@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/lib/mesh/live/daemon/run.js

@@ -11,42 +11,26 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { CLI_VERSION } from "../../../../cli-version.js";
 import { createWorkSessionDeliverer } from "../../client.js";
-import { listActiveMembershipCompanies, meshJson, resolveActiveMembershipCompany } from "../../api.js";
-import { ensureCognitoToken, isMachineIdentity } from "../../../../utils/cognito-session.js";
+import { meshJson, resolveActiveMembershipCompany } from "../../api.js";
+import { ensureCognitoToken } from "../../../../utils/cognito-session.js";
 import { replayOutbox } from "../../../work-context/outbox.js";
 import { workContextRoot } from "../../../work-context/paths.js";
-import { ensureDefaultCompany } from "../../../work-context/default-company.js";
-import { invalidateDefaultCompanyMemberships, readDeviceConfig, } from "../../../work-context/config.js";
-import { readSessionState, mergeLocalSessionFields, updateSessionState, } from "../../../work-context/state.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../session-events-client.js";
 import { flushSessionEvents, HELD_RETRY_INTERVAL_MS, } from "../flush.js";
-import { backfillHeldSessions, } from "../backfill-held.js";
-import { reconcileObservation } from "../../../work-context/reconcile.js";
 import { workMeshRoot, workMeshSpoolPath } from "../paths.js";
 import { createVaultBoardReader, refreshBoundSessionBoards, BOARD_REFRESH_INTERVAL_MS, } from "./board-refresh.js";
-import { createContract3Fetcher, createPersonalRealtimeFetcher, readPreferredCompanyUids, realTimerHost, } from "./credentials.js";
+import { createContract3Fetcher, realTimerHost, } from "./credentials.js";
 import { appendDaemonLog, daemonLogLine, ensureDaemonLog } from "./log.js";
 import { acquirePidLock, defaultPidLockDeps, releasePidLock, } from "./pid-lock.js";
 import { daemonDir } from "./paths.js";
-import { PresenceClient, defaultMqttConnect, } from "./presence.js";
-import { defaultDaemonState, patchDaemonState, readDaemonState, writeDaemonState, } from "./state.js";
+import { PresenceClient, } from "./presence.js";
+import { defaultDaemonState, patchDaemonState, writeDaemonState, } from "./state.js";
 import { workMeshHeldPath } from "../paths.js";
-import { defaultTranscriptFs, noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, TranscriptWatcher, } from "./transcript-watch.js";
+import { noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, TranscriptWatcher, } from "./transcript-watch.js";
 import { resolveMeshEmitMode, runsEmitPath, } from "./mode.js";
-import { hasCliVersionDrift, readInstalledCliVersion } from "./version-drift.js";
-import { resolveRunningCliEntry } from "./install.js";
-import { readDaemonConfig } from "./config.js";
-import { retireLegacyListen } from "./legacy-listen.js";
-import { startWorkCacheSubscriber } from "./work-subscribe.js";
 export const SPOOL_DEBOUNCE_MS = 2_000;
 export const FLUSH_INTERVAL_MS = 10_000;
-/** Keep startup recovery bounded: the next daemon start continues the backlog. */
-export const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
-export const DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS = 2_000;
-/** Non-zero exit reserved for CLI version drift so legacy Restart=on-failure units restart. */
-export const DAEMON_VERSION_DRIFT_EXIT_CODE = 75;
 /**
  * Only producer appends to spool.jsonl should wake the watcher. Every other
  * file in the work-mesh root (held.jsonl, spool.<ts>.claimed, held.<ts>.claimed,
@@ -61,30 +45,6 @@ export function shouldFlushOnSpoolDirEvent(filename) {
         return true;
     return String(filename) === "spool.jsonl";
 }
-function sameCompanyValue(a, b) {
-    return Boolean(a && b && a.toLowerCase() === b.toLowerCase());
-}
-function stillMatchesDeniedCompany(current, input, slug) {
-    const deniedUid = input.companyUid ?? input.state?.companyUid;
-    const deniedSlug = input.companySlug ?? input.state?.companySlug ?? slug;
-    if (deniedUid && current.companyUid && deniedUid !== current.companyUid)
-        return false;
-    if (deniedSlug && current.companySlug && !sameCompanyValue(deniedSlug, current.companySlug))
-        return false;
-    return Boolean(current.companyUid || current.companySlug);
-}
-function stillMatchesDeniedDeviceDefaultBinding(current, original, input, slug) {
