@indigoai-us/hq-cli 5.126.0 → 5.127.0

package/dist/lib/mesh/api.d.ts

@@ -23,10 +23,40 @@ export interface MeshThread {
     lastActivityAt?: string;
     createdAt?: string;
 }
+export interface MeshProjectStoryInput {
+    id: string;
+    title: string;
+    description?: string;
+    acceptanceCriteria?: string[];
+    status?: string;
+    passes?: boolean;
+    priority?: number;
+}
+export interface MeshProjectRepo {
+    path: string;
+    branch: string;
+}
+export interface MeshProjectView {
+    companyUid: string;
+    projectId: string;
+    name: string;
+    description: string;
+    stories: MeshProjectStoryInput[];
+    repos: MeshProjectRepo[];
+    version?: number;
+}
+export interface MeshProjectRegistration {
+    companyUid: string;
+    projectId: string;
+    threadId: string;
+    channelId: string;
+    channelCreated: boolean;
+}
 export declare function meshJson(token: string, path: string, init?: {
     method?: string;
     body?: Record<string, unknown>;
     query?: Record<string, string>;
+    signal?: AbortSignal;
 }): Promise<unknown>;
 export declare function resolveMeshCompany(token: string, company?: string): Promise<MeshCompany>;
 /**
@@ -47,7 +77,14 @@ export declare function listActiveMembershipCompanies(token: string): Promise<Me
  * auth failures so the caller can surface DEFAULT_COMPANY_UNAVAILABLE.
  */
 export declare function resolveActiveMembershipCompany(token: string, slug: string): Promise<MeshCompany | null>;
-export declare function requireToken(): Promise<string>;
+export interface RequireTokenOptions {
+    /**
+     * False from detached or unattended callers (the lane watcher). A person
+     * cache that cannot refresh then throws instead of opening a browser.
+     */
+    interactive?: boolean;
+}
+export declare function requireToken(opts?: RequireTokenOptions): Promise<string>;
 export declare function listActiveThreads(token: string, companyUid: string, projectId?: string): Promise<MeshThread[]>;
 export declare function clamp(value: string, max: number): string;
 export declare function eventPayload(kind: string, opts: {
@@ -62,15 +99,43 @@ export declare function ensureProjectThread(token: string, company: MeshCompany,
     threadId: string;
     created: boolean;
 }>;
-export declare function appendThreadEvent(token: string, companyUid: string, threadId: string, eventKind: string, payload: Record<string, unknown>): Promise<{
+export declare function appendThreadEvent(token: string, companyUid: string, threadId: string, eventKind: string, payload: Record<string, unknown>, signal?: AbortSignal): Promise<{
     eventId?: string;
     createdAt?: string;
 }>;
+export interface StoryPatch {
+    status?: string;
+    assigneeUid?: string;
+    clearAssignee?: boolean;
+}
+export interface StoryPatchResult {
+    projectId: string;
+    status: string;
+    version?: number;
+    assigneeUid: string | null;
+}
+/**
+ * PATCH one Board story. The server derives the actor from the request
+ * credential. This body never includes actorUid.
+ */
+export declare function patchStory(token: string, companyUid: string, projectId: string, storyId: string, patch: StoryPatch): Promise<StoryPatchResult>;
 export declare function patchStoryStatus(token: string, companyUid: string, projectId: string, storyId: string, status: string): Promise<{
     status: string;
     version?: number;
     projectId: string;
 }>;
+/** Read the full durable Board view before preparing a replacement PUT. */
+export declare function getProjectView(token: string, companyUid: string, projectId: string): Promise<MeshProjectView>;
+/** Replace a project's durable Board view and keep the local project cache current. */
+export declare function putProjectView(token: string, companyUid: string, projectId: string, input: {
+    name?: string;
+    description?: string;
+    stories?: MeshProjectStoryInput[];
+    repos?: MeshProjectRepo[];
+    version?: number;
+}): Promise<MeshProjectView>;
+/** Register the project genesis thread and deterministic project channel. */
+export declare function registerMeshProject(token: string, companyUid: string, projectId: string): Promise<MeshProjectRegistration>;
 export declare function pairDmUidsFromInbox(inbox: unknown): string[];
 export interface WarmCacheResult {
     directory: boolean;
@@ -94,13 +159,12 @@ export declare function meshCachePrincipalUid(tokens: {
     accessToken?: string;
 } | null | undefined, fallbackToken?: string): string;
 /**
- * Resolve the cache principal. JWT first; if the human access/id tokens have
- * no entityUid, ask `/v1/realtime/credentials` (same fallback as the pack
- * doctor). Only the uid is kept — credentials are discarded.
