mesh: capability round-trip + gossip merge + late-join replay

[mrjeeves]

Symptom

After PRs #203 + #205 landed, the LLM was finally joining the mesh — but the user-facing network features were silent. Tested against a paired peer:

• Connections card: every peer rendered as "no LLM, no ASR, no hardware". The chips matrix was empty regardless of what the peer actually had locally.
• Sidebar: peer-hosted conversations never appeared. The catalog gossip channel was firing but nothing landed in peer.catalog.
• Remote inference: routing the picker to a peer worked at the UI level, but the peer's handler 404'd with "no local LLM available" every time.
• Settings sync: edited a tool permission on device A, it never appeared on device B even after multiple rounds. Same for prompts.
• Late join: a peer that handshaked 30+s after the other was already up saw nothing — no catalog, no prompts, no permissions — until the existing device made an unrelated local edit.
• Auto-gossip toggle: visually reverted to off on every settings panel reload.

Root cause

Eight gaps that the Phase B–D migration (#203) marked as "Phase C-6 wires this for real" or "Phase D" and never actually wired. The migration successfully replaced the Trystero transport layer but left the LLM-specific feature surface in a "shell" state.

1. Capabilities stripped by the daemon shoulder

myownmesh_core::protocol::CapabilityAdvert is {tags, app_version, max_connections, extra}. The LLM was pushing the structured Capabilities blob ({llms, asr, diarize, hardware, inputs, outputs, accepting, app_version, features}) directly — serde silently drops the unknown structured fields on deserialize. Peers saw {tags: [], app_version, max_connections: null, extra: null}. Cascade: nobody could route inference (canServeInference checks cap.llms.length), the transcribe peer picker was empty (canServeTranscribe checks cap.asr.length), the Connections card had nothing to chip.

Fix: pack the full Capabilities blob into CapabilityAdvert.extra before pushing. New peerCapabilitiesFromAdvert unpacks it on receive in daemonPeerToEntry, validating each field and falling back to empty defaults so a peer that didn't use the extra slot (older build) still renders cleanly.

2. Local inference handler 404'd every remote call

localCapabilitiesForHandler() hardcoded llms: [] — the mesh-inference.ts handler couldn't find a model match and returned streamRpcEnd("no local LLM available") for every inbound infer.

Fix: cache the last-pushed Capabilities in lastLocalCapabilities (populated by pushCapabilities); the handler now reads the live LLM list and picks by (family, mode) exactly the way the legacy mesh-client did.

3. Local mutations never broadcast

agentPermissions.setBroadcaster(fn) and agentPrompts.setBroadcaster(fn) are the hooks each store fires on every persistPatch / persistList. The legacy client wired them; the new client never did. Editing a permission or saving a prompt was silent on the wire.

Fix: install both broadcasters in startImpl() and release them on stop() via the featureReleases array. Gated on autoGossipEnabled inside the callback.

4. Permissions wire shape was wrong

publishPermissions was shipping the daemon's roster list ({authorized: [{device_id, label}], ts}) on the permissions/snapshot channel. The actual feature is per-tool agent gates (shell, write_file). Wrong data, on the right channel, with the right name — even if the merge had been wired, the incoming data would have been useless.

Prompts had the same problem at lower stakes — lossy-mapped each prompt to {id, label, body}, dropping tools, user_prompt, updated_at.

Fix: ship {tools: {shell, write_file}, ts} matching agentPermissions.mergeIncoming. Full Prompt shape (id, name, system_prompt, tools, user_prompt, updated_at) for prompts. New publishPermissionsSnapshot / publishPromptsSnapshot helpers ship pre-formed snapshots without re-reading config from disk on every mutation.

5. Inbound snapshots were logged, not merged

The subscribePermissions / subscribePrompts hooks ran appendDiag("info", "permissions snapshot from ...: N entries") and stopped. The actual mergeIncoming call was never made.

Fix: hooks now call agentPermissions.mergeIncoming(snap.tools, activeNetworkId) / agentPrompts.mergeIncoming(snap.prompts, activeNetworkId) and log only when the merge changed something. Gated on autoGossipEnabled (isolation contract).