-    return stillMatchesDeniedCompany(current, input, slug) &&
-        current.companyUid === original.companyUid &&
-        current.companySlug === original.companySlug &&
-        current.contextStatus === original.contextStatus &&
-        current.projectId === original.projectId &&
-        current.taskId === original.taskId &&
-        current.bindingEpisodeId === original.bindingEpisodeId &&
-        current.source === original.source &&
-        current.version === original.version &&
-        current.updatedAt === original.updatedAt;
-}
 function alive(pid) {
     try {
         process.kill(pid, 0);
@@ -112,28 +72,8 @@ export async function runMeshDaemon(deps = {}) {
         ((d, line) => appendDaemonLog(d, daemonLogLine("info", line, now)));
     const processEvents = deps.processEvents ?? process;
     const exit = deps.exit ?? ((code) => process.exit(code));
-    const daemonVersion = deps.daemonVersion ?? CLI_VERSION;
-    const installedCliVersion = deps.readInstalledCliVersion ?? readInstalledCliVersion;
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const hostPlatform = process.platform === "darwin" || process.platform === "linux" || process.platform === "win32"
-        ? process.platform
-        : "other";
-    const retiredListen = retireLegacyListen({
-        home,
-        platform: deps.legacyListenPlatform ?? hostPlatform,
-        run: deps.legacyListenRun,
-        windowsTaskPresent: deps.windowsLegacyTaskPresent,
-    });
-    const configuredRoots = readDaemonConfig(dir).trustedHqRoots;
-    const trustedRoots = [...new Set([
-            ...(deps.hqRoot ? [deps.hqRoot] : []),
-            ...(env.HQ_ROOT?.trim() ? [env.HQ_ROOT.trim()] : []),
-            ...configuredRoots,
-        ])];
     ensureDaemonLog(dir);
-    if (retiredListen.removed) {
-        log(dir, "retired legacy listener ai.getindigo.hq-work-mesh-listen");
-    }
     const lockDeps = deps.pidLock ?? defaultPidLockDeps({ isProcessAlive: alive });
     const lock = acquirePidLock(dir, lockDeps);
     if (!lock.ok) {
@@ -141,17 +81,7 @@ export async function runMeshDaemon(deps = {}) {
     }
     writeDaemonState(dir, defaultDaemonState(lockDeps.pid, now));
     log(dir, `daemon started pid=${lockDeps.pid} mode=${mode}`);
-    let cliEntry = deps.cliEntry ?? "";
-    if (!cliEntry) {
-        try {
-            cliEntry = resolveRunningCliEntry();
-        }
-        catch {
-            cliEntry = process.argv[1] ?? "";
-        }
-    }
-    log(dir, `daemon version=${daemonVersion} entry=${cliEntry}`);
-    patchDaemonState(dir, { emitMode: mode, cliVersion: daemonVersion, cliEntry }, now);
+    patchDaemonState(dir, { emitMode: mode }, now);
     // Opt into machine-credential minting when the box has creds (systemd exports
     // HQ_MACHINE_CREDS_FILE). On a person laptop with no machine creds this falls
     // through to the person login cache inside ensureCognitoToken.
@@ -162,179 +92,14 @@ export async function runMeshDaemon(deps = {}) {
     // expires after ~1h to every vend/flush forever, so the second credential
     // renewal (~96 min in) and everything after it failed with HTTP 401 and the
     // daemon went dark once its IoT credentials expired.
-    // ensureCognitoToken refuses a refresh whose subject differs from the
-    // active person cache and restores the file. The daemon must not replace
-    // the operator login with another cached session.
     const defaultGetToken = async () => ensureCognitoToken({ interactive: false, tokenSource: "machine" });
     const getToken = deps.getToken ?? defaultGetToken;
-    const resolveMembership = deps.resolveMembership ?? resolveActiveMembershipCompany;
-    const machineIdentity = deps.machineIdentity ?? isMachineIdentity();
-    /** The sole authorization seam for daemon tenant I/O derived from a device default. */
-    const tenantGate = {
-        authorize: async (input) => {
-            const state = input.state ?? (input.sessionId
-                ? readSessionState(input.sessionId, ctxRoot)
-                : null);
-            const slug = input.companySlug ?? state?.companySlug;
-            // A uid alone is enough to ask /membership/me. Missing slug is not a
-            // denial. A device-default session whose company was cleared can be
-            // checked against the configured default; that is the same company the
-            // daemon assigned before the false denial.
