@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/lib/mesh/live/daemon/run.js

@@ -11,26 +11,42 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { CLI_VERSION } from "../../../../cli-version.js";
 import { createWorkSessionDeliverer } from "../../client.js";
-import { meshJson, resolveActiveMembershipCompany } from "../../api.js";
-import { ensureCognitoToken } from "../../../../utils/cognito-session.js";
+import { listActiveMembershipCompanies, meshJson, resolveActiveMembershipCompany } from "../../api.js";
+import { ensureCognitoToken, isMachineIdentity } from "../../../../utils/cognito-session.js";
 import { replayOutbox } from "../../../work-context/outbox.js";
 import { workContextRoot } from "../../../work-context/paths.js";
+import { ensureDefaultCompany } from "../../../work-context/default-company.js";
+import { invalidateDefaultCompanyMemberships, readDeviceConfig, } from "../../../work-context/config.js";
+import { readSessionState, mergeLocalSessionFields, updateSessionState, } from "../../../work-context/state.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../session-events-client.js";
 import { flushSessionEvents, HELD_RETRY_INTERVAL_MS, } from "../flush.js";
+import { backfillHeldSessions, } from "../backfill-held.js";
+import { reconcileObservation } from "../../../work-context/reconcile.js";
 import { workMeshRoot, workMeshSpoolPath } from "../paths.js";
 import { createVaultBoardReader, refreshBoundSessionBoards, BOARD_REFRESH_INTERVAL_MS, } from "./board-refresh.js";
-import { createContract3Fetcher, realTimerHost, } from "./credentials.js";
+import { createContract3Fetcher, createPersonalRealtimeFetcher, readPreferredCompanyUids, realTimerHost, } from "./credentials.js";
 import { appendDaemonLog, daemonLogLine, ensureDaemonLog } from "./log.js";
 import { acquirePidLock, defaultPidLockDeps, releasePidLock, } from "./pid-lock.js";
 import { daemonDir } from "./paths.js";
-import { PresenceClient, } from "./presence.js";
-import { defaultDaemonState, patchDaemonState, writeDaemonState, } from "./state.js";
+import { PresenceClient, defaultMqttConnect, } from "./presence.js";
+import { defaultDaemonState, patchDaemonState, readDaemonState, writeDaemonState, } from "./state.js";
 import { workMeshHeldPath } from "../paths.js";
-import { noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, TranscriptWatcher, } from "./transcript-watch.js";
+import { defaultTranscriptFs, noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, TranscriptWatcher, } from "./transcript-watch.js";
 import { resolveMeshEmitMode, runsEmitPath, } from "./mode.js";
+import { hasCliVersionDrift, readInstalledCliVersion } from "./version-drift.js";
+import { resolveRunningCliEntry } from "./install.js";
+import { readDaemonConfig } from "./config.js";
+import { retireLegacyListen } from "./legacy-listen.js";
+import { startWorkCacheSubscriber } from "./work-subscribe.js";
 export const SPOOL_DEBOUNCE_MS = 2_000;
 export const FLUSH_INTERVAL_MS = 10_000;
+/** Keep startup recovery bounded: the next daemon start continues the backlog. */
+export const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
+export const DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS = 2_000;
+/** Non-zero exit reserved for CLI version drift so legacy Restart=on-failure units restart. */
+export const DAEMON_VERSION_DRIFT_EXIT_CODE = 75;
 /**
  * Only producer appends to spool.jsonl should wake the watcher. Every other
  * file in the work-mesh root (held.jsonl, spool.<ts>.claimed, held.<ts>.claimed,
@@ -45,6 +61,30 @@ export function shouldFlushOnSpoolDirEvent(filename) {
         return true;
     return String(filename) === "spool.jsonl";
 }
+function sameCompanyValue(a, b) {
+    return Boolean(a && b && a.toLowerCase() === b.toLowerCase());
