@adhdev/mesh-shared 1.0.82-rc.3 → 1.0.82-rc.30

package/dist/launch-defaults.d.ts

@@ -0,0 +1,194 @@
+/** Daemon-local launch intent and command wire contract. P2P/local only;
+ * never include this document or its history in cloud status_report.
+ * Publication through mesh-shared's barrel is a later integration step. */
+export declare const LAUNCH_DEFAULT_ROLES: readonly ["assistant", "coordinator"];
+export type LaunchDefaultRole = typeof LAUNCH_DEFAULT_ROLES[number];
+export declare const LAUNCH_DEFAULT_SOURCES: readonly ["user", "stored_default", "project_default", "provider_default"];
+export type LaunchDefaultSource = typeof LAUNCH_DEFAULT_SOURCES[number];
+export declare const LAUNCH_DEFAULTS_NEXT_LAUNCH_NOTE = "Applies to the next launch; running sessions are unchanged.";
+export declare function isLaunchDefaultRole(value: unknown): value is LaunchDefaultRole;
+export declare function isLaunchDefaultSource(value: unknown): value is LaunchDefaultSource;
+export interface LaunchDefaultSelection {
+    provider: string;
+    /** Omission means pass no model/thinking argument, not inherit another provider. */
+    model?: string;
+    thinkingLevel?: string;
+}
+export type LaunchDefaultToolRestriction = 'enforced' | 'prompt_only';
+export type LaunchDefaultOrigin = 'owner' | 'human' | 'relay' | 'review' | 'review_tainted';
+export interface LaunchDefaultEntry extends LaunchDefaultSelection {
+    revision: number;
+    setBy: 'owner' | 'assistant';
+    setAt: number;
+}
+export interface LaunchDefaultChange {
+    at: number;
+    role: LaunchDefaultRole;
+    by: 'owner' | 'assistant';
+    origin: LaunchDefaultOrigin;
+    from: LaunchDefaultEntry | null;
+    to: LaunchDefaultEntry | null;
+}
+export interface LaunchDefaultsDocument {
+    version: 1;
+    /** Global document token, including clears; distinct from entry revisions. */
+    revision: number;
+    assistant?: LaunchDefaultEntry;
+    coordinator?: LaunchDefaultEntry;
+    history: LaunchDefaultChange[];
+}
+export interface LaunchDefaultRef {
+    role: LaunchDefaultRole;
+    scope: 'global' | 'project';
+    /** Entry revision for global defaults; host project token for project defaults. */
+    revision: number;
+    projectId?: string;
+}
+export type LaunchDefaultField = keyof LaunchDefaultSelection;
+export interface LaunchDefaultAxis {
+    value: string | null;
+    source: LaunchDefaultSource;
+    defaultRef?: LaunchDefaultRef;
+}
+export type LaunchDefaultWarning = 'catalog_unverified' | 'manual_mcp_setup_required';
+export type LaunchDefaultValidationReason = 'invalid_schema' | 'provider_unknown' | 'provider_not_cli' | 'provider_disabled' | 'provider_not_detected' | 'provider_not_eligible' | 'provider_quota_gated' | 'model_unsupported' | 'model_provider_mismatch' | 'model_not_offered' | 'thinking_unsupported' | 'thinking_not_offered' | 'catalog_unavailable';
+export type LaunchDefaultResolution = {
+    ok: true;
+    selection: LaunchDefaultSelection;
+    applied: Record<LaunchDefaultField, LaunchDefaultAxis>;
+    defaultRef?: LaunchDefaultRef;
+    documentRevision: number;
+    warnings: LaunchDefaultWarning[];
+    toolRestriction: LaunchDefaultToolRestriction;
+} | {
+    ok: false;
+    code: 'launch_default_required' | 'launch_default_unavailable' | 'launch_selection_invalid';
+    role: LaunchDefaultRole;
+    field: LaunchDefaultField;
+    reason: string;
+    source?: LaunchDefaultSource;
+    value?: string | null;
+    defaultRef?: LaunchDefaultRef;
+    candidates?: readonly string[];
+    hint: string;
+};
+export interface LaunchDefaultsRoleView {
+    stored: LaunchDefaultEntry | null;
+    /** The existing daemon resolver's result, including loud failures. */
+    effective: LaunchDefaultResolution;
+}
+type Target = {
+    role: 'assistant';
+    project?: never;
+} | {
+    role: 'coordinator';
+    project?: string;
+};
+export type LaunchDefaultsReadRequest = ({
+    action?: 'get';
+} & (Target | {
+    role?: never;
+    project?: never;
+})) | ({
+    action: 'check';
+} & Target & LaunchDefaultSelection);