+ * Resolve the authenticated request principal. The request token is the source
+ * of truth; cached credentials may contribute an entity uid only when they
+ * identify the same caller. Only the uid is kept — credentials are discarded.
  */
 export declare function resolveMeshPrincipalUid(token: string, tokens?: {
     idToken?: string;
     accessToken?: string;
-} | null): Promise<string>;
-export declare function callerLabelFromToken(token: string): string;
+} | null): Promise<string | undefined>;
 //# sourceMappingURL=api.d.ts.map

package/dist/lib/mesh/api.js

@@ -30,6 +30,7 @@ export async function meshJson(token, path, init = {}) {
         method: init.method,
         body: init.body,
         query: init.query,
+        signal: init.signal,
     });
     const text = await res.text();
     let data = {};
@@ -48,7 +49,11 @@ export async function meshJson(token, path, init = {}) {
         // 400 whose body text matched no pattern was retried forever.
         const detail = err.error || err.message || res.statusText || "request failed";
         const code = typeof err.code === "string" && err.code ? `${err.code}: ` : "";
-        throw new Error(`${res.status} ${code}${detail}`);
+        const context = [
+            typeof err.stage === "string" && err.stage ? `stage=${err.stage}` : "",
+            typeof err.recovery === "string" && err.recovery ? `recovery=${err.recovery}` : "",
+        ].filter(Boolean);
+        throw new Error(`${res.status} ${code}${detail}${context.length ? ` (${context.join("; ")})` : ""}`);
     }
     return data;
 }
@@ -107,7 +112,11 @@ export async function resolveActiveMembershipCompany(token, slug) {
     const trimmed = slug.trim();
     if (!trimmed)
         return null;
-    const rows = await listActiveMembershipCompanies(token);
+    const payload = asRecord(await meshJson(token, "/membership/me"));
+    if (!payload || !Array.isArray(payload.memberships)) {
+        throw new Error("Malformed membership response: expected memberships array");
+    }
+    const rows = activeMembershipCompanies(payload.memberships);
     const needle = trimmed.toLowerCase();
     const matches = rows.filter((c) => c.companySlug.toLowerCase() === needle ||
         c.companyUid.toLowerCase() === needle);
@@ -118,7 +127,29 @@ export async function resolveActiveMembershipCompany(token, slug) {
     // Ambiguous slug across memberships — refuse rather than guess.
     return null;
 }
-export async function requireToken() {
+function activeMembershipCompanies(rows) {
+    const out = [];
+    const seen = new Set();
+    for (const row of rows) {
+        const rec = asRecord(row);
+        if (!rec)
+            continue;
+        if (String(rec.status || "").toLowerCase() !== "active")
+            continue;
+        const companyUid = typeof rec.companyUid === "string" ? rec.companyUid : "";
+        if (!companyUid || seen.has(companyUid))
+            continue;
+        const companySlug = typeof rec.companySlug === "string"
+            ? rec.companySlug
+            : typeof rec.companyFolderSlug === "string"
+                ? rec.companyFolderSlug
+                : companyUid;
+        seen.add(companyUid);
+        out.push({ companyUid, companySlug: companySlug || companyUid });
+    }
+    return out;
+}
+export async function requireToken(opts = {}) {
     // Agent/machine boxes must authenticate the way the mesh daemon does:
     // an agent's identity claims (custom:entityType=agent, custom:entityUid)
     // ride the ID token ONLY; a person-cache ACCESS token on the box carries
@@ -129,10 +160,11 @@ export async function requireToken() {
     // hard policy indigo-agent-caller-resolution-id-token, agent claims ride
     // the ID token only; the server is correct to require it. Humans keep the
     // person access token (unchanged).