-            const configuredDefault = input.deviceDefault
-                ? readDeviceConfig({ root: ctxRoot }).defaultCompany
-                : undefined;
-            const defaultCompany = configuredDefault?.enabled ? configuredDefault : undefined;
-            const usingDefaultFallback = !slug && !state?.companyUid && Boolean(defaultCompany?.slug || defaultCompany?.uid);
-            const lookupKey = slug || state?.companyUid || (usingDefaultFallback
-                ? (defaultCompany?.slug || defaultCompany?.uid)
-                : undefined);
-            let authorization;
-            if (!lookupKey) {
-                authorization = { status: "denied" };
-            }
-            else {
-                const controller = new AbortController();
-                const timeout = setTimeout(() => controller.abort(), DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS);
-                try {
-                    authorization = await Promise.race([
-                        (async () => {
-                            const membership = await resolveMembership(await getToken(), lookupKey, controller.signal);
-                            // Timeout wins even if the probe then returns null.
-                            if (controller.signal.aborted) {
-                                return {
-                                    status: "unavailable",
-                                    error: `membership lookup timed out after ${DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS}ms`,
-                                };
-                            }
-                            if (membership)
-                                return { status: "authorized", uid: membership.companyUid };
-                            // A machine token often cannot read /membership/me (401/403, or an
-                            // empty person-membership list). That is "cannot tell", not "not
-                            // a member". Leave the company in place and retry.
-                            if (machineIdentity) {
-                                return {
-                                    status: "unavailable",
-                                    error: "membership probe on a machine token did not confirm a company; company left unchanged",
-                                };
-                            }
-                            return { status: "denied" };
-                        })(),
-                        new Promise((resolve) => {
-                            controller.signal.addEventListener("abort", () => resolve({
-                                status: "unavailable",
-                                error: `membership lookup timed out after ${DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS}ms`,
-                            }), { once: true });
-                        }),
-                    ]);
-                }
-                catch (err) {
-                    authorization = {
-                        status: "unavailable",
-                        error: err instanceof Error ? err.message : String(err),
-                    };
-                }
-                finally {
-                    clearTimeout(timeout);
-                }
-            }
-            if (authorization.status === "unavailable") {
-                const prior = readDaemonState(dir)?.deviceDefaultMembershipLookupFailures ?? 0;
-                patchDaemonState(dir, {
-                    lastErrorCode: "DEVICE_DEFAULT_MEMBERSHIP_LOOKUP_FAILED",
-                    deviceDefaultMembershipLookupFailures: prior + 1,
-                }, now);
-                log(dir, `device-default membership lookup unavailable${slug ? ` company=${slug}` : ""}: ${authorization.error.slice(0, 160)}`);
-                return authorization;
-            }
-            if (!input.deviceDefault)
-                return authorization;
-            if (authorization.status === "authorized" &&
-                (!input.companyUid || input.companyUid === authorization.uid) &&
-                (!state?.companyUid || state.companyUid === authorization.uid)) {
-                // A prior false denial cleared the company and left needs_company.
-                // Membership just confirmed the company, so put it back and let flush post.
-                if (state &&
-                    state.companyConfidence === "device_default" &&
-                    state.contextStatus === "needs_company") {
-                    const restoredSlug = state.companySlug || slug || defaultCompany?.slug;
-                    const restoredUid = authorization.uid;
-                    updateSessionState(state.sessionId, ctxRoot, (current) => {
-                        if (!current || current.contextStatus !== "needs_company")
-                            return null;
-                        if (current.companyUid && current.companyUid !== restoredUid)
-                            return null;
-                        if (current.companySlug &&
-                            restoredSlug &&
-                            !sameCompanyValue(current.companySlug, restoredSlug)) {
-                            return null;
-                        }
-                        return mergeLocalSessionFields({
-                            ...current,
-                            companyUid: restoredUid,
-                            ...(restoredSlug ? { companySlug: restoredSlug } : {}),
-                            contextStatus: current.projectId
-                                ? (current.taskId ? "bound" : "needs_task")
-                                : "needs_project",
-                            updatedAt: now().toISOString(),
-                        }, current, { preserveCompanyBinding: false });
-                    });
-                }
-                return authorization;
-            }
-            // Already stripped. Do not revoke, count, or log this again on every flush.
