@adhdev/mesh-shared 1.0.82-rc.4 → 1.0.82-rc.40

package/dist/outbound-message.d.ts

@@ -126,7 +126,7 @@ export type SendPolicy = {
  * `unsupported_input`), which `satisfies readonly SendRefusal[]` there keeps
  * honest at compile time.
  */
-export type SendRefusal = 'not_ready' | 'send_in_flight' | 'not_generating' | 'not_supported' | 'platform_unsupported' | 'modal_parked' | 'interrupt_not_implemented' | 'interrupt_refused' | 'idle_timeout' | 'session_exited' | 'unsupported_input' | 'no_target' | 'bootstrap_pending' | 'duplicate_dispatch' | 'internal_error';
+export type SendRefusal = 'not_ready' | 'send_in_flight' | 'not_generating' | 'not_supported' | 'platform_unsupported' | 'modal_parked' | 'interrupt_not_implemented' | 'interrupt_refused' | 'idle_timeout' | 'session_exited' | 'unsupported_input' | 'no_target' | 'bootstrap_pending' | 'duplicate_dispatch' | 'new_work_held' | 'internal_error';
 /**
  * Which write path carried a delivered/queued message (Phase D2, additive
  * detail — callers branch on `kind`; `route` only refines the report):
@@ -197,9 +197,16 @@ export declare function isOutboundMessageOrigin(value: unknown): value is Outbou
 export declare const SEND_POLICY_MODES: readonly ["queue", "send_now", "interrupt"];
 export declare function isSendPolicyMode(value: unknown): value is SendPolicy['mode'];
 export declare function isSendPolicy(value: unknown): value is SendPolicy;
-export declare const SEND_REFUSAL_REASONS: readonly ["not_ready", "send_in_flight", "not_generating", "not_supported", "platform_unsupported", "modal_parked", "interrupt_not_implemented", "interrupt_refused", "idle_timeout", "session_exited", "unsupported_input", "no_target", "bootstrap_pending", "duplicate_dispatch", "internal_error"];
+export declare const SEND_REFUSAL_REASONS: readonly ["not_ready", "send_in_flight", "not_generating", "not_supported", "platform_unsupported", "modal_parked", "interrupt_not_implemented", "interrupt_refused", "idle_timeout", "session_exited", "unsupported_input", "no_target", "bootstrap_pending", "duplicate_dispatch", "new_work_held", "internal_error"];
 export declare function isSendRefusal(value: unknown): value is SendRefusal;
 export declare function isSubmitOutcome(value: unknown): value is SubmitOutcome;
 export declare function isInputEnvelopeWire(value: unknown): value is InputEnvelopeWire;
 /** Minimal structural check for the wire boundary — not a full decoder (mesh-shared stays a pure leaf; semantic validation stays with the handler that owns it). */
 export declare function isOutboundMessage(value: unknown): value is OutboundMessage;
+/**
+ * Drop the `<pasted_content>` envelope lines Claude Code wraps around a pasted
+ * input. Only a text that OPENS with the envelope is touched; anything else is
+ * returned unchanged. Shared across daemon transcript merge and web echo/display
+ * normalization so wrapped turns correlate identically.
+ */
+export declare function unwrapPastedContent(text: string): string;

package/dist/path-ownership.d.ts

@@ -33,7 +33,7 @@
  */
 /** One normalized ownership entry: a repo-relative path, optionally a `**` subtree prefix. */
 export interface OwnedPathEntry {
-    /** Repo-relative path with forward slashes, no leading `./`, no trailing slash. */
+    /** Repo-relative path with forward slashes, no leading `./`, no trailing slash; empty for the whole-repo subtree. */
     readonly path: string;
     /** True when this entry was declared as `<path>/**` (owns the whole subtree). */
     readonly subtree: boolean;