+/** Mandatory CAS: global document token, or host project token for project writes.
+ * 0 is explicit first setup; clears advance the token and never restore fallback. */
+export type LaunchDefaultsSetRequest = Target & {
+    expectedRevision: number;
+} & (({
+    action: 'set';
+} & LaunchDefaultSelection) | {
+    action: 'clear';
+    provider?: never;
+    model?: never;
+    thinkingLevel?: never;
+});
+/** Existing assistant routing envelope; session identity never supplies origin. */
+export type AssistantLaunchDefaultsReadRequest = LaunchDefaultsReadRequest & {
+    assistantSessionId?: string;
+};
+export type AssistantLaunchDefaultsSetRequest = LaunchDefaultsSetRequest & {
+    assistantSessionId?: string;
+};
+export declare const LAUNCH_DEFAULT_ERROR_CODES: readonly ["invalid_args", "launch_default_required", "launch_default_unavailable", "launch_selection_invalid", "launch_default_invalid", "revision_conflict", "store_unavailable", "store_busy", "persistence_failed", "project_not_found", "project_ambiguous", "project_not_hosted", "project_storage_unavailable", "staging_unavailable", "staging_failed", "review_turn_tool_denied"];
+export type LaunchDefaultsErrorCode = typeof LAUNCH_DEFAULT_ERROR_CODES[number];
+export interface LaunchDefaultsError {
+    success: false;
+    code: LaunchDefaultsErrorCode;
+    error: string;
+    reason?: string;
+    role?: LaunchDefaultRole;
+    field?: LaunchDefaultField;
+    source?: LaunchDefaultSource;
+    value?: string | null;
+    defaultRef?: LaunchDefaultRef;
+    candidates?: readonly string[];
+    actualRevision?: number;
+    /** 0 for an absent global document; absent when it cannot be read. */
+    documentRevision?: number;
+    /** A persistence failure can replace intent without confirming durability.
+     * Re-read before retrying; never report applied on committed:true alone. */
+    committed?: boolean;
+}
+export interface LaunchDefaultsReadSuccess {
+    success: true;
+    result: 'get';
+    documentRevision: number;
+    roles: Partial<Record<LaunchDefaultRole, LaunchDefaultsRoleView>>;
+    project?: {
+        projectId: string;
+        revision: number;
+        entry: LaunchDefaultEntry | null;
+    };
+}
+export interface LaunchDefaultsCheckSuccess {
+    success: true;
+    result: 'check';
+    role: LaunchDefaultRole;
+    selection: LaunchDefaultSelection;
+    warnings: LaunchDefaultWarning[];
+    toolRestriction: LaunchDefaultToolRestriction;
+    lowersToolLock: boolean;
+}
+export interface LaunchDefaultsApplied {
+    success: true;
+    result: 'applied';
+    role: LaunchDefaultRole;
+    scope: 'global' | 'project';
+    projectId?: string;
+    entry: LaunchDefaultEntry | null;
+    previous: LaunchDefaultEntry | null;
+    /** CAS token returned by the authority that performed the write. */
+    revision: number;
+    warnings: LaunchDefaultWarning[];
+    durable: true;
+    note: string;
+}
+export interface LaunchDefaultsStaged {
+    success: true;
+    result: 'staged';
+    role: LaunchDefaultRole;
+    stagedId: string;
+    previous: LaunchDefaultEntry | null;
+    selection: LaunchDefaultSelection | null;
+    expectedRevision: number;
+    warnings: LaunchDefaultWarning[];
+    note: string;
+}
+/** Existing owner Inbox adapter stores this proposal; it is not another default.
+ * Applying it must revalidate on the host and CAS via the same set handler. */
+export interface LaunchDefaultsProposal {
+    kind: 'launch_defaults';
+    role: LaunchDefaultRole;
+    project?: string;
+    selection: LaunchDefaultSelection | null;
+    previous: LaunchDefaultEntry | null;
+    expectedRevision: number;
+    origin: LaunchDefaultOrigin;
+    callerSessionId?: string;
+}
+export type LaunchDefaultsReadResponse = LaunchDefaultsReadSuccess | LaunchDefaultsCheckSuccess | LaunchDefaultsError;
+export type LaunchDefaultsSetResponse = LaunchDefaultsApplied | LaunchDefaultsStaged | LaunchDefaultsError;
+export type LaunchDefaultsResponse = LaunchDefaultsReadResponse | LaunchDefaultsSetResponse;
+export {};