+    const interactive = opts.interactive ?? true;
     if (isMachineIdentity()) {
-        return ensureCognitoToken({ tokenSource: "machine" });
+        return ensureCognitoToken({ tokenSource: "machine", interactive });
     }
-    return ensureCognitoToken();
+    return ensureCognitoToken({ interactive });
 }
 function asRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value)
@@ -291,20 +323,32 @@ export async function ensureProjectThread(token, company, projectId, opts) {
         throw new Error("Work mesh did not return a threadId");
     return { threadId, created: true };
 }
-export async function appendThreadEvent(token, companyUid, threadId, eventKind, payload) {
+export async function appendThreadEvent(token, companyUid, threadId, eventKind, payload, signal) {
     const data = asRecord(await meshJson(token, `/v1/work-mesh/threads/${encodeURIComponent(threadId)}/events`, {
         method: "POST",
         body: { companyUid, eventKind, payload },
+        signal,
     }));
     return {
         eventId: typeof data?.eventId === "string" ? data.eventId : undefined,
         createdAt: typeof data?.createdAt === "string" ? data.createdAt : undefined,
     };
 }
-export async function patchStoryStatus(token, companyUid, projectId, storyId, status) {
+/**
+ * PATCH one Board story. The server derives the actor from the request
+ * credential. This body never includes actorUid.
+ */
+export async function patchStory(token, companyUid, projectId, storyId, patch) {
+    const body = { companyUid };
+    if (patch.status)
+        body.status = patch.status;
+    if (patch.assigneeUid)
+        body.assigneeUid = patch.assigneeUid;
+    if (patch.clearAssignee)
+        body.clearAssignee = true;
     const view = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}/stories/${encodeURIComponent(storyId)}`, {
         method: "PATCH",
-        body: { companyUid, status },
+        body,
     }));
     if (view && typeof view.projectId === "string" && typeof view.companyUid === "string") {
         writeMeshCacheFile(["projects", view.companyUid, `${view.projectId}.json`], view);
@@ -313,10 +357,88 @@ export async function patchStoryStatus(token, companyUid, projectId, storyId, st
     const patched = stories
         .map(asRecord)
         .find((row) => row && row.id === storyId);
+    const assigneeUid = patch.clearAssignee
+        ? typeof patched?.assigneeUid === "string"
+            ? patched.assigneeUid
+            : null
+        : typeof patched?.assigneeUid === "string"
+            ? patched.assigneeUid
+            : patch.assigneeUid ?? null;
     return {
         projectId: String(view?.projectId || projectId),
-        status: typeof patched?.status === "string" ? patched.status : status,
+        status: typeof patched?.status === "string" ? patched.status : patch.status || "",
         version: typeof view?.version === "number" ? view.version : undefined,
+        assigneeUid,
+    };
+}
+export async function patchStoryStatus(token, companyUid, projectId, storyId, status) {
+    const patched = await patchStory(token, companyUid, projectId, storyId, { status });
+    return {
+        projectId: patched.projectId,
+        status: patched.status,
+        version: patched.version,
+    };
+}
+function projectViewFromResponse(view, companyUid, projectId) {
+    const returnedProjectId = String(view.projectId || projectId).trim();
+    const returnedCompanyUid = String(view.companyUid || companyUid).trim();
+    const stories = Array.isArray(view.stories)
+        ? view.stories.filter((story) => asRecord(story))
+        : [];
+    const repos = Array.isArray(view.repos)
+        ? view.repos.flatMap((repo) => {
+            const row = asRecord(repo);
+            const path = typeof row?.path === "string" ? row.path.trim() : "";
+            if (!path)
+                return [];
+            return [{ path, branch: typeof row?.branch === "string" ? row.branch.trim() : "" }];
+        })
+        : [];
+    return {
+        companyUid: returnedCompanyUid,
+        projectId: returnedProjectId,
+        name: String(view.name || returnedProjectId),
+        description: typeof view.description === "string" ? view.description : "",
+        stories,
+        repos,