-            if (state &&
-                state.contextStatus === "needs_company" &&
-                !state.companyUid &&
-                !state.companySlug) {
-                return { status: "denied" };
-            }
-            try {
-                invalidateDefaultCompanyMemberships({ root: ctxRoot, now });
-            }
-            catch (err) {
-                log(dir, `default membership cache invalidation failed: ${String(err).slice(0, 160)}`);
-            }
-            if (state) {
-                // Commit only if the device-default binding that started this lookup is
-                // still current. The shared session-state lock also makes a hook writer
-                // that arrives at this boundary commit after us rather than get lost.
-                deps.beforeDeviceDefaultRevocationCommit?.();
-                const revoked = updateSessionState(state.sessionId, ctxRoot, (current) => {
-                    if (!current || !stillMatchesDeniedDeviceDefaultBinding(current, state, input, slug)) {
-                        return null;
-                    }
-                    return mergeLocalSessionFields({
-                        ...current,
-                        companyUid: undefined,
-                        companySlug: undefined,
-                        contextStatus: "needs_company",
-                        updatedAt: now().toISOString(),
-                    }, current, { preserveCompanyBinding: false });
-                });
-                if (!revoked) {
-                    log(dir, `device-default membership denial left newer session binding intact session=${state.sessionId}`);
-                }
-            }
-            const prior = readDaemonState(dir)?.deviceDefaultAuthorizationDenials ?? 0;
-            patchDaemonState(dir, { deviceDefaultAuthorizationDenials: prior + 1 }, now);
-            log(dir, `device-default membership denied${slug ? ` company=${slug}` : ""}; work held`);
-            return { status: "denied" };
-        },
-    };
-    const validateDaemonMembership = async (slug, deviceDefault) => {
-        const authorization = await tenantGate.authorize({ companySlug: slug, deviceDefault });
-        if (authorization.status === "unavailable") {
-            throw new Error(`device-default membership lookup unavailable: ${authorization.error}`);
-        }
-        return authorization.status === "authorized" ? { uid: authorization.uid } : false;
-    };
     /** In-memory held re-attempt throttle (survives watch-triggered flushes). */
     let lastHeldRetryAtMs = 0;
-    const shutdownController = new AbortController();
     const flushFn = deps.flush ??
-        (async (signal) => {
+        (async () => {
             const t = await getToken();
-            const poster = deps.poster ?? createSessionEventsPoster({
+            const poster = createSessionEventsPoster({
                 token: t,
                 baseUrl: resolveVaultApiBase(env),
             });
@@ -342,97 +107,25 @@ export async function runMeshDaemon(deps = {}) {
                 workMeshRoot: meshRoot,
                 workContextRoot: ctxRoot,
                 poster,
-                signal,
                 heldRetryIntervalMs: HELD_RETRY_INTERVAL_MS,
                 lastHeldRetryAtMs,
                 onHeldClaimed: (atMs) => {
                     lastHeldRetryAtMs = atMs;
                 },
                 log: (message) => log(dir, message),
-                authorizeDeviceDefaultTenant: async (state) => (await tenantGate.authorize({
-                    state,
-                    companySlug: state.companySlug,
-                    companyUid: state.companyUid,
-                    deviceDefault: true,
-                })).status === "authorized",
             });
         });
     const replayFn = deps.replayOutbox ??
         (async () => {
             const t = await getToken();
-            const deliver = deps.deliver ?? createWorkSessionDeliverer({ token: t });
-            return replayOutbox(ctxRoot, async (op) => {
-                const state = readSessionState(op.sessionId, ctxRoot);
-                // Provenance must survive session-state loss. For pre-upgrade outbox
-                // entries without provenance, absent state is unknown and therefore
-                // requires the same membership check before delivery.
