@indigoai-us/hq-cli 5.108.14 → 5.108.15

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## [Unreleased]
 
+## [5.108.15] — 2026-09-07
+
+### Fixed
+
+- Work Mesh Live presence daemon (`hq mesh daemon run`) no longer pins a CPU
+  core when the MQTT broker accepts a connection then closes it just past the
+  stable-connect grace window. The full-jitter reconnect backoff could collapse
+  to ~0 ms after the connect handler reset its counters, producing a tight
+  accept-then-close reconnect spin (each pass re-ran the SigV4 presign and
+  re-materialised the daemon state dir) with no network progress and no log
+  output. A hard `RECONNECT_MIN_DELAY_MS` (1s) floor now applies to every
+  reconnect path — normal backoff, the post-grace reset, and the refused-retry
+  path (which a server `Retry-After: 0` could otherwise drive to 0) — so the
+  delay can never shrink below 1s. Regression tests cover the reset and the
+  refused-retry floor. (#524)
+- The Work Mesh Live daemon no longer burns CPU in a self-triggered flush loop.
+  Its spool directory watcher woke on files the daemon writes itself during a
+  flush (`held.jsonl` and the `*.claimed` files), so any box with held events
+  flushed every two seconds forever; the watcher now reacts only to producer
+  appends to `spool.jsonl`. Recovering a very large orphan claim file no longer
+  overflows the stack, mid-flush disposal is O(1), held events are re-attempted
+  at most every five minutes, and `held.jsonl` is capped at 20,000 lines with
+  the oldest overflow dead-lettered as `HELD_OVERFLOW` (loss-free under failure
+  and concurrent flushers). (#525)
+
 ## [5.108.14] — 2026-09-07
 
 ### Fixed

package/dist/lib/mesh/live/daemon/presence.d.ts

@@ -20,6 +20,20 @@ export type MqttConnectionState = "idle" | "connecting" | "connected" | "reconne
  * then closes immediately after a denied publish).
  */
 export declare const CONNECT_STABLE_GRACE_MS = 5000;
+/**
+ * Hard floor for the delay between MQTT presence reconnect attempts.
+ *
+ * The full-jitter backoff can otherwise compute ~0 ms: after a connection
+ * survives {@link CONNECT_STABLE_GRACE_MS} the connect handler resets both
+ * `attempt` and `lastBackoffMs` to 0, so a broker that accepts-then-closes just
+ * past the grace window makes the next `backoffDelayMs(0, base, cap, random, 0)`
+ * return `random() * base` — frequently a handful of ms, or 0 when `random()`
+ * is near 0. That produces a tight reconnect loop (each pass re-runs the SigV4
+ * presign and re-materialises the daemon state dir) that pins a CPU core with
+ * no network progress and no log output. This floor guarantees every reconnect
+ * waits at least this long regardless of the backoff/grace-reset state.
+ */
+export declare const RECONNECT_MIN_DELAY_MS = 1000;
 /** Always emit the first N close info lines, then at most one per interval. */
 export declare const CLOSE_LOG_ALWAYS_COUNT = 3;
 export declare const CLOSE_LOG_INTERVAL_MS = 60000;
@@ -69,9 +83,13 @@ export interface PresenceClientOptions {
 }
 /**
  * Full-jitter capped exponential backoff (1s base → 60s cap by default),
- * floored at `previousMs` so consecutive failures never shrink the delay.
+ * floored at `previousMs` so consecutive failures never shrink the delay and at
+ * `minMs` so the result can never collapse to ~0 (see
+ * {@link RECONNECT_MIN_DELAY_MS}). The `minMs` floor is what prevents the
+ * accept-then-close reconnect spin after the connect handler resets the
+ * backoff counters.
  */
-export declare function backoffDelayMs(attempt: number, baseMs: number, maxMs: number, random: () => number, previousMs?: number): number;
+export declare function backoffDelayMs(attempt: number, baseMs: number, maxMs: number, random: () => number, previousMs?: number, minMs?: number): number;
 export declare function buildPresencePayload(input: {
     status: "online" | "offline";
     actorUid: string;

