (session-host
+ * record meta on restore, a P2P snapshot). Returns undefined for anything that
+ * is not recognisably a launch record; unknown keys are dropped.
+ */
+export function parseSessionLaunchRecord(raw: unknown): SessionLaunchRecord | undefined {
+    if (!raw || typeof raw !== 'object') return undefined
+    const record = raw as Record<string, unknown>
+    const sessionId = readString(record.sessionId)
+    const providerType = readString(record.providerType)
+    const launchedAt = readFiniteNumber(record.launchedAt)
+    const model = parseModelSelection(record.model)
+    const thinkingLevel = parseModelSelection(record.thinkingLevel)
+    if (!sessionId || !providerType || launchedAt === undefined || !model || !thinkingLevel) return undefined
+    const providerVersion = readString(record.providerVersion)
+    const workspace = readString(record.workspace)
+    const autoApproveModeId = readString(record.autoApproveModeId)
+    return {
+        sessionId,
+        providerType,
+        ...(providerVersion ? { providerVersion } : {}),
+        ...(record.providerChannel === 'stable' || record.providerChannel === 'preview'
+            ? { providerChannel: record.providerChannel }
+            : {}),
+        launchedBy: isSessionLaunchedBy(record.launchedBy) ? record.launchedBy : 'api',
+        launchedAt,
+        ...(workspace ? { workspace } : {}),
+        model,
+        thinkingLevel,
+        ...(autoApproveModeId ? { autoApproveModeId } : {}),
+    }
+}