-                const requiresMembershipCheck = op.companyConfidence === "device_default" ||
-                    state?.companyConfidence === "device_default" ||
-                    // Pre-provenance entries are untrusted even if an equally legacy
-                    // session state happens to exist. A current membership read is the
-                    // only authority that may release them.
-                    !op.companyConfidence;
-                if (requiresMembershipCheck) {
-                    const authorization = await tenantGate.authorize({
-                        state: state ?? undefined,
-                        companySlug: op.companySlug ?? state?.companySlug,
-                        companyUid: op.companyUid ?? state?.companyUid,
-                        deviceDefault: true,
-                    });
-                    if (authorization.status === "unavailable") {
-                        return { ok: false, retryable: true, code: "DEVICE_DEFAULT_MEMBERSHIP_LOOKUP_FAILED" };
-                    }
-                    if (authorization.status !== "authorized") {
-                        return { ok: false, retryable: false, code: "DEVICE_DEFAULT_MEMBERSHIP_DENIED" };
-                    }
-                }
-                return deliver(op);
-            });
-        });
-    const activateDefaultCompany = async () => {
-        try {
-            const token = await getToken();
-            await ensureDefaultCompany({
-                root: ctxRoot,
-                env,
-                listMemberships: () => listActiveMembershipCompanies(token),
-                log: (message) => log(dir, message),
-            });
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            log(dir, `default company activation skipped: ${message.slice(0, 160)}`);
-        }
-    };
-    const backfillFn = deps.backfillHeld ??
-        (async () => {
-            await activateDefaultCompany();
-            const token = await getToken();
-            const deliver = createWorkSessionDeliverer({ token });
-            const useDeviceDefault = readDeviceConfig({ root: ctxRoot }).repairHeldWithDefault === true;
-            return backfillHeldSessions({
-                workMeshRoot: meshRoot,
-                workContextRoot: ctxRoot,
-                hqRoots: trustedRoots,
-                limit: deps.heldBackfillBatchSize ?? HELD_BACKFILL_STARTUP_BATCH_SIZE,
-                env,
-                useDeviceDefault,
-                reconcile: (observation) => reconcileObservation(observation, {
-                    root: ctxRoot,
-                    env,
-                    deliver,
-                    validateMembership: (slug) => validateDaemonMembership(slug, useDeviceDefault),
-                    allowDeviceDefault: useDeviceDefault,
-                    deviceDefaultConfidence: useDeviceDefault,
-                }),
-                validateMembership: (slug) => validateDaemonMembership(slug, useDeviceDefault),
-            });
+            const deliver = createWorkSessionDeliverer({ token: t });
+            return replayOutbox(ctxRoot, deliver);
         });
     const boardLast = new Map();
     const refreshFn = deps.refreshBoards ??
         (async () => {
             const t = await getToken();
-            const reader = deps.readBoard ?? createVaultBoardReader({
+            const reader = createVaultBoardReader({
                 getJson: (p) => meshJson(t, p),
             });
             return refreshBoundSessionBoards({
@@ -441,66 +134,19 @@ export async function runMeshDaemon(deps = {}) {
                 lastRefresh: boardLast,
                 intervalMs: BOARD_REFRESH_INTERVAL_MS,
                 now: () => timers.now(),
-                authorizeDeviceDefaultTenant: async (_sessionId, state) => (await tenantGate.authorize({
-                    state,
-                    companySlug: state.companySlug,
-                    companyUid: state.companyUid,
-                    deviceDefault: true,
-                })).status === "authorized",
             });
         });
-    let boardRefreshFailureActive = false;
-    const refreshBoardsWithDiagnostics = async () => {
-        try {
-            const result = await refreshFn();
-            if (boardRefreshFailureActive) {
-                log(dir, "mesh-board-refresh.recovered");
-                boardRefreshFailureActive = false;
-            }
-            return result;
-        }
-        catch (error) {
-            if (!boardRefreshFailureActive) {
-                const rawName = error instanceof Error ? error.name : typeof error;
-                const errorName = rawName.replace(/[^A-Za-z0-9_.-]/g, "").slice(0, 80) || "Error";
-                const rawMessage = error instanceof Error
-                    ? error.message
-                    : typeof error === "string"
-                        ? error
-                        : "non-Error rejection";
-                const message = rawMessage