package/dist/mesh-tool-names.d.ts

@@ -18,10 +18,10 @@
  * Order mirrors mcp-server `ALL_MESH_TOOLS` for easy visual diffing, but the consistency
  * checks are set-based (order-insensitive).
  */
-export declare const CANONICAL_MESH_TOOL_NAMES: readonly ["mesh_status", "mesh_route_preview", "mesh_list_nodes", "mesh_enqueue_batch", "mesh_enqueue_task", "mesh_view_queue", "mesh_queue_cancel", "mesh_queue_requeue", "mesh_send_task", "mesh_read_chat", "mesh_read_debug", "mesh_read_terminal", "mesh_send_keys", "mesh_launch_session", "mesh_git_status", "mesh_read_node_logs", "mesh_fast_forward_node", "mesh_restart_daemon", "mesh_checkpoint", "mesh_approve", "mesh_answer_question", "mesh_list_pending_approvals", "mesh_create", "mesh_add_node", "mesh_clone_node", "mesh_remove_node", "mesh_cleanup_worktree_nodes", "mesh_refine_node", "mesh_refine_batch", "mesh_config", "mesh_init", "mesh_cleanup_sessions", "mesh_task_history", "mesh_ledger_query", "mesh_note", "mesh_reconcile_ledger", "mesh_mission_upsert", "mesh_mission_list", "mesh_review_inbox", "mesh_node_slots"];
+export declare const CANONICAL_MESH_TOOL_NAMES: readonly ["mesh_status", "mesh_route_preview", "mesh_list_nodes", "mesh_enqueue_batch", "mesh_enqueue_task", "mesh_view_queue", "mesh_queue_cancel", "mesh_queue_requeue", "mesh_queue_revise", "mesh_send_task", "mesh_read_chat", "mesh_read_debug", "mesh_read_terminal", "mesh_send_keys", "mesh_launch_session", "mesh_git_status", "mesh_read_node_logs", "mesh_fast_forward_node", "mesh_restart_daemon", "mesh_checkpoint", "mesh_approve", "mesh_answer_question", "mesh_list_pending_approvals", "mesh_create", "mesh_add_node", "mesh_attach_remote", "mesh_clone_node", "mesh_remove_node", "mesh_cleanup_worktree_nodes", "mesh_refine_node", "mesh_refine_batch", "mesh_config", "mesh_init", "mesh_cleanup_sessions", "mesh_task_history", "mesh_ledger_query", "mesh_note", "mesh_reconcile_ledger", "mesh_mission_upsert", "mesh_mission_list", "mesh_review_inbox", "mesh_node_slots", "driver_list", "driver_describe", "artifact_list"];
 export type CanonicalMeshToolName = typeof CANONICAL_MESH_TOOL_NAMES[number];
 /** The count the `NN tools` barrel doc comments and consistency test assert against. */
-export declare const CANONICAL_MESH_TOOL_COUNT: 40;
+export declare const CANONICAL_MESH_TOOL_COUNT: 45;
 /**
  * Tool names retired by the 2026-09-26 tool-surface consolidation (60 → 48).
  * Every capability behind them is still reachable: each retired name maps to the