package/src/session-status.ts

@@ -0,0 +1,164 @@
+/**
+ * session-status — the ONE session status vocabulary.
+ *
+ * Wiring-unification Phase A1 (docs/design/2026-09-23-wiring-unification.md).
+ *
+ * Before this file, the same eleven-member union was declared three times in
+ * daemon-core (`SessionStatus`, `ManagedStatus`, and a stale `AgentStatus`) and
+ * five independent "is it busy?" sets disagreed with each other — for example
+ * `waiting_approval` counted as busy in three of them and idle in the other
+ * two. Every consumer now derives from here:
+ *
+ *   - the canonical union `SessionStatus` and its member list `SESSION_STATUSES`;
+ *   - a behavioural CLASS per status (`SESSION_STATUS_CLASS`) — the only thing
+ *     send / dispatch / UI logic may branch on;
+ *   - an alias table for the raw spellings providers and status lanes still
+ *     emit (`running`, `streaming`, `no_progress`, …) so classification is total.
+ *
+ * This lives in mesh-shared (a dependency-free leaf) because web-core must not
+ * value-import the daemon-core barrel, and the server has no daemon-core at all.
+ */
+
+export const SESSION_STATUSES = [
+    'idle',
+    'generating',
+    'waiting_approval',
+    'waiting_choice',
+    'finalizing',
+    'error',
+    'stopped',
+    'starting',
+    'panel_hidden',
+    'not_monitored',
+    'disconnected',
+] as const
+
+export type SessionStatus = typeof SESSION_STATUSES[number]
+
+export const RECENT_SESSION_BUCKETS = ['needs_attention', 'working', 'task_complete', 'idle'] as const
+
+export type RecentSessionBucket = typeof RECENT_SESSION_BUCKETS[number]
+
+/**
+ * Behavioural class of a status.
+ *
+ *   working  — the agent owns the turn; input is queued, not delivered.
+ *   blocked  — the agent is waiting on a human decision (approval / choice);
+ *              alive, and the turn is not over.
+ *   ready    — the agent will accept input now.
+ *   dead     — the session will never accept input again.
+ *   unknown  — the spelling is not one we classify (callers must fail safe).
+ */
+export type SessionStatusClass = 'working' | 'blocked' | 'ready' | 'dead' | 'unknown'
+
+export const SESSION_STATUS_CLASS: Record<SessionStatus, Exclude<SessionStatusClass, 'unknown'>> = {
+    generating: 'working',
+    finalizing: 'working',
+    starting: 'working',
+    waiting_approval: 'blocked',
+    waiting_choice: 'blocked',
+    idle: 'ready',
+    panel_hidden: 'ready',
+    not_monitored: 'ready',
+    error: 'dead',
+    stopped: 'dead',
+    disconnected: 'dead',
+}
+
+/**
+ * Raw spellings that still reach status consumers from IDE/CDP providers, the
+ * chat-tail status lane and legacy adapters, mapped onto the canonical member
+ * that carries the same behavioural meaning. Keep this table exhaustive over
+ * what the five pre-unification busy sets accepted; a spelling missing here
+ * classifies as `unknown`, which every consumer must treat as "do not assume
+ * idle".
+ */
+export const SESSION_STATUS_ALIASES: Readonly<Record<string, SessionStatus>> = {
+    running: 'generating',
+    streaming: 'generating',
+    busy: 'generating',
+    working: 'generating',
+    loading: 'generating',
+    loading_reference: 'generating',
+    thinking: 'generating',
+    active: 'generating',
+    // Status-lane refinements of a turn that is still owned by the agent.
+    no_progress: 'generating',
+    long_generating: 'generating',
+    initializing: 'starting',
+    waiting: 'waiting_approval',
+}
+
+const SESSION_STATUS_SET: ReadonlySet<string> = new Set(SESSION_STATUSES)
+
+export function isSessionStatus(value: unknown): value is SessionStatus {
+    return typeof value === 'string' && SESSION_STATUS_SET.has(value)
+}
+
+/** Canonical member for a raw status spelling, or null when unrecognised. */
+export function normalizeSessionStatus(raw: unknown): SessionStatus | null {
+    if (typeof raw !== 'string') return null
+    const value = raw.trim().toLowerCase()
+    if (SESSION_STATUS_SET.has(value)) return value as SessionStatus
+    return SESSION_STATUS_ALIASES[value] ?? null
+}
+
+export function classifySessionStatus(raw: unknown): SessionStatusClass {
+    const status = normalizeSessionStatus(raw)
+    return status ? SESSION_STATUS_CLASS[status] : 'unknown'
+}
+
+export function isWorkingStatus(raw: unknown): boolean {
+    return classifySessionStatus(raw) === 'working'
+}
+
+export function isBlockedStatus(raw: unknown): boolean {
+    return classifySessionStatus(raw) === 'blocked'
+}
+
+export function isReadyStatus(raw: unknown): boolean {
+    return classifySessionStatus(raw) === 'ready'
+}
+
+export function isDeadStatus(raw: unknown): boolean {
+    return classifySessionStatus(raw) === 'dead'
+}
+
+/**
+ * "Busy" in the sense every pre-unification set meant: the agent cannot take a
+ * new instruction right now, whether because it is working or because it is
+ * blocked on a human. Dead sessions are NOT busy — they are gone, and callers
+ * that need to distinguish must check `isDeadStatus` first.
+ */
+export function isBusyStatus(raw: unknown): boolean {
+    const cls = classifySessionStatus(raw)
+    return cls === 'working' || cls === 'blocked'
+}
+
+export function statusesOfClass(cls: Exclude<SessionStatusClass, 'unknown'>): SessionStatus[] {
+    return SESSION_STATUSES.filter((status) => SESSION_STATUS_CLASS[status] === cls)
+}
+
+/**
+ * Mesh-record terminal spellings: a session RECORD in one of these is gone
+ * (the vocabulary's `dead` class covers the canonical members; records also
+ * carry `failed` / `terminated` / `exited` / `closed`).
+ */
+export const TERMINAL_SESSION_RECORD_STATUSES = ['stopped', 'failed', 'terminated', 'exited', 'closed'] as const
+
+export function isTerminalSessionRecordStatus(raw: unknown): boolean {
+    return typeof raw === 'string' && (TERMINAL_SESSION_RECORD_STATUSES as readonly string[]).includes(raw.trim().toLowerCase())
+}
+
+/**
+ * THE "idle — can take a task now" predicate over a session state/record (its
+ * top-level `status` and chat lane). Every idle-candidate check (queue drain,
+ * auto-launch orphan sweep, dispatch pick) uses this one, so they cannot
+ * disagree about which sessions are candidates.
+ */
+export function isIdleSessionState(state: unknown): boolean {
+    const record = state && typeof state === 'object' ? state as { status?: unknown; activeChat?: { status?: unknown } } : {}
+    const status = typeof record.status === 'string' ? record.status.trim().toLowerCase() : ''
+    if (isTerminalSessionRecordStatus(status) || isDeadStatus(status)) return false
+    return isReadyStatus(status) || record.activeChat?.status === 'waiting_input'
+}

