@indigoai-us/hq-cli 5.108.24 → 5.108.26

package/dist/lib/mesh/live/backfill-held.js

@@ -22,7 +22,65 @@
 import * as fs from "node:fs";
 import { readSessionState } from "../../work-context/state.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "../../work-context/contract.js";
+import { resolveCompany } from "../../work-context/company.js";
+import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../../work-context/repo-remote.js";
 import { workMeshHeldPath } from "./paths.js";
+/**
+ * Build the reconcile observation for one held session, forwarding the company
+ * evidence its events recorded (cwd / hqRoot / bound companySlug / project /
+ * task). The event's own companySlug is trusted explicit — it is the company
+ * the session was bound to when the events were emitted on this box.
+ */
+export function observationFromHeldRef(ref, contractVersion, clientOperationId) {
+    const obs = {
+        contractVersion,
+        identity: ref.harness
+            ? { sessionId: ref.sessionId, harness: ref.harness }
+            : { sessionId: ref.sessionId },
+        clientOperationId,
+    };
+    if (ref.cwd)
+        obs.cwd = ref.cwd;
+    if (ref.hqRoot)
+        obs.hqRoot = ref.hqRoot;
+    if (ref.companySlug || ref.project || ref.task) {
+        obs.explicit = {
+            ...(ref.companySlug ? { companySlug: ref.companySlug } : {}),
+            ...(ref.project ? { projectId: ref.project } : {}),
+            ...(ref.task ? { taskId: ref.task } : {}),
+        };
+    }
+    return obs;
+}
+/**
+ * Default dry-run predictor: run the shared `resolveCompany` over the same
+ * evidence the write path forwards. Returns true when a company WOULD resolve
+ * (so dry-run's `reconciled` count matches the write run's). Purely local:
+ * reads config / meta / git-remote, never the network. A slug-only resolution
+ * that later fails online membership validation is the one narrow case where
+ * the write run can still under-count; the gross all-or-nothing mismatch is
+ * gone because both paths key off this same resolver + evidence.
+ */
+function defaultPredictCompany(ref, workContextRoot, remoteOwnerHint, env) {
+    const remoteOwnerSlug = remoteOwnerHint?.trim() ||
+        (ref.cwd
+            ? deriveRemoteOwnerSlug({ cwd: ref.cwd, hqRoot: ref.hqRoot }) ?? undefined
+            : undefined);
+    const repoIdentityKey = ref.cwd
+        ? deriveRepoIdentityKey({ cwd: ref.cwd })
+        : null;
+    const resolution = resolveCompany({
+        root: workContextRoot,
+        sessionId: ref.sessionId,
+        env,
+        trusted: ref.companySlug ? { companySlug: ref.companySlug } : undefined,
+        cwd: ref.cwd,
+        hqRoot: ref.hqRoot,
+        remoteOwnerSlug,
+        repoIdentityKey,
+    });
+    return resolution.status === "resolved";
+}
 /**
  * Read held.jsonl and return distinct sessions (first occurrence wins),
  * carrying the harness from whichever held event we saw first for that session.
@@ -65,10 +123,27 @@ export function readHeldSessions(workMeshRoot) {
             : null;
         if (!sessionId || seen.has(sessionId))
             continue;
-        const harness = typeof event.harness === "string" && event.harness.trim()