package/dist/lib/mesh/live/daemon/presence.js

@@ -20,17 +20,35 @@ import { presignIotWssUrl } from "./presign.js";
  * then closes immediately after a denied publish).
  */
 export const CONNECT_STABLE_GRACE_MS = 5_000;
+/**
+ * Hard floor for the delay between MQTT presence reconnect attempts.
+ *
+ * The full-jitter backoff can otherwise compute ~0 ms: after a connection
+ * survives {@link CONNECT_STABLE_GRACE_MS} the connect handler resets both
+ * `attempt` and `lastBackoffMs` to 0, so a broker that accepts-then-closes just
+ * past the grace window makes the next `backoffDelayMs(0, base, cap, random, 0)`
+ * return `random() * base` — frequently a handful of ms, or 0 when `random()`
+ * is near 0. That produces a tight reconnect loop (each pass re-runs the SigV4
+ * presign and re-materialises the daemon state dir) that pins a CPU core with
+ * no network progress and no log output. This floor guarantees every reconnect
+ * waits at least this long regardless of the backoff/grace-reset state.
+ */
+export const RECONNECT_MIN_DELAY_MS = 1_000;
 /** Always emit the first N close info lines, then at most one per interval. */
 export const CLOSE_LOG_ALWAYS_COUNT = 3;
 export const CLOSE_LOG_INTERVAL_MS = 60_000;
 /**
  * Full-jitter capped exponential backoff (1s base → 60s cap by default),
- * floored at `previousMs` so consecutive failures never shrink the delay.
+ * floored at `previousMs` so consecutive failures never shrink the delay and at
+ * `minMs` so the result can never collapse to ~0 (see
+ * {@link RECONNECT_MIN_DELAY_MS}). The `minMs` floor is what prevents the
+ * accept-then-close reconnect spin after the connect handler resets the
+ * backoff counters.
  */
-export function backoffDelayMs(attempt, baseMs, maxMs, random, previousMs = 0) {
+export function backoffDelayMs(attempt, baseMs, maxMs, random, previousMs = 0, minMs = 0) {
     const cap = Math.min(maxMs, baseMs * 2 ** attempt);
     const raw = Math.max(0, random() * cap);
-    return Math.min(maxMs, Math.max(previousMs, raw));
+    return Math.min(maxMs, Math.max(previousMs, raw, minMs));
 }
 export function buildPresencePayload(input) {
     return {
@@ -341,12 +359,14 @@ export class PresenceClient {
             else {
                 delay = refusedRetryDelayMs(this.refusedRetryMs, this.random);
             }
-            delay = clampRetryDelayMs(delay);
+            // Floor the refused retry too: a server `Retry-After: 0` (or a 0 env
+            // override) would otherwise clamp to 0 and hot-loop the refused path.
+            delay = Math.max(RECONNECT_MIN_DELAY_MS, clampRetryDelayMs(delay));
             const nextRetryAt = new Date(this.timers.now() + delay).toISOString();
             this.noteRefusal(refused, nextRetryAt);
         }
         else {
-            delay = backoffDelayMs(this.attempt, this.baseBackoffMs, this.maxBackoffMs, this.random, this.lastBackoffMs);
+            delay = backoffDelayMs(this.attempt, this.baseBackoffMs, this.maxBackoffMs, this.random, this.lastBackoffMs, RECONNECT_MIN_DELAY_MS);
             this.lastBackoffMs = delay;
             this.attempt += 1;
             // Do not clear refusal here — MQTT close must retain doctor/status refusal

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -15,6 +15,16 @@ import { PresenceClient, type MqttConnectFn } from "./presence.js";
 import { TranscriptWatcher, type TranscriptFs } from "./transcript-watch.js";
 export declare const SPOOL_DEBOUNCE_MS = 2000;
 export declare const FLUSH_INTERVAL_MS = 10000;
+/**
+ * Only producer appends to spool.jsonl should wake the watcher. Every other
+ * file in the work-mesh root (held.jsonl, spool.<ts>.claimed, held.<ts>.claimed,
+ * live-cache.json, dead-letter.jsonl, ...) is written by the daemon itself
+ * during a flush; reacting to those turned each flush into a self-triggered
+ * flush 2s later, forever (observed ~1,750 watch flushes/hour and >50% of a
+ * core on fleet boxes with a non-empty held file). A null filename (platforms
+ * that do not report one) keeps the conservative behaviour and flushes.
+ */
+export declare function shouldFlushOnSpoolDirEvent(filename: string | Buffer | null | undefined): boolean;
 export interface DaemonRunDeps {
     home?: string;
     env?: NodeJS.ProcessEnv;

