@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/lib/mesh/live/backfill-held.js

@@ -13,23 +13,213 @@
  * company (via the identity-file default resolver shipped in 5.108.22). The
  * daemon's next held retry then re-attributes and posts those events naturally.
  *
- * Constraints (owner directive):
- * - Explicit, opt-in only. Never automatic; never wired into a hook or daemon.
+ * Constraints:
+ * - The daemon runs this in bounded startup batches; the CLI command remains
+ *   available for an explicit full/manual recovery.
  * - Idempotent: sessions that already carry a companyUid are skipped.
  * - Never deletes held events; the daemon posts them on the next retry.
  * - Purely local to the box it runs on; no fleet fan-out.
  */
 import * as fs from "node:fs";
+import * as path from "node:path";
 import { readSessionState } from "../../work-context/state.js";
-import { WORK_CONTEXT_CONTRACT_VERSION } from "../../work-context/contract.js";
-import { resolveCompany } from "../../work-context/company.js";
-import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../../work-context/repo-remote.js";
-import { workMeshHeldPath } from "./paths.js";
+import { listOutboxOperations, writeAckedRegisterState, } from "../../work-context/outbox.js";
+import { WORK_CONTEXT_CONTRACT_VERSION, } from "../../work-context/contract.js";
+import { resolveCompany, sameCompany } from "../../work-context/company.js";
+import { readMetaCompanySlug } from "../../work-context/company.js";
+import { deriveRemoteOwnerSlug, } from "../../work-context/repo-remote.js";
+import { workMeshHeldBackfillCursorPath, workMeshHeldPath } from "./paths.js";
+function readBackfillCursor(workMeshRoot) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(workMeshHeldBackfillCursorPath(workMeshRoot), "utf8"));
+        const sessionId = typeof parsed.sessionId === "string" && parsed.sessionId.trim()
+            ? parsed.sessionId.trim()
+            : undefined;
+        const ordinal = typeof parsed.ordinal === "number" &&
+            Number.isInteger(parsed.ordinal) && parsed.ordinal >= 0
+            ? parsed.ordinal
+            : undefined;
+        return sessionId || ordinal !== undefined ? { sessionId, ordinal } : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeBackfillCursor(workMeshRoot, cursor) {
+    try {
+        fs.writeFileSync(workMeshHeldBackfillCursorPath(workMeshRoot), `${JSON.stringify(cursor)}\n`, { mode: 0o600 });
+    }
+    catch {
+        // A missing cursor only repeats a bounded batch; it must never stop flush.
+    }
+}
+function rotateSessions(sessions, limit, cursor) {
+    if (!limit || limit >= sessions.length)
+        return sessions;
+    const previous = cursor?.sessionId
+        ? sessions.findIndex((ref) => ref.sessionId === cursor.sessionId)
+        : -1;
+    const start = previous >= 0
+        ? (previous + 1) % sessions.length
+        : cursor?.ordinal !== undefined
+            ? cursor.ordinal % sessions.length
+            : 0;
+    const rotated = [...sessions.slice(start), ...sessions.slice(0, start)];
+    return rotated.slice(0, limit);
+}
+function verifiedHqRoot(hqRoot) {
+    try {
+        const root = fs.realpathSync(hqRoot);
+        const manifest = path.join(root, "companies", "manifest.yaml");
+        return fs.statSync(manifest).isFile() ? root : null;
+    }
+    catch {
+        return null;
+    }
+}
+function verifiedMetaCompanySlug(sessionId, hqRoot) {
+    try {
+        const root = verifiedHqRoot(hqRoot);
+        if (!root)
+            return undefined;
+        const meta = path.join(root, "workspace", "sessions", sessionId, "meta.yaml");
+        if (!fs.statSync(meta).isFile())
+            return undefined;
+        // Do not follow a meta symlink outside the claimed HQ root.
+        const realMeta = fs.realpathSync(meta);
+        if (path.relative(root, realMeta).startsWith(".."))