-            ? event.harness.trim()
-            : undefined;
-        seen.set(sessionId, { sessionId, harness });
+        const str = (v) => typeof v === "string" && v.trim() ? v.trim() : undefined;
+        const ref = { sessionId };
+        const harness = str(event.harness);
+        if (harness)
+            ref.harness = harness;
+        const cwd = str(event.cwd);
+        if (cwd)
+            ref.cwd = cwd;
+        const hqRoot = str(event.hqRoot);
+        if (hqRoot)
+            ref.hqRoot = hqRoot;
+        const companySlug = str(event.companySlug);
+        if (companySlug)
+            ref.companySlug = companySlug;
+        const project = str(event.project);
+        if (project)
+            ref.project = project;
+        const task = str(event.task);
+        if (task)
+            ref.task = task;
+        seen.set(sessionId, ref);
     }
     return [...seen.values()];
 }
@@ -81,7 +156,10 @@ export async function backfillHeldSessions(deps) {
     const limit = deps.limit && deps.limit > 0 ? deps.limit : 0;
     const contractVersion = deps.contractVersion ?? WORK_CONTEXT_CONTRACT_VERSION;
     const readState = deps.readState ?? readSessionState;
+    const env = deps.env ?? process.env;
     const newOperationId = deps.newOperationId ?? (() => globalThis.crypto.randomUUID());
+    const predictCompany = deps.predictCompany ??
+        ((ref) => defaultPredictCompany(ref, deps.workContextRoot, deps.remoteOwnerHint, env));
     const sessions = readHeldSessions(deps.workMeshRoot);
     const considered = limit > 0 ? sessions.slice(0, limit) : sessions;
     const result = {
@@ -93,23 +171,27 @@ export async function backfillHeldSessions(deps) {
         errors: 0,
         dryRun,
     };
-    for (const { sessionId, harness } of considered) {
+    for (const ref of considered) {
+        const { sessionId, harness } = ref;
         const state = readState(sessionId, deps.workContextRoot);
         if (state?.companyUid) {
             result.alreadyAttributed += 1;
             continue;
         }
         if (dryRun) {
-            // Would reconcile: no state read/write beyond the skip check above.
-            result.reconciled += 1;
-            deps.log?.(`would reconcile ${sessionId}${harness ? ` (${harness})` : ""}`);
+            // Predict with the SAME evidence + resolver the write path uses, so the
+            // dry-run counts match a real run (no blanket would-reconcile).
+            if (predictCompany(ref)) {
+                result.reconciled += 1;
+                deps.log?.(`would reconcile ${sessionId}${harness ? ` (${harness})` : ""}`);
+            }
+            else {
+                result.unresolved += 1;
+                deps.log?.(`would stay unresolved ${sessionId} (no company evidence)`);
+            }
             continue;
         }
-        const obs = {
-            contractVersion,
-            identity: harness ? { sessionId, harness } : { sessionId },
-            clientOperationId: newOperationId(),
-        };
+        const obs = observationFromHeldRef(ref, contractVersion, newOperationId());
         try {
             const outcome = await deps.reconcile(obs);
             if (outcome.result.companyUid) {