package/dist/lib/mesh/live/daemon/run.js

@@ -17,7 +17,7 @@ import { ensureCognitoToken } from "../../../../utils/cognito-session.js";
 import { replayOutbox } from "../../../work-context/outbox.js";
 import { workContextRoot } from "../../../work-context/paths.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../session-events-client.js";
-import { flushSessionEvents } from "../flush.js";
+import { flushSessionEvents, HELD_RETRY_INTERVAL_MS, } from "../flush.js";
 import { workMeshRoot, workMeshSpoolPath } from "../paths.js";
 import { createVaultBoardReader, refreshBoundSessionBoards, BOARD_REFRESH_INTERVAL_MS, } from "./board-refresh.js";
 import { createContract3Fetcher, realTimerHost, } from "./credentials.js";
@@ -30,6 +30,20 @@ import { workMeshHeldPath } from "../paths.js";
 import { noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, TranscriptWatcher, } from "./transcript-watch.js";
 export const SPOOL_DEBOUNCE_MS = 2_000;
 export const FLUSH_INTERVAL_MS = 10_000;
+/**
+ * Only producer appends to spool.jsonl should wake the watcher. Every other
+ * file in the work-mesh root (held.jsonl, spool.<ts>.claimed, held.<ts>.claimed,
+ * live-cache.json, dead-letter.jsonl, ...) is written by the daemon itself
+ * during a flush; reacting to those turned each flush into a self-triggered
+ * flush 2s later, forever (observed ~1,750 watch flushes/hour and >50% of a
+ * core on fleet boxes with a non-empty held file). A null filename (platforms
+ * that do not report one) keeps the conservative behaviour and flushes.
+ */
+export function shouldFlushOnSpoolDirEvent(filename) {
+    if (filename === null || filename === undefined)
+        return true;
+    return String(filename) === "spool.jsonl";
+}
 function alive(pid) {
     try {
         process.kill(pid, 0);
@@ -76,6 +90,8 @@ export async function runMeshDaemon(deps = {}) {
     // daemon went dark once its IoT credentials expired.
     const defaultGetToken = async () => ensureCognitoToken({ interactive: false, tokenSource: "machine" });
     const getToken = deps.getToken ?? defaultGetToken;
+    /** In-memory held re-attempt throttle (survives watch-triggered flushes). */
+    let lastHeldRetryAtMs = 0;
     const flushFn = deps.flush ??
         (async () => {
             const t = await getToken();
@@ -87,6 +103,12 @@ export async function runMeshDaemon(deps = {}) {
                 workMeshRoot: meshRoot,
                 workContextRoot: ctxRoot,
                 poster,
+                heldRetryIntervalMs: HELD_RETRY_INTERVAL_MS,
+                lastHeldRetryAtMs,
+                onHeldClaimed: (atMs) => {
+                    lastHeldRetryAtMs = atMs;
+                },
+                log: (message) => log(dir, message),
             });
         });
     const replayFn = deps.replayOutbox ??
@@ -243,7 +265,10 @@ export async function runMeshDaemon(deps = {}) {
                     lastFlushAt: now().toISOString(),
                     lastFlushResult: { ...summary, ok: true },
                 }, now);
-                if (summary.claimed > 0 || summary.posted > 0 || summary.held > 0) {
+                if (summary.claimed > 0 ||
+                    summary.posted > 0 ||
+                    summary.held > 0 ||
+                    (summary.heldOverflow ?? 0) > 0) {
                     log(dir, `flush(${reason}): claimed=${summary.claimed} posted=${summary.posted} held=${summary.held}`);
                 }
             }
@@ -292,11 +317,7 @@ export async function runMeshDaemon(deps = {}) {
         watcher = fs.watch(path.dirname(spoolPath), { persistent: true }, (_event, filename) => {
             if (stopped)
                 return;
-            if (!filename ||
-                filename === "spool.jsonl" ||
-                filename === "held.jsonl" ||
-                String(filename).startsWith("spool.") ||
-                String(filename).startsWith("held.")) {
+            if (shouldFlushOnSpoolDirEvent(filename)) {
                 scheduleDebouncedFlush();
             }
         });