+}
+function stillMatchesDeniedCompany(current, input, slug) {
+    const deniedUid = input.companyUid ?? input.state?.companyUid;
+    const deniedSlug = input.companySlug ?? input.state?.companySlug ?? slug;
+    if (deniedUid && current.companyUid && deniedUid !== current.companyUid)
+        return false;
+    if (deniedSlug && current.companySlug && !sameCompanyValue(deniedSlug, current.companySlug))
+        return false;
+    return Boolean(current.companyUid || current.companySlug);
+}
+function stillMatchesDeniedDeviceDefaultBinding(current, original, input, slug) {
+    return stillMatchesDeniedCompany(current, input, slug) &&
+        current.companyUid === original.companyUid &&
+        current.companySlug === original.companySlug &&
+        current.contextStatus === original.contextStatus &&
+        current.projectId === original.projectId &&
+        current.taskId === original.taskId &&
+        current.bindingEpisodeId === original.bindingEpisodeId &&
+        current.source === original.source &&
+        current.version === original.version &&
+        current.updatedAt === original.updatedAt;
+}
 function alive(pid) {
     try {
         process.kill(pid, 0);
@@ -72,8 +112,28 @@ export async function runMeshDaemon(deps = {}) {
         ((d, line) => appendDaemonLog(d, daemonLogLine("info", line, now)));
     const processEvents = deps.processEvents ?? process;
     const exit = deps.exit ?? ((code) => process.exit(code));
+    const daemonVersion = deps.daemonVersion ?? CLI_VERSION;
+    const installedCliVersion = deps.readInstalledCliVersion ?? readInstalledCliVersion;
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const hostPlatform = process.platform === "darwin" || process.platform === "linux" || process.platform === "win32"
+        ? process.platform
+        : "other";
+    const retiredListen = retireLegacyListen({
+        home,
+        platform: deps.legacyListenPlatform ?? hostPlatform,
+        run: deps.legacyListenRun,
+        windowsTaskPresent: deps.windowsLegacyTaskPresent,
+    });
+    const configuredRoots = readDaemonConfig(dir).trustedHqRoots;
+    const trustedRoots = [...new Set([
+            ...(deps.hqRoot ? [deps.hqRoot] : []),
+            ...(env.HQ_ROOT?.trim() ? [env.HQ_ROOT.trim()] : []),
+            ...configuredRoots,
+        ])];
     ensureDaemonLog(dir);
+    if (retiredListen.removed) {
+        log(dir, "retired legacy listener ai.getindigo.hq-work-mesh-listen");
+    }
     const lockDeps = deps.pidLock ?? defaultPidLockDeps({ isProcessAlive: alive });
     const lock = acquirePidLock(dir, lockDeps);
     if (!lock.ok) {
@@ -81,7 +141,17 @@ export async function runMeshDaemon(deps = {}) {
     }
     writeDaemonState(dir, defaultDaemonState(lockDeps.pid, now));
     log(dir, `daemon started pid=${lockDeps.pid} mode=${mode}`);
-    patchDaemonState(dir, { emitMode: mode }, now);
+    let cliEntry = deps.cliEntry ?? "";
+    if (!cliEntry) {
+        try {
+            cliEntry = resolveRunningCliEntry();
+        }
+        catch {
+            cliEntry = process.argv[1] ?? "";
+        }
+    }
+    log(dir, `daemon version=${daemonVersion} entry=${cliEntry}`);
+    patchDaemonState(dir, { emitMode: mode, cliVersion: daemonVersion, cliEntry }, now);
     // Opt into machine-credential minting when the box has creds (systemd exports
     // HQ_MACHINE_CREDS_FILE). On a person laptop with no machine creds this falls
     // through to the person login cache inside ensureCognitoToken.
@@ -92,14 +162,179 @@ export async function runMeshDaemon(deps = {}) {
     // expires after ~1h to every vend/flush forever, so the second credential
     // renewal (~96 min in) and everything after it failed with HTTP 401 and the
     // daemon went dark once its IoT credentials expired.