package/dist/protocol/daemon-server.d.ts

@@ -32,15 +32,38 @@ import { type CommandPayload, type Envelope, type MessageId } from './envelope';
  * time (UserSession.ts), so adding a member here without adding it there — or
  * vice versa — fails `tsc`.
  */
-export declare const DAEMON_STATUS_EVENT_NAMES: readonly ["agent:generating_started", "agent:waiting_approval", "agent:waiting_choice", "agent:generating_completed", "agent:stopped", "monitor:no_progress"];
+export declare const DAEMON_STATUS_EVENT_NAMES: readonly ["agent:generating_started", "agent:waiting_approval", "agent:waiting_choice", "agent:generating_completed", "agent:stopped", "monitor:no_progress", "agent:decision_needed"];
 export type DaemonStatusEventName = typeof DAEMON_STATUS_EVENT_NAMES[number];
-export declare const isDaemonStatusEventName: (value: unknown) => value is "agent:generating_started" | "agent:waiting_approval" | "agent:waiting_choice" | "agent:generating_completed" | "agent:stopped" | "monitor:no_progress";
+export declare const isDaemonStatusEventName: (value: unknown) => value is "agent:generating_started" | "agent:waiting_approval" | "agent:waiting_choice" | "agent:generating_completed" | "agent:stopped" | "monitor:no_progress" | "agent:decision_needed";
 /**
  * Server-bound status event. Content boundary: identifiers, enums, counters
  * and booleans only — plus the approved approval-modal exception
  * (`modalMessage`/`modalButtons`, CLAUDE.md "Push notification exception").
  * Mirror of daemon-core `DaemonStatusEventPayload`.
  */
+/**
+ * Owner-decision push payload (design §9, owner decision D1 2026-10-28). The ONLY mission text that
+ * reaches the server: the question (<=80 chars) and up to 3 option labels (<=24 chars). Never
+ * `context`, free-text answers, mission goal/summary or chat content.
+ */
+export type DecisionPushWire = {
+    meshId: string;
+    missionId: string;
+    itemId: string;
+    question: string;
+    options: Array<{
+        id: string;
+        label: string;
+    }>;
+    recommended?: string;
+    urgency: 'normal' | 'blocking';
+    dueAt?: string;
+    /** `new` = freshly asked; `remind` = a blocking decision crossed its due time. */
+    reason: 'new' | 'remind';
+};
+export declare const DECISION_PUSH_QUESTION_MAX = 80;
+export declare const DECISION_PUSH_OPTION_LABEL_MAX = 24;
+export declare const DECISION_PUSH_OPTIONS_MAX = 3;
 export type DaemonStatusEventWirePayload = {
     event: DaemonStatusEventName;
     timestamp: number;
@@ -52,8 +75,13 @@ export type DaemonStatusEventWirePayload = {
     elapsedSec?: number;
     modalMessage?: string;
     modalButtons?: string[];
+    modalKey?: string;
+    approvalEvidence?: 'live' | 'cached' | 'unavailable';
+    waitKind?: 'external';
     surfaceHidden?: boolean;
     muted?: boolean;
+    /** Present only on `agent:decision_needed`. */
+    decision?: DecisionPushWire;
 };
 /** Routing-only session entry the daemon reports over the server WS. Mirror of daemon-core `RoutingSessionEntry`. */
 export type RoutingSessionWireEntry = {
@@ -213,11 +241,17 @@ export type P2POfferWirePayload = {
     sdp: string;
     type: string;
     peerId: string;
+    attemptId?: number;
+    attemptEpoch?: string;
+    probe?: boolean;
 };
 export type P2PIceWirePayload = {
     candidate: string;
     mid: string;
     peerId: string;
+    attemptId?: number;
+    attemptEpoch?: string;
+    probe?: boolean;
 };
 /**
  * A dashboard-originated signal as relayed to the daemon. `peerId` is stamped
@@ -229,6 +263,12 @@ export type P2PIceWirePayload = {
 export type RelayedP2PSignalWirePayload = {
     peerId?: string;
     daemonId?: string;
+    attemptId?: number;
+    attemptEpoch?: string;
+    /** p2p_ready only: the dashboard's stale-connect backoff index (see DashboardP2PReadyWirePayload). */
+    backoffStep?: number;
+    /** Make-before-break relay->direct re-probe of an existing peer (see DashboardP2PReadyWirePayload). */
+    probe?: boolean;
     sharePermission?: string;
     shareTargetSessionId?: string;
     sdp?: string;

