@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/lib/mesh/live/backfill-held.js

@@ -13,213 +13,23 @@
  * company (via the identity-file default resolver shipped in 5.108.22). The
  * daemon's next held retry then re-attributes and posts those events naturally.
  *
- * Constraints:
- * - The daemon runs this in bounded startup batches; the CLI command remains
- *   available for an explicit full/manual recovery.
+ * Constraints (owner directive):
+ * - Explicit, opt-in only. Never automatic; never wired into a hook or daemon.
  * - Idempotent: sessions that already carry a companyUid are skipped.
  * - Never deletes held events; the daemon posts them on the next retry.
  * - Purely local to the box it runs on; no fleet fan-out.
  */
 import * as fs from "node:fs";
-import * as path from "node:path";
 import { readSessionState } from "../../work-context/state.js";
-import { listOutboxOperations, writeAckedRegisterState, } from "../../work-context/outbox.js";
-import { WORK_CONTEXT_CONTRACT_VERSION, } from "../../work-context/contract.js";
-import { resolveCompany, sameCompany } from "../../work-context/company.js";
-import { readMetaCompanySlug } from "../../work-context/company.js";
-import { deriveRemoteOwnerSlug, } from "../../work-context/repo-remote.js";
-import { workMeshHeldBackfillCursorPath, workMeshHeldPath } from "./paths.js";
-function readBackfillCursor(workMeshRoot) {
-    try {
-        const parsed = JSON.parse(fs.readFileSync(workMeshHeldBackfillCursorPath(workMeshRoot), "utf8"));
-        const sessionId = typeof parsed.sessionId === "string" && parsed.sessionId.trim()
-            ? parsed.sessionId.trim()
-            : undefined;
-        const ordinal = typeof parsed.ordinal === "number" &&
-            Number.isInteger(parsed.ordinal) && parsed.ordinal >= 0
-            ? parsed.ordinal
-            : undefined;
-        return sessionId || ordinal !== undefined ? { sessionId, ordinal } : null;
-    }
-    catch {
-        return null;
-    }
-}
-function writeBackfillCursor(workMeshRoot, cursor) {
-    try {
-        fs.writeFileSync(workMeshHeldBackfillCursorPath(workMeshRoot), `${JSON.stringify(cursor)}\n`, { mode: 0o600 });
-    }
-    catch {
-        // A missing cursor only repeats a bounded batch; it must never stop flush.
-    }
-}
-function rotateSessions(sessions, limit, cursor) {
-    if (!limit || limit >= sessions.length)
-        return sessions;
-    const previous = cursor?.sessionId
-        ? sessions.findIndex((ref) => ref.sessionId === cursor.sessionId)
-        : -1;
-    const start = previous >= 0
-        ? (previous + 1) % sessions.length
-        : cursor?.ordinal !== undefined
-            ? cursor.ordinal % sessions.length
-            : 0;
-    const rotated = [...sessions.slice(start), ...sessions.slice(0, start)];
-    return rotated.slice(0, limit);
-}
-function verifiedHqRoot(hqRoot) {
-    try {
-        const root = fs.realpathSync(hqRoot);
-        const manifest = path.join(root, "companies", "manifest.yaml");
-        return fs.statSync(manifest).isFile() ? root : null;
-    }
-    catch {
-        return null;
-    }
-}
-function verifiedMetaCompanySlug(sessionId, hqRoot) {
-    try {
-        const root = verifiedHqRoot(hqRoot);
-        if (!root)
-            return undefined;
-        const meta = path.join(root, "workspace", "sessions", sessionId, "meta.yaml");
-        if (!fs.statSync(meta).isFile())
-            return undefined;
-        // Do not follow a meta symlink outside the claimed HQ root.
-        const realMeta = fs.realpathSync(meta);
-        if (path.relative(root, realMeta).startsWith(".."))