+            return undefined;
+        return readMetaCompanySlug(sessionId, root);
+    }
+    catch {
+        return undefined;
+    }
+}
+function candidatesAgree(a, b) {
+    return sameCompany(a, b) ||
+        (!a.uid && !b.uid && Boolean(a.slug && b.slug) &&
+            a.slug.toLowerCase() === b.slug.toLowerCase());
+}
+function consistentCandidate(candidates) {
+    let chosen = null;
+    for (const candidate of candidates) {
+        if (!candidate.slug && !candidate.uid)
+            continue;
+        if (!chosen) {
+            chosen = { ...candidate };
+            continue;
+        }
+        if (!candidatesAgree(chosen, candidate))
+            return { candidate: null, conflict: true };
+        chosen = {
+            slug: chosen.slug ?? candidate.slug,
+            uid: chosen.uid ?? candidate.uid,
+            hqRoot: chosen.hqRoot ?? candidate.hqRoot,
+        };
+    }
+    return { candidate: chosen, conflict: false };
+}
+function localCompanyCandidates(ref, state, canonicalHqRoot, canonicalHqRoots = []) {
+    const candidates = [];
+    // A slug without a UID can be the failed/stale projection this repair is
+    // investigating. Only a persisted UID is a durable registration signal.
+    if (state?.companyUid) {
+        candidates.push({ slug: state.companySlug, uid: state.companyUid });
+    }
+    const roots = [...new Set([canonicalHqRoot, ...canonicalHqRoots]
+            .filter((candidate) => Boolean(candidate)))]
+        .map(verifiedHqRoot).filter((root) => Boolean(root));
+    const eventEvidence = currentInstanceEventEvidence(ref, state);
+    const eventRoots = eventEvidence.map((evidence) => evidence.hqRoot).filter((candidate) => Boolean(candidate));
+    for (const root of roots)
+        if (eventRoots.some((candidate) => {
+            try {
+                return fs.realpathSync(candidate) === root;
+            }
+            catch {
+                return false;
+            }
+        })) {
+            const slug = verifiedMetaCompanySlug(ref.sessionId, root);
+            if (slug)
+                candidates.push({ slug, hqRoot: root });
+            // The event cwd itself is not company evidence. The repository's origin is,
+            // but only when it is mapped by this verified HQ root's manifest.
+            for (const evidence of eventEvidence) {
+                if (!evidence.cwd || !evidence.hqRoot)
+                    continue;
+                try {
+                    if (fs.realpathSync(evidence.hqRoot) !== root)
+                        continue;
+                }
+                catch {
+                    continue;
+                }
+                const remoteSlug = deriveRemoteOwnerSlug({ cwd: evidence.cwd, hqRoot: root });
+                if (remoteSlug)
+                    candidates.push({ slug: remoteSlug, hqRoot: root });
+            }
+        }
+    return candidates;
+}
+/**
+ * Keep only event evidence for the current session instance. When the state
+ * file has a binding episode, that id is the instance. A timestamp, including
+ * one later than startedAt, does not make another episode current.
+ * Sessions that predate episodes still use startedAt so an older event is
+ * not treated as this instance.