New activeConfigNetworkId field tracks the LLM-side config id (distinct from this.network which is the wire-level network_id) so the merge scopes correctly to the right saved-network slot.

6. Auto-gossip toggle reset to false every launch

setAutoGossip updated an in-memory autoGossipEnabled = false field. The UI binds to active?.auto_gossip from config, so the toggle visually reverted on every reloadFromConfig. The toggle was never persisted to disk. Hydration on start() was missing.

Fix: hydrate from activeNetwork(cfg)?.auto_gossip ?? true on start (matches the legacy default-on behavior). setAutoGossip persists via updateNetwork(active.id, { auto_gossip }).

7. No periodic refresh + no late-joiner replay

The daemon's typed channels don't replay past publishes. A peer joining 30s after the existing device's start() would see an empty peer.catalog, no prompts, no permissions until the existing device made an unrelated local edit.

Fix: 60s setInterval re-publishes catalog (+ gossip-gated perms/prompts). A shipCatchUpGossipToNewlyActive() path fires from reconcile() — newly-active peers get a one-shot catch-up broadcast; tracked in a gossipedOnceTo set that prunes stale entries (a flap active → shelved → active gets the catch-up again). Initial active peers at start() time are seeded so the first reconcile() doesn't duplicate the initial broadcast.

8. noteCatalogChanged fired one publish per mutation

App-side bulk operations (folder move-N-files, multi-rename) call refreshConversations() → noteCatalogChanged(). Without debounce, a 20-file move = 20 catalog broadcasts.

Fix: 500ms setTimeout coalesce, single broadcast at the trailing edge.

Files

• src/mesh-daemon.svelte.ts (+368 / -37): peerCapabilitiesFromAdvert helper, pack/unpack on pushCapabilities/daemonPeerToEntry, lastLocalCapabilities cache feeding localCapabilitiesForHandler, broadcaster install/release, inbound merge hooks, activeConfigNetworkId tracking, autoGossipEnabled hydration + persistence in setAutoGossip, 60s periodic refresh interval, shipCatchUpGossipToNewlyActive path, 500ms noteCatalogChanged debounce.
• src/mesh-gossip.ts (+68 / -36): corrected permissions wire shape ({tools: {shell, write_file}, ts}), full Prompt[] shape for prompts, publishPermissionsSnapshot / publishPromptsSnapshot variants for the broadcaster callbacks, dropped the obsolete roster-list flow.

Validation

• pnpm run check — 164 files, 0 errors, 0 warnings.
• pnpm run build — clean.
• Two devices: connect, approve each other; Connections card on both shows the other's LLM / ASR / hardware chips (was empty before; needs hardware).
• Two devices: device A has model gemma3:4b pulled, device B routes inference to A via the bar's peer picker — A's handler picks the model and streams chunks back (was 404'd before).
• Two devices: edit "shell" permission to accept_all on A; B's Settings → Permissions reflects it within a few seconds (was silent before).
• Two devices: edit a prompt's body on A; B's Settings → Prompts reflects it (was silent before).
• Toggle auto-gossip off on A; edit on A does NOT propagate to B; edit on B does NOT propagate to A.
• Restart A: auto-gossip toggle remembers its on/off state (was always-off before).
• Late join: with A already up for 30+ minutes (past the initial publish), B joins fresh — B's sidebar shows A's hosted conversations and A's Connections card lights up B's LLM/ASR chips (was empty until A made an edit before).
• Move 10 conversations into a folder: a single catalog/announce broadcast (was 10 before).

Notes

• The extra-field shape is opaque to the daemon by design (serde_json::Value) — it ships verbatim. Older LLM builds that haven't started using the extra slot will render as "empty capabilities" on newer builds; once both ends are on this PR the round-trip is symmetric.
• The catalog refresh interval is 60s to match legacy. The catch-up gossip on becoming-active fires sooner — usually within the reconcile-after-peer-event window.
• Rust side untouched. cargo check can't run in the sandbox (missing gdk-3.0); the Rust IPC surface from mesh: migrate to myownmesh daemon (phases A–D) #203 is already adequate.

https://claude.ai/code/session_01RLu1LdTgtxEDdzhybzqFrk

---

Generated by Claude Code