package/dist/lib/mesh/live/daemon/doctor.d.ts

@@ -10,6 +10,10 @@ export interface DaemonDoctorReport {
     pid?: number;
     mqttState: string;
     companiesOnline: string[];
+    /** Daemon emit mode: "legacy" (spool/flush) or "direct" (receive-only). */
+    emitMode: "legacy" | "direct";
+    /** True when the receive subscriber is connected (mqtt connected). */
+    subscribed: boolean;
     spoolDepth: number;
     heldCount: number;
     deadLetterCount: number;
@@ -25,6 +29,17 @@ export interface DaemonDoctorReport {
     actorKind: CognitoActorKind;
     /** Credential vend refused (disabled / unsupported / 403). */
     presenceRefusal?: DaemonStateFile["presenceRefusal"];
+    /** Pending events awaiting a retry drain (POST /v1/mesh/events). */
+    emitRetryDepth: number;
+    /** Last successful direct-emit POST time. */
+    lastPostAt?: string;
+    /** Per-status counts from the last emit attempt. */
+    lastEmit?: {
+        accepted?: number;
+        unassigned?: number;
+        rejected?: number;
+        error?: string;
+    };
 }
 export interface DaemonDoctorDeps {
     home?: string;

package/dist/lib/mesh/live/daemon/doctor.js

@@ -10,6 +10,8 @@ import { workContextRoot } from "../../../work-context/paths.js";
 import { countJsonlLines, } from "../spool.js";
 import { workMeshDeadLetterPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "../paths.js";
 import { daemonDir, daemonPidPath } from "./paths.js";
+import { readEmitState } from "../emit.js";
+import { emitRetryDepth } from "../emit-retry.js";
 import { pidLockStatus, readPidLock } from "./pid-lock.js";
 import { readDaemonState } from "./state.js";
 export const UNHEALTHY_SPOOL_AGE_MS = 60_000;
@@ -79,10 +81,13 @@ export function collectDaemonDoctor(deps = {}) {
     const outbox = outboxStats(ctxRoot);
     const mqttState = state?.mqttState ?? (running ? "unknown" : "closed");
     const companiesOnline = state?.companiesOnline ?? [];
+    const emitMode = state?.emitMode ?? "legacy";
+    const subscribed = mqttState === "connected";
     const oldestSpoolAgeMs = oldestJsonlAgeMs(spoolPath, now());
     const unhealthyReasons = [];
     const online = mqttState === "connected" && companiesOnline.length > 0;
-    if (online &&
+    if (emitMode === "legacy" &&
+        online &&
         spoolDepth > 0 &&
         oldestSpoolAgeMs !== undefined &&
         oldestSpoolAgeMs > UNHEALTHY_SPOOL_AGE_MS) {
@@ -96,6 +101,11 @@ export function collectDaemonDoctor(deps = {}) {
         unhealthyReasons.push(`presence credential refused (${presenceRefusal.code}); next retry ${presenceRefusal.nextRetryAt}`);
     }
     const auth = describeCognitoTokenSource({ home, env });
+    const emitState = readEmitState(meshRoot);
+    const emitRetry = emitRetryDepth(meshRoot);
+    if (emitRetry > 0) {
+        unhealthyReasons.push(`direct-emit retry depth=${emitRetry}`);
+    }
     return {
         running,
         pid: running ? record?.pid : undefined,
@@ -113,23 +123,44 @@ export function collectDaemonDoctor(deps = {}) {
         tokenSource: auth.tokenSource,
         actorKind: auth.actorKind,
         presenceRefusal,
+        emitMode,
+        subscribed,
+        emitRetryDepth: emitRetry,
+        lastPostAt: emitState?.lastPostAt,
+        lastEmit: emitState
+            ? {
+                accepted: emitState.lastAccepted,
+                unassigned: emitState.lastUnassigned,
+                rejected: emitState.lastRejected,
+                error: emitState.lastError,
+            }
+            : undefined,
     };
 }
 export function formatDaemonDoctor(report) {
     const lines = [
         `daemon: ${report.running ? `running pid=${report.pid}` : "not running"}`,
+        `mode: ${report.emitMode}`,
         `mqtt: ${report.mqttState}`,
+        `subscription: ${report.subscribed ? "connected" : "disconnected"}`,
         `companies online: ${report.companiesOnline.length ? report.companiesOnline.join(", ") : "(none)"}`,
-        `spool depth: ${report.spoolDepth}`,
-        `held: ${report.heldCount}`,
-        `dead-letter: ${report.deadLetterCount}`,
-        `outbox depth: ${report.outboxDepth}`,
-        `token source: ${report.tokenSource}`,
-        `actor kind: ${report.actorKind}`,
-        `last flush: ${report.lastFlushAt ?? "(never)"}${report.lastFlushResult
-            ? ` ok=${report.lastFlushResult.ok} posted=${report.lastFlushResult.posted}`
-            : ""}`,
     ];
+    if (report.emitMode === "legacy") {
+        // Legacy emit path only: the spool/held/outbox queues do not exist in
+        // receive-only (direct) mode.
+        lines.push(`spool depth: ${report.spoolDepth}`, `held: ${report.heldCount}`, `outbox depth: ${report.outboxDepth}`);
+    }
+    lines.push(`dead-letter: ${report.deadLetterCount}`, `token source: ${report.tokenSource}`, `actor kind: ${report.actorKind}`);
+    if (report.emitMode === "legacy") {
+        lines.push(`last flush: ${report.lastFlushAt ?? "(never)"}${report.lastFlushResult
+            ? ` ok=${report.lastFlushResult.ok} posted=${report.lastFlushResult.posted}`
+            : ""}`);
+    }
+    lines.push(`emit last post: ${report.lastPostAt ?? "(never)"}${report.lastEmit
+        ? ` accepted=${report.lastEmit.accepted ?? 0}` +
+            ` unassigned=${report.lastEmit.unassigned ?? 0}` +
+            ` rejected=${report.lastEmit.rejected ?? 0}`
+        : ""}`, `emit retry depth: ${report.emitRetryDepth}`);
     if (report.presenceRefusal) {
         lines.push(`presence refusal: ${report.presenceRefusal.code} (HTTP ${report.presenceRefusal.status}); next retry at ${report.presenceRefusal.nextRetryAt}`);
     }