package/dist/protocol/dashboard-daemon-p2p.d.ts

@@ -34,7 +34,7 @@ export type ChunkFrame<T extends string> = {
 export declare function isChunkType(value: unknown): value is `${string}_chunk`;
 export declare const DASHBOARD_TO_DAEMON_P2P_TYPES: readonly ["ping", "pong", "command", "input", "pty_input", "pty_resize", "screenshot_start", "screenshot_stop", "subscribe", "unsubscribe", "seqscribe_session_interest", "read", "write", "list"];
 export type DashboardToDaemonP2PType = typeof DASHBOARD_TO_DAEMON_P2P_TYPES[number];
-export declare const isDashboardToDaemonP2PType: (value: unknown) => value is "list" | "command" | "ping" | "pong" | "input" | "pty_input" | "pty_resize" | "screenshot_start" | "screenshot_stop" | "subscribe" | "unsubscribe" | "seqscribe_session_interest" | "read" | "write";
+export declare const isDashboardToDaemonP2PType: (value: unknown) => value is "read" | "list" | "command" | "ping" | "pong" | "input" | "pty_input" | "pty_resize" | "screenshot_start" | "screenshot_stop" | "subscribe" | "unsubscribe" | "seqscribe_session_interest" | "write";
 export type DashboardToDaemonChunkType = `${DashboardToDaemonP2PType}_chunk`;
 export declare function isDashboardToDaemonChunkType(value: unknown): value is DashboardToDaemonChunkType;
 export type P2PPingMsg = {

package/dist/protocol/dashboard-server.d.ts

@@ -21,9 +21,9 @@ import { type DaemonStatusEventName, type P2PIceWirePayload, type P2POfferWirePa
 /** Server-originated events the dashboard receives in addition to the daemon set. */
 export declare const SERVER_STATUS_EVENT_NAMES: readonly ["daemon:disconnect", "team:session_viewed", "team:view_request", "team:view_request_approved", "team:view_request_rejected"];
 /** Mirror of daemon-core `DashboardStatusEventName`; pinned equal by the server at compile time. */
-export declare const DASHBOARD_STATUS_EVENT_NAMES: readonly ["agent:generating_started", "agent:waiting_approval", "agent:waiting_choice", "agent:generating_completed", "agent:stopped", "monitor:no_progress", "daemon:disconnect", "team:session_viewed", "team:view_request", "team:view_request_approved", "team:view_request_rejected"];
+export declare const DASHBOARD_STATUS_EVENT_NAMES: readonly ["agent:generating_started", "agent:waiting_approval", "agent:waiting_choice", "agent:generating_completed", "agent:stopped", "monitor:no_progress", "agent:decision_needed", "daemon:disconnect", "team:session_viewed", "team:view_request", "team:view_request_approved", "team:view_request_rejected"];
 export type DashboardStatusEventName = DaemonStatusEventName | typeof SERVER_STATUS_EVENT_NAMES[number];
-export declare const isDashboardStatusEventName: (value: unknown) => value is "agent:generating_started" | "agent:waiting_approval" | "agent:waiting_choice" | "agent:generating_completed" | "agent:stopped" | "monitor:no_progress" | "daemon:disconnect" | "team:session_viewed" | "team:view_request" | "team:view_request_approved" | "team:view_request_rejected";
+export declare const isDashboardStatusEventName: (value: unknown) => value is "agent:generating_started" | "agent:waiting_approval" | "agent:waiting_choice" | "agent:generating_completed" | "agent:stopped" | "monitor:no_progress" | "agent:decision_needed" | "daemon:disconnect" | "team:session_viewed" | "team:view_request" | "team:view_request_approved" | "team:view_request_rejected";
 /**
  * Sanitized status event as the server relays it (UserSession
  * `buildDashboardStatusEvent`). Mirror of daemon-core
@@ -109,12 +109,18 @@ export type SystemAnnouncementWirePayload = {
 export type DashboardP2POfferWirePayload = {
     daemonId: string;
     peerId?: string;
+    attemptId?: number;
+    attemptEpoch?: string;
+    probe?: boolean;
     sdp: string;
     type: string;
 };
 export type DashboardP2PIceWirePayload = {
     daemonId: string;
     peerId?: string;
+    attemptId?: number;
+    attemptEpoch?: string;
+    probe?: boolean;
     candidate: string;
     mid?: string;
     sdpMid?: string | null;
@@ -151,19 +157,31 @@ export declare const isDashboardToUserSessionType: (value: unknown) => value is
 export declare const DASHBOARD_P2P_SIGNAL_TYPES: readonly ["p2p_ready", "p2p_answer", "p2p_ice"];
 export type DashboardP2PSignalType = typeof DASHBOARD_P2P_SIGNAL_TYPES[number];
 export declare const isDashboardP2PSignalType: (value: unknown) => value is "p2p_ready" | "p2p_answer" | "p2p_ice";
+/** `backoffStep`: the dashboard's stale-connect backoff index (0 = 15s, 1 = 30s, 2 = 60s), so the daemon holds the connecting slot for the same window. */
+/** `probe`: identifier-only flag — this signal belongs to a make-before-break relay->direct re-probe of the SAME logical peer (never a new peer for the connection cap). */
 export type DashboardP2PReadyWirePayload = {
     daemonId: string;
     peerId: string;
+    attemptId?: number;
+    attemptEpoch?: string;
+    backoffStep?: number;
+    probe?: boolean;
 };
 export type DashboardP2PAnswerWirePayload = {
     daemonId: string;
     peerId: string;
     sdp: string;
     type: string;
+    attemptId?: number;
+    attemptEpoch?: string;
+    probe?: boolean;
 };
 export type DashboardP2PLocalIceWirePayload = {
     daemonId: string;
     peerId: string;
+    attemptId?: number;
+    attemptEpoch?: string;
+    probe?: boolean;
     candidate: string;
     sdpMid: string | null;
     sdpMLineIndex: number | null;

