@indigoai-us/hq-cli 5.123.0 → 5.123.1

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [5.123.1] — 2026-09-19
+
+### Fixed
+
+- Work Mesh now preserves an acknowledged company binding through later
+  company-less hook writes, preventing repeated registrations and held events.
+  Held recovery accepts only durable registrations, canonical metadata under a
+  verified HQ root, or manifest-backed repository ownership; conflicting or
+  event-only hints stay unresolved. Its batch cursor rotates across restarts.
+  Both legacy and direct-mode daemons detect an upgraded CLI, and systemd units
+  use `Restart=always` so the installed service reloads the new code.
+
+- Held-session recovery now accepts session metadata only from the daemon's
+  configured HQ root, requires current-session evidence before restoring an
+  acknowledged registration, and retains batch position when held records are
+  compacted. Repeated hook activity no longer re-registers an unchanged binding.
+  CLI updates report installed system units that need their host service manager
+  to restart them. Daemon installs persist verified HQ-root allowlists, inject
+  the primary root into service environments, and rewrite/reload existing user
+  units so upgraded daemons restart reliably.
+
 ## [5.123.0] — 2026-09-19
 
 ### Fixed

package/dist/commands/mesh.js

@@ -6,6 +6,7 @@
  * Distinct from `hq doctor` (hook guardrails).
  */
 import * as os from "node:os";
+import { findHqRoot } from "../utils/manifest.js";
 import chalk from "chalk";
 import { loadCachedTokens, isMachineIdentity } from "../utils/cognito-session.js";
 import * as readline from "node:readline/promises";
@@ -324,6 +325,7 @@ async function runContextBackfillHeld(opts) {
     const result = await backfillHeldSessions({
         workMeshRoot: meshRoot,
         workContextRoot: root,
+        hqRoot: process.env.HQ_ROOT?.trim() || findHqRoot(),
         dryRun,
         limit,
         // Mirror the reconcile closure's non-forcing hint in the dry-run predictor
@@ -1181,7 +1183,10 @@ async function runDaemonRun() {
 async function runDaemonInstall(opts) {
     const result = installDaemonService({
         platform: detectPlatform(),
-        paths: buildInstallPaths({ systemUser: opts.systemUser }),
+        paths: buildInstallPaths({
+            systemUser: opts.systemUser,
+            hqRoot: process.env.HQ_ROOT?.trim() || findHqRoot(),
+        }),
         systemUser: opts.systemUser,
     });
     if (opts.json) {
@@ -1242,7 +1247,7 @@ async function runDaemonStatus(opts) {
     }
 }
 async function runDaemonDoctorCmd(opts) {
-    const report = collectDaemonDoctor();
+    const report = collectDaemonDoctor({ hqRoot: process.env.HQ_ROOT?.trim() || findHqRoot() });
     if (opts.json) {
         console.log(JSON.stringify({ ok: !report.unhealthy, ...report }, null, 2));
         return;

package/dist/commands/update.js

@@ -5,6 +5,7 @@
 import * as path from 'path';
 import { findHqRoot, readManifest, readLock, writeLock, getModulesDir } from '../utils/manifest.js';
 import { fetchRepo, pullRepo, getCurrentCommit, isRepo } from '../utils/git.js';
+import { restartDaemonServiceIfInstalled } from "../lib/mesh/live/daemon/install.js";
 export function registerUpdateCommand(program) {
     program
         .command('update [module-name]')
@@ -49,6 +50,11 @@ export function registerUpdateCommand(program) {
                 }
             }
             writeLock(hqRoot, lock);
+            // An installed daemon is a separate Node process. Refresh it
+            // best-effort after a successful update without making the update fail.