package/dist/mesh-vocabulary.d.ts

@@ -15,9 +15,11 @@
  * ./brain-routing.ts and are re-exported here for one-stop discovery.
  */
 export { MESH_TASK_DIFFICULTIES, type MeshTaskDifficulty } from './brain-routing';
-export declare const MESH_TASK_STATUSES: readonly ["pending", "assigned", "completed", "failed", "cancelled"];
+/** `blocked` ends a worker attempt pending external follow-up; only completed satisfies dependencies.
+ * Branch convergence (including blocked_review) remains an independent axis. */
+export declare const MESH_TASK_STATUSES: readonly ["pending", "assigned", "completed", "blocked", "failed", "cancelled"];
 export type MeshTaskStatus = typeof MESH_TASK_STATUSES[number];
-export declare const MESH_TERMINAL_TASK_STATUSES: readonly ["completed", "failed", "cancelled"];
+export declare const MESH_TERMINAL_TASK_STATUSES: readonly ["completed", "blocked", "failed", "cancelled"];
 export type MeshTerminalTaskStatus = typeof MESH_TERMINAL_TASK_STATUSES[number];
 export declare const MESH_TASK_MODES: readonly ["code_change", "validation", "live_debug_readonly", "launch_app", "convergence"];
 export type MeshTaskMode = typeof MESH_TASK_MODES[number];
@@ -46,11 +48,18 @@ export type MeshSessionCleanupMode = typeof MESH_SESSION_CLEANUP_MODES[number];
 /** Outcome a delegated worker may report through `report_completion`. */
 export declare const WORKER_REPORT_OUTCOMES: readonly ["completed", "blocked", "failed"];
 export type WorkerReportOutcome = typeof WORKER_REPORT_OUTCOMES[number];
+/**
+ * Hard cap on a `report_completion` summary (characters, after trim). Over-limit
+ * summaries are REJECTED, never truncated. Declared once so the daemon validator
+ * and the mcp-server's pre-send check (which keeps an over-limit report out of the
+ * durable outbox) cannot drift apart.
+ */
+export declare const WORKER_REPORT_SUMMARY_MAX_CHARS = 8000;
 /** Final branch state a worker reports (see coordinator convergence rules). */
 export declare const WORKER_BRANCH_STATES: readonly ["merged_to_main", "pushed_feature_branch_needs_merge", "blocked_review", "cleanup_candidate", "not_mergeable"];
 export type WorkerBranchState = typeof WORKER_BRANCH_STATES[number];
-export declare const isMeshTaskStatus: (value: unknown) => value is "failed" | "pending" | "assigned" | "completed" | "cancelled";
-export declare const isMeshTerminalTaskStatus: (value: unknown) => value is "failed" | "completed" | "cancelled";
+export declare const isMeshTaskStatus: (value: unknown) => value is "pending" | "failed" | "blocked" | "assigned" | "completed" | "cancelled";
+export declare const isMeshTerminalTaskStatus: (value: unknown) => value is "failed" | "blocked" | "completed" | "cancelled";
 export declare const isMeshTaskMode: (value: unknown) => value is "code_change" | "validation" | "live_debug_readonly" | "launch_app" | "convergence";
 export declare const isMeshTaskPriority: (value: unknown) => value is "low" | "high" | "normal";
 export declare const isMeshDeliveryMode: (value: unknown) => value is "when_idle" | "interrupt";

package/dist/node-facts.d.ts

@@ -94,6 +94,20 @@ export interface MeshNodeFactsProviderQuota {
          * rather than presenting them as a freshly measured value.
          */
         lastGoodWindows?: boolean;
+        /**
+         * Unix ms the reporting node's NEXT scheduled retry of this transient
+         * failure is due (HTTP Retry-After wins when later). Re-stamped to the
+         * real backoff time on every failure — see daemon-core
+         * `updateFailureRetry`. Absent on persistent failures and on daemons
+         * predating the stamp.
+         */
+        retryAtMs?: number;
+        /**
+         * True once the node has spent its bounded transient-retry budget and
+         * stopped retrying; the next look is the hourly backfill. Readers must
+         * stop calling retained numbers "refreshing" (`assessQuotaFreshness`).
+         */
+        retryExhausted?: boolean;
         /**
          * Unix ms when the reporting node last ATTEMPTED a refresh of this
          * provider — deliberately distinct from `updatedAt`, which dates the
@@ -109,6 +123,25 @@ export interface MeshNodeFactsProviderQuota {
          * predating the field.
          */
         fetchedAt?: number;
+        /**
+         * Provenance of the RETAINED reading when `lastGoodWindows` is true —
+         * the source/plan/measurement time of the snapshot that produced the
+         * carried numbers, as opposed to the top-level `source`/`planType`,
+         * which describe the fresh failed attempt. See daemon-core
+         * `QuotaMetadata.lastGood`.
+         */
+        lastGood?: {
+            measuredAt: number;
+            source?: string;
+            planType?: string | null;
+            collectorScope?: string;
+        };
+        /**
+         * `'background-collector'` when the snapshot came from a daemon-spawned
+         * probe rather than an executing CLI session; a failure with this scope
+         * is not evidence about a running session's sign-in.
+         */
+        collectorScope?: string;
         [extra: string]: unknown;
     };
     [extra: string]: unknown;
@@ -132,6 +165,13 @@ export interface MeshNodeFactsProviderEnablement {
 }
 export interface MeshNodeFacts {
     schemaVersion: number;
+    /** Cached CLI detection only; no paths or account data. */
+    providerInventory?: {
+        observedAt: number;
+        providers: Record<string, {
+            installed: boolean;
+        }>;
+    };
     reportedAt: number;
     daemonBuild?: MeshNodeFactsDaemonBuild;
     providerVersions?: Record<string, string>;
@@ -238,7 +278,7 @@ export declare function normalizeMeshNodeFacts(raw: unknown): MeshNodeFacts | un
  * the host `agy` itself uses; the unprefixed `cloudcode-pa` host 429s Google
  * AI Pro Antigravity accounts), and its credential lives in the OS keyring,
  * not the stale on-disk token file — see the provenance note in daemon-core
- * `quota/fetchers/antigravity.ts`. Supported on macOS and Windows; other
+ * `quota/fetchers/antigravity.ts`. Supported on macOS, Windows, and Linux; other
  * platforms report `unsupported` rather than guess at a keyring backend
  * nobody has verified.
  *