package/dist/lib/mesh/live/daemon/mode.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Mesh daemon mode gate (owner decision 2026-09-08 "retire the client daemon";
+ * contract direct-emit-v1 §6.3 "deprecated, not deleted").
+ *
+ * Two modes coexist so this can merge before the server route ships and flip
+ * after:
+ *   - "legacy"  — the daemon runs the EMIT path (spool watch + flush + held +
+ *                 outbox replay + transcript-watch fallback) AND the receive
+ *                 subscriber. This is the default until the server route is live.
+ *   - "direct"  — sessions POST events directly (see `hq mesh session`/`emit`);
+ *                 the daemon runs RECEIVE-ONLY: the presence subscriber on
+ *                 hq/{personUid}/mesh keeps the cache the desktop app reads warm.
+ *                 No spool/held/outbox/flush/transcript-watch on this box.
+ *
+ * The flag is resolved from (highest first): env HQ_MESH_MODE, the work-mesh
+ * config file (~/.hq/work-mesh/config.json `emitMode`), else "legacy".
+ */
+export type MeshEmitMode = "legacy" | "direct";
+export declare const MESH_MODE_ENV = "HQ_MESH_MODE";
+export declare function meshConfigPath(meshRoot: string): string;
+/** Read `emitMode` from ~/.hq/work-mesh/config.json (best-effort). */
+export declare function readMeshConfigMode(meshRoot: string): MeshEmitMode | null;
+export interface ResolveModeDeps {
+    env?: NodeJS.ProcessEnv;
+    meshRoot?: string;
+    home?: string;
+}
+/**
+ * Resolve the daemon's emit mode. Env HQ_MESH_MODE wins, then the config file,
+ * else "legacy" (safe default until the server route returns 200).
+ */
+export declare function resolveMeshEmitMode(deps?: ResolveModeDeps): MeshEmitMode;
+/** Persist the emit mode to ~/.hq/work-mesh/config.json (`hq mesh mode set`). */
+export declare function writeMeshConfigMode(meshRoot: string, mode: MeshEmitMode): void;
+/** True when the daemon should run the legacy emit path (spool/flush/held). */
+export declare function runsEmitPath(mode: MeshEmitMode): boolean;
+//# sourceMappingURL=mode.d.ts.map

package/dist/lib/mesh/live/daemon/mode.js

@@ -0,0 +1,88 @@
+/**
+ * Mesh daemon mode gate (owner decision 2026-09-08 "retire the client daemon";
+ * contract direct-emit-v1 §6.3 "deprecated, not deleted").
+ *
+ * Two modes coexist so this can merge before the server route ships and flip
+ * after:
+ *   - "legacy"  — the daemon runs the EMIT path (spool watch + flush + held +
+ *                 outbox replay + transcript-watch fallback) AND the receive
+ *                 subscriber. This is the default until the server route is live.
+ *   - "direct"  — sessions POST events directly (see `hq mesh session`/`emit`);
+ *                 the daemon runs RECEIVE-ONLY: the presence subscriber on
+ *                 hq/{personUid}/mesh keeps the cache the desktop app reads warm.
+ *                 No spool/held/outbox/flush/transcript-watch on this box.
+ *
+ * The flag is resolved from (highest first): env HQ_MESH_MODE, the work-mesh
+ * config file (~/.hq/work-mesh/config.json `emitMode`), else "legacy".
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { workMeshRoot } from "../paths.js";
+export const MESH_MODE_ENV = "HQ_MESH_MODE";
+export function meshConfigPath(meshRoot) {
+    return path.join(meshRoot, "config.json");
+}
+function normalizeMode(value) {
+    if (typeof value !== "string")
+        return null;
+    const v = value.trim().toLowerCase();
+    if (v === "direct" || v === "direct-emit" || v === "receive-only")
+        return "direct";
+    if (v === "legacy" || v === "daemon")
+        return "legacy";
+    return null;
+}
+/** Read `emitMode` from ~/.hq/work-mesh/config.json (best-effort). */
+export function readMeshConfigMode(meshRoot) {
+    try {
+        const raw = fs.readFileSync(meshConfigPath(meshRoot), "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            return normalizeMode(parsed.emitMode);
+        }
+    }
+    catch {
+        /* absent / malformed → no override */
+    }
+    return null;
+}
+/**
+ * Resolve the daemon's emit mode. Env HQ_MESH_MODE wins, then the config file,
+ * else "legacy" (safe default until the server route returns 200).
+ */
+export function resolveMeshEmitMode(deps = {}) {
+    const env = deps.env ?? process.env;
+    const fromEnv = normalizeMode(env[MESH_MODE_ENV]);
+    if (fromEnv)
+        return fromEnv;
+    const meshRoot = deps.meshRoot ?? workMeshRoot(deps.home, env);
+    const fromConfig = readMeshConfigMode(meshRoot);
+    if (fromConfig)
+        return fromConfig;
+    return "legacy";
+}
+/** Persist the emit mode to ~/.hq/work-mesh/config.json (`hq mesh mode set`). */
+export function writeMeshConfigMode(meshRoot, mode) {
+    const p = meshConfigPath(meshRoot);
+    let existing = {};
+    try {
+        const raw = fs.readFileSync(p, "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            existing = parsed;
+        }
+    }
+    catch {
+        /* new file */
+    }
+    existing.emitMode = mode;
+    fs.mkdirSync(path.dirname(p), { recursive: true, mode: 0o700 });
+    const tmp = `${p}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(existing, null, 2), { mode: 0o600 });
+    fs.renameSync(tmp, p);
+}
+/** True when the daemon should run the legacy emit path (spool/flush/held). */
+export function runsEmitPath(mode) {
+    return mode === "legacy";
+}
+//# sourceMappingURL=mode.js.map