+            const restart = restartDaemonServiceIfInstalled();
+            if (restart.message)
+                console.log(restart.message);
             console.log('\nLock file updated.');
         }
         catch (error) {

package/dist/lib/mesh/live/backfill-held.d.ts

@@ -22,6 +22,7 @@
  */
 import type { ReconcileObservation, ReconcileOutcome } from "../../work-context/reconcile.js";
 import { type SessionStateFile } from "../../work-context/state.js";
+import { type OutboxOperation } from "../../work-context/outbox.js";
 /**
  * One distinct session discovered in held.jsonl, carrying the company evidence
  * its held events recorded at enqueue time (cwd / hqRoot / companySlug /
@@ -38,12 +39,25 @@ export interface HeldSessionRef {
     cwd?: string;
     /** HQ root, so the resolver can read workspace/sessions/<sid>/meta.yaml. */
     hqRoot?: string;
+    /** Every HQ root seen for this session, ordered by first observation. */
+    hqRoots?: string[];
     /** Company the session was bound to at emit time (enqueue --company-slug). */
     companySlug?: string;
     /** Project id carried on the event, if any. */
     project?: string;
     /** Task id carried on the event, if any. */
     task?: string;
+    /**
+     * Per-event local evidence retained while coalescing a held session. Event
+     * timestamps are instance boundaries: a session id may be reused, so a root
+     * observed before the current state.startedAt must not attribute it.
+     */
+    eventEvidence?: Array<{
+        hqRoot?: string;
+        cwd?: string;
+        harness?: string;
+        at?: string;
+    }>;
 }
 export interface BackfillHeldResult {
     /** Distinct sessions found in held.jsonl (before --limit). */
@@ -52,10 +66,15 @@ export interface BackfillHeldResult {
     considered: number;
     /** Skipped because state already has a companyUid. */
     alreadyAttributed: number;
-    /** Reconcile invoked and a company was resolved (would-reconcile in dry-run). */
+    /**
+     * A recovered company binding was persisted locally (would-recover in
+     * dry-run). A reconcile attempt that ends in needs_company is unresolved.
+     */
     reconciled: number;
     /** Reconcile ran but resolver found no company. */
     unresolved: number;
+    /** Unresolved because otherwise-trusted local evidence disagreed. */
+    conflictingEvidence: number;
     /** Sessions that errored during reconcile. */
     errors: number;
     dryRun: boolean;
@@ -65,6 +84,10 @@ export interface BackfillHeldDeps {
     workMeshRoot: string;
     /** Work-context root that holds sessions/<sid>.json. */
     workContextRoot: string;
+    /** HQ root configured for this daemon/CLI invocation (or device allowlist). */
+    hqRoot?: string;
+    /** Durable device allowlist of verified local HQ roots. */
+    hqRoots?: string[];
     /** Report only; write nothing, call no network, invoke no reconcile. */
     dryRun?: boolean;
     /** Cap distinct sessions processed. 0 (default) = no cap. */
@@ -100,17 +123,29 @@ export interface BackfillHeldDeps {
     predictCompany?: (ref: HeldSessionRef) => boolean;
     /** Optional progress logger. */
     log?: (message: string) => void;
+    /** Read/write seam for the bounded-startup rotation cursor. */
+    readCursor?: () => BackfillCursor | null;
+    writeCursor?: (cursor: BackfillCursor) => void;
+}
+interface BackfillCursor {
+    sessionId?: string;
+    /** Zero-based index of the last considered session in its file generation. */
+    ordinal?: number;
 }
+/** Read-only doctor helper: report only independently verified held evidence. */
+export declare function refWithLocalCompanyEvidence(ref: HeldSessionRef, canonicalHqRoot?: string, canonicalHqRoots?: readonly string[], state?: SessionStateFile | null): HeldSessionRef | null;
 /**
- * Build the reconcile observation for one held session, forwarding the company
- * evidence its events recorded (cwd / hqRoot / bound companySlug / project /
- * task). The event's own companySlug is trusted explicit — it is the company
- * the session was bound to when the events were emitted on this box.
+ * Build the reconcile observation for a company that was independently proven
+ * from durable local evidence. Held-event fields are deliberately not forwarded
+ * as trusted explicit context.
  */
 export declare function observationFromHeldRef(ref: HeldSessionRef, contractVersion: number, clientOperationId: string): ReconcileObservation;
+/** Shared doctor/backfill gate for a receipt that is safe to treat as current evidence. */
+export declare function hasCurrentAcknowledgedRegistration(ref: HeldSessionRef, state: SessionStateFile | null, operations: readonly OutboxOperation[], hqRoot?: string, hqRoots?: readonly string[]): boolean;
 /**
- * Read held.jsonl and return distinct sessions (first occurrence wins),
- * carrying the harness from whichever held event we saw first for that session.
+ * Read held.jsonl and return distinct sessions. Later events can add local
+ * evidence absent from the first event (the original first-occurrence-only
+ * implementation missed exactly that shape after a session became bound).