+    // ensureCognitoToken refuses a refresh whose subject differs from the
+    // active person cache and restores the file. The daemon must not replace
+    // the operator login with another cached session.
     const defaultGetToken = async () => ensureCognitoToken({ interactive: false, tokenSource: "machine" });
     const getToken = deps.getToken ?? defaultGetToken;
+    const resolveMembership = deps.resolveMembership ?? resolveActiveMembershipCompany;
+    const machineIdentity = deps.machineIdentity ?? isMachineIdentity();
+    /** The sole authorization seam for daemon tenant I/O derived from a device default. */
+    const tenantGate = {
+        authorize: async (input) => {
+            const state = input.state ?? (input.sessionId
+                ? readSessionState(input.sessionId, ctxRoot)
+                : null);
+            const slug = input.companySlug ?? state?.companySlug;
+            // A uid alone is enough to ask /membership/me. Missing slug is not a
+            // denial. A device-default session whose company was cleared can be
+            // checked against the configured default; that is the same company the
+            // daemon assigned before the false denial.
+            const configuredDefault = input.deviceDefault
+                ? readDeviceConfig({ root: ctxRoot }).defaultCompany
+                : undefined;
+            const defaultCompany = configuredDefault?.enabled ? configuredDefault : undefined;
+            const usingDefaultFallback = !slug && !state?.companyUid && Boolean(defaultCompany?.slug || defaultCompany?.uid);
+            const lookupKey = slug || state?.companyUid || (usingDefaultFallback
+                ? (defaultCompany?.slug || defaultCompany?.uid)
+                : undefined);
+            let authorization;
+            if (!lookupKey) {
+                authorization = { status: "denied" };
+            }
+            else {
+                const controller = new AbortController();
+                const timeout = setTimeout(() => controller.abort(), DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS);
+                try {
+                    authorization = await Promise.race([
+                        (async () => {
+                            const membership = await resolveMembership(await getToken(), lookupKey, controller.signal);
+                            // Timeout wins even if the probe then returns null.
+                            if (controller.signal.aborted) {
+                                return {
+                                    status: "unavailable",
+                                    error: `membership lookup timed out after ${DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS}ms`,
+                                };
+                            }
+                            if (membership)
+                                return { status: "authorized", uid: membership.companyUid };
+                            // A machine token often cannot read /membership/me (401/403, or an
+                            // empty person-membership list). That is "cannot tell", not "not
+                            // a member". Leave the company in place and retry.
+                            if (machineIdentity) {
+                                return {
+                                    status: "unavailable",
+                                    error: "membership probe on a machine token did not confirm a company; company left unchanged",
+                                };
+                            }
+                            return { status: "denied" };
+                        })(),
+                        new Promise((resolve) => {
+                            controller.signal.addEventListener("abort", () => resolve({
+                                status: "unavailable",
+                                error: `membership lookup timed out after ${DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS}ms`,
+                            }), { once: true });
+                        }),
+                    ]);
+                }
+                catch (err) {
+                    authorization = {
+                        status: "unavailable",
+                        error: err instanceof Error ? err.message : String(err),
+                    };
+                }
+                finally {
+                    clearTimeout(timeout);
+                }
+            }
+            if (authorization.status === "unavailable") {
+                const prior = readDaemonState(dir)?.deviceDefaultMembershipLookupFailures ?? 0;
+                patchDaemonState(dir, {
+                    lastErrorCode: "DEVICE_DEFAULT_MEMBERSHIP_LOOKUP_FAILED",
+                    deviceDefaultMembershipLookupFailures: prior + 1,
+                }, now);
+                log(dir, `device-default membership lookup unavailable${slug ? ` company=${slug}` : ""}: ${authorization.error.slice(0, 160)}`);
+                return authorization;
+            }
+            if (!input.deviceDefault)
+                return authorization;
+            if (authorization.status === "authorized" &&
+                (!input.companyUid || input.companyUid === authorization.uid) &&
+                (!state?.companyUid || state.companyUid === authorization.uid)) {
+                // A prior false denial cleared the company and left needs_company.
+                // Membership just confirmed the company, so put it back and let flush post.