package/dist/lib/mesh/live/flush.d.ts

@@ -11,7 +11,11 @@
 import { type RandomFn, type SleepFn } from "./backoff.js";
 import { type SessionEventsPoster } from "./session-events-client.js";
 export declare const HELD_TTL_MS: number;
-export type HeldReason = "STATE_ABSENT" | "NEEDS_COMPANY" | "COMPANY_CONFLICT" | "HELD_EXPIRED";
+/** Re-attempt held events at most this often (spool still flushes every cycle). */
+export declare const HELD_RETRY_INTERVAL_MS: number;
+/** Cap held.jsonl size; oldest overflow is dead-lettered with HELD_OVERFLOW. */
+export declare const HELD_MAX_LINES = 20000;
+export type HeldReason = "STATE_ABSENT" | "NEEDS_COMPANY" | "COMPANY_CONFLICT" | "HELD_EXPIRED" | "HELD_OVERFLOW";
 export interface HeldLineRecord {
     /** Original spool event fields. */
     event: Record<string, unknown>;
@@ -26,6 +30,19 @@ export interface FlushDeps {
     sleep?: SleepFn;
     random?: RandomFn;
     maxAttempts?: number;
+    /**
+     * Minimum gap between held re-attempts. Default HELD_RETRY_INTERVAL_MS.
+     * Pass 0 in tests to re-claim held every flush.
+     */
+    heldRetryIntervalMs?: number;
+    /** Epoch ms of the last flush that claimed held (daemon keeps this in memory). */
+    lastHeldRetryAtMs?: number;
+    /** Invoked when this flush claims held, so the daemon can advance its timestamp. */
+    onHeldClaimed?: (atMs: number) => void;
+    /** Max lines retained in held.jsonl after a flush. Default HELD_MAX_LINES. */
+    heldMaxLines?: number;
+    /** Optional logger (daemon wires this); used once per overflow trim. */
+    log?: (message: string) => void;
 }
 export interface FlushSummary {
     claimed: number;
@@ -35,6 +52,10 @@ export interface FlushSummary {
     deadLettered: number;
     restored: number;
     batches: number;
+    /** True when this flush claimed/re-read held.jsonl. */
+    heldClaimed?: boolean;
+    /** Oldest held lines dead-lettered this flush due to HELD_MAX_LINES. */
+    heldOverflow?: number;
 }
 /**
  * Flush spool + held. Safe to call concurrently with enqueue (claim-by-rename).