  * Lines that fail to parse or carry no sessionId are ignored (the daemon owns
  * their disposition; this backfill never mutates or deletes held lines).
  */
@@ -120,4 +155,5 @@ export declare function readHeldSessions(workMeshRoot: string): HeldSessionRef[]
  * re-running skips sessions that already carry a companyUid.
  */
 export declare function backfillHeldSessions(deps: BackfillHeldDeps): Promise<BackfillHeldResult>;
+export {};
 //# sourceMappingURL=backfill-held.d.ts.map

package/dist/lib/mesh/live/backfill-held.js

@@ -21,16 +21,189 @@
  * - Purely local to the box it runs on; no fleet fan-out.
  */
 import * as fs from "node:fs";
+import * as path from "node:path";
 import { readSessionState } from "../../work-context/state.js";
+import { listOutboxOperations, writeAckedRegisterState, } from "../../work-context/outbox.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "../../work-context/contract.js";
-import { resolveCompany } from "../../work-context/company.js";
-import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../../work-context/repo-remote.js";
-import { workMeshHeldPath } from "./paths.js";
+import { resolveCompany, sameCompany } from "../../work-context/company.js";
+import { readMetaCompanySlug } from "../../work-context/company.js";
+import { deriveRemoteOwnerSlug, } from "../../work-context/repo-remote.js";
+import { workMeshHeldBackfillCursorPath, workMeshHeldPath } from "./paths.js";
+function readBackfillCursor(workMeshRoot) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(workMeshHeldBackfillCursorPath(workMeshRoot), "utf8"));
+        const sessionId = typeof parsed.sessionId === "string" && parsed.sessionId.trim()
+            ? parsed.sessionId.trim()
+            : undefined;
+        const ordinal = typeof parsed.ordinal === "number" &&
+            Number.isInteger(parsed.ordinal) && parsed.ordinal >= 0
+            ? parsed.ordinal
+            : undefined;
+        return sessionId || ordinal !== undefined ? { sessionId, ordinal } : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeBackfillCursor(workMeshRoot, cursor) {
+    try {
+        fs.writeFileSync(workMeshHeldBackfillCursorPath(workMeshRoot), `${JSON.stringify(cursor)}\n`, { mode: 0o600 });
+    }
+    catch {
+        // A missing cursor only repeats a bounded batch; it must never stop flush.
+    }
+}
+function rotateSessions(sessions, limit, cursor) {
+    if (!limit || limit >= sessions.length)
+        return sessions;
+    const previous = cursor?.sessionId
+        ? sessions.findIndex((ref) => ref.sessionId === cursor.sessionId)
+        : -1;
+    const start = previous >= 0
+        ? (previous + 1) % sessions.length
+        : cursor?.ordinal !== undefined
+            ? cursor.ordinal % sessions.length
+            : 0;
+    const rotated = [...sessions.slice(start), ...sessions.slice(0, start)];
+    return rotated.slice(0, limit);
+}
+function verifiedHqRoot(hqRoot) {
+    try {
+        const root = fs.realpathSync(hqRoot);
+        const manifest = path.join(root, "companies", "manifest.yaml");
+        return fs.statSync(manifest).isFile() ? root : null;
+    }
+    catch {
+        return null;
+    }
+}
+function verifiedMetaCompanySlug(sessionId, hqRoot) {
+    try {
+        const root = verifiedHqRoot(hqRoot);
+        if (!root)
+            return undefined;
+        const meta = path.join(root, "workspace", "sessions", sessionId, "meta.yaml");
+        if (!fs.statSync(meta).isFile())
+            return undefined;
+        // Do not follow a meta symlink outside the claimed HQ root.
+        const realMeta = fs.realpathSync(meta);
+        if (path.relative(root, realMeta).startsWith(".."))