+                if (state &&
+                    state.companyConfidence === "device_default" &&
+                    state.contextStatus === "needs_company") {
+                    const restoredSlug = state.companySlug || slug || defaultCompany?.slug;
+                    const restoredUid = authorization.uid;
+                    updateSessionState(state.sessionId, ctxRoot, (current) => {
+                        if (!current || current.contextStatus !== "needs_company")
+                            return null;
+                        if (current.companyUid && current.companyUid !== restoredUid)
+                            return null;
+                        if (current.companySlug &&
+                            restoredSlug &&
+                            !sameCompanyValue(current.companySlug, restoredSlug)) {
+                            return null;
+                        }
+                        return mergeLocalSessionFields({
+                            ...current,
+                            companyUid: restoredUid,
+                            ...(restoredSlug ? { companySlug: restoredSlug } : {}),
+                            contextStatus: current.projectId
+                                ? (current.taskId ? "bound" : "needs_task")
+                                : "needs_project",
+                            updatedAt: now().toISOString(),
+                        }, current, { preserveCompanyBinding: false });
+                    });
+                }
+                return authorization;
+            }
+            // Already stripped. Do not revoke, count, or log this again on every flush.
+            if (state &&
+                state.contextStatus === "needs_company" &&
+                !state.companyUid &&
+                !state.companySlug) {
+                return { status: "denied" };
+            }
+            try {
+                invalidateDefaultCompanyMemberships({ root: ctxRoot, now });
+            }
+            catch (err) {
+                log(dir, `default membership cache invalidation failed: ${String(err).slice(0, 160)}`);
+            }
+            if (state) {
+                // Commit only if the device-default binding that started this lookup is
+                // still current. The shared session-state lock also makes a hook writer
+                // that arrives at this boundary commit after us rather than get lost.
+                deps.beforeDeviceDefaultRevocationCommit?.();
+                const revoked = updateSessionState(state.sessionId, ctxRoot, (current) => {
+                    if (!current || !stillMatchesDeniedDeviceDefaultBinding(current, state, input, slug)) {
+                        return null;
+                    }
+                    return mergeLocalSessionFields({
+                        ...current,
+                        companyUid: undefined,
+                        companySlug: undefined,
+                        contextStatus: "needs_company",
+                        updatedAt: now().toISOString(),
+                    }, current, { preserveCompanyBinding: false });
+                });
+                if (!revoked) {
+                    log(dir, `device-default membership denial left newer session binding intact session=${state.sessionId}`);
+                }
+            }
+            const prior = readDaemonState(dir)?.deviceDefaultAuthorizationDenials ?? 0;
+            patchDaemonState(dir, { deviceDefaultAuthorizationDenials: prior + 1 }, now);
+            log(dir, `device-default membership denied${slug ? ` company=${slug}` : ""}; work held`);
+            return { status: "denied" };
+        },
+    };
+    const validateDaemonMembership = async (slug, deviceDefault) => {
+        const authorization = await tenantGate.authorize({ companySlug: slug, deviceDefault });
+        if (authorization.status === "unavailable") {
+            throw new Error(`device-default membership lookup unavailable: ${authorization.error}`);
+        }
+        return authorization.status === "authorized" ? { uid: authorization.uid } : false;
+    };
     /** In-memory held re-attempt throttle (survives watch-triggered flushes). */
     let lastHeldRetryAtMs = 0;
+    const shutdownController = new AbortController();
     const flushFn = deps.flush ??
-        (async () => {
+        (async (signal) => {
             const t = await getToken();
-            const poster = createSessionEventsPoster({
+            const poster = deps.poster ?? createSessionEventsPoster({
                 token: t,
                 baseUrl: resolveVaultApiBase(env),
             });
@@ -107,25 +342,97 @@ export async function runMeshDaemon(deps = {}) {
                 workMeshRoot: meshRoot,
                 workContextRoot: ctxRoot,
                 poster,
+                signal,
                 heldRetryIntervalMs: HELD_RETRY_INTERVAL_MS,
                 lastHeldRetryAtMs,
                 onHeldClaimed: (atMs) => {
                     lastHeldRetryAtMs = atMs;
                 },
                 log: (message) => log(dir, message),
+                authorizeDeviceDefaultTenant: async (state) => (await tenantGate.authorize({
+                    state,
+                    companySlug: state.companySlug,
+                    companyUid: state.companyUid,
+                    deviceDefault: true,
+                })).status === "authorized",
             });
         });
     const replayFn = deps.replayOutbox ??