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -13,6 +13,7 @@ import { type CredentialsFetcher, type TimerHost } from "./credentials.js";
 import { type PidLockDeps } from "./pid-lock.js";
 import { PresenceClient, type MqttConnectFn } from "./presence.js";
 import { TranscriptWatcher, type TranscriptFs } from "./transcript-watch.js";
+import { type MeshEmitMode } from "./mode.js";
 export declare const SPOOL_DEBOUNCE_MS = 2000;
 export declare const FLUSH_INTERVAL_MS = 10000;
 /**
@@ -53,6 +54,13 @@ export interface DaemonRunDeps {
     enablePresence?: boolean;
     /** When false, skip transcript-watch lane (tests). Default true. */
     enableTranscriptWatch?: boolean;
+    /**
+     * Emit mode. "legacy" runs the spool/flush/held/outbox/transcript-watch emit
+     * path; "direct" runs receive-only (subscriber + cache) because sessions POST
+     * events directly. Default resolves from HQ_MESH_MODE / work-mesh config, else
+     * "legacy" (contract direct-emit-v1 §6.3).
+     */
+    mode?: MeshEmitMode;
     /** Injectable transcript fs (tests). */
     transcriptFs?: TranscriptFs;
     /** HQ tree root for deterministic cwd→company/project mapping. */