package/dist/outbound-message.d.ts

@@ -203,3 +203,10 @@ export declare function isSubmitOutcome(value: unknown): value is SubmitOutcome;
 export declare function isInputEnvelopeWire(value: unknown): value is InputEnvelopeWire;
 /** Minimal structural check for the wire boundary — not a full decoder (mesh-shared stays a pure leaf; semantic validation stays with the handler that owns it). */
 export declare function isOutboundMessage(value: unknown): value is OutboundMessage;
+/**
+ * Drop the `<pasted_content>` envelope lines Claude Code wraps around a pasted
+ * input. Only a text that OPENS with the envelope is touched; anything else is
+ * returned unchanged. Shared across daemon transcript merge and web echo/display
+ * normalization so wrapped turns correlate identically.
+ */
+export declare function unwrapPastedContent(text: string): string;

package/dist/path-ownership.d.ts

@@ -33,7 +33,7 @@
  */
 /** One normalized ownership entry: a repo-relative path, optionally a `**` subtree prefix. */
 export interface OwnedPathEntry {
-    /** Repo-relative path with forward slashes, no leading `./`, no trailing slash. */
+    /** Repo-relative path with forward slashes, no leading `./`, no trailing slash; empty for the whole-repo subtree. */
     readonly path: string;
     /** True when this entry was declared as `<path>/**` (owns the whole subtree). */
     readonly subtree: boolean;

package/dist/protocol/daemon-server.d.ts

@@ -52,6 +52,9 @@ export type DaemonStatusEventWirePayload = {
     elapsedSec?: number;
     modalMessage?: string;
     modalButtons?: string[];
+    modalKey?: string;
+    approvalEvidence?: 'live' | 'cached' | 'unavailable';
+    waitKind?: 'external';
     surfaceHidden?: boolean;
     muted?: boolean;
 };
@@ -213,11 +216,15 @@ export type P2POfferWirePayload = {
     sdp: string;
     type: string;
     peerId: string;
+    attemptId?: number;
+    attemptEpoch?: string;
 };
 export type P2PIceWirePayload = {
     candidate: string;
     mid: string;
     peerId: string;
+    attemptId?: number;
+    attemptEpoch?: string;
 };
 /**
  * A dashboard-originated signal as relayed to the daemon. `peerId` is stamped
@@ -229,6 +236,8 @@ export type P2PIceWirePayload = {
 export type RelayedP2PSignalWirePayload = {
     peerId?: string;
     daemonId?: string;
+    attemptId?: number;
+    attemptEpoch?: string;
     sharePermission?: string;
     shareTargetSessionId?: string;
     sdp?: string;