+        version: typeof view.version === "number" ? view.version : undefined,
+    };
+}
+/** Read the full durable Board view before preparing a replacement PUT. */
+export async function getProjectView(token, companyUid, projectId) {
+    const view = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}`, {
+        query: { companyUid },
+    }));
+    if (!view)
+        throw new Error("Work mesh returned an invalid project view");
+    return projectViewFromResponse(view, companyUid, projectId);
+}
+/** Replace a project's durable Board view and keep the local project cache current. */
+export async function putProjectView(token, companyUid, projectId, input) {
+    const view = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}`, {
+        method: "PUT",
+        body: { companyUid, ...input },
+    }));
+    if (!view)
+        throw new Error("Work mesh returned an invalid project view");
+    const result = projectViewFromResponse(view, companyUid, projectId);
+    writeMeshCacheFile(["projects", result.companyUid, `${result.projectId}.json`], view);
+    return result;
+}
+/** Register the project genesis thread and deterministic project channel. */
+export async function registerMeshProject(token, companyUid, projectId) {
+    const result = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}/register`, { method: "POST", body: { companyUid } }));
+    const threadId = String(result?.threadId || "").trim();
+    const channelId = String(result?.channelId || "").trim();
+    if (!threadId || !channelId) {
+        throw new Error("Work mesh registration did not return a threadId and channelId");
+    }
+    return {
+        companyUid: String(result?.companyUid || companyUid).trim(),
+        projectId: String(result?.projectId || projectId).trim(),
+        threadId,
+        channelId,
+        channelCreated: result?.channelCreated === true,
     };
 }
 export function pairDmUidsFromInbox(inbox) {
@@ -423,15 +545,43 @@ export function meshCachePrincipalUid(tokens, fallbackToken) {
     }
     return "session";
 }
+function tokensIdentifySamePrincipal(token, candidate) {
+    if (token === candidate)
+        return true;
+    const tokenClaims = peekIdToken(token);
+    const candidateClaims = peekIdToken(candidate);
+    const tokenEntityUid = entityUidFromJwt(token);
+    const candidateEntityUid = entityUidFromJwt(candidate);
+    if (tokenEntityUid && candidateEntityUid && tokenEntityUid !== candidateEntityUid) {
+        return false;
+    }
+    for (const claim of ["sub", "cognito:username", "username", "email"]) {
+        const tokenValue = tokenClaims[claim];
+        const candidateValue = candidateClaims[claim];
+        if (typeof tokenValue === "string" &&
+            tokenValue.length > 0 &&
+            tokenValue === candidateValue) {
+            return true;
+        }
+    }
+    return false;
+}
 /**
- * Resolve the cache principal. JWT first; if the human access/id tokens have
- * no entityUid, ask `/v1/realtime/credentials` (same fallback as the pack
- * doctor). Only the uid is kept — credentials are discarded.
+ * Resolve the authenticated request principal. The request token is the source
+ * of truth; cached credentials may contribute an entity uid only when they
+ * identify the same caller. Only the uid is kept — credentials are discarded.
  */
 export async function resolveMeshPrincipalUid(token, tokens) {
-    const fromJwt = meshCachePrincipalUid(tokens, token);
-    if (fromJwt !== "session")
-        return fromJwt;
+    const fromRequestToken = entityUidFromJwt(token);
+    if (fromRequestToken)
+        return fromRequestToken;
+    for (const candidate of [tokens?.idToken, tokens?.accessToken]) {
+        if (!candidate || !tokensIdentifySamePrincipal(token, candidate))
+            continue;
+        const uid = entityUidFromJwt(candidate);
+        if (uid)
+            return uid;
+    }
     try {
         const data = await meshJson(token, "/v1/realtime/credentials", {
             method: "POST",
@@ -442,19 +592,8 @@ export async function resolveMeshPrincipalUid(token, tokens) {
             return uid;
     }
     catch {
-        // best-effort; session.json is worse than failing doctor
+        // Best-effort; callers must fail rather than claim work as "session".