package/dist/lib/mesh/live/daemon/run.js

@@ -28,6 +28,7 @@ import { PresenceClient, } from "./presence.js";
 import { defaultDaemonState, patchDaemonState, writeDaemonState, } from "./state.js";
 import { workMeshHeldPath } from "../paths.js";
 import { noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, TranscriptWatcher, } from "./transcript-watch.js";
+import { resolveMeshEmitMode, runsEmitPath, } from "./mode.js";
 export const SPOOL_DEBOUNCE_MS = 2_000;
 export const FLUSH_INTERVAL_MS = 10_000;
 /**
@@ -64,6 +65,8 @@ export async function runMeshDaemon(deps = {}) {
     const ctxRoot = deps.workContextRoot ?? workContextRoot(home, env);
     const dir = daemonDir(meshRoot, home, env);
     const timers = deps.timers ?? realTimerHost;
+    const mode = deps.mode ?? resolveMeshEmitMode({ env, meshRoot, home });
+    const emitPath = runsEmitPath(mode);
     const now = deps.now ?? (() => new Date());
     const log = deps.log ??
         ((d, line) => appendDaemonLog(d, daemonLogLine("info", line, now)));
@@ -77,7 +80,8 @@ export async function runMeshDaemon(deps = {}) {
         throw new Error(`daemon already running (pid ${lock.owner.pid}); refuse second instance`);
     }
     writeDaemonState(dir, defaultDaemonState(lockDeps.pid, now));
-    log(dir, `daemon started pid=${lockDeps.pid}`);
+    log(dir, `daemon started pid=${lockDeps.pid} mode=${mode}`);
+    patchDaemonState(dir, { emitMode: mode }, now);
     // Opt into machine-credential minting when the box has creds (systemd exports
     // HQ_MACHINE_CREDS_FILE). On a person laptop with no machine creds this falls
     // through to the person login cache inside ensureCognitoToken.
@@ -199,7 +203,7 @@ export async function runMeshDaemon(deps = {}) {
     /** Shared with transcript watcher: sessionIds seen on the hook/spool path. */
     const lastHookEventAt = new Map();
     let transcriptWatcher = null;
-    if (deps.enableTranscriptWatch !== false) {
+    if (emitPath && deps.enableTranscriptWatch !== false) {
         const hqRoot = deps.hqRoot ?? env.HQ_ROOT?.trim() ?? undefined;
         const getToken = deps.getToken ?? defaultGetToken;
         transcriptWatcher = new TranscriptWatcher({
@@ -314,34 +318,36 @@ export async function runMeshDaemon(deps = {}) {
             void doFlushCycle("watch");
         }, SPOOL_DEBOUNCE_MS);
     };
-    // Watch spool directory (and file) for changes.
+    // Watch spool directory (and file) for changes — legacy emit path only.
     const spoolPath = workMeshSpoolPath(meshRoot);
-    try {
-        fs.mkdirSync(path.dirname(spoolPath), { recursive: true, mode: 0o700 });
-        if (!fs.existsSync(spoolPath)) {
-            fs.writeFileSync(spoolPath, "", { mode: 0o600 });
+    if (emitPath) {
+        try {
+            fs.mkdirSync(path.dirname(spoolPath), { recursive: true, mode: 0o700 });
+            if (!fs.existsSync(spoolPath)) {
+                fs.writeFileSync(spoolPath, "", { mode: 0o600 });
+            }
+            watcher = fs.watch(path.dirname(spoolPath), { persistent: true }, (_event, filename) => {
+                if (stopped)
+                    return;
+                if (shouldFlushOnSpoolDirEvent(filename)) {
+                    scheduleDebouncedFlush();
+                }
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            log(dir, `fs.watch failed (interval flush still active): ${msg.slice(0, 120)}`);
         }
-        watcher = fs.watch(path.dirname(spoolPath), { persistent: true }, (_event, filename) => {
+        flushIntervalHandle = timers.setTimeout(function tick() {
             if (stopped)
                 return;
-            if (shouldFlushOnSpoolDirEvent(filename)) {
-                scheduleDebouncedFlush();
-            }
-        });
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        log(dir, `fs.watch failed (interval flush still active): ${msg.slice(0, 120)}`);
+            void doFlushCycle("interval").finally(() => {
+                if (stopped)
+                    return;
+                flushIntervalHandle = timers.setTimeout(tick, FLUSH_INTERVAL_MS);
+            });
+        }, FLUSH_INTERVAL_MS);
     }
-    flushIntervalHandle = timers.setTimeout(function tick() {
-        if (stopped)
-            return;
-        void doFlushCycle("interval").finally(() => {
-            if (stopped)
-                return;
-            flushIntervalHandle = timers.setTimeout(tick, FLUSH_INTERVAL_MS);
-        });
-    }, FLUSH_INTERVAL_MS);
     boardIntervalHandle = timers.setTimeout(function boardTick() {
         if (stopped)
             return;
@@ -393,10 +399,15 @@ export async function runMeshDaemon(deps = {}) {
             });
         }, TRANSCRIPT_WATCH_INTERVAL_MS);
     }
-    // Initial flush + board pass + transcript scan.
-    void doFlushCycle("start");
+    // Initial pass. Board refresh runs in both modes; the flush + transcript
+    // scan are legacy emit-path only.
+    if (emitPath) {
+        void doFlushCycle("start");
+    }
     void refreshFn().catch(() => undefined);
-    void runTranscriptTick();
+    if (emitPath) {
+        void runTranscriptTick();
+    }
     const stop = async () => {
         if (stopped)
             return;

package/dist/lib/mesh/live/daemon/state.d.ts

@@ -22,6 +22,8 @@ export interface DaemonStateFile {
     lastErrorCode?: string;
     /** Set while credential vend is refused (FEATURE_DISABLED / unsupported / 403). */
     presenceRefusal?: PresenceRefusalState | null;
+    /** Daemon emit mode: "legacy" (spool/flush) or "direct" (receive-only). */
+    emitMode?: "legacy" | "direct";
     updatedAt: string;
 }
 export declare function defaultDaemonState(pid: number, now?: () => Date): DaemonStateFile;