-                    .replace(/[\r\n\t]+/g, " ")
-                    .replace(/Bearer\s+\S+/gi, "Bearer [REDACTED]")
-                    .replace(/op:\/\/[^\s"]+/gi, "op://[REDACTED]")
-                    .replace(/https?:\/\/[^\s"<>]+/gi, "[URL]")
-                    .replace(/\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]+|AKIA[0-9A-Z]{16}|eyJ[A-Za-z0-9_.-]{10,})\b/gi, "[REDACTED]")
-                    .replace(/\b(?:access[_-]?token|refresh[_-]?token|id[_-]?token|token|cookie|authorization)\b\s*[:=]\s*[^\s,;&]+/gi, "credential=[REDACTED]")
-                    .replace(/\b(?:cmp|prs|prj|sess?)_[A-Za-z0-9_-]+\b/gi, "[ID]")
-                    .slice(0, 160);
-                log(dir, `mesh-board-refresh.failed errorName=${errorName} message=${message || "[empty]"}`);
-            }
-            boardRefreshFailureActive = true;
-            throw error;
-        }
-    };
     let presence = null;
-    let workCache = null;
     if (deps.enablePresence !== false) {
-        const fetchCredentialsRaw = deps.fetchCredentials ??
+        const fetchCredentials = deps.fetchCredentials ??
             (async () => {
                 const t = await getToken();
                 return createContract3Fetcher({
                     token: t,
                     baseUrl: resolveVaultApiBase(env),
                     env,
-                    readPreferredCompanyUids: () => readPreferredCompanyUids({ workContextRoot: ctxRoot }),
                 })();
             });
-        const fetchCredentials = async () => {
-            const bundle = await fetchCredentialsRaw();
-            patchDaemonState(dir, { presenceDroppedCompanies: bundle.droppedCompanies }, now);
-            return bundle;
-        };
         const presenceOpts = {
             fetchCredentials,
             mqttConnect: deps.mqttConnect,
@@ -520,7 +166,6 @@ export async function runMeshDaemon(deps = {}) {
                 }, now);
                 log(dir, `presence online companies=${companies.length}`);
             },
-            readPreferredCompanyUids: () => readPreferredCompanyUids({ workContextRoot: ctxRoot }),
             onRefusal: (refusal) => {
                 patchDaemonState(dir, {
                     presenceRefusal: refusal,
@@ -548,55 +193,16 @@ export async function runMeshDaemon(deps = {}) {
             // Continue draining spool even if MQTT is down.
         }
     }
-    if (deps.enableWorkCache) {
-        try {
-            workCache = await startWorkCacheSubscriber({
-                meshRoot,
-                fetchCredentials: deps.fetchPersonalCredentials ?? (async () => {
-                    const t = await getToken();
-                    return createPersonalRealtimeFetcher({
-                        token: t,
-                        baseUrl: resolveVaultApiBase(env),
-                    })();
-                }),
-                mqttConnect: (url, options) => {
-                    const connect = deps.mqttConnect ?? defaultMqttConnect;
-                    return connect(url, options);
-                },
-                now,
-                onInfo: (message) => log(dir, message.slice(0, 200)),
-                random: deps.random,
-            });
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            log(dir, `work cache subscribe failed: ${msg.slice(0, 200)}`);
-        }
-    }
     let stopped = false;
-    let restartRequested = false;
     let flushInFlight = null;
     let debounceHandle = null;
     let flushIntervalHandle = null;
-    let versionIntervalHandle = null;
     let boardIntervalHandle = null;
     let transcriptIntervalHandle = null;
     let watcher = null;
     /** Shared with transcript watcher: sessionIds seen on the hook/spool path. */
     const lastHookEventAt = new Map();
-    const lastHookTurnEndAt = new Map();
     let transcriptWatcher = null;
-    const requestRestartForVersionDrift = () => {
-        if (stopped || restartRequested)
-            return restartRequested;
-        const installedVersion = installedCliVersion();
-        if (!hasCliVersionDrift(daemonVersion, installedVersion))
-            return false;
-        restartRequested = true;
-        log(dir, `cli upgraded ${daemonVersion} -> ${installedVersion}, restarting`);
-        exit(DAEMON_VERSION_DRIFT_EXIT_CODE);
-        return true;
-    };
     if (emitPath && deps.enableTranscriptWatch !== false) {
         const hqRoot = deps.hqRoot ?? env.HQ_ROOT?.trim() ?? undefined;
         const getToken = deps.getToken ?? defaultGetToken;
@@ -609,11 +215,18 @@ export async function runMeshDaemon(deps = {}) {
             fs: deps.transcriptFs,
             now: () => now().getTime(),
             lastHookEventAt,
-            lastHookTurnEndAt,
-            // Transcript watch has no direct state writer: reconcile owns its write
-            // and merges local fields. Surface transient lookup failures as throws so
-            // reconcile defers without turning them into an authoritative denial.