     }
-    return "session";
-}
-export function callerLabelFromToken(token) {
-    const claims = peekIdToken(token);
-    const entityUid = claims["custom:entityUid"];
-    if (typeof entityUid === "string" && entityUid)
-        return entityUid;
-    if (typeof claims.email === "string" && claims.email)
-        return claims.email;
-    if (typeof claims.sub === "string" && claims.sub)
-        return claims.sub;
-    return "hq-cli";
+    return undefined;
 }
 //# sourceMappingURL=api.js.map

package/dist/lib/mesh/live/backfill-held.d.ts

@@ -22,6 +22,7 @@
  */
 import type { ReconcileObservation, ReconcileOutcome } from "../../work-context/reconcile.js";
 import { type SessionStateFile } from "../../work-context/state.js";
+import type { MembershipValidationResult } from "../../work-context/config.js";
 import { type OutboxOperation } from "../../work-context/outbox.js";
 /**
  * One distinct session discovered in held.jsonl, carrying the company evidence
@@ -75,8 +76,20 @@ export interface BackfillHeldResult {
     unresolved: number;
     /** Unresolved because otherwise-trusted local evidence disagreed. */
     conflictingEvidence: number;
+    /**
+     * Unresolved because no local company evidence existed (not even a slug).
+     * These sessions cannot be recovered without --use-device-default or new
+     * local activity; they are never silently folded into the plain unresolved
+     * count.
+     */
+    noEvidence: number;
     /** Sessions that errored during reconcile. */
     errors: number;
+    /** Why each session with otherwise-valid local evidence stayed unresolved. */
+    unresolvedReasons: Array<{
+        sessionId: string;
+        reason: string;
+    }>;
     dryRun: boolean;
 }
 export interface BackfillHeldDeps {
@@ -88,7 +101,7 @@ export interface BackfillHeldDeps {
     hqRoot?: string;
     /** Durable device allowlist of verified local HQ roots. */
     hqRoots?: string[];
-    /** Report only; write nothing, call no network, invoke no reconcile. */
+    /** Report only; write nothing or deliver events. Membership validation may run. */
     dryRun?: boolean;
     /** Cap distinct sessions processed. 0 (default) = no cap. */
     limit?: number;
@@ -116,13 +129,11 @@ export interface BackfillHeldDeps {
     /** Env passed to the dry-run resolver (tests). Default process.env. */
     env?: NodeJS.ProcessEnv;
     /**
-     * Read-only company predictor for --dry-run. MUST mirror what the write
-     * path's reconcile would resolve, so dry-run and write report the same
-     * counts (the earlier bug: dry-run counted every session as would-reconcile
-     * while the write path, given no evidence, resolved none). Default runs the
-     * shared `resolveCompany` over the same reconstructed evidence.
+     * Membership validation used by both the dry-run preview and the live
+     * reconciler. A false response means the locally resolved slug is no longer
+     * an active membership and cannot be recovered.
      */
-    predictCompany?: (ref: HeldSessionRef) => boolean;
+    validateMembership?: (slug: string) => Promise<MembershipValidationResult> | MembershipValidationResult;
     /** Optional progress logger. */
     log?: (message: string) => void;
     /** Read/write seam for the bounded-startup rotation cursor. */

package/dist/lib/mesh/live/backfill-held.js

@@ -24,7 +24,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { readSessionState } from "../../work-context/state.js";
 import { listOutboxOperations, writeAckedRegisterState, } from "../../work-context/outbox.js";
-import { WORK_CONTEXT_CONTRACT_VERSION } from "../../work-context/contract.js";
+import { WORK_CONTEXT_CONTRACT_VERSION, } from "../../work-context/contract.js";
 import { resolveCompany, sameCompany } from "../../work-context/company.js";
 import { readMetaCompanySlug } from "../../work-context/company.js";
 import { deriveRemoteOwnerSlug, } from "../../work-context/repo-remote.js";
@@ -222,16 +222,11 @@ export function observationFromHeldRef(ref, contractVersion, clientOperationId)
     }
     return obs;
 }
-/**
- * Default dry-run predictor: run the shared `resolveCompany` over the same
- * evidence the write path forwards. Returns true when a company WOULD resolve
- * (so dry-run's `reconciled` count matches the write run's). Purely local:
- * reads config / meta / git-remote, never the network. A slug-only resolution
- * that later fails online membership validation is the one narrow case where
- * the write run can still under-count; the gross all-or-nothing mismatch is
- * gone because both paths key off this same resolver + evidence.