         (async () => {
             const t = await getToken();
-            const deliver = createWorkSessionDeliverer({ token: t });
-            return replayOutbox(ctxRoot, deliver);
+            const deliver = deps.deliver ?? createWorkSessionDeliverer({ token: t });
+            return replayOutbox(ctxRoot, async (op) => {
+                const state = readSessionState(op.sessionId, ctxRoot);
+                // Provenance must survive session-state loss. For pre-upgrade outbox
+                // entries without provenance, absent state is unknown and therefore
+                // requires the same membership check before delivery.
+                const requiresMembershipCheck = op.companyConfidence === "device_default" ||
+                    state?.companyConfidence === "device_default" ||
+                    // Pre-provenance entries are untrusted even if an equally legacy
+                    // session state happens to exist. A current membership read is the
+                    // only authority that may release them.
+                    !op.companyConfidence;
+                if (requiresMembershipCheck) {
+                    const authorization = await tenantGate.authorize({
+                        state: state ?? undefined,
+                        companySlug: op.companySlug ?? state?.companySlug,
+                        companyUid: op.companyUid ?? state?.companyUid,
+                        deviceDefault: true,
+                    });
+                    if (authorization.status === "unavailable") {
+                        return { ok: false, retryable: true, code: "DEVICE_DEFAULT_MEMBERSHIP_LOOKUP_FAILED" };
+                    }
+                    if (authorization.status !== "authorized") {
+                        return { ok: false, retryable: false, code: "DEVICE_DEFAULT_MEMBERSHIP_DENIED" };
+                    }
+                }
+                return deliver(op);
+            });
+        });
+    const activateDefaultCompany = async () => {
+        try {
+            const token = await getToken();
+            await ensureDefaultCompany({
+                root: ctxRoot,
+                env,
+                listMemberships: () => listActiveMembershipCompanies(token),
+                log: (message) => log(dir, message),
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            log(dir, `default company activation skipped: ${message.slice(0, 160)}`);
+        }
+    };
+    const backfillFn = deps.backfillHeld ??
+        (async () => {
+            await activateDefaultCompany();
+            const token = await getToken();
+            const deliver = createWorkSessionDeliverer({ token });
+            const useDeviceDefault = readDeviceConfig({ root: ctxRoot }).repairHeldWithDefault === true;
+            return backfillHeldSessions({
+                workMeshRoot: meshRoot,
+                workContextRoot: ctxRoot,
+                hqRoots: trustedRoots,
+                limit: deps.heldBackfillBatchSize ?? HELD_BACKFILL_STARTUP_BATCH_SIZE,
+                env,
+                useDeviceDefault,
+                reconcile: (observation) => reconcileObservation(observation, {
+                    root: ctxRoot,
+                    env,
+                    deliver,
+                    validateMembership: (slug) => validateDaemonMembership(slug, useDeviceDefault),
+                    allowDeviceDefault: useDeviceDefault,
+                    deviceDefaultConfidence: useDeviceDefault,
+                }),
+                validateMembership: (slug) => validateDaemonMembership(slug, useDeviceDefault),
+            });
         });
     const boardLast = new Map();
     const refreshFn = deps.refreshBoards ??