-            validateMembership: (slug) => validateDaemonMembership(slug, true),
+            validateMembership: async (slug) => {
+                try {
+                    const token = await getToken();
+                    const membership = await resolveActiveMembershipCompany(token, slug);
+                    if (!membership)
+                        return false;
+                    return { uid: membership.companyUid };
+                }
+                catch {
+                    return false;
+                }
+            },
             deliver: async (op) => {
                 try {
                     const token = await getToken();
@@ -631,12 +244,7 @@ export async function runMeshDaemon(deps = {}) {
     }
     const doFlushCycle = async (reason, opts = {}) => {
         // Refuse new cycles after stop, except the forced shutdown flush.
-        if ((stopped || restartRequested) && !opts.force)
-            return;
-        // A long-lived daemon retains its loaded JS after a global CLI upgrade.
-        // The service unit resolves the binary again on restart, so exiting lets
-        // launchd/systemd bring up the upgraded implementation.
-        if (!opts.force && requestRestartForVersionDrift())
+        if (stopped && !opts.force)
             return;
         if (flushInFlight) {
             await flushInFlight;
@@ -645,28 +253,11 @@ export async function runMeshDaemon(deps = {}) {
         }
         flushInFlight = (async () => {
             try {
-                // A held session has already ended, so no later hook will naturally
-                // revisit its context. Repair a bounded batch before the first flush;
-                // recovered state is then retried immediately in this same cycle.
-                if (reason === "start") {
-                    try {
-                        const recovered = await backfillFn();
-                        if (recovered.reconciled > 0 ||
-                            recovered.unresolved > 0 ||
-                            recovered.errors > 0) {
-                            log(dir, `held backfill: considered=${recovered.considered} reconciled=${recovered.reconciled} unresolved=${recovered.unresolved} errors=${recovered.errors}`);
-                        }
-                    }
-                    catch (err) {
-                        const msg = err instanceof Error ? err.message : String(err);
-                        log(dir, `held backfill error: ${msg.slice(0, 200)}`);
-                    }
-                }
                 // Record hook-emitted session ids from spool/held before claim/rename.
                 const at = now().getTime();
-                noteHookSessionsFromSpoolFile(workMeshSpoolPath(meshRoot), lastHookEventAt, at, defaultTranscriptFs, lastHookTurnEndAt);
-                noteHookSessionsFromSpoolFile(workMeshHeldPath(meshRoot), lastHookEventAt, at, defaultTranscriptFs, lastHookTurnEndAt);
-                const summary = await flushFn(shutdownController.signal);
+                noteHookSessionsFromSpoolFile(workMeshSpoolPath(meshRoot), lastHookEventAt, at);
+                noteHookSessionsFromSpoolFile(workMeshHeldPath(meshRoot), lastHookEventAt, at);
+                const summary = await flushFn();
                 try {
                     const replay = await replayFn();
                     const delivered = replay.delivered ?? 0;
@@ -735,30 +326,13 @@ export async function runMeshDaemon(deps = {}) {
             if (!fs.existsSync(spoolPath)) {
                 fs.writeFileSync(spoolPath, "", { mode: 0o600 });
             }
-            const spoolWatcher = fs.watch(path.dirname(spoolPath), { persistent: true }, (_event, filename) => {
+            watcher = fs.watch(path.dirname(spoolPath), { persistent: true }, (_event, filename) => {
                 if (stopped)
                     return;
                 if (shouldFlushOnSpoolDirEvent(filename)) {
                     scheduleDebouncedFlush();
                 }
             });
-            watcher = spoolWatcher;
-            spoolWatcher.on("error", (err) => {
-                // fs.watch can fail asynchronously after returning a watcher. Without
-                // an error listener Node treats EMFILE as an uncaught exception; the
-                // periodic flush below already provides a polling fallback.
-                if (watcher === spoolWatcher)
-                    watcher = null;
-                try {
-                    spoolWatcher.close();
-                }
-                catch (closeError) {
-                    const closeMessage = closeError instanceof Error ? closeError.message : String(closeError);
-                    log(dir, `fs.watch close failed after watcher error: ${closeMessage.slice(0, 120)}`);
-                }
-                const msg = err instanceof Error ? err.message : String(err);
-                log(dir, `fs.watch error; continuing interval flush: ${msg.slice(0, 120)}`);
-            });
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
@@ -777,7 +351,7 @@ export async function runMeshDaemon(deps = {}) {
     boardIntervalHandle = timers.setTimeout(function boardTick() {
         if (stopped)
             return;
-        void refreshBoardsWithDiagnostics()
+        void refreshFn()
             .catch(() => undefined)
             .finally(() => {
             if (stopped)
@@ -785,14 +359,6 @@ export async function runMeshDaemon(deps = {}) {
             boardIntervalHandle = timers.setTimeout(boardTick, BOARD_REFRESH_INTERVAL_MS);
         });
     }, BOARD_REFRESH_INTERVAL_MS);
-    // Version drift is independent of the legacy spool flush. Direct-mode
-    // daemons have no flush cycle, so they still need the same periodic restart
-    // check after an in-place CLI upgrade.
-    versionIntervalHandle = timers.setTimeout(function versionTick() {
-        if (stopped || requestRestartForVersionDrift())
-            return;
-        versionIntervalHandle = timers.setTimeout(versionTick, FLUSH_INTERVAL_MS);
-    }, FLUSH_INTERVAL_MS);
     const runTranscriptTick = async () => {
         if (!transcriptWatcher || stopped)
             return;
@@ -813,9 +379,6 @@ export async function runMeshDaemon(deps = {}) {
                 summary.turns > 0 ||
                 summary.ended > 0) {
                 log(dir, `transcript-watch: started=${summary.started} turns=${summary.turns} ended=${summary.ended} skippedHook=${summary.skippedHookCovered}`);
-                for (const sessionId of summary.endedSessionIds) {
-                    log(dir, `transcript-watch quiet session_end sessionId=${sessionId}`);
-                }
                 scheduleDebouncedFlush();
             }
         }
@@ -838,13 +401,10 @@ export async function runMeshDaemon(deps = {}) {
     }
     // Initial pass. Board refresh runs in both modes; the flush + transcript
     // scan are legacy emit-path only.
-    if (!requestRestartForVersionDrift() && emitPath) {
+    if (emitPath) {
         void doFlushCycle("start");
     }
-    else {
-        void activateDefaultCompany();
-    }
-    void refreshBoardsWithDiagnostics().catch(() => undefined);
+    void refreshFn().catch(() => undefined);
     if (emitPath) {
         void runTranscriptTick();
     }
@@ -852,14 +412,11 @@ export async function runMeshDaemon(deps = {}) {
         if (stopped)
             return;
         stopped = true;
-        shutdownController.abort();
         log(dir, "daemon stopping");
         if (debounceHandle !== null)
             timers.clearTimeout(debounceHandle);
         if (flushIntervalHandle !== null)
             timers.clearTimeout(flushIntervalHandle);
-        if (versionIntervalHandle !== null)
-            timers.clearTimeout(versionIntervalHandle);
         if (boardIntervalHandle !== null)
             timers.clearTimeout(boardIntervalHandle);
         if (transcriptIntervalHandle !== null) {
@@ -874,15 +431,6 @@ export async function runMeshDaemon(deps = {}) {
         // Final flush, then clean MQTT DISCONNECT so the broker emits the
         // lifecycle event; offline is published server-side only.
         await doFlushCycle("shutdown", { force: true });
-        if (workCache) {
-            try {
-                await workCache.stop();
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                log(dir, `work cache stop error: ${msg.slice(0, 120)}`);
-            }
-        }
         if (presence) {
             try {
                 await presence.stop();