+ */
+function currentInstanceEventEvidence(ref, state) {
+    const evidence = ref.eventEvidence ?? [
+        {
+            hqRoot: ref.hqRoot,
+            cwd: ref.cwd,
+            harness: ref.harness,
+        },
+        ...(ref.hqRoots ?? []).filter((hqRoot) => hqRoot !== ref.hqRoot).map((hqRoot) => ({ hqRoot })),
+    ];
+    if (state?.bindingEpisodeId) {
+        return evidence.filter((entry) => Boolean(entry.hqRoot) && entry.bindingEpisodeId === state.bindingEpisodeId);
+    }
+    if (!state?.startedAt)
+        return evidence;
+    const startedAt = Date.parse(state.startedAt);
+    if (!Number.isFinite(startedAt))
+        return [];
+    return evidence.filter((entry) => {
+        if (!entry.hqRoot)
+            return false;
+        const eventAt = entry.at ? Date.parse(entry.at) : Number.NaN;
+        return Number.isFinite(eventAt) && eventAt >= startedAt;
+    });
+}
+/** Plain reason when every rooted held event belongs to another episode. */
+function episodeMismatchReason(ref, state) {
+    if (!state?.bindingEpisodeId)
+        return null;
+    const rooted = (ref.eventEvidence ?? []).filter((entry) => entry.hqRoot);
+    if (rooted.length === 0)
+        return null;
+    if (rooted.some((entry) => entry.bindingEpisodeId === state.bindingEpisodeId))
+        return null;
+    return "episode does not match the current instance";
+}
+function hasOnlyStaleEventEvidence(ref, state) {
+    return Boolean((state?.bindingEpisodeId || state?.startedAt) &&
+        ref.eventEvidence?.some((entry) => entry.hqRoot) &&
+        !currentInstanceEventEvidence(ref, state).some((entry) => entry.hqRoot));
+}
+/** Read-only doctor helper: report only independently verified held evidence. */
+export function refWithLocalCompanyEvidence(ref, canonicalHqRoot, canonicalHqRoots = [], state = null) {
+    const evidence = consistentCandidate(localCompanyCandidates(ref, state, canonicalHqRoot, canonicalHqRoots));
+    return !evidence.conflict && evidence.candidate?.slug
+        ? { ...ref, companySlug: evidence.candidate.slug }
+        : null;
+}
 /**
- * Build the reconcile observation for one held session, forwarding the company
- * evidence its events recorded (cwd / hqRoot / bound companySlug / project /
- * task). The event's own companySlug is trusted explicit — it is the company
- * the session was bound to when the events were emitted on this box.
+ * Build the reconcile observation for a company that was independently proven
+ * from durable local evidence. Held-event fields are deliberately not forwarded
+ * as trusted explicit context.
  */
 export function observationFromHeldRef(ref, contractVersion, clientOperationId) {
     const obs = {
@@ -39,12 +229,8 @@ export function observationFromHeldRef(ref, contractVersion, clientOperationId)
             : { sessionId: ref.sessionId },
         clientOperationId,
     };
-    if (ref.cwd)
-        obs.cwd = ref.cwd;
-    if (ref.hqRoot)
-        obs.hqRoot = ref.hqRoot;
     if (ref.companySlug || ref.project || ref.task) {
-        obs.explicit = {
+        obs.trustedContext = {
             ...(ref.companySlug ? { companySlug: ref.companySlug } : {}),
             ...(ref.project ? { projectId: ref.project } : {}),
             ...(ref.task ? { taskId: ref.task } : {}),
@@ -52,38 +238,129 @@ export function observationFromHeldRef(ref, contractVersion, clientOperationId)
     }
     return obs;
 }
-/**
- * Default dry-run predictor: run the shared `resolveCompany` over the same
- * evidence the write path forwards. Returns true when a company WOULD resolve
- * (so dry-run's `reconciled` count matches the write run's). Purely local:
- * reads config / meta / git-remote, never the network. A slug-only resolution
- * that later fails online membership validation is the one narrow case where
- * the write run can still under-count; the gross all-or-nothing mismatch is
- * gone because both paths key off this same resolver + evidence.
- */
-function defaultPredictCompany(ref, workContextRoot, remoteOwnerHint, env) {
-    const remoteOwnerSlug = remoteOwnerHint?.trim() ||
-        (ref.cwd
-            ? deriveRemoteOwnerSlug({ cwd: ref.cwd, hqRoot: ref.hqRoot }) ?? undefined
-            : undefined);
-    const repoIdentityKey = ref.cwd
-        ? deriveRepoIdentityKey({ cwd: ref.cwd })
-        : null;
+/** The sole success predicate for both the preview and a live reconciliation. */
+function isSuccessfulBackfillRecovery(kind) {
+    return kind === "bound" || kind === "needs_project" || kind === "needs_task" || kind === "queued";
+}
+async function previewCompanyRecovery(ref, workContextRoot, remoteOwnerHint, env, useDeviceDefault, validateMembership) {
+    // This predictor is called only with a ref already rebuilt from trusted local
+    // evidence. Do not let raw held-event cwd/hqRoot values re-enter resolution.