-            return undefined;
-        return readMetaCompanySlug(sessionId, root);
-    }
-    catch {
-        return undefined;
-    }
-}
-function candidatesAgree(a, b) {
-    return sameCompany(a, b) ||
-        (!a.uid && !b.uid && Boolean(a.slug && b.slug) &&
-            a.slug.toLowerCase() === b.slug.toLowerCase());
-}
-function consistentCandidate(candidates) {
-    let chosen = null;
-    for (const candidate of candidates) {
-        if (!candidate.slug && !candidate.uid)
-            continue;
-        if (!chosen) {
-            chosen = { ...candidate };
-            continue;
-        }
-        if (!candidatesAgree(chosen, candidate))
-            return { candidate: null, conflict: true };
-        chosen = {
-            slug: chosen.slug ?? candidate.slug,
-            uid: chosen.uid ?? candidate.uid,
-            hqRoot: chosen.hqRoot ?? candidate.hqRoot,
-        };
-    }
-    return { candidate: chosen, conflict: false };
-}
-function localCompanyCandidates(ref, state, canonicalHqRoot, canonicalHqRoots = []) {
-    const candidates = [];
-    // A slug without a UID can be the failed/stale projection this repair is
-    // investigating. Only a persisted UID is a durable registration signal.
-    if (state?.companyUid) {
-        candidates.push({ slug: state.companySlug, uid: state.companyUid });
-    }
-    const roots = [...new Set([canonicalHqRoot, ...canonicalHqRoots]
-            .filter((candidate) => Boolean(candidate)))]
-        .map(verifiedHqRoot).filter((root) => Boolean(root));
-    const eventEvidence = currentInstanceEventEvidence(ref, state);
-    const eventRoots = eventEvidence.map((evidence) => evidence.hqRoot).filter((candidate) => Boolean(candidate));
-    for (const root of roots)
-        if (eventRoots.some((candidate) => {
-            try {
-                return fs.realpathSync(candidate) === root;
-            }
-            catch {
-                return false;
-            }
-        })) {
-            const slug = verifiedMetaCompanySlug(ref.sessionId, root);
-            if (slug)
-                candidates.push({ slug, hqRoot: root });
-            // The event cwd itself is not company evidence. The repository's origin is,
-            // but only when it is mapped by this verified HQ root's manifest.
-            for (const evidence of eventEvidence) {
-                if (!evidence.cwd || !evidence.hqRoot)
-                    continue;
-                try {
-                    if (fs.realpathSync(evidence.hqRoot) !== root)
-                        continue;
-                }
-                catch {
-                    continue;
-                }
-                const remoteSlug = deriveRemoteOwnerSlug({ cwd: evidence.cwd, hqRoot: root });
-                if (remoteSlug)
-                    candidates.push({ slug: remoteSlug, hqRoot: root });
-            }
-        }
-    return candidates;
-}
-/**
- * Keep only event evidence for the current session instance. When the state
- * file has a binding episode, that id is the instance. A timestamp, including
- * one later than startedAt, does not make another episode current.
- * Sessions that predate episodes still use startedAt so an older event is
- * not treated as this instance.
- */
-function currentInstanceEventEvidence(ref, state) {
-    const evidence = ref.eventEvidence ?? [
-        {
-            hqRoot: ref.hqRoot,
-            cwd: ref.cwd,
-            harness: ref.harness,
-        },
-        ...(ref.hqRoots ?? []).filter((hqRoot) => hqRoot !== ref.hqRoot).map((hqRoot) => ({ hqRoot })),
-    ];
-    if (state?.bindingEpisodeId) {
-        return evidence.filter((entry) => Boolean(entry.hqRoot) && entry.bindingEpisodeId === state.bindingEpisodeId);
-    }
-    if (!state?.startedAt)
-        return evidence;
-    const startedAt = Date.parse(state.startedAt);
-    if (!Number.isFinite(startedAt))
-        return [];
-    return evidence.filter((entry) => {
-        if (!entry.hqRoot)
-            return false;