package/dist/protocol/dashboard-daemon-p2p.d.ts

@@ -34,7 +34,7 @@ export type ChunkFrame<T extends string> = {
 export declare function isChunkType(value: unknown): value is `${string}_chunk`;
 export declare const DASHBOARD_TO_DAEMON_P2P_TYPES: readonly ["ping", "pong", "command", "input", "pty_input", "pty_resize", "screenshot_start", "screenshot_stop", "subscribe", "unsubscribe", "seqscribe_session_interest", "read", "write", "list"];
 export type DashboardToDaemonP2PType = typeof DASHBOARD_TO_DAEMON_P2P_TYPES[number];
-export declare const isDashboardToDaemonP2PType: (value: unknown) => value is "list" | "command" | "ping" | "pong" | "input" | "pty_input" | "pty_resize" | "screenshot_start" | "screenshot_stop" | "subscribe" | "unsubscribe" | "seqscribe_session_interest" | "read" | "write";
+export declare const isDashboardToDaemonP2PType: (value: unknown) => value is "read" | "list" | "command" | "ping" | "pong" | "input" | "pty_input" | "pty_resize" | "screenshot_start" | "screenshot_stop" | "subscribe" | "unsubscribe" | "seqscribe_session_interest" | "write";
 export type DashboardToDaemonChunkType = `${DashboardToDaemonP2PType}_chunk`;
 export declare function isDashboardToDaemonChunkType(value: unknown): value is DashboardToDaemonChunkType;
 export type P2PPingMsg = {

package/dist/protocol/dashboard-server.d.ts

@@ -109,12 +109,16 @@ export type SystemAnnouncementWirePayload = {
 export type DashboardP2POfferWirePayload = {
     daemonId: string;
     peerId?: string;
+    attemptId?: number;
+    attemptEpoch?: string;
     sdp: string;
     type: string;
 };
 export type DashboardP2PIceWirePayload = {
     daemonId: string;
     peerId?: string;
+    attemptId?: number;
+    attemptEpoch?: string;
     candidate: string;
     mid?: string;
     sdpMid?: string | null;
@@ -154,16 +158,22 @@ export declare const isDashboardP2PSignalType: (value: unknown) => value is "p2p
 export type DashboardP2PReadyWirePayload = {
     daemonId: string;
     peerId: string;
+    attemptId?: number;
+    attemptEpoch?: string;
 };
 export type DashboardP2PAnswerWirePayload = {
     daemonId: string;
     peerId: string;
     sdp: string;
     type: string;
+    attemptId?: number;
+    attemptEpoch?: string;
 };
 export type DashboardP2PLocalIceWirePayload = {
     daemonId: string;
     peerId: string;
+    attemptId?: number;
+    attemptEpoch?: string;
     candidate: string;
     sdpMid: string | null;
     sdpMLineIndex: number | null;

package/dist/provider-approval.d.ts

@@ -0,0 +1,36 @@
+/** Provider permissions are runtime decisions, never owner write ratification. */
+export interface ProviderApproval {
+    source: 'provider_modal' | 'legacy_provider' | 'status_only' | 'ledger_approval';
+    /** Exact Inbox actions or the existing session handler; never inferred consent. */
+    compatibility?: 'exact' | 'session_only' | 'unknown';
+    type: 'tool_permission' | 'provider_setup' | 'unknown';
+    evidence: 'live' | 'cached' | 'unavailable';
+    lifecycle: 'pending' | 'resolved';
+    modalKey: string | null;
+    createdAt: number | null;
+    resolvedAt: number | null;
+    description: string;
+    runtimeDirectory?: string;
+    displayedDirectory?: string | null;
+    buttons: string[];
+    actionable: boolean;
+    providerType?: string;
+    sessionId?: string;
+    nodeId?: string | null;
+    meshId?: string | null;
+    taskId?: string | null;
+    attemptId?: string | null;
+    generation?: number | null;
+}
+/** Exact resource identity required by the approvals-only action path. */
+export interface ProviderApprovalTarget {
+    modalKey: string;
+    attemptId: string | null;
+    generation: number | null;
+}
+/** Confirmed authority for the new Inbox path. Legacy handlers retain their own checks. */
+export declare function isActionableProviderApproval(approval: ProviderApproval | null | undefined): boolean;
+/** An explicit null suppresses the resource; only missing metadata uses compatibility. */
+export declare function readProviderDecision(approval: ProviderApproval | null | undefined, waiting: boolean, hasModal?: boolean): ProviderApproval | null;
+/** Host metadata is durable: identity and clocks only, never modal text or directories. */
+export declare function providerApprovalSnapshot(approval: ProviderApproval | null | undefined): ProviderApproval | null;