+    const remoteOwnerSlug = remoteOwnerHint?.trim();
     const resolution = resolveCompany({
         root: workContextRoot,
         sessionId: ref.sessionId,
         env,
         trusted: ref.companySlug ? { companySlug: ref.companySlug } : undefined,
-        cwd: ref.cwd,
-        hqRoot: ref.hqRoot,
         remoteOwnerSlug,
-        repoIdentityKey,
+        allowDeviceDefault: useDeviceDefault,
     });
-    return resolution.status === "resolved";
+    if (resolution.status !== "resolved") {
+        return { kind: resolution.status, reason: resolution.status };
+    }
+    const resolved = resolution.company;
+    if (!resolved.slug)
+        return { kind: "queued" };
+    if (!validateMembership) {
+        // Device defaults are weak, cached evidence. Reconcile refuses to use one
+        // for tenant I/O until membership has been revalidated, so the dry-run
+        // preview must fail closed in precisely the same way.
+        if (resolved.source === "device_default") {
+            return {
+                kind: "needs_company",
+                reason: "needs_company: device-default membership validator unavailable",
+            };
+        }
+        return { kind: "queued" };
+    }
+    try {
+        const membership = await validateMembership(resolved.slug);
+        if (membership === false) {
+            return {
+                kind: "needs_company",
+                reason: `membership denied for slug=${resolved.slug}`,
+            };
+        }
+    }
+    catch (err) {
+        // reconcile continues on a failed refresh for durable local evidence, but
+        // must stop a device-default recovery because that evidence is weak.
+        if (resolved.source === "device_default") {
+            return {
+                kind: "needs_company",
+                reason: `device-default membership refresh unavailable: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+    }
+    return { kind: "queued" };
+}
+/**
+ * A backfill is only useful when the daemon can observe a durable company
+ * binding on its next held retry. Do not use the reconcile result alone here:
+ * a completed reconcile may legitimately return needs_company after a failed
+ * membership lookup, and that leaves the held events exactly where they were.
+ *
+ * A persisted companySlug without a companyUid is still a durable binding:
+ * the daemon resolves the uid via membership validation on its next held retry.
+ * Requiring companyUid causes dry-run and live counts to diverge when offline
+ * reconcile writes only a slug (resolveCompany returns trusted_explicit with
+ * no uid when no manifest lookup occurs), making live report reconciled=0 for
+ * sessions the dry-run correctly predicted as recoverable.
+ */
+function hasDurableCompanyRecovery(sessionId, workContextRoot, readState) {
+    const state = readState(sessionId, workContextRoot);
+    return Boolean(state?.companyUid || state?.companySlug);
+}
+function latestAcknowledgedRegistration(sessionId, operations) {
+    for (let index = operations.length - 1; index >= 0; index -= 1) {
+        const operation = operations[index];
+        if (operation.kind === "register" &&
+            operation.delivery === "acked" &&
+            operation.sessionId === sessionId &&
+            operation.companyUid &&
+            operation.receiptId) {
+            return operation;
+        }
+    }
+    return null;
+}
+function acknowledgedRegistrationMatches(operation, ref, evidence, state) {
+    if (!operation.companyUid || !operation.receiptId)
+        return false;
+    if (state?.bindingEpisodeId) {
+        if (state.bindingEpisodeId !== operation.receiptId)
+            return false;
+    }
+    else {
+        if (!state?.startedAt)
+            return false;
+        const startedAt = Date.parse(state.startedAt);
+        const registeredAt = Date.parse(operation.createdAt);
+        if (!Number.isFinite(startedAt) || !Number.isFinite(registeredAt) || registeredAt < startedAt) {
+            return false;
+        }
+    }
+    if (evidence &&
+        !candidatesAgree(evidence, {
+            slug: operation.companySlug,
+            uid: operation.companyUid,
+        }))
+        return false;
+    if (ref.harness && operation.harness && ref.harness !== operation.harness)
+        return false;
+    return true;
+}
+/** Shared doctor/backfill gate for a receipt that is safe to treat as current evidence. */
+export function hasCurrentAcknowledgedRegistration(ref, state, operations, hqRoot, hqRoots = []) {
+    const evidence = consistentCandidate(localCompanyCandidates(ref, state, hqRoot, hqRoots));
+    if (evidence.conflict)
+        return false;
+    const operation = latestAcknowledgedRegistration(ref.sessionId, operations);
+    return Boolean(operation && acknowledgedRegistrationMatches(operation, ref, evidence.candidate, state));
 }
 /**
- * Read held.jsonl and return distinct sessions (first occurrence wins),
- * carrying the harness from whichever held event we saw first for that session.