package/dist/provider-approval.d.ts

@@ -0,0 +1,36 @@
+/** Provider permissions are runtime decisions, never owner write ratification. */
+export interface ProviderApproval {
+    source: 'provider_modal' | 'legacy_provider' | 'status_only' | 'ledger_approval';
+    /** Exact Inbox actions or the existing session handler; never inferred consent. */
+    compatibility?: 'exact' | 'session_only' | 'unknown';
+    type: 'tool_permission' | 'provider_setup' | 'unknown';
+    evidence: 'live' | 'cached' | 'unavailable';
+    lifecycle: 'pending' | 'resolved';
+    modalKey: string | null;
+    createdAt: number | null;
+    resolvedAt: number | null;
+    description: string;
+    runtimeDirectory?: string;
+    displayedDirectory?: string | null;
+    buttons: string[];
+    actionable: boolean;
+    providerType?: string;
+    sessionId?: string;
+    nodeId?: string | null;
+    meshId?: string | null;
+    taskId?: string | null;
+    attemptId?: string | null;
+    generation?: number | null;
+}
+/** Exact resource identity required by the approvals-only action path. */
+export interface ProviderApprovalTarget {
+    modalKey: string;
+    attemptId: string | null;
+    generation: number | null;
+}
+/** Confirmed authority for the new Inbox path. Legacy handlers retain their own checks. */
+export declare function isActionableProviderApproval(approval: ProviderApproval | null | undefined): boolean;
+/** An explicit null suppresses the resource; only missing metadata uses compatibility. */
+export declare function readProviderDecision(approval: ProviderApproval | null | undefined, waiting: boolean, hasModal?: boolean): ProviderApproval | null;
+/** Host metadata is durable: identity and clocks only, never modal text or directories. */
+export declare function providerApprovalSnapshot(approval: ProviderApproval | null | undefined): ProviderApproval | null;

package/dist/provider-question.d.ts

@@ -0,0 +1,19 @@
+/** Ephemeral provenance supplied by the owning daemon, never inferred from prompt text. */
+export interface ProviderQuestionBinding {
+    transport: 'codex_rpc' | 'codex_async';
+    sessionId: string;
+    generation: string;
+    threadId: string;
+    turnId: string;
+    itemId: string;
+    requestId?: string | number;
+}
+export type ProviderQuestionLifecycle = 'pending' | 'submitted' | 'resolved' | 'completed' | 'cancelled' | 'expired' | 'unknown';
+export interface ProviderQuestionEpisode {
+    blocking?: boolean;
+    binding?: ProviderQuestionBinding;
+    lifecycle?: ProviderQuestionLifecycle;
+    /** Async dismiss is product-local; it is not a native tool cancellation. */
+    support?: 'request_bound' | 'product_local' | 'uncertain';
+}
+export declare function isProviderQuestionBinding(value: unknown): value is ProviderQuestionBinding;