package/dist/provider-question.d.ts

@@ -0,0 +1,19 @@
+/** Ephemeral provenance supplied by the owning daemon, never inferred from prompt text. */
+export interface ProviderQuestionBinding {
+    transport: 'codex_rpc' | 'codex_async';
+    sessionId: string;
+    generation: string;
+    threadId: string;
+    turnId: string;
+    itemId: string;
+    requestId?: string | number;
+}
+export type ProviderQuestionLifecycle = 'pending' | 'submitted' | 'resolved' | 'completed' | 'cancelled' | 'expired' | 'unknown';
+export interface ProviderQuestionEpisode {
+    blocking?: boolean;
+    binding?: ProviderQuestionBinding;
+    lifecycle?: ProviderQuestionLifecycle;
+    /** Async dismiss is product-local; it is not a native tool cancellation. */
+    support?: 'request_bound' | 'product_local' | 'uncertain';
+}
+export declare function isProviderQuestionBinding(value: unknown): value is ProviderQuestionBinding;

package/dist/quota-freshness.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Quota snapshot freshness — the ONE decision every display surface shares.
+ *
+ * Why this lives in the leaf package: the dashboard chips (web-core
+ * `quotaWindowCue`), the `adhdev quota` CLI (daemon-core `quota/cli.ts`) and the
+ * coordinator-facing `mesh_status` fold (mcp-server `summarizeNodeQuota`) each
+ * carried a hand-copied version of this rule, and a fix to one left the other
+ * two telling a different story about the same snapshot. They all call
+ * `assessQuotaFreshness` now; only the WORDING stays per-surface.
+ *
+ * Pure: plain objects in, plain object out, no clock except the `now` argument.
+ */
+import type { MeshNodeFactsProviderQuota } from './node-facts';
+export type QuotaFreshnessCue = 'refreshing' | 'stale';
+export interface QuotaFreshness {
+    /** Undefined = nothing to say (a fresh reading, or no retained numbers). */
+    cue?: QuotaFreshnessCue;
+    /**
+     * Only the USER can produce a new reading (aged-out Claude statusline;
+     * expired CLI access token — the daemon never redeems it). The surface
+     * should say what to run, not promise a self-heal.
+     */
+    userMustAct: boolean;
+    /**
+     * Unix ms by which the daemon will have looked again, for a `stale` reading
+     * the daemon re-checks on its own. Absent when the user must act, when the
+     * reading is `refreshing` (a retry is already scheduled), or when the check
+     * is already due.
+     */
+    nextCheckAt?: number;
+}
+/**
+ * How long past `metadata.retryAtMs` a retry still reads as "in flight". The
+ * retry timer fires at retryAtMs and the probe itself takes a few seconds; a
+ * retryAtMs well in the past with no newer attempt means no retry is coming.
+ */
+export declare const QUOTA_RETRY_INFLIGHT_GRACE_MS = 60000;
+/**
+ * The daemon's backfill horizon: a snapshot is re-probed once it is this old
+ * even on an idle machine. Mirrors daemon-core `QUOTA_ROUTABLE_MAX_AGE_MS`
+ * (quota/refresh.ts); daemon-core's quota-freshness test pins the two equal.
+ */
+export declare const QUOTA_BACKFILL_HORIZON_MS: number;
+/**
+ * Which freshness cue a snapshot's retained numbers should carry.
+ *
+ *  - `stale` + `userMustAct` — nothing will refresh it without the user:
+ *      · `no-data` on any provider EXCEPT codex (Claude's statusline aged out —
+ *        a session must run). Codex's `no-data` is the daemon re-reading the
+ *        rollout files itself (≈60s while a CLI is active, ≤60 min idle), so it
+ *        is `stale` WITHOUT userMustAct;
+ *      · `expired-token` on Grok/Kimi/antigravity — only the owning CLI
+ *        renews it on use. An idle CLI has no background renewal cadence.
+ *        A scheduled quota retry does not itself renew credentials.
+ *  - `refreshing` — retained numbers after a transient failure with a retry
+ *    actually pending. ★Honest about the end of the retry budget: once the
+ *    daemon has stopped retrying (`metadata.retryExhausted`, or `retryAtMs`
+ *    long past with no newer attempt) the numbers are `stale` with the next
+ *    scheduled check, not "refreshing" for the up-to-60 minutes until the
+ *    hourly backfill. A snapshot with NO retry bookkeeping at all (a daemon
+ *    predating the stamp) keeps the old `refreshing` reading.
+ */
+export declare function assessQuotaFreshness(quota: MeshNodeFactsProviderQuota, now?: number): QuotaFreshness;
+/** Whole minutes (min 1) until `nextCheckAt`, for the "next check ~Nm" wording. */
+export declare function minutesUntilQuotaCheck(nextCheckAt: number, now?: number): number;