-        const eventAt = entry.at ? Date.parse(entry.at) : Number.NaN;
-        return Number.isFinite(eventAt) && eventAt >= startedAt;
-    });
-}
-/** Plain reason when every rooted held event belongs to another episode. */
-function episodeMismatchReason(ref, state) {
-    if (!state?.bindingEpisodeId)
-        return null;
-    const rooted = (ref.eventEvidence ?? []).filter((entry) => entry.hqRoot);
-    if (rooted.length === 0)
-        return null;
-    if (rooted.some((entry) => entry.bindingEpisodeId === state.bindingEpisodeId))
-        return null;
-    return "episode does not match the current instance";
-}
-function hasOnlyStaleEventEvidence(ref, state) {
-    return Boolean((state?.bindingEpisodeId || state?.startedAt) &&
-        ref.eventEvidence?.some((entry) => entry.hqRoot) &&
-        !currentInstanceEventEvidence(ref, state).some((entry) => entry.hqRoot));
-}
-/** Read-only doctor helper: report only independently verified held evidence. */
-export function refWithLocalCompanyEvidence(ref, canonicalHqRoot, canonicalHqRoots = [], state = null) {
-    const evidence = consistentCandidate(localCompanyCandidates(ref, state, canonicalHqRoot, canonicalHqRoots));
-    return !evidence.conflict && evidence.candidate?.slug
-        ? { ...ref, companySlug: evidence.candidate.slug }
-        : null;
-}
+import { WORK_CONTEXT_CONTRACT_VERSION } from "../../work-context/contract.js";
+import { resolveCompany } from "../../work-context/company.js";
+import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../../work-context/repo-remote.js";
+import { workMeshHeldPath } from "./paths.js";
 /**
- * Build the reconcile observation for a company that was independently proven
- * from durable local evidence. Held-event fields are deliberately not forwarded
- * as trusted explicit context.
+ * Build the reconcile observation for one held session, forwarding the company
+ * evidence its events recorded (cwd / hqRoot / bound companySlug / project /
+ * task). The event's own companySlug is trusted explicit — it is the company
+ * the session was bound to when the events were emitted on this box.
  */
 export function observationFromHeldRef(ref, contractVersion, clientOperationId) {
     const obs = {
@@ -229,8 +39,12 @@ export function observationFromHeldRef(ref, contractVersion, clientOperationId)
             : { sessionId: ref.sessionId },
         clientOperationId,
     };
+    if (ref.cwd)
+        obs.cwd = ref.cwd;
+    if (ref.hqRoot)
+        obs.hqRoot = ref.hqRoot;
     if (ref.companySlug || ref.project || ref.task) {
-        obs.trustedContext = {
+        obs.explicit = {
             ...(ref.companySlug ? { companySlug: ref.companySlug } : {}),
             ...(ref.project ? { projectId: ref.project } : {}),
             ...(ref.task ? { taskId: ref.task } : {}),
@@ -238,129 +52,38 @@ export function observationFromHeldRef(ref, contractVersion, clientOperationId)
     }
     return obs;
 }
-/** The sole success predicate for both the preview and a live reconciliation. */
-function isSuccessfulBackfillRecovery(kind) {
-    return kind === "bound" || kind === "needs_project" || kind === "needs_task" || kind === "queued";
-}
-async function previewCompanyRecovery(ref, workContextRoot, remoteOwnerHint, env, useDeviceDefault, validateMembership) {
-    // This predictor is called only with a ref already rebuilt from trusted local
-    // evidence. Do not let raw held-event cwd/hqRoot values re-enter resolution.
-    const remoteOwnerSlug = remoteOwnerHint?.trim();
+/**
+ * Default dry-run predictor: run the shared `resolveCompany` over the same
+ * evidence the write path forwards. Returns true when a company WOULD resolve
+ * (so dry-run's `reconciled` count matches the write run's). Purely local:
+ * reads config / meta / git-remote, never the network. A slug-only resolution
+ * that later fails online membership validation is the one narrow case where
+ * the write run can still under-count; the gross all-or-nothing mismatch is
+ * gone because both paths key off this same resolver + evidence.