package/dist/lib/mesh/live/flush.js

@@ -15,9 +15,13 @@ import { workContextRoot } from "../../work-context/paths.js";
 import { defaultSleep, FLUSH_MAX_ATTEMPTS, fullJitterDelayMs, } from "./backoff.js";
 import { LOCAL_ONLY_FIELDS, stripLocalOnlyFields } from "./format-spool-line.js";
 import { SESSION_EVENTS_BATCH_MAX, WRITABLE_CONTEXT_STATUSES, parseSessionEventsBatchAck, } from "./session-events-client.js";
-import { appendDeadLetterLine, appendDroppedReceipt, appendHeldLine, appendSpoolLine, claimHeld, claimSpool, recoverOrphanClaims, removeClaimFile, } from "./spool.js";
-import { workMeshRoot } from "./paths.js";
+import { appendDeadLetterLine, appendDroppedReceipt, appendHeldLine, appendSpoolLine, claimHeld, claimSpool, countJsonlLines, ensureSpoolFile, recoverOrphanClaims, removeClaimFile, } from "./spool.js";
+import { workMeshHeldPath, workMeshRoot } from "./paths.js";
 export const HELD_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+/** Re-attempt held events at most this often (spool still flushes every cycle). */
+export const HELD_RETRY_INTERVAL_MS = 5 * 60 * 1000;
+/** Cap held.jsonl size; oldest overflow is dead-lettered with HELD_OVERFLOW. */
+export const HELD_MAX_LINES = 20_000;
 function parseLine(line) {
     try {
         const v = JSON.parse(line);
@@ -101,10 +105,22 @@ export async function flushSessionEvents(deps) {
     const sleep = deps.sleep ?? defaultSleep;
     const random = deps.random ?? Math.random;
     const maxAttempts = deps.maxAttempts ?? FLUSH_MAX_ATTEMPTS;
-    const ts = `${now().getTime()}`;
+    const heldRetryIntervalMs = deps.heldRetryIntervalMs ?? HELD_RETRY_INTERVAL_MS;
+    const heldMaxLines = deps.heldMaxLines ?? HELD_MAX_LINES;
+    const nowMs = now().getTime();
+    const ts = `${nowMs}`;
     const orphans = recoverOrphanClaims(deps.workMeshRoot);
     const spoolClaim = claimSpool(deps.workMeshRoot, ts);
-    const heldClaim = claimHeld(deps.workMeshRoot, `${ts}.held`);
+    // Throttle held re-attempts; spool (fresh) events still flush every cycle.
+    const lastHeldRetryAtMs = deps.lastHeldRetryAtMs ?? 0;
+    const shouldClaimHeld = heldRetryIntervalMs <= 0 ||
+        nowMs - lastHeldRetryAtMs >= heldRetryIntervalMs;
+    const heldClaim = shouldClaimHeld
+        ? claimHeld(deps.workMeshRoot, `${ts}.held`)
+        : { claimPath: null, lines: [] };
+    if (shouldClaimHeld) {
+        deps.onHeldClaimed?.(nowMs);
+    }
     const claimPaths = [
         ...orphans.claimPaths,
         spoolClaim.claimPath,
@@ -118,42 +134,45 @@ export async function flushSessionEvents(deps) {
         deadLettered: 0,
         restored: 0,
         batches: 0,
+        heldClaimed: shouldClaimHeld,
+        heldOverflow: 0,
     };
-    /** Original events still awaiting disposition (restored on throw). */
-    const pendingRestore = [];
+    /** Original events still awaiting disposition (restored on throw). O(1) delete. */
+    const pendingRestore = new Set();
     const collected = [];
     try {
-        for (const line of [...orphans.lines, ...spoolClaim.lines, ...heldClaim.lines]) {
-            summary.claimed += 1;
-            const parsed = parseLine(line);
-            if (!parsed) {
-                appendDeadLetterLine(deadLetterEnvelope({ raw: line.slice(0, 200) }, "SCHEMA_REJECTED", "parse_error", now().toISOString()), deps.workMeshRoot);
-                summary.deadLettered += 1;
-                continue;
-            }
-            const { event, heldAt } = unwrapHeld(parsed);
-            if (!sessionIdOf(event)) {
-                appendDeadLetterLine(deadLetterEnvelope(event, "SCHEMA_REJECTED", "missing_sessionId", now().toISOString()), deps.workMeshRoot);
-                summary.deadLettered += 1;
-                continue;
-            }
-            // Expire held lines older than 7 days.
-            if (heldAt) {
-                const age = now().getTime() - Date.parse(heldAt);
-                if (Number.isFinite(age) && age > HELD_TTL_MS) {
-                    appendDeadLetterLine(deadLetterEnvelope(event, "HELD_EXPIRED", "held_ttl", now().toISOString()), deps.workMeshRoot);
+        // Iterate sources separately — avoid building one giant combined array.
+        for (const source of [orphans.lines, spoolClaim.lines, heldClaim.lines]) {
+            for (const line of source) {
+                summary.claimed += 1;
+                const parsed = parseLine(line);
+                if (!parsed) {
+                    appendDeadLetterLine(deadLetterEnvelope({ raw: line.slice(0, 200) }, "SCHEMA_REJECTED", "parse_error", now().toISOString()), deps.workMeshRoot);
+                    summary.deadLettered += 1;
+                    continue;
+                }
+                const { event, heldAt } = unwrapHeld(parsed);
+                if (!sessionIdOf(event)) {
+                    appendDeadLetterLine(deadLetterEnvelope(event, "SCHEMA_REJECTED", "missing_sessionId", now().toISOString()), deps.workMeshRoot);
                     summary.deadLettered += 1;
                     continue;
                 }
+                // Expire held lines older than 7 days.