package/dist/quota-freshness.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Quota snapshot freshness — the ONE decision every display surface shares.
+ *
+ * Why this lives in the leaf package: the dashboard chips (web-core
+ * `quotaWindowCue`), the `adhdev quota` CLI (daemon-core `quota/cli.ts`) and the
+ * coordinator-facing `mesh_status` fold (mcp-server `summarizeNodeQuota`) each
+ * carried a hand-copied version of this rule, and a fix to one left the other
+ * two telling a different story about the same snapshot. They all call
+ * `assessQuotaFreshness` now; only the WORDING stays per-surface.
+ *
+ * Pure: plain objects in, plain object out, no clock except the `now` argument.
+ */
+import type { MeshNodeFactsProviderQuota } from './node-facts';
+export type QuotaFreshnessCue = 'refreshing' | 'stale';
+export interface QuotaFreshness {
+    /** Undefined = nothing to say (a fresh reading, or no retained numbers). */
+    cue?: QuotaFreshnessCue;
+    /**
+     * Only the USER can produce a new reading (aged-out Claude statusline;
+     * expired CLI access token — the daemon never redeems it). The surface
+     * should say what to run, not promise a self-heal.
+     */
+    userMustAct: boolean;
+    /**
+     * Unix ms by which the daemon will have looked again, for a `stale` reading
+     * the daemon re-checks on its own. Absent when the user must act, when the
+     * reading is `refreshing` (a retry is already scheduled), or when the check
+     * is already due.
+     */
+    nextCheckAt?: number;
+}
+/**
+ * How long past `metadata.retryAtMs` a retry still reads as "in flight". The
+ * retry timer fires at retryAtMs and the probe itself takes a few seconds; a
+ * retryAtMs well in the past with no newer attempt means no retry is coming.
+ */
+export declare const QUOTA_RETRY_INFLIGHT_GRACE_MS = 60000;
+/**
+ * The daemon's backfill horizon: a snapshot is re-probed once it is this old
+ * even on an idle machine. Mirrors daemon-core `QUOTA_ROUTABLE_MAX_AGE_MS`
+ * (quota/refresh.ts); daemon-core's quota-freshness test pins the two equal.
+ */
+export declare const QUOTA_BACKFILL_HORIZON_MS: number;
+/**
+ * Which freshness cue a snapshot's retained numbers should carry.
+ *
+ *  - `stale` + `userMustAct` — nothing will refresh it without the user:
+ *      · `no-data` on any provider EXCEPT codex (Claude's statusline aged out —
+ *        a session must run). Codex's `no-data` is the daemon re-reading the
+ *        rollout files itself (≈60s while a CLI is active, ≤60 min idle), so it
+ *        is `stale` WITHOUT userMustAct;
+ *      · `expired-token` on Grok/Kimi/antigravity — only the owning CLI
+ *        renews it on use. An idle CLI has no background renewal cadence.
+ *        A scheduled quota retry does not itself renew credentials.
+ *  - `refreshing` — retained numbers after a transient failure with a retry
+ *    actually pending. ★Honest about the end of the retry budget: once the
+ *    daemon has stopped retrying (`metadata.retryExhausted`, or `retryAtMs`
+ *    long past with no newer attempt) the numbers are `stale` with the next
+ *    scheduled check, not "refreshing" for the up-to-60 minutes until the
+ *    hourly backfill. A snapshot with NO retry bookkeeping at all (a daemon
+ *    predating the stamp) keeps the old `refreshing` reading.
+ */
+export declare function assessQuotaFreshness(quota: MeshNodeFactsProviderQuota, now?: number): QuotaFreshness;
+/** Whole minutes (min 1) until `nextCheckAt`, for the "next check ~Nm" wording. */
+export declare function minutesUntilQuotaCheck(nextCheckAt: number, now?: number): number;

package/dist/relay-reprobe.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Relay -> direct re-probe scheduler (pure, dependency-free).
+ *
+ * A P2P connection that settled on a TURN relay never looks for a direct path
+ * again. The owning transport (dashboard `P2PConnection`, daemon peer manager)
+ * uses this scheduler to periodically attempt a make-before-break probe: a
+ * SECOND peer connection (STUN-only) is built next to the working relay one and
+ * only swapped in once it is verified direct. The scheduler owns nothing but
+ * timing: backoff 60s -> 5min (doubling), jitter, and the stop conditions. The
+ * transport supplies `shouldProbe` (open + idle + visible) and `probe`.
+ */
+export type RelayReprobeOutcome = 'direct' | 'relay' | 'failed' | 'skipped';
+export interface RelayReprobeTiming {
+    /** First delay and the unit of growth (default 60s). */
+    baseDelayMs?: number;
+    /** Backoff ceiling before jitter (default 5min). */
+    maxDelayMs?: number;
+    /** +/- fraction applied to every delay (default 0.2). */
+    jitterRatio?: number;
+}
+export declare const RELAY_REPROBE_BASE_DELAY_MS = 60000;
+export declare const RELAY_REPROBE_MAX_DELAY_MS: number;
+export declare const RELAY_REPROBE_JITTER_RATIO = 0.2;
+/** Delay before the next attempt after `failures` consecutive non-direct outcomes. */
+export declare function computeRelayReprobeDelay(failures: number, random: () => number, timing?: RelayReprobeTiming): number;
+export interface RelayReprobeSchedulerOptions extends RelayReprobeTiming {
+    random: () => number;
+    setTimer: (callback: () => void, ms: number) => unknown;
+    clearTimer: (handle: unknown) => void;
+    /** Connected over relay, idle, tab visible, auth epoch unchanged... Re-checked on every tick. */
+    shouldProbe: () => boolean;
+    /** One make-before-break attempt. Must never throw into the scheduler; a rejection counts as 'failed'. */
+    probe: () => Promise<RelayReprobeOutcome>;
+}
+export declare class RelayReprobeScheduler {
+    private readonly options;
+    private handle;
+    private running;
+    private inFlight;
+    private failureCount;
+    private generation;
+    constructor(options: RelayReprobeSchedulerOptions);
+    get isRunning(): boolean;
+    get failures(): number;
+    get probing(): boolean;
+    /** Begin probing (idempotent). Call when a connection is selected as relay. */
+    start(): void;
+    /** Stop for good (direct path found, connection closed, auth epoch changed). */
+    stop(): void;
+    private schedule;
+    private tick;
+}

package/dist/release.d.ts

@@ -0,0 +1,90 @@
+/**
+ * release — types, limits and pure helpers for release objects
+ * (docs/design/2026-11-01-release-objects.md).
+ *
+ * A release is a mesh-scoped entity that groups MISSIONS (explicit membership) and records
+ * deploy facts. It is distinct from the vendor release stamp (a build channel stamp) and
+ * from `.adhdev/preview-deploy.json` (the per-checkout deploy record it snapshots).
+ * Membership is only ever created by an explicit call; git evaluation and deploy heads
+ * produce suggestions, never members. Dependency-free leaf.
+ */
+export declare const MESH_RELEASE_CHANNELS: readonly ["preview", "stable"];
+export type MeshReleaseChannel = typeof MESH_RELEASE_CHANNELS[number];
+export declare function isMeshReleaseChannel(value: unknown): value is MeshReleaseChannel;
+export declare const MESH_RELEASE_STATUSES: readonly ["planned", "frozen", "deployed", "verified", "superseded", "cancelled"];
+export type ReleaseStatus = typeof MESH_RELEASE_STATUSES[number];
+export declare function isReleaseStatus(value: unknown): value is ReleaseStatus;
+export declare const RELEASE_MEMBER_STATES: readonly ["member", "moved_out", "removed"];
+export type ReleaseMemberState = typeof RELEASE_MEMBER_STATES[number];
+/** Who may write release membership. The daemon never adds a member on its own. */
+export declare const RELEASE_ACTORS: readonly ["coordinator", "owner", "assistant", "script"];
+export type ReleaseActor = typeof RELEASE_ACTORS[number];
+export declare const RELEASE_EVENT_TYPES: readonly ["created", "status_changed", "scope_added", "scope_moved", "scope_removed", "deploy_recorded", "changelog_drafted", "changelog_applied"];
+export type ReleaseEventType = typeof RELEASE_EVENT_TYPES[number];
+/** Mission-side events recorded when membership changes (so the mission history shows it). */
+export declare const MISSION_RELEASE_EVENT_TYPES: readonly ["release_attached", "release_moved", "release_detached"];
+export declare const RELEASE_LIMITS: {
+    readonly name: 80;
+    readonly note: 500;
+    /** `mesh_missions.release_note`: one user/operator-visible sentence. */
+    readonly releaseNote: 400;
+    readonly missionsPerCall: 100;
+    readonly changelogEntries: 300;
+};
+/** Deploy targets snapshot (a copy of `.adhdev/preview-deploy.json` `targets`). */
+export interface ReleaseDeployTarget {
+    commit?: string;
+    deployedAt?: string;
+    previewVersion?: string;
+    [key: string]: unknown;
+}
+export type ReleaseTargets = Partial<Record<'npm' | 'server' | 'web', ReleaseDeployTarget>> & Record<string, ReleaseDeployTarget | undefined>;
+export declare const CHANGELOG_SECTIONS: readonly ["Added", "Fixed", "Changed"];
+export type ChangelogSection = typeof CHANGELOG_SECTIONS[number];
+export interface ChangelogDraftEntry {
+    missionId: string;
+    /** `<!-- m:<id8> -->` — the idempotency marker `--apply` writes after the line. */
+    marker: string;
+    section: ChangelogSection;
+    /** The sentence that would be written to CHANGELOG.md. */
+    text: string;
+    source: 'release_note' | 'summary';
+    /** True when `text` is not user-facing wording yet (carries the needs-wording marker). */
+    needsWording?: boolean;
+    /** Evidence kept in the draft JSON only; never written to CHANGELOG.md. */
+    evidence?: {
+        gitState?: string;
+        outcome?: string;
+        shas?: string[];
+    };
+    /** Non-blocking lint warnings (internal ids / wave numbers / forbidden phrases). */
+    lint?: string[];
+}
+export interface ChangelogDraftExcluded {
+    missionId: string;
+    reason: string;
+}
+export interface ChangelogDraft {
+    generatedAt: string;
+    entries: ChangelogDraftEntry[];
+    /** Member missions without a `release_note` (target 0 at deploy time). */
+    needsNote: string[];
+    excluded: ChangelogDraftExcluded[];
+    /** Member missions whose refs are not confirmed on the default branch (`not_landed` / `unknown`). */
+    warnings: Array<{
+        missionId: string;
+        gitState: string;
+        message: string;
+    }>;
+    appliedAt?: string;
+}
+export declare const NEEDS_WORDING_MARKER = "[needs user-facing wording]";
+/** Marker that makes `--apply` idempotent: one per mission entry inside CHANGELOG.md. */
+export declare function changelogMissionMarker(missionId: string): string;
+/** Default section for an entry; `[Fixed]`/`[Added]`/`[Changed]` prefixes on the note pin it. */
+export declare function classifyChangelogSection(text: string, hint?: string): {
+    section: ChangelogSection;
+    text: string;
+};
+/** Phrases that must not reach a public CHANGELOG (internal waves, rc numbering, ids). Warning-only. */
+export declare function lintChangelogText(text: string): string[];

package/dist/role-launch.d.ts

@@ -0,0 +1,11 @@
+/** Persisted role-launch intent. Restart replays this selection rather than
+ * consulting newer machine defaults; restore preserves its original provenance. */
+import { type LaunchDefaultRole, type LaunchDefaultSelection, type LaunchDefaultAxis, type LaunchDefaultRef } from './launch-defaults';
+export interface RoleLaunchSelection {
+    role: LaunchDefaultRole;
+    selection: LaunchDefaultSelection;
+    applied: Record<keyof LaunchDefaultSelection, LaunchDefaultAxis>;
+    defaultRef?: LaunchDefaultRef;
+    documentRevision: number;
+}
+export declare function parseRoleLaunchSelection(value: unknown): RoleLaunchSelection | undefined;

package/dist/session-launch.d.ts

@@ -1,25 +1,5 @@
-/**
- * session-launch — how a session was launched: provider, model and thinking
- * level, and WHERE each value came from.
- *
- * Wiring-unification Phase E (docs/design/2026-09-23-wiring-unification.md §7,
- * RC5). Before this record the only trace of a session's model was a display
- * string in recent-activity (`buildLegacyModelModeSummaryMetadata`), so nobody
- * could answer "did I pick this model, did the dashboard restore it from last
- * time, did a mesh slot choose it, or is it just the provider default?" — and
- * after a daemon restart not even the value survived.
- *
- * The daemon owns the record (daemon-core `SessionRegistry`); this file holds the
- * shape and the pure readers so daemon-core, web-core, the server and the MCP
- * server all read one definition. It is a dependency-free leaf, like the rest of
- * mesh-shared.
- *
- * ★Server content boundary (CLAUDE.md): the full record rides P2P only. The
- * server path carries exactly two derived fields — `model` (an identifier,
- * passed through {@link sanitizeModelIdentifier}) and `modelSource` (an enum,
- * passed through {@link isModelAxisSource}). Never widen that to the record.
- */
-export declare const MODEL_AXIS_SOURCES: readonly ["user", "remembered", "mesh_slot", "task_override", "provider_default", "unspecified"];
+import { type RoleLaunchSelection } from './role-launch';
+export declare const MODEL_AXIS_SOURCES: readonly ["user", "remembered", "stored_default", "project_default", "mesh_slot", "task_override", "provider_default", "unspecified"];
 export type ModelAxisSource = typeof MODEL_AXIS_SOURCES[number];
 export declare function isModelAxisSource(value: unknown): value is ModelAxisSource;
 /**
@@ -61,10 +41,18 @@ export interface ModelSelection {
     /** Last value the provider itself reported (statusline, native history). */
     observed?: string;
     observedAt?: number;
+    /**
+     * The provider SILENTLY substituted another model for the requested one
+     * (antigravity: `model X is not recognized … Using "Y" instead`). `observed`
+     * then holds the model actually running. P2P/launch-record only — the
+     * server path never carries it (see the content boundary above).
+     */
+    fallback?: boolean;
     /** Every value change in order. The last entry is the value in force. */
     history: ModelSelectionHistoryEntry[];
 }
 export interface SessionLaunchRecord {
+    roleLaunch?: RoleLaunchSelection;
     sessionId: string;
     providerType: string;
     providerVersion?: string;