+            return undefined;
+        return readMetaCompanySlug(sessionId, root);
+    }
+    catch {
+        return undefined;
+    }
+}
+function candidatesAgree(a, b) {
+    return sameCompany(a, b) ||
+        (!a.uid && !b.uid && Boolean(a.slug && b.slug) &&
+            a.slug.toLowerCase() === b.slug.toLowerCase());
+}
+function consistentCandidate(candidates) {
+    let chosen = null;
+    for (const candidate of candidates) {
+        if (!candidate.slug && !candidate.uid)
+            continue;
+        if (!chosen) {
+            chosen = { ...candidate };
+            continue;
+        }
+        if (!candidatesAgree(chosen, candidate))
+            return { candidate: null, conflict: true };
+        chosen = {
+            slug: chosen.slug ?? candidate.slug,
+            uid: chosen.uid ?? candidate.uid,
+            hqRoot: chosen.hqRoot ?? candidate.hqRoot,
+        };
+    }
+    return { candidate: chosen, conflict: false };
+}
+function localCompanyCandidates(ref, state, canonicalHqRoot, canonicalHqRoots = []) {
+    const candidates = [];
+    // A slug without a UID can be the failed/stale projection this repair is
+    // investigating. Only a persisted UID is a durable registration signal.
+    if (state?.companyUid) {
+        candidates.push({ slug: state.companySlug, uid: state.companyUid });
+    }
+    const roots = [...new Set([canonicalHqRoot, ...canonicalHqRoots]
+            .filter((candidate) => Boolean(candidate)))]
+        .map(verifiedHqRoot).filter((root) => Boolean(root));
+    const eventEvidence = currentInstanceEventEvidence(ref, state);
+    const eventRoots = eventEvidence.map((evidence) => evidence.hqRoot).filter((candidate) => Boolean(candidate));
+    for (const root of roots)
+        if (eventRoots.some((candidate) => {
+            try {
+                return fs.realpathSync(candidate) === root;
+            }
+            catch {
+                return false;
+            }
+        })) {
+            const slug = verifiedMetaCompanySlug(ref.sessionId, root);
+            if (slug)
+                candidates.push({ slug, hqRoot: root });
+            // The event cwd itself is not company evidence. The repository's origin is,
+            // but only when it is mapped by this verified HQ root's manifest.
+            for (const evidence of eventEvidence) {
+                if (!evidence.cwd || !evidence.hqRoot)
+                    continue;
+                try {
+                    if (fs.realpathSync(evidence.hqRoot) !== root)
+                        continue;
+                }
+                catch {
+                    continue;
+                }
+                const remoteSlug = deriveRemoteOwnerSlug({ cwd: evidence.cwd, hqRoot: root });
+                if (remoteSlug)
+                    candidates.push({ slug: remoteSlug, hqRoot: root });
+            }
+        }
+    return candidates;
+}
 /**
- * Build the reconcile observation for one held session, forwarding the company
- * evidence its events recorded (cwd / hqRoot / bound companySlug / project /
- * task). The event's own companySlug is trusted explicit — it is the company
- * the session was bound to when the events were emitted on this box.
+ * Keep only event evidence that belongs to the current session instance. A
+ * current state is a durable instance marker; metadata from a held event that
+ * predates it could belong to a prior use of the same session id.
+ */
+function currentInstanceEventEvidence(ref, state) {
+    const evidence = ref.eventEvidence ?? [
+        {
+            hqRoot: ref.hqRoot,
+            cwd: ref.cwd,
+            harness: ref.harness,
+        },
+        ...(ref.hqRoots ?? []).filter((hqRoot) => hqRoot !== ref.hqRoot).map((hqRoot) => ({ hqRoot })),
+    ];
+    if (!state?.startedAt)
+        return evidence;
+    const startedAt = Date.parse(state.startedAt);
+    if (!Number.isFinite(startedAt))
+        return [];
+    return evidence.filter((entry) => {
+        if (!entry.hqRoot)
+            return false;
+        const eventAt = entry.at ? Date.parse(entry.at) : Number.NaN;
+        return Number.isFinite(eventAt) && eventAt >= startedAt;
+    });
+}
+function hasOnlyStaleEventEvidence(ref, state) {
+    return Boolean(state?.startedAt &&
+        ref.eventEvidence?.some((entry) => entry.hqRoot) &&
+        !currentInstanceEventEvidence(ref, state).some((entry) => entry.hqRoot));
+}
+/** Read-only doctor helper: report only independently verified held evidence. */
+export function refWithLocalCompanyEvidence(ref, canonicalHqRoot, canonicalHqRoots = [], state = null) {
+    const evidence = consistentCandidate(localCompanyCandidates(ref, state, canonicalHqRoot, canonicalHqRoots));
+    return !evidence.conflict && evidence.candidate?.slug
+        ? { ...ref, companySlug: evidence.candidate.slug }
+        : null;
+}
+/**
+ * Build the reconcile observation for a company that was independently proven
+ * from durable local evidence. Held-event fields are deliberately not forwarded
+ * as trusted explicit context.