+ */
+function defaultPredictCompany(ref, workContextRoot, remoteOwnerHint, env) {
+    const remoteOwnerSlug = remoteOwnerHint?.trim() ||
+        (ref.cwd
+            ? deriveRemoteOwnerSlug({ cwd: ref.cwd, hqRoot: ref.hqRoot }) ?? undefined
+            : undefined);
+    const repoIdentityKey = ref.cwd
+        ? deriveRepoIdentityKey({ cwd: ref.cwd })
+        : null;
     const resolution = resolveCompany({
         root: workContextRoot,
         sessionId: ref.sessionId,
         env,
         trusted: ref.companySlug ? { companySlug: ref.companySlug } : undefined,
+        cwd: ref.cwd,
+        hqRoot: ref.hqRoot,
         remoteOwnerSlug,
-        allowDeviceDefault: useDeviceDefault,
+        repoIdentityKey,
     });
-    if (resolution.status !== "resolved") {
-        return { kind: resolution.status, reason: resolution.status };
-    }
-    const resolved = resolution.company;
-    if (!resolved.slug)
-        return { kind: "queued" };
-    if (!validateMembership) {
-        // Device defaults are weak, cached evidence. Reconcile refuses to use one
-        // for tenant I/O until membership has been revalidated, so the dry-run
-        // preview must fail closed in precisely the same way.
-        if (resolved.source === "device_default") {
-            return {
-                kind: "needs_company",
-                reason: "needs_company: device-default membership validator unavailable",
-            };
-        }
-        return { kind: "queued" };
-    }
-    try {
-        const membership = await validateMembership(resolved.slug);
-        if (membership === false) {
-            return {
-                kind: "needs_company",
-                reason: `membership denied for slug=${resolved.slug}`,
-            };
-        }
-    }
-    catch (err) {
-        // reconcile continues on a failed refresh for durable local evidence, but
-        // must stop a device-default recovery because that evidence is weak.
-        if (resolved.source === "device_default") {
-            return {
-                kind: "needs_company",
-                reason: `device-default membership refresh unavailable: ${err instanceof Error ? err.message : String(err)}`,
-            };
-        }
-    }
-    return { kind: "queued" };
-}
-/**
- * A backfill is only useful when the daemon can observe a durable company
- * binding on its next held retry. Do not use the reconcile result alone here:
- * a completed reconcile may legitimately return needs_company after a failed
- * membership lookup, and that leaves the held events exactly where they were.
- *
- * A persisted companySlug without a companyUid is still a durable binding:
- * the daemon resolves the uid via membership validation on its next held retry.
- * Requiring companyUid causes dry-run and live counts to diverge when offline
- * reconcile writes only a slug (resolveCompany returns trusted_explicit with
- * no uid when no manifest lookup occurs), making live report reconciled=0 for
- * sessions the dry-run correctly predicted as recoverable.
- */
-function hasDurableCompanyRecovery(sessionId, workContextRoot, readState) {
-    const state = readState(sessionId, workContextRoot);
-    return Boolean(state?.companyUid || state?.companySlug);
-}
-function latestAcknowledgedRegistration(sessionId, operations) {
-    for (let index = operations.length - 1; index >= 0; index -= 1) {
-        const operation = operations[index];
-        if (operation.kind === "register" &&
-            operation.delivery === "acked" &&
-            operation.sessionId === sessionId &&
-            operation.companyUid &&
-            operation.receiptId) {
-            return operation;
-        }
-    }
-    return null;
-}
-function acknowledgedRegistrationMatches(operation, ref, evidence, state) {
-    if (!operation.companyUid || !operation.receiptId)
-        return false;
-    if (state?.bindingEpisodeId) {
-        if (state.bindingEpisodeId !== operation.receiptId)
-            return false;
-    }
-    else {
-        if (!state?.startedAt)
-            return false;
-        const startedAt = Date.parse(state.startedAt);
-        const registeredAt = Date.parse(operation.createdAt);
-        if (!Number.isFinite(startedAt) || !Number.isFinite(registeredAt) || registeredAt < startedAt) {
-            return false;
-        }
-    }
-    if (evidence &&
-        !candidatesAgree(evidence, {
-            slug: operation.companySlug,
-            uid: operation.companyUid,
-        }))
-        return false;
-    if (ref.harness && operation.harness && ref.harness !== operation.harness)
-        return false;
-    return true;
-}
-/** Shared doctor/backfill gate for a receipt that is safe to treat as current evidence. */
-export function hasCurrentAcknowledgedRegistration(ref, state, operations, hqRoot, hqRoots = []) {
-    const evidence = consistentCandidate(localCompanyCandidates(ref, state, hqRoot, hqRoots));
-    if (evidence.conflict)
-        return false;
-    const operation = latestAcknowledgedRegistration(ref.sessionId, operations);
-    return Boolean(operation && acknowledgedRegistrationMatches(operation, ref, evidence.candidate, state));
+    return resolution.status === "resolved";
 }
 /**
- * Read held.jsonl and return distinct sessions. Later events can add local
- * evidence absent from the first event (the original first-occurrence-only
- * implementation missed exactly that shape after a session became bound).