package/dist/role-launch.d.ts

@@ -0,0 +1,11 @@
+/** Persisted role-launch intent. Restart replays this selection rather than
+ * consulting newer machine defaults; restore preserves its original provenance. */
+import { type LaunchDefaultRole, type LaunchDefaultSelection, type LaunchDefaultAxis, type LaunchDefaultRef } from './launch-defaults';
+export interface RoleLaunchSelection {
+    role: LaunchDefaultRole;
+    selection: LaunchDefaultSelection;
+    applied: Record<keyof LaunchDefaultSelection, LaunchDefaultAxis>;
+    defaultRef?: LaunchDefaultRef;
+    documentRevision: number;
+}
+export declare function parseRoleLaunchSelection(value: unknown): RoleLaunchSelection | undefined;

package/dist/session-launch.d.ts

@@ -1,25 +1,5 @@
-/**
- * session-launch — how a session was launched: provider, model and thinking
- * level, and WHERE each value came from.
- *
- * Wiring-unification Phase E (docs/design/2026-09-23-wiring-unification.md §7,
- * RC5). Before this record the only trace of a session's model was a display
- * string in recent-activity (`buildLegacyModelModeSummaryMetadata`), so nobody
- * could answer "did I pick this model, did the dashboard restore it from last
- * time, did a mesh slot choose it, or is it just the provider default?" — and
- * after a daemon restart not even the value survived.
- *
- * The daemon owns the record (daemon-core `SessionRegistry`); this file holds the
- * shape and the pure readers so daemon-core, web-core, the server and the MCP
- * server all read one definition. It is a dependency-free leaf, like the rest of
- * mesh-shared.
- *
- * ★Server content boundary (CLAUDE.md): the full record rides P2P only. The
- * server path carries exactly two derived fields — `model` (an identifier,
- * passed through {@link sanitizeModelIdentifier}) and `modelSource` (an enum,
- * passed through {@link isModelAxisSource}). Never widen that to the record.
- */
-export declare const MODEL_AXIS_SOURCES: readonly ["user", "remembered", "mesh_slot", "task_override", "provider_default", "unspecified"];
+import { type RoleLaunchSelection } from './role-launch';
+export declare const MODEL_AXIS_SOURCES: readonly ["user", "remembered", "stored_default", "project_default", "mesh_slot", "task_override", "provider_default", "unspecified"];
 export type ModelAxisSource = typeof MODEL_AXIS_SOURCES[number];
 export declare function isModelAxisSource(value: unknown): value is ModelAxisSource;
 /**
@@ -65,6 +45,7 @@ export interface ModelSelection {
     history: ModelSelectionHistoryEntry[];
 }
 export interface SessionLaunchRecord {
+    roleLaunch?: RoleLaunchSelection;
     sessionId: string;
     providerType: string;
     providerVersion?: string;

package/dist/slot-proposal.d.ts

@@ -35,6 +35,13 @@ import { type MeshTaskDifficulty, type NodeCapabilitySlot } from './brain-routin
 export interface CliSlotRecipe {
     /** Optional model to pin on the slot. Best-effort at launch. */
     model?: string;
+    /**
+     * Optional ordered candidate models to prefer when the provider's live
+     * `modelOptions` (from model discovery) is present on `DetectedCliProvider`.
+     * The first candidate present in `modelOptions` wins; falls back to `model`
+     * when `modelOptions` is absent or contains none of the candidates.
+     */
+    modelCandidates?: readonly string[];
     /** Optional thinking level, in the provider's own vocabulary. */
     thinkingLevel?: string;
     /** Difficulty range this slot handles. Empty = general-purpose. */
@@ -76,6 +83,13 @@ export interface DetectedCliProvider {
     displayName?: string;
     /** Detected version, when known. Display only — never affects the mapping. */
     version?: string;
+    /**
+     * Live discovered / resolved `modelOptions` for this provider on the node,
+     * when available on the status catalog. When present and non-empty, recipes
+     * prefer the first matching model from `[recipe.model, ...recipe.modelCandidates]`
+     * that exists in `modelOptions`.
+     */
+    modelOptions?: readonly string[];
 }
 /** One proposed slot plus why it was proposed. */
 export interface ProposedSlotEntry {