  */
 export function observationFromHeldRef(ref, contractVersion, clientOperationId) {
     const obs = {
@@ -40,12 +213,8 @@ export function observationFromHeldRef(ref, contractVersion, clientOperationId)
             : { sessionId: ref.sessionId },
         clientOperationId,
     };
-    if (ref.cwd)
-        obs.cwd = ref.cwd;
-    if (ref.hqRoot)
-        obs.hqRoot = ref.hqRoot;
     if (ref.companySlug || ref.project || ref.task) {
-        obs.explicit = {
+        obs.trustedContext = {
             ...(ref.companySlug ? { companySlug: ref.companySlug } : {}),
             ...(ref.project ? { projectId: ref.project } : {}),
             ...(ref.task ? { taskId: ref.task } : {}),
@@ -63,28 +232,74 @@ export function observationFromHeldRef(ref, contractVersion, clientOperationId)
  * gone because both paths key off this same resolver + evidence.
  */
 function defaultPredictCompany(ref, workContextRoot, remoteOwnerHint, env) {
-    const remoteOwnerSlug = remoteOwnerHint?.trim() ||
-        (ref.cwd
-            ? deriveRemoteOwnerSlug({ cwd: ref.cwd, hqRoot: ref.hqRoot }) ?? undefined
-            : undefined);
-    const repoIdentityKey = ref.cwd
-        ? deriveRepoIdentityKey({ cwd: ref.cwd })
-        : null;
+    // This predictor is called only with a ref already rebuilt from trusted local
+    // evidence. Do not let raw held-event cwd/hqRoot values re-enter resolution.
+    const remoteOwnerSlug = remoteOwnerHint?.trim();
     const resolution = resolveCompany({
         root: workContextRoot,
         sessionId: ref.sessionId,
         env,
         trusted: ref.companySlug ? { companySlug: ref.companySlug } : undefined,
-        cwd: ref.cwd,
-        hqRoot: ref.hqRoot,
         remoteOwnerSlug,
-        repoIdentityKey,
     });
     return resolution.status === "resolved";
 }
 /**
- * Read held.jsonl and return distinct sessions (first occurrence wins),
- * carrying the harness from whichever held event we saw first for that session.
+ * A backfill is only useful when the daemon can observe a durable company
+ * binding on its next held retry. Do not use the reconcile result alone here:
+ * a completed reconcile may legitimately return needs_company after a failed
+ * membership lookup, and that leaves the held events exactly where they were.
+ */
+function hasDurableCompanyRecovery(sessionId, workContextRoot, readState) {
+    return Boolean(readState(sessionId, workContextRoot)?.companyUid);
+}
+function latestAcknowledgedRegistration(sessionId, operations) {
+    for (let index = operations.length - 1; index >= 0; index -= 1) {
+        const operation = operations[index];
+        if (operation.kind === "register" &&
+            operation.delivery === "acked" &&
+            operation.sessionId === sessionId &&
+            operation.companyUid &&
+            operation.receiptId) {
+            return operation;
+        }
+    }
+    return null;
+}
+function acknowledgedRegistrationMatches(operation, ref, evidence, state) {
+    if (!operation.companyUid || !operation.receiptId)
+        return false;
+    if (!state?.startedAt)
+        return false;
+    const startedAt = Date.parse(state.startedAt);
+    const registeredAt = Date.parse(operation.createdAt);
+    if (!Number.isFinite(startedAt) || !Number.isFinite(registeredAt) || registeredAt < startedAt) {
+        return false;
+    }
+    if (evidence &&
+        !candidatesAgree(evidence, {
+            slug: operation.companySlug,
+            uid: operation.companyUid,
+        }))
+        return false;
+    if (ref.harness && operation.harness && ref.harness !== operation.harness)
+        return false;
+    if (state?.bindingEpisodeId && state.bindingEpisodeId !== operation.receiptId)
+        return false;
+    return true;
+}
+/** Shared doctor/backfill gate for a receipt that is safe to treat as current evidence. */
+export function hasCurrentAcknowledgedRegistration(ref, state, operations, hqRoot, hqRoots = []) {
+    const evidence = consistentCandidate(localCompanyCandidates(ref, state, hqRoot, hqRoots));
+    if (evidence.conflict)
+        return false;
+    const operation = latestAcknowledgedRegistration(ref.sessionId, operations);
+    return Boolean(operation && acknowledgedRegistrationMatches(operation, ref, evidence.candidate, state));
+}
+/**
+ * Read held.jsonl and return distinct sessions. Later events can add local
+ * evidence absent from the first event (the original first-occurrence-only
+ * implementation missed exactly that shape after a session became bound).
