@indigoai-us/hq-cli 5.129.0 → 5.131.0

package/CHANGELOG.md

@@ -2,6 +2,53 @@
 
 ## [Unreleased]
 
+## [5.131.0] — 2026-09-22
+
+### Added
+
+- `hq files share` can post the share record to a project channel instead of a
+  DM: `--channel <name>` names the channel and `--mention <person>` (repeatable)
+  tags people in it. Using `--mention` without `--channel` is an error. If you
+  or a mentioned person are not members of that channel, access is still
+  granted and the record falls back to a DM, with a short note on the CLI.
+- Offline preflight results the CLI can emit are published at
+  `contracts/preflight/v1/schema.json` and `fixtures.json` (included in the
+  package). `hq mesh contract preflight --print-fixtures` prints the same
+  document. A test fails if the committed fixtures drift from the emitter.
+  contractVersion stays pinned at 1 until hq-core's vendored copy moves with it.
+
+### Fixed
+
+- Expected caller errors from company resolution, membership, and qmd lookups
+  no longer create Sentry issues. Windows filesystem failures remain visible
+  and now include redacted path context plus a sync-aware diagnostic.
+
+- An acknowledged Work Mesh register keeps the company on the session even
+  when there is no project, or a project and no task. The next flush posts a
+  held event for that session instead of leaving it held for lack of a company.
+  Tests cover each acked-register branch.
+
+- `hq mesh project set` sends the project version it just read (`If-Match` and
+  `expectedVersion`). A 409 prints "The Board changed while you were editing.
+  Re-run to pick up the latest." and exits non-zero. `--json` includes
+  `VERSION_CONFLICT`.
+
+- `hq mesh session` prints each rejected event's server code (and `--json`
+  includes `rejections`). A flush dead-letter row for a per-event rejection
+  stores that code next to `reason`.
+
+- A Cognito refresh that comes back for a different subject is refused and the
+  active `cognito-tokens.json` is left unchanged. `hq mesh daemon doctor`
+  prints the whoami subject and the subject the daemon is using.
+
+## [5.130.0] — 2026-09-22
+
+### Fixed
+
+- Hook-timeout reports remain visible as warning events with stable grouping and
+  diagnostic tags. Repeated reports are rate-limited while the next capture
+  records the suppressed count.
+
 ## [5.129.0] — 2026-09-22
 
 ### Added
@@ -305,7 +352,11 @@
   with its tenant intact, the write reflects the true classification, and no
   `projectId`, `taskId`, or binding episode is fabricated on partial paths.
   Note: a company resolved by slug only (no uid) is still not attributed on
-  either path.
+  either path. Tests disable each of those two writers in turn
+  (`writeAckedRegisterState`, and the post-ack `writeSessionState`) and
+  require the other one to still land the company for a company-only ack
+  and a company-plus-project ack. The production write itself landed in
+  `28aee9e` (#670).
 
 - The setup bot no longer posts the same question twice when a turn takes a
   while: a question asked in an interim update is held back if the final

package/contracts/preflight/v1/fixtures.json

@@ -0,0 +1,87 @@
+{
+  "contractVersion": 1,
+  "source": "hq-cli contracts/preflight/v1/fixtures.json",
+  "classifications": [
+    "unresolved",
+    "needs_company",
+    "company_conflict",
+    "needs_project",
+    "needs_task",
+    "bound",
+    "untracked"
+  ],
+  "fixtures": [
+    {
+      "contractVersion": 1,
+      "kind": "queued",
+      "classification": "unresolved",
+      "delivery": "queued",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture"
+    },
+    {
+      "contractVersion": 1,
+      "kind": "needs_company",
+      "classification": "needs_company",
+      "delivery": "clean",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture"
+    },
+    {
+      "contractVersion": 1,
+      "kind": "company_conflict",
+      "classification": "company_conflict",
+      "delivery": "clean",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture"
+    },
+    {
+      "contractVersion": 1,
+      "kind": "queued",
+      "classification": "needs_project",
+      "delivery": "queued",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture",
+      "companySlug": "acme",
+      "companyUid": "cmp_acme"
+    },
+    {
+      "contractVersion": 1,
+      "kind": "queued",
+      "classification": "needs_task",
+      "delivery": "queued",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture",
+      "companySlug": "acme",
+      "companyUid": "cmp_acme",
+      "projectId": "dispatch-proj"
+    },
+    {
+      "contractVersion": 1,
+      "kind": "queued",
+      "classification": "bound",
+      "delivery": "queued",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture",
+      "companySlug": "acme",
+      "companyUid": "cmp_acme",
+      "projectId": "dispatch-proj",
+      "taskId": "US-9"
+    },
+    {
+      "contractVersion": 1,
+      "kind": "untracked",
+      "classification": "untracked",
+      "delivery": "clean",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture"
+    }
+  ]
+}

package/contracts/preflight/v1/schema.json

@@ -0,0 +1,58 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hq.getindigo.ai/schemas/work-context/preflight/v1/schema.json",
+  "title": "Offline preflight ContextResult",
+  "description": "Shapes hq mesh context reconcile --offline emits. Hook consumers must accept every fixture and reject any classification outside this enum. Bump contractVersion together with hq-core core/hooks/SessionStart/preflight-fixtures.json.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "contractVersion",
+    "kind",
+    "classification",
+    "delivery",
+    "lifecycle",
+    "sessionId",
+    "clientOperationId"
+  ],
+  "properties": {
+    "contractVersion": { "type": "integer", "const": 1 },
+    "kind": {
+      "type": "string",
+      "enum": [
+        "queued",
+        "needs_company",
+        "company_conflict",
+        "untracked",
+        "bound",
+        "needs_project",
+        "needs_task",
+        "error"
+      ]
+    },
+    "classification": {
+      "type": "string",
+      "enum": [
+        "unresolved",
+        "needs_company",
+        "company_conflict",
+        "needs_project",
+        "needs_task",
+        "bound",
+        "untracked"
+      ]
+    },
+    "delivery": {
+      "type": "string",
+      "enum": ["clean", "queued", "acked", "quarantined"]
+    },
+    "lifecycle": { "type": "string", "enum": ["open", "terminal"] },
+    "sessionId": { "type": "string", "minLength": 1 },
+    "clientOperationId": { "type": "string", "minLength": 1 },
+    "companySlug": { "type": "string", "minLength": 1 },
+    "companyUid": { "type": "string", "minLength": 1 },
+    "projectId": { "type": "string", "minLength": 1 },
+    "taskId": { "type": "string", "minLength": 1 },
+    "bindingEpisodeId": { "type": "string", "minLength": 1 },
+    "errorCode": { "type": "string", "minLength": 1 }
+  }
+}

package/dist/command-catalog.generated.d.ts

@@ -1677,6 +1677,12 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--no-open";
             readonly description: "Print the share-session URL but do not launch the browser";
+        }, {
+            readonly flags: "--channel <name>";
+            readonly description: "Post the share record to this named channel instead of a DM";
+        }, {
+            readonly flags: "--mention <person>";
+            readonly description: "Mention a person on the channel share record (repeatable)";
         }];
         readonly subcommands: readonly [];
     }, {
@@ -5984,6 +5990,27 @@ export declare const COMMAND_CATALOG: readonly [{
             }];
             readonly subcommands: readonly [];
         }];
+    }, {
+        readonly name: "contract";
+        readonly description: "Print versioned work-mesh contracts for other repositories";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "preflight";
+            readonly description: "Offline preflight ContextResult contract (contracts/preflight/v1)";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--print-fixtures";
+                readonly description: "Write the fixture file JSON to stdout";
+            }];
+            readonly subcommands: readonly [];
+        }];
     }, {
         readonly name: "session";
         readonly description: "Local session-event spool: enqueue (printf-compatible), flush, and live status";

package/dist/command-catalog.generated.js

@@ -2138,6 +2138,14 @@ export const COMMAND_CATALOG = [
                     {
                         "flags": "--no-open",
                         "description": "Print the share-session URL but do not launch the browser"
+                    },
+                    {
+                        "flags": "--channel <name>",
+                        "description": "Post the share record to this named channel instead of a DM"
+                    },
+                    {
+                        "flags": "--mention <person>",
+                        "description": "Mention a person on the channel share record (repeatable)"
                     }
                 ],
                 "subcommands": []
@@ -7725,6 +7733,32 @@ export const COMMAND_CATALOG = [
                     }
                 ]
             },
+            {
+                "name": "contract",
+                "description": "Print versioned work-mesh contracts for other repositories",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [command]",
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "preflight",
+                        "description": "Offline preflight ContextResult contract (contracts/preflight/v1)",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--print-fixtures",
+                                "description": "Write the fixture file JSON to stdout"
+                            }
+                        ],
+                        "subcommands": []
+                    }
+                ]
+            },
             {
                 "name": "session",
                 "description": "Local session-event spool: enqueue (printf-compatible), flush, and live status",

package/dist/commands/core.js

@@ -483,7 +483,13 @@ export function registerCoreCommands(program) {
         .action(async (options) => {
         const stdin = await readSentryReportStdin(process.stdin);
         const timeoutMs = options.timeoutMs === undefined ? undefined : Number(options.timeoutMs);
-        const result = await reportSentryEvent(stdin ?? "", { dryRun: options.dryRun, timeoutMs });
+        const scope = core.opts();
+        const hqRoot = scope.hqRoot ? resolveLiveRoot({ hqRoot: scope.hqRoot }) : undefined;
+        const result = await reportSentryEvent(stdin ?? "", {
+            dryRun: options.dryRun,
+            timeoutMs,
+            hqRoot,
+        });
         if (result.code !== 0)
             process.exitCode = result.code;
     });

package/dist/commands/dm.d.ts

@@ -190,6 +190,8 @@ export declare function buildConnectionActionBody(identifier: string, matched: C
 } | {
     withEmail: string;
 };
+/** Fetch the caller's channels (GET /v1/notify/channels). */
+export declare function fetchChannels(token: string): Promise<ChannelSummary[]>;
 /** One incoming DM as returned by GET /v1/notify/inbox. */
 export interface DmInboxEvent {
     eventId: string;

package/dist/commands/dm.js

@@ -489,7 +489,7 @@ async function runGroupSend(recipients, message) {
     }
 }
 /** Fetch the caller's channels (GET /v1/notify/channels). */
-async function fetchChannels(token) {
+export async function fetchChannels(token) {
     const res = await vaultApiFetch({ token, path: "/v1/notify/channels" });
     if (!res.ok) {
         const err = (await res.json().catch(() => ({})));

package/dist/commands/files.js

@@ -8,6 +8,13 @@ import { GROUP_ID_PATTERN, EMAIL_PATTERN, normalizeFilePrefix } from "./_pattern
 import { looksLikeCompanyUid } from "../utils/vault-api.js";
 import { AuthError } from "../utils/auth-error.js";
 import { formatAccessDenied, offerAccessLadder, } from "../utils/access-denied-hint.js";
+import { fetchChannels, matchChannelsByName } from "./dm.js";
+import { resolveCompanySlug, resolvePersonWithRosterFallback, } from "./people.js";
+import { findHqRoot } from "../utils/manifest.js";
+const PERSON_UID_PATTERN = /^(prs|agt)_[A-Za-z0-9_-]+$/;
+function collectMentions(value, previous) {
+    return [...previous, value];
+}
 // ---------------------------------------------------------------------------
 // Pure helpers (exported for unit tests)
 // ---------------------------------------------------------------------------
@@ -129,8 +136,23 @@ export function registerFilesCommand(program) {
         .option("--full", "Grant access to the ENTIRE vault (the '*' wildcard prefix) — no need to quote a glob. Requires --with; defaults to write permission.")
         .option("--expires <duration>", "Token expiry duration for share-session URL (e.g. 15m, 1h, 24h). Default 15m. Max 24h.")
         .option("--no-open", "Print the share-session URL but do not launch the browser")
+        .option("--channel <name>", "Post the share record to this named channel instead of a DM")
+        .option("--mention <person>", "Mention a person on the channel share record (repeatable)", collectMentions, [])
         .action(async (paths, opts) => {
         try {
+            const mentions = opts.mention ?? [];
+            if (mentions.length > 0 && opts.channel === undefined) {
+                console.error(chalk.red("--mention requires --channel <name>."));
+                process.exit(1);
+            }
+            const companySlug = files.opts().company;
+            const channelTarget = opts.channel !== undefined
+                ? await resolveShareChannelTarget({
+                    channelName: opts.channel,
+                    mentions,
+                    companySlug,
+                })
+                : undefined;
             // Full-vault grant: a glob-safe affordance for "give this person the
             // whole vault" so admins never have to quote a `*` (an unquoted glob
             // expands to local filenames and instantly fails the one-prefix
@@ -150,8 +172,9 @@ export function registerFilesCommand(program) {
                     prefix: "*",
                     principal: opts.with,
                     permission: opts.permission ?? "write",
-                    companySlug: files.opts().company,
+                    companySlug,
                     fullVault: true,
+                    ...channelTarget,
                 });
                 return;
             }
@@ -159,9 +182,9 @@ export function registerFilesCommand(program) {
                 console.error(chalk.red("usage: hq files share <paths...> [--with <principal>]"));
                 process.exit(1);
             }
-            // Fork: --with present → existing direct-grant path. No --with →
-            // browser-launch share-session path. The direct-grant path
-            // operates on a single prefix.
+            // Fork: --with present → existing direct-grant path. --channel without
+            // --with grants each --mention as a person. No --with and no --channel
+            // → browser-launch share-session path.
             if (opts.with !== undefined) {
                 if (paths.length !== 1) {
                     console.error(chalk.red("Direct grant (--with) takes exactly one prefix. Pass multiple paths only when minting a share-session URL."));
@@ -171,15 +194,42 @@ export function registerFilesCommand(program) {
                     prefix: paths[0],
                     principal: opts.with,
                     permission: opts.permission,
-                    companySlug: files.opts().company,
+                    companySlug,
+                    ...channelTarget,
                 });
                 return;
             }
+            if (channelTarget) {
+                if (channelTarget.mentionPersonUids.length === 0) {
+                    console.error(chalk.red("--channel requires --with <principal> or --mention <person>."));
+                    process.exit(1);
+                }
+                if (paths.length !== 1) {
+                    console.error(chalk.red("Channel share takes exactly one prefix. Pass multiple paths only when minting a share-session URL."));
+                    process.exit(1);
+                }
+                const permission = opts.permission ?? "read";
+                for (const [index, uid] of channelTarget.mentionPersonUids.entries()) {
+                    await runDirectGrant({
+                        prefix: paths[0],
+                        principal: uid,
+                        permission,
+                        companySlug,
+                        ...(index === 0
+                            ? {
+                                channelId: channelTarget.channelId,
+                                mentionPersonUids: channelTarget.mentionPersonUids,
+                            }
+                            : {}),
+                    });
+                }
+                return;
+            }
             await runShareSession({
                 paths,
                 expires: opts.expires,
                 launchBrowser: opts.open,
-                companySlug: files.opts().company,
+                companySlug,
             });
         }
         catch (err) {
@@ -511,6 +561,64 @@ export function registerFilesCommand(program) {
     // files-browse.ts) onto the same group without re-creating it.
     return files;
 }
+async function resolveShareChannelTarget(params) {
+    const token = (await resolveVaultCredential()).token;
+    const channels = await fetchChannels(token);
+    const matches = matchChannelsByName(channels, params.channelName);
+    if (matches.length === 0) {
+        console.error(chalk.red(`No channel named '${params.channelName}' — run \`hq channels\` to see your channels.`));
+        process.exit(1);
+    }
+    if (matches.length > 1) {
+        const scopes = matches
+            .map((c) => c.scope ?? "unknown")
+            .join(", ");
+        console.error(chalk.red(`'${params.channelName}' matches ${matches.length} channels (${scopes}) — this is ambiguous.`));
+        process.exit(1);
+    }
+    const channelId = matches[0].channelId;
+    const mentionPersonUids = [];
+    for (const mention of params.mentions) {
+        mentionPersonUids.push(await resolveMentionPersonUid(mention, params.companySlug));
+    }
+    return { channelId, mentionPersonUids };
+}
+async function resolveMentionPersonUid(mention, companySlug) {
+    const trimmed = mention.trim();
+    if (PERSON_UID_PATTERN.test(trimmed))
+        return trimmed;
+    const hqRoot = findHqRoot();
+    const slug = resolveCompanySlug(hqRoot, companySlug);
+    const result = await resolvePersonWithRosterFallback({
+        hqRoot,
+        slug,
+        name: trimmed,
+    });
+    if (result.status === "found" && result.person.personUid) {
+        return result.person.personUid;
+    }
+    if (result.status === "ambiguous") {
+        const names = result.matches.map((p) => p.name).join(", ");
+        console.error(chalk.red(`'${trimmed}' matches multiple people (${names}) — use a person uid or email.`));
+        process.exit(1);
+    }
+    const membership = await resolvePersonWithRosterFallback({
+        hqRoot,
+        slug,
+        name: trimmed,
+        opts: { membershipOnly: true },
+    });
+    if (membership.status === "found" && membership.person.personUid) {
+        return membership.person.personUid;
+    }
+    if (membership.status === "ambiguous") {
+        const names = membership.matches.map((p) => p.name).join(", ");
+        console.error(chalk.red(`'${trimmed}' matches multiple people (${names}) — use a person uid or email.`));
+        process.exit(1);
+    }
+    console.error(chalk.red(`Could not resolve --mention '${trimmed}' to a person.`));
+    process.exit(1);
+}
 async function runDirectGrant(params) {
     const canonicalPrefix = normalizeCompanyFilePrefix(params.prefix, {
         mutating: true,
@@ -535,11 +643,18 @@ async function runDirectGrant(params) {
     const isAll = principal === "@all";
     const isEmail = !isAll && EMAIL_PATTERN.test(principal);
     const isGroup = !isAll && GROUP_ID_PATTERN.test(principal);
-    if (!isAll && !isEmail && !isGroup) {
-        console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, or a group id matching grp_<alphanumeric>`));
+    const isPerson = !isAll && !isEmail && !isGroup && PERSON_UID_PATTERN.test(principal);
+    if (!isAll && !isEmail && !isGroup && !isPerson) {
+        console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, a person uid, or a group id matching grp_<alphanumeric>`));
         process.exit(1);
     }
-    const granteeType = isAll ? "company-wide" : isEmail ? "email" : "group";
+    const granteeType = isAll
+        ? "company-wide"
+        : isEmail
+            ? "email"
+            : isPerson
+                ? "person"
+                : "group";
     const granteeId = isAll
         ? ""
         : isEmail
@@ -558,6 +673,10 @@ async function runDirectGrant(params) {
             granteeType,
             granteeId,
             permission: params.permission,
+            ...(params.channelId ? { channelId: params.channelId } : {}),
+            ...(params.mentionPersonUids && params.mentionPersonUids.length > 0
+                ? { mentionPersonUids: params.mentionPersonUids }
+                : {}),
         },
     });
     // No ACL row exists yet for this prefix. Auto-create one with this
@@ -572,6 +691,10 @@ async function runDirectGrant(params) {
             body: {
                 prefix: canonicalPrefix,
                 entries: [{ granteeType, granteeId, permission: params.permission }],
+                ...(params.channelId ? { channelId: params.channelId } : {}),
+                ...(params.mentionPersonUids && params.mentionPersonUids.length > 0
+                    ? { mentionPersonUids: params.mentionPersonUids }
+                    : {}),
             },
         });
         autoCreated = res.ok;
@@ -610,6 +733,11 @@ async function runDirectGrant(params) {
     else {
         console.log(chalk.green(`${verb} ${params.permission} on ${printedPrefix} to ${principalLabel}`));
     }
+    if (typeof data.record?.error === "string" &&
+        typeof data.record.status === "number" &&
+        data.record.status >= 400) {
+        console.log(data.record.error);
+    }
 }
 async function runShareSession(params) {
     // Validate every path before minting a session; an anchored path must never

package/dist/commands/mesh.js

@@ -12,6 +12,7 @@ import chalk from "chalk";
 import { loadCachedTokens, isMachineIdentity } from "../utils/cognito-session.js";
 import * as readline from "node:readline/promises";
 import { STORY_STATUSES, appendThreadEvent, ensureProjectThread, eventPayload, getProjectView, listActiveMembershipCompanies, listActiveThreads, patchStory, putProjectView, registerMeshProject, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
+import { buildPreflightFixtures } from "../lib/work-context/preflight-contract.js";
 import { createCandidatesFetcher, createMigratePoster, createOrganizePoster, createWorkSessionDeliverer, fetchCompanyLive, formatCompanyLiveTable, openMeshTransport, probeMigrationCapabilityForMemberships, requireToken, } from "../lib/mesh/client.js";
 import { clearDefaultCompany, isDefaultCompanyDisabled, readDeviceConfig, recordMigrationCapabilitySnapshot, setRepairHeldWithDefault, setDefaultCompany, } from "../lib/work-context/config.js";
 import { ensureDefaultCompany } from "../lib/work-context/default-company.js";
@@ -24,7 +25,7 @@ import { createSessionEventsPoster, resolveVaultApiBase, } from "../lib/mesh/liv
 const MEMBERSHIP_VALIDATION_TIMEOUT_MS = 5_000;
 import { buildEmitEvidence } from "../lib/mesh/live/emit-evidence.js";
 import { createEmitPoster, buildMeshEmitEvent } from "../lib/mesh/live/emit-client.js";
-import { emitEvents } from "../lib/mesh/live/emit.js";
+import { emitEvents, formatEmitRejectionLines } from "../lib/mesh/live/emit.js";
 import { readEmitRetry, writeEmitRetry } from "../lib/mesh/live/emit-retry.js";
 import { generateUlid } from "../lib/mesh/live/ulid.js";
 import { readLegacyBacklog } from "../lib/mesh/live/emit-replay.js";
@@ -300,17 +301,31 @@ async function runProjectSet(projectId, opts) {
     const { token, company } = await withCompany(opts);
     const current = await getProjectView(token, company.companyUid, projectId);
     const principalUid = await resolveMeshPrincipalUid(token, loadCachedTokens());
-    const view = await putProjectView(token, company.companyUid, projectId, {
-        name: opts.name?.trim() || source?.name || current.name,
-        ...(opts.description !== undefined
-            ? { description: opts.description }
-            : source?.description !== undefined
-                ? { description: source.description }
-                : { description: current.description }),
-        stories: source?.stories ?? current.stories,
-        repos: explicitRepos ?? source?.repos ?? current.repos,
-        ...(current.version !== undefined ? { version: current.version } : {}),
-    });
+    const PROJECT_CHANGED = "The Board changed while you were editing. Re-run to pick up the latest.";
+    let view;
+    try {
+        view = await putProjectView(token, company.companyUid, projectId, {
+            name: opts.name?.trim() || source?.name || current.name,
+            ...(opts.description !== undefined
+                ? { description: opts.description }
+                : source?.description !== undefined
+                    ? { description: source.description }
+                    : { description: current.description }),
+            stories: source?.stories ?? current.stories,
+            repos: explicitRepos ?? source?.repos ?? current.repos,
+            ...(current.version !== undefined ? { expectedVersion: current.version } : {}),
+        });
+    }
+    catch (err) {
+        const conflict = err;
+        if (conflict.status === 409 && conflict.code === "VERSION_CONFLICT") {
+            if (opts.json) {
+                console.log(JSON.stringify({ ok: false, code: "VERSION_CONFLICT", error: PROJECT_CHANGED }));
+            }
+            fail(PROJECT_CHANGED);
+        }
+        throw err;
+    }
     if (opts.json) {
         console.log(JSON.stringify({ ok: true, action: "project.set", principalUid, ...view }, null, 2));
         return;
@@ -1108,6 +1123,9 @@ async function runSessionEnqueue(cliKind, opts) {
     console.error(`work-mesh: emit ${kind} accepted=${summary.accepted}` +
         ` unassigned=${summary.unassigned} rejected=${summary.rejected}` +
         ` retryDepth=${summary.retryDepth}`);
+    for (const line of formatEmitRejectionLines(summary.rejections)) {
+        console.error(line);
+    }
 }
 async function runMeshMode(action, opts) {
     const meshRoot = workMeshHomeRoot();
@@ -1192,6 +1210,9 @@ async function runMeshEmit(opts) {
         ` unassigned=${summary.unassigned} rejected=${summary.rejected}` +
         ` retryDepth=${summary.retryDepth}` +
         (opts.replayLegacy ? ` (legacy scanned=${scanned} skipped=${skipped})` : ""));
+    for (const line of formatEmitRejectionLines(summary.rejections)) {
+        console.log(line);
+    }
 }
 async function runSessionFlush(opts) {
     const token = await requireToken();
@@ -1419,6 +1440,19 @@ export function registerMeshCommand(program) {
         .argument("<sessionId>", "Canonical session id")
         .option("--machine", "Write exactly one ContextResult JSON line to stdout")
         .action((sessionId, opts) => wrap(() => runContextUntracked(sessionId, opts))());
+    const contract = mesh
+        .command("contract")
+        .description("Print versioned work-mesh contracts for other repositories");
+    contract
+        .command("preflight")
+        .description("Offline preflight ContextResult contract (contracts/preflight/v1)")
+        .option("--print-fixtures", "Write the fixture file JSON to stdout")
+        .action((opts) => wrap(async () => {
+        if (!opts.printFixtures) {
+            throw new Error("Pass --print-fixtures. The stable package path is contracts/preflight/v1/fixtures.json.");
+        }
+        process.stdout.write(`${JSON.stringify(buildPreflightFixtures(), null, 2)}\n`);
+    })());
     const session = mesh
         .command("session")
         .description("Local session-event spool: enqueue (printf-compatible), flush, and live status");