package/src/slot-proposal.ts

@@ -1,9 +1,9 @@
 /**
- * CLI auto-detect → capability-slot / MAGI-panel PROPOSAL generator.
+ * CLI auto-detect → capability-slot PROPOSAL generator.
  *
  * Detection of installed CLI providers already exists per node (the status
  * snapshot's `availableProviders`), and applying a slot profile already exists
- * (`mesh_node_slots_set`, dry-run by default). What was missing is the bit in
+ * (`mesh_node_slots` action "set", dry-run by default). What was missing is the bit in
  * between: turning "these CLIs are installed on this node" into a concrete
  * `NodeCapabilitySlot[]` draft the operator can review. This module is that
  * bridge, and nothing more — it is a PURE proposal generator. It never writes;
@@ -31,7 +31,6 @@ import {
     type MeshTaskDifficulty,
     type NodeCapabilitySlot,
 } from './brain-routing'
-import type { MagiSlot } from './magi'
 
 /**
  * One provider's seeded slot recipe. A provider may map to MORE THAN ONE slot
@@ -280,48 +279,3 @@ export function buildSlotProposal(
         destructive: droppedSlots.length > 0,
     }
 }
-
-/**
- * Build a MAGI panel proposal from the same detections.
- *
- * ─── Deliberately narrow ──────────────────────────────────────────────────────
- *
- * MAGI's value is provider INDEPENDENCE: replicas from different providers
- * (ideally different machines) answering the same question, so agreement means
- * something. Detection tells us which providers exist — that is exactly enough
- * to propose one panel of distinct providers, and no more.
- *
- * What detection does NOT tell us is which provider suits which review KIND
- * (rca vs design vs claim_audit). Nothing in any manifest grades a provider for
- * root-cause analysis over design review, and inventing a per-kind assignment
- * would fabricate a rationale that does not exist. So this proposes ONE panel of
- * the detected providers and leaves the kind binding to the operator; the caller
- * decides which `task_kind` to bind it to via the existing dry-run tool.
- *
- * Ordering follows {@link CLI_SLOT_RECIPES} insertion order (recipe-known
- * providers first, in table order), so the panel leads with the providers whose
- * suitability is actually attested.
- */
-export function buildMagiPanelProposal(
-    detected: readonly DetectedCliProvider[],
-    opts: { nodeId?: string; maxSlots?: number } = {},
-): MagiSlot[] {
-    const providers = dedupeDetected(detected ?? [])
-    const tableOrder = Object.keys(CLI_SLOT_RECIPES)
-    const rank = (type: string): number => {
-        const i = tableOrder.indexOf(type)
-        return i === -1 ? Number.MAX_SAFE_INTEGER : i
-    }
-    const ordered = [...providers].sort((a, b) => rank(a.type) - rank(b.type))
-    const limit = Number.isFinite(opts.maxSlots) && (opts.maxSlots as number) > 0
-        ? Math.floor(opts.maxSlots as number)
-        : ordered.length
-
-    return ordered.slice(0, limit).map((p): MagiSlot => ({
-        ...(opts.nodeId ? { nodeId: opts.nodeId } : {}),
-        provider: p.type,
-        // A model is intentionally NOT pinned: the panel's job is cross-provider
-        // independence, and pinning models here would silently couple the panel
-        // to this table's cost assumptions rather than to review quality.
-    }))
-}