- */
-function defaultPredictCompany(ref, workContextRoot, remoteOwnerHint, env, useDeviceDefault) {
+/** The sole success predicate for both the preview and a live reconciliation. */
+function isSuccessfulBackfillRecovery(kind) {
+    return kind === "bound" || kind === "needs_project" || kind === "needs_task" || kind === "queued";
+}
+async function previewCompanyRecovery(ref, workContextRoot, remoteOwnerHint, env, useDeviceDefault, validateMembership) {
     // This predictor is called only with a ref already rebuilt from trusted local
     // evidence. Do not let raw held-event cwd/hqRoot values re-enter resolution.
     const remoteOwnerSlug = remoteOwnerHint?.trim();
@@ -243,16 +238,61 @@ function defaultPredictCompany(ref, workContextRoot, remoteOwnerHint, env, useDe
         remoteOwnerSlug,
         allowDeviceDefault: useDeviceDefault,
     });
-    return resolution.status === "resolved";
+    if (resolution.status !== "resolved") {
+        return { kind: resolution.status, reason: resolution.status };
+    }
+    const resolved = resolution.company;
+    if (!resolved.slug)
+        return { kind: "queued" };
+    if (!validateMembership) {
+        // Device defaults are weak, cached evidence. Reconcile refuses to use one
+        // for tenant I/O until membership has been revalidated, so the dry-run
+        // preview must fail closed in precisely the same way.
+        if (resolved.source === "device_default") {
+            return {
+                kind: "needs_company",
+                reason: "needs_company: device-default membership validator unavailable",
+            };
+        }
+        return { kind: "queued" };
+    }
+    try {
+        const membership = await validateMembership(resolved.slug);
+        if (membership === false) {
+            return {
+                kind: "needs_company",
+                reason: `membership denied for slug=${resolved.slug}`,
+            };
+        }
+    }
+    catch (err) {
+        // reconcile continues on a failed refresh for durable local evidence, but
+        // must stop a device-default recovery because that evidence is weak.
+        if (resolved.source === "device_default") {
+            return {
+                kind: "needs_company",
+                reason: `device-default membership refresh unavailable: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+    }
+    return { kind: "queued" };
 }
 /**
  * A backfill is only useful when the daemon can observe a durable company
  * binding on its next held retry. Do not use the reconcile result alone here:
  * a completed reconcile may legitimately return needs_company after a failed
  * membership lookup, and that leaves the held events exactly where they were.
+ *
+ * A persisted companySlug without a companyUid is still a durable binding:
+ * the daemon resolves the uid via membership validation on its next held retry.
+ * Requiring companyUid causes dry-run and live counts to diverge when offline
+ * reconcile writes only a slug (resolveCompany returns trusted_explicit with
+ * no uid when no manifest lookup occurs), making live report reconciled=0 for
+ * sessions the dry-run correctly predicted as recoverable.
  */
 function hasDurableCompanyRecovery(sessionId, workContextRoot, readState) {
-    return Boolean(readState(sessionId, workContextRoot)?.companyUid);
+    const state = readState(sessionId, workContextRoot);
+    return Boolean(state?.companyUid || state?.companySlug);
 }
 function latestAcknowledgedRegistration(sessionId, operations) {
     for (let index = operations.length - 1; index >= 0; index -= 1) {
@@ -385,8 +425,6 @@ export async function backfillHeldSessions(deps) {
     const readState = deps.readState ?? readSessionState;
     const env = deps.env ?? process.env;
     const newOperationId = deps.newOperationId ?? (() => globalThis.crypto.randomUUID());
-    const predictCompany = deps.predictCompany ??