+                if (heldAt) {
+                    const age = now().getTime() - Date.parse(heldAt);
+                    if (Number.isFinite(age) && age > HELD_TTL_MS) {
+                        appendDeadLetterLine(deadLetterEnvelope(event, "HELD_EXPIRED", "held_ttl", now().toISOString()), deps.workMeshRoot);
+                        summary.deadLettered += 1;
+                        continue;
+                    }
+                }
+                pendingRestore.add(event);
+                collected.push({ event, heldAt });
             }
-            pendingRestore.push(event);
-            collected.push({ event, heldAt });
         }
         const bySession = groupBySession(collected);
         const markDisposed = (event) => {
-            const idx = pendingRestore.indexOf(event);
-            if (idx >= 0)
-                pendingRestore.splice(idx, 1);
+            pendingRestore.delete(event);
         };
         for (const [sessionId, items] of bySession) {
             const state = readSessionState(sessionId, deps.workContextRoot);
@@ -238,13 +257,100 @@ export async function flushSessionEvents(deps) {
                 /* best-effort; orphan claim scan will retry next flush */
             }
         }
-        pendingRestore.length = 0;
+        pendingRestore.clear();
         for (const p of claimPaths) {
             removeClaimFile(p);
         }
     }
+    const overflowed = trimHeldOverflow(deps.workMeshRoot, heldMaxLines, now, summary);
+    if (overflowed > 0) {
+        deps.log?.(`held overflow: dead-lettered ${overflowed} oldest events (cap=${heldMaxLines})`);
+    }
     return summary;
 }
+/**
+ * After a flush, if held.jsonl exceeds maxLines, dead-letter the oldest
+ * overflow (by heldAt, not file position) with HELD_OVERFLOW and keep the rest.
+ *
+ * Durability rules:
+ * - Retained lines are APPENDED to held.jsonl, never written over it: another
+ *   flusher (`hq mesh flush` beside the daemon) may have appended to a fresh
+ *   held.jsonl after our claim renamed the old one away.
+ * - The overflow claim file is removed only after every dead letter and every
+ *   retained line is on disk. If anything throws, the claim stays behind and
+ *   recoverOrphanClaims re-reads it on the next flush (duplicates are possible,
+ *   loss is not).
+ */
+function trimHeldOverflow(meshRoot, maxLines, now, summary) {
+    if (maxLines <= 0)
+        return 0;
+    const heldPath = workMeshHeldPath(meshRoot);
+    if (countJsonlLines(heldPath) <= maxLines)
+        return 0;
+    const claim = claimHeld(meshRoot, `${now().getTime()}.overflow`);
+    if (!claim.claimPath)
+        return 0;
+    if (claim.lines.length === 0) {
+        removeClaimFile(claim.claimPath);
+        return 0;
+    }
+    try {
+        if (claim.lines.length <= maxLines) {
+            appendHeldLines(meshRoot, claim.lines);
+            removeClaimFile(claim.claimPath);
+            return 0;
+        }
+        const overflow = claim.lines.length - maxLines;
+        // Oldest by heldAt: retries regroup held by session, so file order is not
+        // chronological. Unparseable lines sort first (dead-lettered first).
+        const ordered = claim.lines
+            .map((line, idx) => ({ line, idx, atMs: heldAtMs(line) }))
+            .sort((a, b) => a.atMs - b.atMs || a.idx - b.idx);
+        const toDead = ordered.slice(0, overflow);
+        const toKeep = ordered
+            .slice(overflow)
+            .sort((a, b) => a.idx - b.idx)
+            .map((x) => x.line);
+        const at = now().toISOString();
+        for (const { line } of toDead) {
+            const parsed = parseLine(line);
+            if (!parsed) {
+                appendDeadLetterLine(deadLetterEnvelope({ raw: line.slice(0, 200) }, "HELD_OVERFLOW", "held_max_lines", at), meshRoot);
+            }
+            else {
+                const { event } = unwrapHeld(parsed);
+                appendDeadLetterLine(deadLetterEnvelope(event, "HELD_OVERFLOW", "held_max_lines", at), meshRoot);
+            }
+            summary.deadLettered += 1;
+        }
+        appendHeldLines(meshRoot, toKeep);
+        summary.heldOverflow = overflow;
+        removeClaimFile(claim.claimPath);
+        return overflow;
+    }
+    catch {
+        // Leave the claim for orphan recovery; never drop held events on a failed trim.
+        return 0;
+    }
+}
+/** heldAt of a held line as epoch ms; 0 when missing or unparseable. */
+function heldAtMs(line) {
+    const parsed = parseLine(line);
+    if (!parsed)
+        return 0;
+    const { heldAt } = unwrapHeld(parsed);
+    if (!heldAt)
+        return 0;
+    const ms = Date.parse(heldAt);
+    return Number.isFinite(ms) ? ms : 0;
+}
+function appendHeldLines(meshRoot, lines) {
+    if (lines.length === 0)
+        return;
+    const heldPath = workMeshHeldPath(meshRoot);
+    ensureSpoolFile(heldPath);
+    fs.appendFileSync(heldPath, `${lines.join("\n")}\n`, { mode: 0o600 });
+}
 /**
  * Account a 2xx batch: dead-letter rejected eventIds with their codes;
  * count accepted+duplicates as posted; restore any eventId not accounted for.