+ * Read held.jsonl and return distinct sessions (first occurrence wins),
+ * carrying the harness from whichever held event we saw first for that session.
  * Lines that fail to parse or carry no sessionId are ignored (the daemon owns
  * their disposition; this backfill never mutates or deletes held lines).
  */
@@ -389,48 +112,37 @@ export function readHeldSessions(workMeshRoot) {
             continue;
         const obj = parsed;
         // Peel the held envelope { event, heldReason, heldAt } if present.
-        const envelope = obj.event &&
+        const event = obj.event &&
             typeof obj.event === "object" &&
             !Array.isArray(obj.event) &&
             typeof obj.heldReason === "string"
-            ? obj
-            : undefined;
-        const event = envelope ? envelope.event : obj;
+            ? obj.event
+            : obj;
         const sessionId = typeof event.sessionId === "string" && event.sessionId.trim()
             ? event.sessionId.trim()
             : null;
-        if (!sessionId)
+        if (!sessionId || seen.has(sessionId))
             continue;
         const str = (v) => typeof v === "string" && v.trim() ? v.trim() : undefined;
-        const ref = seen.get(sessionId) ?? { sessionId };
+        const ref = { sessionId };
         const harness = str(event.harness);
-        if (harness && !ref.harness)
+        if (harness)
             ref.harness = harness;
         const cwd = str(event.cwd);
-        if (cwd && !ref.cwd)
+        if (cwd)
             ref.cwd = cwd;
         const hqRoot = str(event.hqRoot);
-        if (hqRoot) {
-            if (!ref.hqRoot)
-                ref.hqRoot = hqRoot;
-            if (!ref.hqRoots?.includes(hqRoot)) {
-                ref.hqRoots = [...(ref.hqRoots ?? []), hqRoot];
-            }
-        }
+        if (hqRoot)
+            ref.hqRoot = hqRoot;
         const companySlug = str(event.companySlug);
-        if (companySlug && !ref.companySlug)
+        if (companySlug)
             ref.companySlug = companySlug;
         const project = str(event.project);
-        if (project && !ref.project)
+        if (project)
             ref.project = project;
         const task = str(event.task);
-        if (task && !ref.task)
+        if (task)
             ref.task = task;
-        const at = str(event.at) ?? (envelope ? str(envelope.heldAt) : undefined);
-        const bindingEpisodeId = str(event.bindingEpisodeId);
-        if (hqRoot || cwd) {
-            ref.eventEvidence = [...(ref.eventEvidence ?? []), { hqRoot, cwd, harness, at, bindingEpisodeId }];
-        }
         seen.set(sessionId, ref);
     }
     return [...seen.values()];
@@ -446,22 +158,17 @@ export async function backfillHeldSessions(deps) {
     const readState = deps.readState ?? readSessionState;
     const env = deps.env ?? process.env;
     const newOperationId = deps.newOperationId ?? (() => globalThis.crypto.randomUUID());
+    const predictCompany = deps.predictCompany ??
+        ((ref) => defaultPredictCompany(ref, deps.workContextRoot, deps.remoteOwnerHint, env));
     const sessions = readHeldSessions(deps.workMeshRoot);
-    // An acked register is authoritative local evidence. Older clients could
-    // lose its state projection on a later hook write; recover that projection
-    // directly instead of re-registering the same session.