  * Lines that fail to parse or carry no sessionId are ignored (the daemon owns
  * their disposition; this backfill never mutates or deletes held lines).
  */
@@ -113,37 +328,47 @@ export function readHeldSessions(workMeshRoot) {
             continue;
         const obj = parsed;
         // Peel the held envelope { event, heldReason, heldAt } if present.
-        const event = obj.event &&
+        const envelope = obj.event &&
             typeof obj.event === "object" &&
             !Array.isArray(obj.event) &&
             typeof obj.heldReason === "string"
-            ? obj.event
-            : obj;
+            ? obj
+            : undefined;
+        const event = envelope ? envelope.event : obj;
         const sessionId = typeof event.sessionId === "string" && event.sessionId.trim()
             ? event.sessionId.trim()
             : null;
-        if (!sessionId || seen.has(sessionId))
+        if (!sessionId)
             continue;
         const str = (v) => typeof v === "string" && v.trim() ? v.trim() : undefined;
-        const ref = { sessionId };
+        const ref = seen.get(sessionId) ?? { sessionId };
         const harness = str(event.harness);
-        if (harness)
+        if (harness && !ref.harness)
             ref.harness = harness;
         const cwd = str(event.cwd);
-        if (cwd)
+        if (cwd && !ref.cwd)
             ref.cwd = cwd;
         const hqRoot = str(event.hqRoot);
-        if (hqRoot)
-            ref.hqRoot = hqRoot;
+        if (hqRoot) {
+            if (!ref.hqRoot)
+                ref.hqRoot = hqRoot;
+            if (!ref.hqRoots?.includes(hqRoot)) {
+                ref.hqRoots = [...(ref.hqRoots ?? []), hqRoot];
+            }
+        }
         const companySlug = str(event.companySlug);
-        if (companySlug)
+        if (companySlug && !ref.companySlug)
             ref.companySlug = companySlug;
         const project = str(event.project);
-        if (project)
+        if (project && !ref.project)
             ref.project = project;
         const task = str(event.task);
-        if (task)
+        if (task && !ref.task)
             ref.task = task;
+        const at = str(event.at) ?? (envelope ? str(envelope.heldAt) : undefined);
+        if (hqRoot || cwd) {
+            ref.eventEvidence = [...(ref.eventEvidence ?? []), { hqRoot, cwd, harness, at }];
+        }
         seen.set(sessionId, ref);
     }
     return [...seen.values()];
@@ -162,13 +387,18 @@ export async function backfillHeldSessions(deps) {
     const predictCompany = deps.predictCompany ??
         ((ref) => defaultPredictCompany(ref, deps.workContextRoot, deps.remoteOwnerHint, env));
     const sessions = readHeldSessions(deps.workMeshRoot);
-    const considered = limit > 0 ? sessions.slice(0, limit) : sessions;
+    // An acked register is authoritative local evidence. Older clients could
+    // lose its state projection on a later hook write; recover that projection
+    // directly instead of re-registering the same session.