         (async () => {
             const t = await getToken();
-            const reader = createVaultBoardReader({
+            const reader = deps.readBoard ?? createVaultBoardReader({
                 getJson: (p) => meshJson(t, p),
             });
             return refreshBoundSessionBoards({
@@ -134,19 +441,66 @@ export async function runMeshDaemon(deps = {}) {
                 lastRefresh: boardLast,
                 intervalMs: BOARD_REFRESH_INTERVAL_MS,
                 now: () => timers.now(),
+                authorizeDeviceDefaultTenant: async (_sessionId, state) => (await tenantGate.authorize({
+                    state,
+                    companySlug: state.companySlug,
+                    companyUid: state.companyUid,
+                    deviceDefault: true,
+                })).status === "authorized",
             });
         });
+    let boardRefreshFailureActive = false;
+    const refreshBoardsWithDiagnostics = async () => {
+        try {
+            const result = await refreshFn();
+            if (boardRefreshFailureActive) {
+                log(dir, "mesh-board-refresh.recovered");
+                boardRefreshFailureActive = false;
+            }
+            return result;
+        }
+        catch (error) {
+            if (!boardRefreshFailureActive) {
+                const rawName = error instanceof Error ? error.name : typeof error;
+                const errorName = rawName.replace(/[^A-Za-z0-9_.-]/g, "").slice(0, 80) || "Error";
+                const rawMessage = error instanceof Error
+                    ? error.message
+                    : typeof error === "string"
+                        ? error
+                        : "non-Error rejection";
+                const message = rawMessage
+                    .replace(/[\r\n\t]+/g, " ")
+                    .replace(/Bearer\s+\S+/gi, "Bearer [REDACTED]")
+                    .replace(/op:\/\/[^\s"]+/gi, "op://[REDACTED]")
+                    .replace(/https?:\/\/[^\s"<>]+/gi, "[URL]")
+                    .replace(/\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]+|AKIA[0-9A-Z]{16}|eyJ[A-Za-z0-9_.-]{10,})\b/gi, "[REDACTED]")
+                    .replace(/\b(?:access[_-]?token|refresh[_-]?token|id[_-]?token|token|cookie|authorization)\b\s*[:=]\s*[^\s,;&]+/gi, "credential=[REDACTED]")
+                    .replace(/\b(?:cmp|prs|prj|sess?)_[A-Za-z0-9_-]+\b/gi, "[ID]")
+                    .slice(0, 160);
+                log(dir, `mesh-board-refresh.failed errorName=${errorName} message=${message || "[empty]"}`);
+            }
+            boardRefreshFailureActive = true;
+            throw error;
+        }
+    };
     let presence = null;
+    let workCache = null;
     if (deps.enablePresence !== false) {
-        const fetchCredentials = deps.fetchCredentials ??
+        const fetchCredentialsRaw = deps.fetchCredentials ??
             (async () => {
                 const t = await getToken();
                 return createContract3Fetcher({
                     token: t,
                     baseUrl: resolveVaultApiBase(env),
                     env,
+                    readPreferredCompanyUids: () => readPreferredCompanyUids({ workContextRoot: ctxRoot }),
                 })();
             });
+        const fetchCredentials = async () => {
+            const bundle = await fetchCredentialsRaw();
+            patchDaemonState(dir, { presenceDroppedCompanies: bundle.droppedCompanies }, now);
+            return bundle;
+        };
         const presenceOpts = {
             fetchCredentials,
             mqttConnect: deps.mqttConnect,
@@ -166,6 +520,7 @@ export async function runMeshDaemon(deps = {}) {
                 }, now);
                 log(dir, `presence online companies=${companies.length}`);
             },
+            readPreferredCompanyUids: () => readPreferredCompanyUids({ workContextRoot: ctxRoot }),
             onRefusal: (refusal) => {
                 patchDaemonState(dir, {
                     presenceRefusal: refusal,
@@ -193,16 +548,55 @@ export async function runMeshDaemon(deps = {}) {
             // Continue draining spool even if MQTT is down.