-        ((ref) => defaultPredictCompany(ref, deps.workContextRoot, deps.remoteOwnerHint, env, deps.useDeviceDefault === true));
     const sessions = readHeldSessions(deps.workMeshRoot);
     // An acked register is authoritative local evidence. Older clients could
     // lose its state projection on a later hook write; recover that projection
@@ -400,7 +438,9 @@ export async function backfillHeldSessions(deps) {
         reconciled: 0,
         unresolved: 0,
         conflictingEvidence: 0,
+        noEvidence: 0,
         errors: 0,
+        unresolvedReasons: [],
         dryRun,
     };
     for (const ref of considered) {
@@ -440,6 +480,7 @@ export async function backfillHeldSessions(deps) {
         // slug from the held event itself.
         if (!evidence.candidate?.slug && deps.useDeviceDefault !== true) {
             result.unresolved += 1;
+            result.noEvidence += 1;
             deps.log?.(`would stay unresolved ${sessionId} (${hasOnlyStaleEventEvidence(ref, state) ? "STALE_EVIDENCE" : "no local company evidence"})`);
             continue;
         }
@@ -453,22 +494,24 @@ export async function backfillHeldSessions(deps) {
             task: state?.taskId,
         };
         if (dryRun) {
-            // Predict with the SAME evidence + resolver the write path uses, so the
-            // dry-run counts match a real run (no blanket would-reconcile).
-            if (predictCompany(evidenceRef)) {
+            const preview = await previewCompanyRecovery(evidenceRef, deps.workContextRoot, deps.remoteOwnerHint, env, deps.useDeviceDefault === true, deps.validateMembership);
+            if (isSuccessfulBackfillRecovery(preview.kind)) {
                 result.reconciled += 1;
                 deps.log?.(`would reconcile ${sessionId}${harness ? ` (${harness})` : ""}`);
             }
             else {
                 result.unresolved += 1;
-                deps.log?.(`would stay unresolved ${sessionId} (no company evidence)`);
+                const reason = preview.reason ?? "no company evidence";
+                result.unresolvedReasons.push({ sessionId, reason });
+                deps.log?.(`would stay unresolved ${sessionId} (${reason})`);
             }
             continue;
         }
         const obs = observationFromHeldRef(evidenceRef, contractVersion, newOperationId());
         try {
             const outcome = await deps.reconcile(obs);
-            if (hasDurableCompanyRecovery(sessionId, deps.workContextRoot, readState)) {
+            if (isSuccessfulBackfillRecovery(outcome.result.kind) &&
+                hasDurableCompanyRecovery(sessionId, deps.workContextRoot, readState)) {
                 result.reconciled += 1;
                 deps.log?.(`reconciled ${sessionId} → durable company binding`);
             }
@@ -478,7 +521,9 @@ export async function backfillHeldSessions(deps) {
             }
             else {
                 result.unresolved += 1;
-                deps.log?.(`unresolved ${sessionId} (${outcome.result.kind}: no durable company binding)`);
+                const reason = outcome.diagnostics?.at(-1) ?? `${outcome.result.kind}: no durable company binding`;
+                result.unresolvedReasons.push({ sessionId, reason });
+                deps.log?.(`unresolved ${sessionId} (${reason})`);
             }
         }
         catch (err) {

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -90,6 +90,8 @@ export interface DaemonRunDeps {
     resolveMembership?: (token: string, slug: string, signal?: AbortSignal) => Promise<{
         companyUid: string;
     } | null>;
+    /** Test seam immediately before a device-default revocation's guarded commit. */
+    beforeDeviceDefaultRevocationCommit?: () => void;
     log?: (dir: string, line: string) => void;
     /** Stop after this many ms (tests). */
     runForMs?: number;