+    const outboxOperations = listOutboxOperations(deps.workContextRoot);
+    const considered = rotateSessions(sessions, limit, (deps.readCursor ?? (() => readBackfillCursor(deps.workMeshRoot)))());
     const result = {
         scanned: sessions.length,
         considered: considered.length,
         alreadyAttributed: 0,
         reconciled: 0,
         unresolved: 0,
+        conflictingEvidence: 0,
         errors: 0,
         dryRun,
     };
@@ -179,10 +409,49 @@ export async function backfillHeldSessions(deps) {
             result.alreadyAttributed += 1;
             continue;
         }
+        const evidence = consistentCandidate(localCompanyCandidates(ref, state, deps.hqRoot, deps.hqRoots));
+        if (evidence.conflict) {
+            result.unresolved += 1;
+            result.conflictingEvidence += 1;
+            deps.log?.(`unresolved ${sessionId} (CONFLICTING_EVIDENCE)`);
+            continue;
+        }
+        const acknowledged = latestAcknowledgedRegistration(sessionId, outboxOperations);
+        const acknowledgedMatches = acknowledged && acknowledgedRegistrationMatches(acknowledged, ref, evidence.candidate, state);
+        if (acknowledged && !acknowledgedMatches) {
+            deps.log?.(`ignored stale acknowledged register for ${sessionId}`);
+        }
+        if (acknowledgedMatches && dryRun) {
+            result.reconciled += 1;
+            deps.log?.(`would reconcile ${sessionId} from acknowledged register`);
+            continue;
+        }
+        if (acknowledgedMatches) {
+            writeAckedRegisterState(acknowledged, deps.workContextRoot, acknowledged.receiptId);
+            if (readState(sessionId, deps.workContextRoot)?.companyUid) {
+                result.reconciled += 1;
+                deps.log?.(`reconciled ${sessionId} from acknowledged register`);
+                continue;
+            }
+        }
+        if (!evidence.candidate?.slug) {
+            result.unresolved += 1;
+            deps.log?.(`would stay unresolved ${sessionId} (${hasOnlyStaleEventEvidence(ref, state) ? "STALE_EVIDENCE" : "no local company evidence"})`);
+            continue;
+        }
+        const evidenceRef = {
+            sessionId,
+            harness,
+            companySlug: evidence.candidate.slug,
+            // Held-event fields are transport input, not trusted context. Preserve
+            // project/task only when the durable session state already owns them.
+            project: state?.projectId,
+            task: state?.taskId,
+        };
         if (dryRun) {
             // Predict with the SAME evidence + resolver the write path uses, so the
             // dry-run counts match a real run (no blanket would-reconcile).
-            if (predictCompany(ref)) {
+            if (predictCompany(evidenceRef)) {
                 result.reconciled += 1;
                 deps.log?.(`would reconcile ${sessionId}${harness ? ` (${harness})` : ""}`);
             }
@@ -192,16 +461,20 @@ export async function backfillHeldSessions(deps) {
             }
             continue;
         }
-        const obs = observationFromHeldRef(ref, contractVersion, newOperationId());
+        const obs = observationFromHeldRef(evidenceRef, contractVersion, newOperationId());
         try {
             const outcome = await deps.reconcile(obs);
-            if (outcome.result.companyUid) {
+            if (hasDurableCompanyRecovery(sessionId, deps.workContextRoot, readState)) {
                 result.reconciled += 1;
-                deps.log?.(`reconciled ${sessionId} → ${outcome.result.companyUid}`);
+                deps.log?.(`reconciled ${sessionId} → durable company binding`);
+            }
+            else if (outcome.result.errorCode === "NOT_TRACKING") {
+                result.errors += 1;
+                deps.log?.(`error ${sessionId}: NOT_TRACKING (state was not durable)`);
             }
             else {
                 result.unresolved += 1;
-                deps.log?.(`unresolved ${sessionId} (no company)`);
+                deps.log?.(`unresolved ${sessionId} (${outcome.result.kind}: no durable company binding)`);
             }
         }
         catch (err) {
@@ -209,6 +482,14 @@ export async function backfillHeldSessions(deps) {
             deps.log?.(`error ${sessionId}: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
+    if (!dryRun && limit > 0 && considered.length > 0) {
+        const last = considered[considered.length - 1];
+        const ordinal = sessions.findIndex((ref) => ref.sessionId === last.sessionId);
+        (deps.writeCursor ?? ((cursor) => writeBackfillCursor(deps.workMeshRoot, cursor)))({
+            sessionId: last.sessionId,
+            ...(ordinal >= 0 ? { ordinal } : {}),
+        });
+    }
     return result;
 }
 //# sourceMappingURL=backfill-held.js.map

package/dist/lib/mesh/live/daemon/config.d.ts

@@ -0,0 +1,9 @@
+export interface DaemonConfig {
+    trustedHqRoots: string[];
+}
+export declare function daemonConfigPath(daemonDirectory: string): string;
+export declare function verifyHqRoot(candidate: string | undefined): string | null;
+export declare function readDaemonConfig(daemonDirectory: string): DaemonConfig;
+/** Record a verified local HQ checkout without trusting a caller-supplied path at runtime. */
+export declare function registerTrustedHqRoot(daemonDirectory: string, candidate: string | undefined): DaemonConfig;
+//# sourceMappingURL=config.d.ts.map