+ * Read held.jsonl and return distinct sessions. Later events can add local
+ * evidence absent from the first event (the original first-occurrence-only
+ * implementation missed exactly that shape after a session became bound).
  * Lines that fail to parse or carry no sessionId are ignored (the daemon owns
  * their disposition; this backfill never mutates or deletes held lines).
  */
@@ -112,37 +389,48 @@ export function readHeldSessions(workMeshRoot) {
             continue;
         const obj = parsed;
         // Peel the held envelope { event, heldReason, heldAt } if present.
-        const event = obj.event &&
+        const envelope = obj.event &&
             typeof obj.event === "object" &&
             !Array.isArray(obj.event) &&
             typeof obj.heldReason === "string"
-            ? obj.event
-            : obj;
+            ? obj
+            : undefined;
+        const event = envelope ? envelope.event : obj;
         const sessionId = typeof event.sessionId === "string" && event.sessionId.trim()
             ? event.sessionId.trim()
             : null;
-        if (!sessionId || seen.has(sessionId))
+        if (!sessionId)
             continue;
         const str = (v) => typeof v === "string" && v.trim() ? v.trim() : undefined;
-        const ref = { sessionId };
+        const ref = seen.get(sessionId) ?? { sessionId };
         const harness = str(event.harness);
-        if (harness)
+        if (harness && !ref.harness)
             ref.harness = harness;
         const cwd = str(event.cwd);
-        if (cwd)
+        if (cwd && !ref.cwd)
             ref.cwd = cwd;
         const hqRoot = str(event.hqRoot);
-        if (hqRoot)
-            ref.hqRoot = hqRoot;
+        if (hqRoot) {
+            if (!ref.hqRoot)
+                ref.hqRoot = hqRoot;
+            if (!ref.hqRoots?.includes(hqRoot)) {
+                ref.hqRoots = [...(ref.hqRoots ?? []), hqRoot];
+            }
+        }
         const companySlug = str(event.companySlug);
-        if (companySlug)
+        if (companySlug && !ref.companySlug)
             ref.companySlug = companySlug;
         const project = str(event.project);
-        if (project)
+        if (project && !ref.project)
             ref.project = project;
         const task = str(event.task);
-        if (task)
+        if (task && !ref.task)
             ref.task = task;
+        const at = str(event.at) ?? (envelope ? str(envelope.heldAt) : undefined);
+        const bindingEpisodeId = str(event.bindingEpisodeId);
+        if (hqRoot || cwd) {
+            ref.eventEvidence = [...(ref.eventEvidence ?? []), { hqRoot, cwd, harness, at, bindingEpisodeId }];
+        }
         seen.set(sessionId, ref);
     }
     return [...seen.values()];
@@ -158,17 +446,22 @@ export async function backfillHeldSessions(deps) {
     const readState = deps.readState ?? readSessionState;
     const env = deps.env ?? process.env;
     const newOperationId = deps.newOperationId ?? (() => globalThis.crypto.randomUUID());
-    const predictCompany = deps.predictCompany ??
-        ((ref) => defaultPredictCompany(ref, deps.workContextRoot, deps.remoteOwnerHint, env));
     const sessions = readHeldSessions(deps.workMeshRoot);
-    const considered = limit > 0 ? sessions.slice(0, limit) : sessions;
+    // An acked register is authoritative local evidence. Older clients could
+    // lose its state projection on a later hook write; recover that projection
+    // directly instead of re-registering the same session.