package/dist/lib/mesh/live/index.d.ts

@@ -13,7 +13,7 @@ export { workMeshClaimPath, workMeshDeadLetterPath, workMeshDroppedReceiptPath,
 export { SPOOL_LINE_MAX_BYTES, SpoolWriteError, appendDeadLetterLine, appendDroppedReceipt, appendHeldLine, appendJsonlLine, appendSpoolLine, claimHeld, claimJsonlByRename, claimSpool, countJsonlLines, deadLetterNonEmpty, ensureSpoolFile, removeClaimFile, } from "./spool.js";
 export { CLI_KIND_TO_SCHEMA, EnqueueValidationError, enqueueSessionEvent, resolveEnqueueSessionId, } from "./enqueue.js";
 export type { EnqueueOptions, EnqueueResult } from "./enqueue.js";
-export { HELD_TTL_MS, assertNoBindCacheAccess, bindCacheExists, defaultFlushRoots, flushSessionEvents, sessionsBindPath, } from "./flush.js";
+export { HELD_MAX_LINES, HELD_RETRY_INTERVAL_MS, HELD_TTL_MS, assertNoBindCacheAccess, bindCacheExists, defaultFlushRoots, flushSessionEvents, sessionsBindPath, } from "./flush.js";
 export type { FlushDeps, FlushSummary, HeldReason } from "./flush.js";
 export { BACKOFF_BASE_MS, BACKOFF_CAP_MS, FLUSH_MAX_ATTEMPTS, defaultSleep, fullJitterDelayMs, } from "./backoff.js";
 export { SESSION_EVENTS_BATCH_MAX, SESSION_EVENTS_PATH, WRITABLE_CONTEXT_STATUSES, classifySessionEventsResponse, createSessionEventsPoster, resolveVaultApiBase, } from "./session-events-client.js";

package/dist/lib/mesh/live/index.js

@@ -9,7 +9,7 @@ export { encodeCrockford, generateUlid, isUlid } from "./ulid.js";
 export { workMeshClaimPath, workMeshDeadLetterPath, workMeshDroppedReceiptPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "./paths.js";
 export { SPOOL_LINE_MAX_BYTES, SpoolWriteError, appendDeadLetterLine, appendDroppedReceipt, appendHeldLine, appendJsonlLine, appendSpoolLine, claimHeld, claimJsonlByRename, claimSpool, countJsonlLines, deadLetterNonEmpty, ensureSpoolFile, removeClaimFile, } from "./spool.js";
 export { CLI_KIND_TO_SCHEMA, EnqueueValidationError, enqueueSessionEvent, resolveEnqueueSessionId, } from "./enqueue.js";
-export { HELD_TTL_MS, assertNoBindCacheAccess, bindCacheExists, defaultFlushRoots, flushSessionEvents, sessionsBindPath, } from "./flush.js";
+export { HELD_MAX_LINES, HELD_RETRY_INTERVAL_MS, HELD_TTL_MS, assertNoBindCacheAccess, bindCacheExists, defaultFlushRoots, flushSessionEvents, sessionsBindPath, } from "./flush.js";
 export { BACKOFF_BASE_MS, BACKOFF_CAP_MS, FLUSH_MAX_ATTEMPTS, defaultSleep, fullJitterDelayMs, } from "./backoff.js";
 export { SESSION_EVENTS_BATCH_MAX, SESSION_EVENTS_PATH, WRITABLE_CONTEXT_STATUSES, classifySessionEventsResponse, createSessionEventsPoster, resolveVaultApiBase, } from "./session-events-client.js";
 export * from "./daemon/index.js";

package/dist/lib/mesh/live/spool.js

@@ -153,7 +153,12 @@ export function recoverOrphanClaims(root) {
     const claimPaths = listOrphanClaimFiles(root);
     const lines = [];
     for (const p of claimPaths) {
-        lines.push(...readClaimFileLines(p));
+        // Plain loop: Array#push(...huge) exceeds V8's argument limit (~65k–128k)
+        // and throws RangeError ("Maximum call stack size exceeded").
+        const orphanLines = readClaimFileLines(p);
+        for (const line of orphanLines) {
+            lines.push(line);
+        }
     }
     return { lines, claimPaths };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.108.14",
+  "version": "5.108.15",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {