@indigoai-us/hq-cli 5.130.0 → 5.132.0

package/dist/lib/lanes/spawn.js

@@ -979,13 +979,19 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
         }
         return existing;
     }
+    // A queued lane that a move parked at the target's cap carries the turn
+    // it was resumed with: the admit spawn continues that session instead of
+    // starting fresh from the brief.
+    const pendingResume = launch.trigger === undefined && existing.state === "queued" ? existing.pending_resume : undefined;
     const trigger = launch.trigger ?? inferTrigger(existing);
     // A message into a finished lane must not turn that lane `failed` when the
     // account cannot be bound: nothing has started yet, so the record keeps its
     // state and the caller sees the error. Admission and question resume keep
     // today's behaviour of naming the terminal reason on the record.
     const markPreSpawnFailure = trigger.kind !== "message" && trigger.kind !== "resume";
-    const plan = planLaneLaunch(existing, trigger);
+    const plan = pendingResume !== undefined && providerSupportsSessionResume(existing.provider)
+        ? { mode: "resume", session_id: pendingResume.session_id }
+        : planLaneLaunch(existing, trigger);
     if (existing.host.kind === "outpost") {
         refuseOutpostSelfTarget(hqRoot, existing, deps);
     }
@@ -1065,8 +1071,8 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
                     ? trigger.text
                     : trigger.kind === "resume"
                         ? trigger.text
-                        : undefined,
-                resumedFrom: trigger.kind === "resume" ? trigger.from : undefined,
+                        : pendingResume?.text,
+                resumedFrom: trigger.kind === "resume" ? trigger.from : pendingResume?.resumed_from,
                 answersPath: trigger.kind === "answered_questions" && existsSync(answersPath)
                     ? answersPath
                     : undefined,
@@ -1119,7 +1125,8 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
     // Resume-time compaction (compaction.ts). Runs before the claim so the
     // lane is never `running` without a worker while `/compact` works.
     let compaction;
-    if (resume && launch.compact !== false) {
+    const compactWanted = pendingResume?.compact ?? launch.compact;
+    if (resume && compactWanted !== false) {
         const nowFn = deps.now ?? (() => new Date());
         const decision = compactionDue(existing, nowFn().getTime(), providerCompactAfterMs(config.providers[lane.provider]));
         if (decision.due) {
@@ -1169,6 +1176,8 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
             ...current,
             state: "running",
             queued_reason: undefined,
+            // An account move's reservation ends with the claim.
+            pending_resume: undefined,
             account: resolved.id,
             ...(model !== undefined ? { model } : {}),
             effort_source: effort.source,
@@ -1187,10 +1196,22 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
         }
         if (compaction)
             next.last_compaction = { ...compaction, resume_at: nowIso };
-        if (resume && trigger.kind !== "admit") {
+        if (resume && pendingResume !== undefined) {
             next.last_resume = {
                 session_id: resume.session_id,
                 at: nowIso,
+                account: resolved.id,
+                trigger: pendingResume.trigger,
+                ...(pendingResume.message_id !== undefined ? { message_id: pendingResume.message_id } : {}),
+                ...(pendingResume.resumed_from !== undefined ? { resumed_from: pendingResume.resumed_from } : {}),
+                ...(pendingResume.text !== undefined ? { text: pendingResume.text } : {}),
+            };
+        }
+        else if (resume && trigger.kind !== "admit") {
+            next.last_resume = {
+                session_id: resume.session_id,
+                at: nowIso,
+                account: resolved.id,
                 trigger: trigger.kind,
                 ...(trigger.kind === "message" ? { message_id: trigger.message_id } : {}),
                 ...(trigger.kind === "resume"

package/dist/lib/lanes/store.js

@@ -325,6 +325,11 @@ export function parseLaneRecord(raw, filePath) {
             path: filePath,
         });
     }
+    if (raw.account_history !== undefined && !Array.isArray(raw.account_history)) {
+        throw new LaneSchemaError("account_history must be an array when present", {
+            path: filePath,
+        });
+    }
     if (!Array.isArray(raw.attribution_history)) {
         throw new LaneSchemaError("attribution_history must be an array", {
             path: filePath,
@@ -466,6 +471,11 @@ export function mergeLaneRecords(live, sidecars) {
         ...base,
         senior_history: unionHistory(all.map((record) => record.senior_history), entryIdentity, base.senior_history),
         attribution_history: unionHistory(all.map((record) => record.attribution_history), attributionIdentity, base.attribution_history),
+        ...(all.some((record) => record.account_history !== undefined)
+            ? {
+                account_history: unionHistory(all.map((record) => record.account_history ?? []), entryIdentity, base.account_history ?? []),
+            }
+            : {}),
     };
 }
 export function mergeQuestionRecords(live, sidecars) {

package/dist/lib/lanes/types.d.ts

@@ -250,6 +250,13 @@ export interface LaneRecord {
     senior_history: SeniorHistoryEntry[];
     state: LaneState;
     queued_reason?: QueuedReason;
+    /**
+     * Set by `hq lanes pickup` when it stores an outpost lane and cleared by
+     * the account bind once the model probe has finished. While set, the
+     * reconcile pass does not admit the lane: a spawn during the probe would
+     * leave a running worker behind a record the probe result then rewrites.
+     */
+    pickup_validation_pending?: true;
     priority: number;
     worker?: string;
     /** Registry-relative directory of the resolved worker, when --worker was set. */
@@ -258,6 +265,20 @@ export interface LaneRecord {
     worker_pack?: string;
     provider: LaneProvider;
     account?: string;
+    /**
+     * Every operator move of the lane's session to another account of the
+     * same provider (`hq lanes resume|message --account`), newest last, capped
+     * like the other histories.
+     */
+    account_history?: AccountHistoryEntry[];
+    /**
+     * Set by an account move (`--account`) until the spawn claims the lane:
+     * the turn the move was asked to run. While set it reserves a slot on the
+     * account for the capacity check of later moves. When the target was at
+     * its cap the lane is queued there and the reconcile pass resumes the
+     * recorded session with this turn instead of starting fresh from the brief.
+     */
+    pending_resume?: PendingResume;
     host: LaneHost;
     /**
      * Creating machine's identity when `host.kind` is `outpost` (spec §5.2).
@@ -308,8 +329,10 @@ export interface LaneRecord {
     terminal_reason?: string;
     /**
      * Structured detail behind a named `terminal_reason` (dispatch, pickup and
-     * spawn failures), or the missing-binary search path behind
-     * `provider_binary_missing`. Written by the command and spawn writers.
+     * spawn failures), the missing-binary search path behind
+     * `provider_binary_missing`, or the provider's own message, status, model
+     * and account behind `provider_rejected`. Written by the command, spawn
+     * and watcher writers.
      */
     terminal_details?: Record<string, unknown>;
     /** SSM command id of the `hq outposts exec` pickup that started this lane. */
@@ -368,9 +391,27 @@ export interface LaneEnvelopeRepair {
     envelope_ref?: string;
     at: string;
 }
+export interface AccountHistoryEntry {
+    from: string | null;
+    to: string;
+    at: string;
+    reason: "operator_move";
+}
+export interface PendingResume {
+    session_id: string;
+    trigger: "message" | "resume";
+    resumed_from?: "interrupted" | "done" | "blocked";
+    text?: string;
+    message_id?: string;
+    /** False when the command passed --no-compact; the deferred spawn honours it. */
+    compact?: boolean;
+    at: string;
+}
 export interface LaneResumeRecord {
     session_id: string;
     at: string;
+    /** Account the resumed run was bound to. */
+    account?: string;
     trigger: "answered_questions" | "message" | "resume";
     message_id?: string;
     /**
@@ -508,6 +549,12 @@ export interface ProviderConfig {
      * means the five-minute default.
      */
     progress_event_min_interval_ms?: number;
+    /**
+     * Hold applied to an account after a 429 whose message names no reset
+     * time: the account is skipped for this long. Absent means the
+     * fifteen-minute default.
+     */
+    quota_default_hold_ms?: number;
     accounts: Record<string, AccountConfig>;
 }
 export interface ThrottleConfig {

package/dist/lib/lanes/types.js

@@ -198,13 +198,14 @@ export const LANE_FIELD_WRITERS = {
     project_id: ["command"], story_id: ["command"], thread_id: ["creator", "command"],
     depth: ["command"], senior: ["command"], senior_history: ["command"],
     state: ["creator", "command", "watcher", "reconcile", "spawn"], queued_reason: ["creator", "command", "spawn", "reconcile"],
+    pickup_validation_pending: ["creator", "command", "spawn"],
     priority: ["command"], worker: ["creator"], worker_path: ["creator"], worker_pack: ["creator"],
-    provider: ["creator"], account: ["creator", "spawn"], host: ["creator"], origin_host: ["creator"], origin_host_source: ["creator"],
+    provider: ["creator"], account: ["creator", "spawn", "command"], account_history: ["command"], pending_resume: ["command", "spawn"], host: ["creator"], origin_host: ["creator"], origin_host_source: ["creator"],
     version: ["creator"], created_at: ["creator"], updated_at: ["creator"], attribution_history: ["command"],
-    last_envelope: ["watcher", "reconcile"], model: ["creator", "spawn"], effort: ["creator", "spawn"], effort_source: ["creator", "spawn"],
+    last_envelope: ["watcher", "reconcile"], model: ["creator", "spawn", "command"], effort: ["creator", "spawn"], effort_source: ["creator", "spawn"],
     last_message_at: ["command"], last_compaction: ["spawn"], story_complete: ["watcher", "reconcile"], story_complete_reason: ["watcher", "reconcile"], story_status: ["watcher", "reconcile"],
     overdue: ["reconcile"], overdue_at: ["reconcile"], last_host_report_at: ["watcher", "spawn", "reconcile"], stalled: ["watcher"], stalled_at: ["watcher"], stalled_reason: ["watcher"],
-    admitted_reason: ["reconcile"], terminal_reason: ["command", "watcher", "spawn", "reconcile"], terminal_details: ["command", "spawn"],
+    admitted_reason: ["reconcile"], terminal_reason: ["command", "watcher", "spawn", "reconcile"], terminal_details: ["command", "spawn", "watcher", "reconcile"],
     quota_reset_at: ["watcher", "reconcile"], model_quota_marker: ["watcher", "reconcile"], outpost_command_id: ["command"],
     provider_session_id: ["watcher"], provider_session_id_absent: ["watcher"], last_resume: ["spawn"], last_run_usage: ["watcher"], envelope_repair: ["watcher", "reconcile"], last_progress_event_at: ["watcher"],
 };

package/dist/lib/lanes/watcher.d.ts

@@ -33,6 +33,7 @@
  */
 import { type LaneEnvelope, type LaneRecord, type LaneState } from "./types.js";
 import { type QuotaSignal } from "./quota.js";
+import { type ProviderRejection } from "./provider-rejection.js";
 import { type LaneMesh } from "./mesh-events.js";
 import { type EnvelopeRepairSpawnInput } from "./spawn.js";
 /** Spec §5.7: no signal for 20 minutes while the process is still alive. */
@@ -73,6 +74,7 @@ export interface WatcherTickInput {
     invalidEnvelope?: {
         errors: string[];
     } | null;
+    providerRejection?: ProviderRejection | null;
 }
 export interface WatcherTickResult {
     emit?: WatcherSignal;
@@ -97,7 +99,30 @@ export declare function classifyLaneExit(input: {
     invalidEnvelope?: {
         errors: string[];
     } | null;
+    /**
+     * Set when the worker's output stream carries a provider-level turn
+     * failure (codex `turn.failed`, a Claude error result with an HTTP status,
+     * a grok error object). Failed, never interrupted: the provider refused
+     * the turn, so there is nothing to resume and no envelope to repair.
+     */
+    providerRejection?: ProviderRejection | null;
 }): TerminalClassification;
+/**
+ * One decision for an exited worker's output. An explicit provider status
+ * wins over the quota text heuristics: a 429 from any provider (including
+ * codex `turn.failed` and grok error objects, which the claude-shaped quota
+ * reader never sees) becomes a quota signal; any other explicit status is a
+ * rejection even when its text sounds like a quota message (a 402 "requires
+ * usage credits" is a rejection, not a hold). A failure with no status at
+ * all is matched against the quota text heuristics first: a status-less
+ * "usage limit" / "rate limit" turn.failed still creates the account hold;
+ * any other status-less message is a rejection. Only when the stream
+ * carries no failure object does the quota reader's own read apply.
+ */
+export declare function routeProviderFailure(failure: ProviderRejection | null, readQuota: () => QuotaSignal | null, model: string | undefined, now: Date): {
+    quota: QuotaSignal | null;
+    rejection: ProviderRejection | null;
+};
 export declare function tickWatcher(input: WatcherTickInput): WatcherTickResult;
 export declare function watcherEventsPath(hqRoot: string, laneId: string): string;
 export declare function watcherOutLogPath(hqRoot: string, laneId: string): string;
@@ -119,6 +144,8 @@ export interface ApplyTerminalOpts {
     envelopeRef?: string;
     at?: string;
     quota?: QuotaSignal | null;
+    /** Written to `terminal_details` with the model and account the run used. */
+    providerRejection?: ProviderRejection | null;
 }
 export declare function stalledReason(silenceMs: number): string;
 /**

package/dist/lib/lanes/watcher.js

@@ -38,9 +38,10 @@ import { raiseEnvelopeQuestions } from "./questions.js";
 import { isTerminalLaneState, parseLaneEnvelope, } from "./types.js";
 import { readLane, retryUpdateLane } from "./store.js";
 import { readWorkerRunResult } from "./delivery.js";
-import { readQuotaSignal, recordAccountQuota } from "./quota.js";
+import { applyDefaultQuotaHold, quotaSignalFromFields, readQuotaSignal, recordAccountQuota, } from "./quota.js";
+import { PROVIDER_REJECTED_REASON, QUOTA_STATUS, providerRejectionDetails, readProviderRejection, } from "./provider-rejection.js";
 import { readToolActivity, toolActivityPath } from "./dropbox.js";
-import { loadLanesConfig, providerProgressEventMinIntervalMs } from "./config.js";
+import { loadLanesConfig, providerProgressEventMinIntervalMs, providerQuotaDefaultHoldMs } from "./config.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneProgressEvent, progressEventDue, } from "./mesh-events.js";
 import { envelopeQuestionId } from "./questions.js";
 import { laneRunDir, missingPidProbe, probePidRecord, readPidRecord, readProcStarttime, readSpawnManifest, envelopeRepairMode, spawnEnvelopeRepair, } from "./spawn.js";
@@ -86,6 +87,9 @@ export function classifyLaneExit(input) {
             return { state: "blocked" };
         throw new LanesError("unknown_envelope_decision", `Unknown envelope decision ${JSON.stringify(input.envelope.decision)}. Accepted: done, ask, blocked`, { accepted: ["done", "ask", "blocked"], value: input.envelope.decision });
     }
+    if (input.providerRejection) {
+        return { state: "failed", reason: PROVIDER_REJECTED_REASON };
+    }
     if (input.invalidEnvelope) {
         return { state: "failed", reason: ENVELOPE_INVALID_REASON };
     }
@@ -100,6 +104,34 @@ export function classifyLaneExit(input) {
     }
     return { state: "failed", reason: "exited_without_envelope" };
 }
+/**
+ * One decision for an exited worker's output. An explicit provider status
+ * wins over the quota text heuristics: a 429 from any provider (including
+ * codex `turn.failed` and grok error objects, which the claude-shaped quota
+ * reader never sees) becomes a quota signal; any other explicit status is a
+ * rejection even when its text sounds like a quota message (a 402 "requires
+ * usage credits" is a rejection, not a hold). A failure with no status at
+ * all is matched against the quota text heuristics first: a status-less
+ * "usage limit" / "rate limit" turn.failed still creates the account hold;
+ * any other status-less message is a rejection. Only when the stream
+ * carries no failure object does the quota reader's own read apply.
+ */
+export function routeProviderFailure(failure, readQuota, model, now) {
+    if (failure && failure.status === QUOTA_STATUS) {
+        return {
+            quota: quotaSignalFromFields({ api_error_status: QUOTA_STATUS, is_error: true, result: failure.message }, model, now),
+            rejection: null,
+        };
+    }
+    if (failure && failure.status === null) {
+        const quota = quotaSignalFromFields({ api_error_status: undefined, is_error: true, result: failure.message }, model, now);
+        if (quota)
+            return { quota, rejection: null };
+    }
+    if (failure)
+        return { quota: null, rejection: failure };
+    return { quota: readQuota(), rejection: null };
+}
 export function tickWatcher(input) {
     const silenceMs = input.silenceMs ?? SILENCE_MS;
     const at = new Date(input.nowMs).toISOString();
@@ -109,6 +141,7 @@ export function tickWatcher(input) {
             hasPartialOutput: input.hasPartialOutput,
             quota: input.quota,
             invalidEnvelope: input.invalidEnvelope,
+            providerRejection: input.providerRejection,
         });
         return {
             emit: { kind: "terminal", at, classification },
@@ -301,6 +334,9 @@ export function applyTerminalToLaneWithResult(hqRoot, laneId, classification, op
         if (opts.quota?.marker) {
             next.model_quota_marker = opts.quota.marker;
         }
+        if (opts.providerRejection) {
+            next.terminal_details = providerRejectionDetails(opts.providerRejection, current);
+        }
         if (opts.envelope && opts.envelopeRef) {
             next.last_envelope = {
                 ref: opts.envelopeRef,
@@ -589,19 +625,37 @@ export async function runWatcherLoop(hqRoot, laneId, deps = {}) {
         const hasPartialOutput = logFiles.some((file) => fileNonEmpty(file));
         let quota = null;
         let quotaLane = null;
+        let providerRejection = null;
         if (!processAlive && !envelope) {
             try {
                 quotaLane = readLane(hqRoot, laneId);
-                quota = readQuotaSignal(runDir, quotaLane.model, new Date(now()), readSpawnManifest(runDir).worker_out_offset ?? 0);
+                const workerOutOffset = readSpawnManifest(runDir).worker_out_offset ?? 0;
+                const routed = routeProviderFailure(readProviderRejection(runDir, quotaLane.provider, workerOutOffset), () => readQuotaSignal(runDir, quotaLane.model, new Date(now()), workerOutOffset), quotaLane.model, new Date(now()));
+                // A reset-less 429 still holds the account: the configured default
+                // hold becomes its reset, recorded as such.
+                quota = routed.quota
+                    ? applyDefaultQuotaHold(routed.quota, providerQuotaDefaultHoldMs(loadLanesConfig(hqRoot).providers[quotaLane.provider]), new Date(now()))
+                    : null;
+                providerRejection = routed.rejection;
             }
             catch (err) {
                 process.stderr.write(`hq lanes watcher: quota read failed for ${laneId}: ${err instanceof Error ? err.message : String(err)}\n`);
             }
         }
         // Spec §4: the process exited and its envelope file does not parse.
-        // Exactly one repair turn, then failed with both errors.
+        // Exactly one repair turn, then failed with both errors. A provider
+        // rejection skips the repair: the provider refused the turn, so a
+        // second turn on the same model and account would be refused the same
+        // way. A quota signal skips it too: a repair turn on an exhausted account
+        // fails the same way, and would end the lane envelope_invalid without
+        // ever recording the hold. The quota result applies immediately instead.
         let invalidEnvelope = null;
-        if (!processAlive && !envelope && latestFile && latestFile.envelope === null) {
+        if (!processAlive &&
+            !envelope &&
+            !providerRejection &&
+            !quota &&
+            latestFile &&
+            latestFile.envelope === null) {
             const repair = decideEnvelopeRepair(hqRoot, laneId, latestFile, now(), spawnRepair, logDecision);
             if (repair.action === "spawned") {
                 lastSignalMs = now();
@@ -626,6 +680,7 @@ export async function runWatcherLoop(hqRoot, laneId, deps = {}) {
             silenceMs,
             quota,
             invalidEnvelope,
+            providerRejection,
         });
         if (processAlive) {
             maybeHeartbeatLane(hqRoot, laneId, now());
@@ -702,6 +757,13 @@ export async function runWatcherLoop(hqRoot, laneId, deps = {}) {
                     state: classification.state,
                     reason: classification.reason,
                     ...(invalidEnvelope ? { envelope_errors: invalidEnvelope.errors } : {}),
+                    ...(providerRejection
+                        ? {
+                            provider_status: providerRejection.status,
+                            provider_message: providerRejection.message,
+                            retryable: providerRejection.retryable,
+                        }
+                        : {}),
                 });
                 if (quota &&
                     quotaLane?.account &&
@@ -719,6 +781,7 @@ export async function runWatcherLoop(hqRoot, laneId, deps = {}) {
                     envelopeRef: latest?.ref,
                     at: tick.emit.at,
                     quota,
+                    providerRejection,
                 });
                 const updated = terminalWrite.record;
                 logDecision({

package/dist/lib/mesh/api.d.ts

@@ -56,6 +56,7 @@ export declare function meshJson(token: string, path: string, init?: {
     method?: string;
     body?: Record<string, unknown>;
     query?: Record<string, string>;
+    headers?: Record<string, string>;
     signal?: AbortSignal;
 }): Promise<unknown>;
 export declare function resolveMeshCompany(token: string, company?: string): Promise<MeshCompany>;
@@ -133,6 +134,7 @@ export declare function putProjectView(token: string, companyUid: string, projec
     stories?: MeshProjectStoryInput[];
     repos?: MeshProjectRepo[];
     version?: number;
+    expectedVersion?: number;
 }): Promise<MeshProjectView>;
 /** Register the project genesis thread and deterministic project channel. */
 export declare function registerMeshProject(token: string, companyUid: string, projectId: string): Promise<MeshProjectRegistration>;

package/dist/lib/mesh/api.js

@@ -30,6 +30,7 @@ export async function meshJson(token, path, init = {}) {
         method: init.method,
         body: init.body,
         query: init.query,
+        headers: init.headers,
         signal: init.signal,
     });
     const text = await res.text();
@@ -53,7 +54,11 @@ export async function meshJson(token, path, init = {}) {
             typeof err.stage === "string" && err.stage ? `stage=${err.stage}` : "",
             typeof err.recovery === "string" && err.recovery ? `recovery=${err.recovery}` : "",
         ].filter(Boolean);
-        throw new Error(`${res.status} ${code}${detail}${context.length ? ` (${context.join("; ")})` : ""}`);
+        const failure = new Error(`${res.status} ${code}${detail}${context.length ? ` (${context.join("; ")})` : ""}`);
+        failure.status = res.status;
+        if (typeof err.code === "string" && err.code)
+            failure.code = err.code;
+        throw failure;
     }
     return data;
 }
@@ -415,9 +420,17 @@ export async function getProjectView(token, companyUid, projectId) {
 }
 /** Replace a project's durable Board view and keep the local project cache current. */
 export async function putProjectView(token, companyUid, projectId, input) {
+    const { expectedVersion, ...document } = input;
     const view = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}`, {
         method: "PUT",
-        body: { companyUid, ...input },
+        body: {
+            companyUid,
+            ...document,
+            ...(expectedVersion !== undefined ? { expectedVersion } : {}),
+        },
+        ...(expectedVersion !== undefined
+            ? { headers: { "If-Match": String(expectedVersion) } }
+            : {}),
     }));
     if (!view)
         throw new Error("Work mesh returned an invalid project view");

package/dist/lib/mesh/live/backfill-held.d.ts

@@ -49,15 +49,16 @@ export interface HeldSessionRef {
     /** Task id carried on the event, if any. */
     task?: string;
     /**
-     * Per-event local evidence retained while coalescing a held session. Event
-     * timestamps are instance boundaries: a session id may be reused, so a root
-     * observed before the current state.startedAt must not attribute it.
+     * Per-event local evidence retained while coalescing a held session. A
+     * session id may be reused. The current instance is state.bindingEpisodeId,
+     * never the event timestamp: a later `at` on another episode is still stale.
      */
     eventEvidence?: Array<{
         hqRoot?: string;
         cwd?: string;
         harness?: string;
         at?: string;
+        bindingEpisodeId?: string;
     }>;
 }
 export interface BackfillHeldResult {

package/dist/lib/mesh/live/backfill-held.js

@@ -163,9 +163,11 @@ function localCompanyCandidates(ref, state, canonicalHqRoot, canonicalHqRoots =
     return candidates;
 }
 /**
- * Keep only event evidence that belongs to the current session instance. A
- * current state is a durable instance marker; metadata from a held event that
- * predates it could belong to a prior use of the same session id.
+ * Keep only event evidence for the current session instance. When the state
+ * file has a binding episode, that id is the instance. A timestamp, including
+ * one later than startedAt, does not make another episode current.
+ * Sessions that predate episodes still use startedAt so an older event is
+ * not treated as this instance.
  */
 function currentInstanceEventEvidence(ref, state) {
     const evidence = ref.eventEvidence ?? [
@@ -176,6 +178,9 @@ function currentInstanceEventEvidence(ref, state) {
         },
         ...(ref.hqRoots ?? []).filter((hqRoot) => hqRoot !== ref.hqRoot).map((hqRoot) => ({ hqRoot })),
     ];
+    if (state?.bindingEpisodeId) {
+        return evidence.filter((entry) => Boolean(entry.hqRoot) && entry.bindingEpisodeId === state.bindingEpisodeId);
+    }
     if (!state?.startedAt)
         return evidence;
     const startedAt = Date.parse(state.startedAt);
@@ -188,8 +193,19 @@ function currentInstanceEventEvidence(ref, state) {
         return Number.isFinite(eventAt) && eventAt >= startedAt;
     });
 }
+/** Plain reason when every rooted held event belongs to another episode. */
+function episodeMismatchReason(ref, state) {
+    if (!state?.bindingEpisodeId)
+        return null;
+    const rooted = (ref.eventEvidence ?? []).filter((entry) => entry.hqRoot);
+    if (rooted.length === 0)
+        return null;
+    if (rooted.some((entry) => entry.bindingEpisodeId === state.bindingEpisodeId))
+        return null;
+    return "episode does not match the current instance";
+}
 function hasOnlyStaleEventEvidence(ref, state) {
-    return Boolean(state?.startedAt &&
+    return Boolean((state?.bindingEpisodeId || state?.startedAt) &&
         ref.eventEvidence?.some((entry) => entry.hqRoot) &&
         !currentInstanceEventEvidence(ref, state).some((entry) => entry.hqRoot));
 }
@@ -310,12 +326,18 @@ function latestAcknowledgedRegistration(sessionId, operations) {
 function acknowledgedRegistrationMatches(operation, ref, evidence, state) {
     if (!operation.companyUid || !operation.receiptId)
         return false;
-    if (!state?.startedAt)
-        return false;
-    const startedAt = Date.parse(state.startedAt);
-    const registeredAt = Date.parse(operation.createdAt);
-    if (!Number.isFinite(startedAt) || !Number.isFinite(registeredAt) || registeredAt < startedAt) {
-        return false;
+    if (state?.bindingEpisodeId) {
+        if (state.bindingEpisodeId !== operation.receiptId)
+            return false;
+    }
+    else {
+        if (!state?.startedAt)
+            return false;
+        const startedAt = Date.parse(state.startedAt);
+        const registeredAt = Date.parse(operation.createdAt);
+        if (!Number.isFinite(startedAt) || !Number.isFinite(registeredAt) || registeredAt < startedAt) {
+            return false;
+        }
     }
     if (evidence &&
         !candidatesAgree(evidence, {
@@ -325,8 +347,6 @@ function acknowledgedRegistrationMatches(operation, ref, evidence, state) {
         return false;
     if (ref.harness && operation.harness && ref.harness !== operation.harness)
         return false;
-    if (state?.bindingEpisodeId && state.bindingEpisodeId !== operation.receiptId)
-        return false;
     return true;
 }
 /** Shared doctor/backfill gate for a receipt that is safe to treat as current evidence. */
@@ -407,8 +427,9 @@ export function readHeldSessions(workMeshRoot) {
         if (task && !ref.task)
             ref.task = task;
         const at = str(event.at) ?? (envelope ? str(envelope.heldAt) : undefined);
+        const bindingEpisodeId = str(event.bindingEpisodeId);
         if (hqRoot || cwd) {
-            ref.eventEvidence = [...(ref.eventEvidence ?? []), { hqRoot, cwd, harness, at }];
+            ref.eventEvidence = [...(ref.eventEvidence ?? []), { hqRoot, cwd, harness, at, bindingEpisodeId }];
         }
         seen.set(sessionId, ref);
     }
@@ -481,7 +502,9 @@ export async function backfillHeldSessions(deps) {
         if (!evidence.candidate?.slug && deps.useDeviceDefault !== true) {
             result.unresolved += 1;
             result.noEvidence += 1;
-            deps.log?.(`would stay unresolved ${sessionId} (${hasOnlyStaleEventEvidence(ref, state) ? "STALE_EVIDENCE" : "no local company evidence"})`);
+            const staleReason = episodeMismatchReason(ref, state)
+                ?? (hasOnlyStaleEventEvidence(ref, state) ? "STALE_EVIDENCE" : "no local company evidence");
+            deps.log?.(`would stay unresolved ${sessionId} (${staleReason})`);
             continue;
         }
         const evidenceRef = {

package/dist/lib/mesh/live/daemon/doctor.d.ts

@@ -33,6 +33,10 @@ export interface DaemonDoctorReport {
     tokenSource: CognitoTokenSource;
     /** human | agent | unknown — from token claims / machine signal. */
     actorKind: CognitoActorKind;
+    /** Subject in the person login file (`hq whoami`), or empty claims. */
+    whoamiSubject: string;
+    /** Subject the daemon will authenticate as (machine cache, else person file). */
+    daemonSubject: string;
     /** Credential vend refused (disabled / unsupported / 403). */
     presenceRefusal?: DaemonStateFile["presenceRefusal"];
     /** Companies the current presence credential did not include. */

package/dist/lib/mesh/live/daemon/doctor.js

@@ -5,7 +5,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { describeCognitoTokenSource, } from "../../../../utils/cognito-session.js";
+import { describeCognitoTokenSource, formatCognitoSubject, loadMachineCachedTokens, readPersonTokenFile, } from "../../../../utils/cognito-session.js";
 import { listOutboxOperations, outboxStats, } from "../../../work-context/outbox.js";
 import { readSessionState } from "../../../work-context/state.js";
 import { workContextRoot } from "../../../work-context/paths.js";
@@ -126,7 +126,7 @@ export function collectDaemonDoctor(deps = {}) {
     if (deadLetterCount > 0) {
         unhealthyReasons.push(`dead-letter count=${deadLetterCount}`);
     }
-    if (emitMode === "legacy" && heldCount > 0) {
+    if (heldCount > 0) {
         unhealthyReasons.push(`held events awaiting company attribution=${heldCount}`);
     }
     if (heldWithNoLocalEvidence > 0) {
@@ -145,6 +145,12 @@ export function collectDaemonDoctor(deps = {}) {
         unhealthyReasons.push(`presence credential refused (${presenceRefusal.code}); next retry ${presenceRefusal.nextRetryAt}`);
     }
     const auth = describeCognitoTokenSource({ home, env });
+    const whoamiTokens = readPersonTokenFile(home, env);
+    const daemonTokens = auth.tokenSource === "machine"
+        ? loadMachineCachedTokens(home, env)
+        : whoamiTokens;
+    const whoamiSubject = formatCognitoSubject(whoamiTokens);
+    const daemonSubject = formatCognitoSubject(daemonTokens);
     const emitState = readEmitState(meshRoot);
     const emitRetry = emitRetryDepth(meshRoot);
     if (emitRetry > 0) {
@@ -169,6 +175,8 @@ export function collectDaemonDoctor(deps = {}) {
         oldestSpoolAgeMs,
         tokenSource: auth.tokenSource,
         actorKind: auth.actorKind,
+        whoamiSubject,
+        daemonSubject,
         presenceRefusal,
         presenceDroppedCompanies,
         emitMode,
@@ -197,10 +205,13 @@ export function formatDaemonDoctor(report) {
     if (report.emitMode === "legacy") {
         // Legacy emit path only: the spool/held/outbox queues do not exist in
         // receive-only (direct) mode.
-        lines.push(`spool depth: ${report.spoolDepth}`, `held: ${report.heldCount}`, `held with no local evidence: ${report.heldWithNoLocalEvidence}`, `outbox depth: ${report.outboxDepth}`);
+        lines.push(`spool depth: ${report.spoolDepth}`, `held: ${report.heldCount}${report.heldCount > 0 ? " (needs_company; not sent as NONE)" : ""}`, `held with no local evidence: ${report.heldWithNoLocalEvidence}`, `outbox depth: ${report.outboxDepth}`);
+    }
+    if (report.emitMode !== "legacy" && report.heldCount > 0) {
+        lines.push(`held: ${report.heldCount} (needs_company; not sent as NONE)`);
     }
     lines.push(`attributed by device default: ${report.attributedByDeviceDefault}`, `device-default authorization denials: ${report.deviceDefaultAuthorizationDenials}`, `dead-letter: ${report.deadLetterCount}`, `unattributed events: ${report.unattributedEvents.total} ` +
-        `(spool=${report.unattributedEvents.spool} held=${report.unattributedEvents.held} dead-letter=${report.unattributedEvents.deadLetter})`, `token source: ${report.tokenSource}`, `actor kind: ${report.actorKind}`);
+        `(spool=${report.unattributedEvents.spool} held=${report.unattributedEvents.held} dead-letter=${report.unattributedEvents.deadLetter})`, `token source: ${report.tokenSource}`, `actor kind: ${report.actorKind}`, `identity whoami: ${report.whoamiSubject}`, `identity daemon: ${report.daemonSubject}`);
     if (report.emitMode === "legacy") {
         lines.push(`last flush: ${report.lastFlushAt ?? "(never)"}${report.lastFlushResult
             ? ` ok=${report.lastFlushResult.ok} posted=${report.lastFlushResult.posted}`