+    const outboxOperations = listOutboxOperations(deps.workContextRoot);
+    const considered = rotateSessions(sessions, limit, (deps.readCursor ?? (() => readBackfillCursor(deps.workMeshRoot)))());
     const result = {
         scanned: sessions.length,
         considered: considered.length,
         alreadyAttributed: 0,
         reconciled: 0,
         unresolved: 0,
+        conflictingEvidence: 0,
+        noEvidence: 0,
         errors: 0,
+        unresolvedReasons: [],
         dryRun,
     };
     for (const ref of considered) {
@@ -178,29 +471,82 @@ export async function backfillHeldSessions(deps) {
             result.alreadyAttributed += 1;
             continue;
         }
+        const evidence = consistentCandidate(localCompanyCandidates(ref, state, deps.hqRoot, deps.hqRoots));
+        if (evidence.conflict) {
+            result.unresolved += 1;
+            result.conflictingEvidence += 1;
+            deps.log?.(`unresolved ${sessionId} (CONFLICTING_EVIDENCE)`);
+            continue;
+        }
+        const acknowledged = latestAcknowledgedRegistration(sessionId, outboxOperations);
+        const acknowledgedMatches = acknowledged && acknowledgedRegistrationMatches(acknowledged, ref, evidence.candidate, state);
+        if (acknowledged && !acknowledgedMatches) {
+            deps.log?.(`ignored stale acknowledged register for ${sessionId}`);
+        }
+        if (acknowledgedMatches && dryRun) {
+            result.reconciled += 1;
+            deps.log?.(`would reconcile ${sessionId} from acknowledged register`);
+            continue;
+        }
+        if (acknowledgedMatches) {
+            writeAckedRegisterState(acknowledged, deps.workContextRoot, acknowledged.receiptId);
+            if (readState(sessionId, deps.workContextRoot)?.companyUid) {
+                result.reconciled += 1;
+                deps.log?.(`reconciled ${sessionId} from acknowledged register`);
+                continue;
+            }
+        }
+        // Historical repair may use the explicitly opted-in device default only
+        // when there is no durable local company evidence. Never manufacture a
+        // slug from the held event itself.
+        if (!evidence.candidate?.slug && deps.useDeviceDefault !== true) {
+            result.unresolved += 1;
+            result.noEvidence += 1;
+            const staleReason = episodeMismatchReason(ref, state)
+                ?? (hasOnlyStaleEventEvidence(ref, state) ? "STALE_EVIDENCE" : "no local company evidence");
+            deps.log?.(`would stay unresolved ${sessionId} (${staleReason})`);
+            continue;
+        }
+        const evidenceRef = {
+            sessionId,
+            harness,
+            companySlug: evidence.candidate?.slug,
+            // Held-event fields are transport input, not trusted context. Preserve
+            // project/task only when the durable session state already owns them.
+            project: state?.projectId,
+            task: state?.taskId,
+        };
         if (dryRun) {
-            // Predict with the SAME evidence + resolver the write path uses, so the
-            // dry-run counts match a real run (no blanket would-reconcile).
-            if (predictCompany(ref)) {
+            const preview = await previewCompanyRecovery(evidenceRef, deps.workContextRoot, deps.remoteOwnerHint, env, deps.useDeviceDefault === true, deps.validateMembership);
+            if (isSuccessfulBackfillRecovery(preview.kind)) {
                 result.reconciled += 1;
                 deps.log?.(`would reconcile ${sessionId}${harness ? ` (${harness})` : ""}`);
             }
             else {
                 result.unresolved += 1;
-                deps.log?.(`would stay unresolved ${sessionId} (no company evidence)`);
+                const reason = preview.reason ?? "no company evidence";
+                result.unresolvedReasons.push({ sessionId, reason });
+                deps.log?.(`would stay unresolved ${sessionId} (${reason})`);
             }
             continue;
         }
-        const obs = observationFromHeldRef(ref, contractVersion, newOperationId());
+        const obs = observationFromHeldRef(evidenceRef, contractVersion, newOperationId());
         try {
             const outcome = await deps.reconcile(obs);
-            if (outcome.result.companyUid) {