package/dist/slot-proposal.d.ts

@@ -35,6 +35,13 @@ import { type MeshTaskDifficulty, type NodeCapabilitySlot } from './brain-routin
 export interface CliSlotRecipe {
     /** Optional model to pin on the slot. Best-effort at launch. */
     model?: string;
+    /**
+     * Optional ordered candidate models to prefer when the provider's live
+     * `modelOptions` (from model discovery) is present on `DetectedCliProvider`.
+     * The first candidate present in `modelOptions` wins; falls back to `model`
+     * when `modelOptions` is absent or contains none of the candidates.
+     */
+    modelCandidates?: readonly string[];
     /** Optional thinking level, in the provider's own vocabulary. */
     thinkingLevel?: string;
     /** Difficulty range this slot handles. Empty = general-purpose. */
@@ -76,6 +83,13 @@ export interface DetectedCliProvider {
     displayName?: string;
     /** Detected version, when known. Display only — never affects the mapping. */
     version?: string;
+    /**
+     * Live discovered / resolved `modelOptions` for this provider on the node,
+     * when available on the status catalog. When present and non-empty, recipes
+     * prefer the first matching model from `[recipe.model, ...recipe.modelCandidates]`
+     * that exists in `modelOptions`.
+     */
+    modelOptions?: readonly string[];
 }
 /** One proposed slot plus why it was proposed. */
 export interface ProposedSlotEntry {

package/dist/task-source-phase.d.ts

@@ -0,0 +1,75 @@
+import type { OwnedPathEntry } from './path-ownership';
+export type MeshTaskPhase = 'source' | 'integration';
+/** Host-produced evidence. Never accepted from MCP/peer-supplied paths or branch labels. */
+export interface PhysicalOwnershipScope {
+    version: 1;
+    repoIdentity: string;
+    machineId: string;
+    nodeId: string;
+    worktree: string;
+    worktreeIdentity: string;
+    gitDir: string;
+    commonGitDir: string;
+    phase: MeshTaskPhase;
+    gitResources: {
+        index: string;
+        refs: string;
+        hooks: string;
+        config: string;
+    };
+    resources: Array<{
+        path: string;
+        identity?: string;
+        subtree: boolean;
+    }>;
+    declaration: readonly OwnedPathEntry[];
+}
+/** A source packet is an input to integration, never release/feature acceptance. */
+export interface MeshSourceCandidate {
+    version: 1;
+    readiness: 'uncommitted' | 'verified_source_candidate';
+    taskId: string;
+    missionId: string;
+    revision: number;
+    repoIdentity: string;
+    machineId: string;
+    canonicalWorktree: string;
+    rootBaseSha: string;
+    ossBaseSha: string;
+    rootCandidateSha?: string;
+    ossCandidateSha?: string;
+    patchSha256: string;
+    manifestSha256: string;
+    touchedPaths: string[];
+    tests: Array<{
+        command: string;
+        exit: number;
+        logSha256: string;
+    }>;
+    settledCommands: boolean;
+    integrationTaskId: string;
+    logicalOverlapTaskIds: string[];
+}
+/** Product B consumes one frozen batch; normal hooks/parity/gates remain required. */
+export interface MeshIntegrationBatchContract {
+    version: 1;
+    batchId: string;
+    candidates: MeshSourceCandidate[];
+    integrationOrder: string[];
+    approvedRootSha: string;
+    approvedOssSha: string;
+    bundleInvocationCount: 1;
+    requiredGates: string[];
+    normalHooksRequired: true;
+    independentReviewRequired: true;
+    ownerLandingApprovalRequired: true;
+}
+/** These only rank legal targets; targetNodeId/SessionId and requiredTags remain hard. */
+export interface MeshRoutingPreferences {
+    nodeIds?: string[];
+    providers?: string[];
+}
+export interface MeshReviewConstraint {
+    sourceTaskId: string;
+    differentProvider: true;
+}