-    const outboxOperations = listOutboxOperations(deps.workContextRoot);
-    const considered = rotateSessions(sessions, limit, (deps.readCursor ?? (() => readBackfillCursor(deps.workMeshRoot)))());
+    const considered = limit > 0 ? sessions.slice(0, limit) : sessions;
     const result = {
         scanned: sessions.length,
         considered: considered.length,
         alreadyAttributed: 0,
         reconciled: 0,
         unresolved: 0,
-        conflictingEvidence: 0,
-        noEvidence: 0,
         errors: 0,
-        unresolvedReasons: [],
         dryRun,
     };
     for (const ref of considered) {
@@ -471,82 +178,29 @@ export async function backfillHeldSessions(deps) {
             result.alreadyAttributed += 1;
             continue;
         }
-        const evidence = consistentCandidate(localCompanyCandidates(ref, state, deps.hqRoot, deps.hqRoots));
-        if (evidence.conflict) {
-            result.unresolved += 1;
-            result.conflictingEvidence += 1;
-            deps.log?.(`unresolved ${sessionId} (CONFLICTING_EVIDENCE)`);
-            continue;
-        }
-        const acknowledged = latestAcknowledgedRegistration(sessionId, outboxOperations);
-        const acknowledgedMatches = acknowledged && acknowledgedRegistrationMatches(acknowledged, ref, evidence.candidate, state);
-        if (acknowledged && !acknowledgedMatches) {
-            deps.log?.(`ignored stale acknowledged register for ${sessionId}`);
-        }
-        if (acknowledgedMatches && dryRun) {
-            result.reconciled += 1;
-            deps.log?.(`would reconcile ${sessionId} from acknowledged register`);
-            continue;
-        }
-        if (acknowledgedMatches) {
-            writeAckedRegisterState(acknowledged, deps.workContextRoot, acknowledged.receiptId);
-            if (readState(sessionId, deps.workContextRoot)?.companyUid) {
-                result.reconciled += 1;
-                deps.log?.(`reconciled ${sessionId} from acknowledged register`);
-                continue;
-            }
-        }
-        // Historical repair may use the explicitly opted-in device default only
-        // when there is no durable local company evidence. Never manufacture a
-        // slug from the held event itself.
-        if (!evidence.candidate?.slug && deps.useDeviceDefault !== true) {
-            result.unresolved += 1;
-            result.noEvidence += 1;
-            const staleReason = episodeMismatchReason(ref, state)
-                ?? (hasOnlyStaleEventEvidence(ref, state) ? "STALE_EVIDENCE" : "no local company evidence");
-            deps.log?.(`would stay unresolved ${sessionId} (${staleReason})`);
-            continue;
-        }
-        const evidenceRef = {
-            sessionId,
-            harness,
-            companySlug: evidence.candidate?.slug,
-            // Held-event fields are transport input, not trusted context. Preserve
-            // project/task only when the durable session state already owns them.
-            project: state?.projectId,
-            task: state?.taskId,
-        };
         if (dryRun) {
-            const preview = await previewCompanyRecovery(evidenceRef, deps.workContextRoot, deps.remoteOwnerHint, env, deps.useDeviceDefault === true, deps.validateMembership);
-            if (isSuccessfulBackfillRecovery(preview.kind)) {
+            // Predict with the SAME evidence + resolver the write path uses, so the
+            // dry-run counts match a real run (no blanket would-reconcile).
+            if (predictCompany(ref)) {
                 result.reconciled += 1;
                 deps.log?.(`would reconcile ${sessionId}${harness ? ` (${harness})` : ""}`);
             }
             else {
                 result.unresolved += 1;
-                const reason = preview.reason ?? "no company evidence";
-                result.unresolvedReasons.push({ sessionId, reason });
-                deps.log?.(`would stay unresolved ${sessionId} (${reason})`);
+                deps.log?.(`would stay unresolved ${sessionId} (no company evidence)`);
             }
             continue;
         }
-        const obs = observationFromHeldRef(evidenceRef, contractVersion, newOperationId());
+        const obs = observationFromHeldRef(ref, contractVersion, newOperationId());
         try {
             const outcome = await deps.reconcile(obs);
-            if (isSuccessfulBackfillRecovery(outcome.result.kind) &&
-                hasDurableCompanyRecovery(sessionId, deps.workContextRoot, readState)) {
+            if (outcome.result.companyUid) {
                 result.reconciled += 1;
-                deps.log?.(`reconciled ${sessionId} → durable company binding`);
-            }
-            else if (outcome.result.errorCode === "NOT_TRACKING") {
-                result.errors += 1;
-                deps.log?.(`error ${sessionId}: NOT_TRACKING (state was not durable)`);
+                deps.log?.(`reconciled ${sessionId} → ${outcome.result.companyUid}`);
             }
             else {
                 result.unresolved += 1;
-                const reason = outcome.diagnostics?.at(-1) ?? `${outcome.result.kind}: no durable company binding`;
-                result.unresolvedReasons.push({ sessionId, reason });
-                deps.log?.(`unresolved ${sessionId} (${reason})`);
+                deps.log?.(`unresolved ${sessionId} (no company)`);
             }
         }
         catch (err) {
@@ -554,14 +208,6 @@ export async function backfillHeldSessions(deps) {
             deps.log?.(`error ${sessionId}: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
-    if (!dryRun && limit > 0 && considered.length > 0) {
-        const last = considered[considered.length - 1];
-        const ordinal = sessions.findIndex((ref) => ref.sessionId === last.sessionId);
-        (deps.writeCursor ?? ((cursor) => writeBackfillCursor(deps.workMeshRoot, cursor)))({
-            sessionId: last.sessionId,
-            ...(ordinal >= 0 ? { ordinal } : {}),
-        });
-    }
     return result;
 }
 //# sourceMappingURL=backfill-held.js.map

package/dist/lib/mesh/live/backoff.d.ts

@@ -6,11 +6,11 @@ export declare const BACKOFF_BASE_MS = 1000;
 export declare const BACKOFF_CAP_MS = 60000;
 export declare const FLUSH_MAX_ATTEMPTS = 5;
 export type RandomFn = () => number;
-export type SleepFn = (ms: number, signal?: AbortSignal) => Promise<void>;
+export type SleepFn = (ms: number) => Promise<void>;
 export declare function fullJitterDelayMs(attempt: number, opts?: {
     baseMs?: number;
     capMs?: number;
     random?: RandomFn;
 }): number;
-export declare function defaultSleep(ms: number, signal?: AbortSignal): Promise<void>;
+export declare function defaultSleep(ms: number): Promise<void>;
 //# sourceMappingURL=backoff.d.ts.map

package/dist/lib/mesh/live/backoff.js

@@ -12,22 +12,9 @@ export function fullJitterDelayMs(attempt, opts = {}) {
     const exp = Math.min(cap, base * 2 ** attempt);
     return Math.floor(random() * exp);
 }
-export async function defaultSleep(ms, signal) {
-    if (ms <= 0 || signal?.aborted)
+export async function defaultSleep(ms) {
+    if (ms <= 0)
         return;
-    await new Promise((resolve) => {
-        const onAbort = () => {
-            clearTimeout(timer);
-            finish();
-        };
-        const finish = () => {
-            signal?.removeEventListener("abort", onAbort);
-            resolve();
-        };
-        const timer = setTimeout(finish, ms);
-        signal?.addEventListener("abort", onAbort, { once: true });
-        if (signal?.aborted)
-            onAbort();
-    });
+    await new Promise((resolve) => setTimeout(resolve, ms));
 }
 //# sourceMappingURL=backoff.js.map

package/dist/lib/mesh/live/daemon/board-refresh.d.ts

@@ -1,12 +1,8 @@
 /**
  * Refresh ~/.hq/work-context/sessions/<sid>/board.md for bound sessions
- * from the ProjectView read route at most every 60s.
- *
- * Board JSON remains the fallback for older projects, but story status is
- * authoritative in ProjectView because `hq mesh story` writes there.
+ * from GET /companies/{companyUid}/board at most every 60s.
  * Metadata-only snapshot — never prompts or tokens.
  */
-import type { SessionStateFile } from "../../../work-context/state.js";
 export declare const BOARD_REFRESH_INTERVAL_MS = 60000;
 export interface BoardStorySnapshot {
     id: string;
@@ -27,8 +23,6 @@ export interface BoardRefreshDeps {
     /** Per-session last refresh timestamps (ms). */
     lastRefresh?: Map<string, number>;
     intervalMs?: number;
-    /** Authorizes a device-default-derived session before its tenant read. */
-    authorizeDeviceDefaultTenant?: (sessionId: string, state: SessionStateFile) => Promise<boolean>;
 }
 export declare function formatBoardMarkdown(input: {
     sessionId: string;