+            if (isSuccessfulBackfillRecovery(outcome.result.kind) &&
+                hasDurableCompanyRecovery(sessionId, deps.workContextRoot, readState)) {
                 result.reconciled += 1;
-                deps.log?.(`reconciled ${sessionId} → ${outcome.result.companyUid}`);
+                deps.log?.(`reconciled ${sessionId} → durable company binding`);
+            }
+            else if (outcome.result.errorCode === "NOT_TRACKING") {
+                result.errors += 1;
+                deps.log?.(`error ${sessionId}: NOT_TRACKING (state was not durable)`);
             }
             else {
                 result.unresolved += 1;
-                deps.log?.(`unresolved ${sessionId} (no company)`);
+                const reason = outcome.diagnostics?.at(-1) ?? `${outcome.result.kind}: no durable company binding`;
+                result.unresolvedReasons.push({ sessionId, reason });
+                deps.log?.(`unresolved ${sessionId} (${reason})`);
             }
         }
         catch (err) {
@@ -208,6 +554,14 @@ export async function backfillHeldSessions(deps) {
             deps.log?.(`error ${sessionId}: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
+    if (!dryRun && limit > 0 && considered.length > 0) {
+        const last = considered[considered.length - 1];
+        const ordinal = sessions.findIndex((ref) => ref.sessionId === last.sessionId);
+        (deps.writeCursor ?? ((cursor) => writeBackfillCursor(deps.workMeshRoot, cursor)))({
+            sessionId: last.sessionId,
+            ...(ordinal >= 0 ? { ordinal } : {}),
+        });
+    }
     return result;
 }
 //# sourceMappingURL=backfill-held.js.map

package/dist/lib/mesh/live/backoff.d.ts

@@ -6,11 +6,11 @@ export declare const BACKOFF_BASE_MS = 1000;
 export declare const BACKOFF_CAP_MS = 60000;
 export declare const FLUSH_MAX_ATTEMPTS = 5;
 export type RandomFn = () => number;
-export type SleepFn = (ms: number) => Promise<void>;
+export type SleepFn = (ms: number, signal?: AbortSignal) => Promise<void>;
 export declare function fullJitterDelayMs(attempt: number, opts?: {
     baseMs?: number;
     capMs?: number;
     random?: RandomFn;
 }): number;
-export declare function defaultSleep(ms: number): Promise<void>;
+export declare function defaultSleep(ms: number, signal?: AbortSignal): Promise<void>;
 //# sourceMappingURL=backoff.d.ts.map

package/dist/lib/mesh/live/backoff.js

@@ -12,9 +12,22 @@ export function fullJitterDelayMs(attempt, opts = {}) {
     const exp = Math.min(cap, base * 2 ** attempt);
     return Math.floor(random() * exp);
 }
-export async function defaultSleep(ms) {
-    if (ms <= 0)
+export async function defaultSleep(ms, signal) {
+    if (ms <= 0 || signal?.aborted)
         return;
-    await new Promise((resolve) => setTimeout(resolve, ms));
+    await new Promise((resolve) => {
+        const onAbort = () => {
+            clearTimeout(timer);
+            finish();
+        };
+        const finish = () => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        };
+        const timer = setTimeout(finish, ms);
+        signal?.addEventListener("abort", onAbort, { once: true });
+        if (signal?.aborted)
+            onAbort();
+    });
 }
 //# sourceMappingURL=backoff.js.map

package/dist/lib/mesh/live/daemon/board-refresh.d.ts

@@ -1,8 +1,12 @@
 /**
  * Refresh ~/.hq/work-context/sessions/<sid>/board.md for bound sessions
- * from GET /companies/{companyUid}/board at most every 60s.
+ * from the ProjectView read route at most every 60s.
+ *
+ * Board JSON remains the fallback for older projects, but story status is
+ * authoritative in ProjectView because `hq mesh story` writes there.
  * Metadata-only snapshot — never prompts or tokens.
  */
+import type { SessionStateFile } from "../../../work-context/state.js";
 export declare const BOARD_REFRESH_INTERVAL_MS = 60000;
 export interface BoardStorySnapshot {
     id: string;
@@ -23,6 +27,8 @@ export interface BoardRefreshDeps {
     /** Per-session last refresh timestamps (ms). */
     lastRefresh?: Map<string, number>;
     intervalMs?: number;
+    /** Authorizes a device-default-derived session before its tenant read. */
+    authorizeDeviceDefaultTenant?: (sessionId: string, state: SessionStateFile) => Promise<boolean>;
 }
 export declare function formatBoardMarkdown(input: {
     sessionId: string;