package/dist/lib/mesh/live/emit-client.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Direct-emit client: POST /v1/mesh/events (owner decision 2026-09-08).
+ *
+ * Hooks post each Work Mesh event straight to the server over HTTPS with the
+ * caller's normal HQ bearer token (person login or fleet agent token). The
+ * server persists, attributes (server-side), and fans out over MQTT. There is
+ * no local spool, held queue, or per-person STS vend on the emit path.
+ *
+ * Field names for the endpoint + per-event status vocabulary follow
+ * companies/indigo/projects/work-mesh-live/contracts/direct-emit-v1.md; this
+ * client tolerates minor shape drift (unknown keys ignored) and treats an
+ * unparseable 2xx as "retain and retry" rather than pretend-posted.
+ */
+import type { SessionEventKind, SessionEventHarness, SessionEventSource } from "./format-spool-line.js";
+import type { EmitEvidence } from "./emit-evidence.js";
+export declare const MESH_EVENTS_PATH = "/v1/mesh/events";
+/** Max events per POST (server batches; keep parity with legacy 100). */
+export declare const MESH_EVENTS_BATCH_MAX = 100;
+/** Per-event server disposition. */
+export type EmitEventStatus = "accepted" | "unassigned" | "rejected";
+export interface EmitEventResult {
+    eventId: string;
+    status: EmitEventStatus;
+    /** Present when status != accepted (no_company_evidence | not_a_member | …). */
+    reason?: string;
+    /** Resolved company (accepted, or unassigned-into-single-company). */
+    companyUid?: string;
+}
+export interface EmitPostResult {
+    status: number;
+    body: unknown;
+    ok: boolean;
+    retryable: boolean;
+    networkError?: boolean;
+}
+export type EmitPoster = (events: Record<string, unknown>[]) => Promise<EmitPostResult>;
+export declare function classifyEmitResponse(status: number, networkError?: boolean): Pick<EmitPostResult, "ok" | "retryable" | "networkError">;
+/**
+ * Parse the batch response into per-event statuses. Returns null when the body
+ * is not an object (caller should retain events rather than treat as posted).
+ * Accepts either { results: [{eventId,status,code}] } or
+ * { accepted:[ids], unassigned:[ids], rejected:[{eventId,code}] }.
+ */
+export declare function parseEmitResults(body: unknown): EmitEventResult[] | null;
+/**
+ * Build a poster that uses vaultApiFetch + the caller's bearer token.
+ * `post` override is for tests (never hits the network).
+ */
+export declare function createEmitPoster(opts: {
+    token: string;
+    baseUrl?: string;
+    post?: (path: string, body: {
+        events: Record<string, unknown>[];
+    }) => Promise<{
+        status: number;
+        body: unknown;
+    }>;
+}): EmitPoster;
+/** One event posted to /v1/mesh/events: core session-event fields + evidence. */
+export interface MeshEmitEvent {
+    v: 1;
+    eventId: string;
+    kind: SessionEventKind;
+    sessionId: string;
+    harness: SessionEventHarness;
+    adapterVersion: string;
+    at: string;
+    seq: number;
+    runtimeVersion?: string;
+    source?: SessionEventSource;
+    taskId?: string;
+    status?: "queued" | "in_progress" | "review" | "done";
+    reason?: string;
+    summary?: string;
+    evidence?: EmitEvidence;
+}
+export interface BuildMeshEmitEventInput {
+    eventId: string;
+    kind: SessionEventKind;
+    sessionId: string;
+    harness: SessionEventHarness;
+    adapterVersion: string;
+    at: string;
+    seq: number;
+    runtimeVersion?: string;
+    source?: SessionEventSource;
+    taskId?: string;
+    status?: "queued" | "in_progress" | "review" | "done";
+    reason?: string;
+    summary?: string;
+    evidence?: EmitEvidence;
+}
+/**
+ * Build a MeshEmitEvent, omitting empty optionals and dropping the evidence
+ * object entirely when it carries nothing. Never includes server-owned fields
+ * (companyUid/actorUid/contextStatus) — those would draw a 403 (contract §2.1).
+ */
+export declare function buildMeshEmitEvent(input: BuildMeshEmitEventInput): MeshEmitEvent;
+//# sourceMappingURL=emit-client.d.ts.map