         }
     }
+    if (deps.enableWorkCache) {
+        try {
+            workCache = await startWorkCacheSubscriber({
+                meshRoot,
+                fetchCredentials: deps.fetchPersonalCredentials ?? (async () => {
+                    const t = await getToken();
+                    return createPersonalRealtimeFetcher({
+                        token: t,
+                        baseUrl: resolveVaultApiBase(env),
+                    })();
+                }),
+                mqttConnect: (url, options) => {
+                    const connect = deps.mqttConnect ?? defaultMqttConnect;
+                    return connect(url, options);
+                },
+                now,
+                onInfo: (message) => log(dir, message.slice(0, 200)),
+                random: deps.random,
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            log(dir, `work cache subscribe failed: ${msg.slice(0, 200)}`);
+        }
+    }
     let stopped = false;
+    let restartRequested = false;
     let flushInFlight = null;
     let debounceHandle = null;
     let flushIntervalHandle = null;
+    let versionIntervalHandle = null;
     let boardIntervalHandle = null;
     let transcriptIntervalHandle = null;
     let watcher = null;
     /** Shared with transcript watcher: sessionIds seen on the hook/spool path. */
     const lastHookEventAt = new Map();
+    const lastHookTurnEndAt = new Map();
     let transcriptWatcher = null;
+    const requestRestartForVersionDrift = () => {
+        if (stopped || restartRequested)
+            return restartRequested;
+        const installedVersion = installedCliVersion();
+        if (!hasCliVersionDrift(daemonVersion, installedVersion))
+            return false;
+        restartRequested = true;
+        log(dir, `cli upgraded ${daemonVersion} -> ${installedVersion}, restarting`);
+        exit(DAEMON_VERSION_DRIFT_EXIT_CODE);
+        return true;
+    };
     if (emitPath && deps.enableTranscriptWatch !== false) {
         const hqRoot = deps.hqRoot ?? env.HQ_ROOT?.trim() ?? undefined;
         const getToken = deps.getToken ?? defaultGetToken;
@@ -215,18 +609,11 @@ export async function runMeshDaemon(deps = {}) {
             fs: deps.transcriptFs,
             now: () => now().getTime(),
             lastHookEventAt,
-            validateMembership: async (slug) => {
-                try {
-                    const token = await getToken();
-                    const membership = await resolveActiveMembershipCompany(token, slug);
-                    if (!membership)
-                        return false;
-                    return { uid: membership.companyUid };
-                }
-                catch {
-                    return false;
-                }
-            },
+            lastHookTurnEndAt,
+            // Transcript watch has no direct state writer: reconcile owns its write
+            // and merges local fields. Surface transient lookup failures as throws so
+            // reconcile defers without turning them into an authoritative denial.
+            validateMembership: (slug) => validateDaemonMembership(slug, true),
             deliver: async (op) => {
                 try {
                     const token = await getToken();
@@ -244,7 +631,12 @@ export async function runMeshDaemon(deps = {}) {
     }
     const doFlushCycle = async (reason, opts = {}) => {
         // Refuse new cycles after stop, except the forced shutdown flush.
-        if (stopped && !opts.force)
+        if ((stopped || restartRequested) && !opts.force)
+            return;
+        // A long-lived daemon retains its loaded JS after a global CLI upgrade.
+        // The service unit resolves the binary again on restart, so exiting lets
+        // launchd/systemd bring up the upgraded implementation.
+        if (!opts.force && requestRestartForVersionDrift())
             return;
         if (flushInFlight) {
             await flushInFlight;
@@ -253,11 +645,28 @@ export async function runMeshDaemon(deps = {}) {
         }
         flushInFlight = (async () => {
             try {
+                // A held session has already ended, so no later hook will naturally
+                // revisit its context. Repair a bounded batch before the first flush;
+                // recovered state is then retried immediately in this same cycle.
+                if (reason === "start") {
+                    try {
+                        const recovered = await backfillFn();
+                        if (recovered.reconciled > 0 ||
+                            recovered.unresolved > 0 ||
+                            recovered.errors > 0) {
+                            log(dir, `held backfill: considered=${recovered.considered} reconciled=${recovered.reconciled} unresolved=${recovered.unresolved} errors=${recovered.errors}`);
+                        }
+                    }
+                    catch (err) {
+                        const msg = err instanceof Error ? err.message : String(err);
+                        log(dir, `held backfill error: ${msg.slice(0, 200)}`);
+                    }
+                }
                 // Record hook-emitted session ids from spool/held before claim/rename.
                 const at = now().getTime();
-                noteHookSessionsFromSpoolFile(workMeshSpoolPath(meshRoot), lastHookEventAt, at);
-                noteHookSessionsFromSpoolFile(workMeshHeldPath(meshRoot), lastHookEventAt, at);
-                const summary = await flushFn();
+                noteHookSessionsFromSpoolFile(workMeshSpoolPath(meshRoot), lastHookEventAt, at, defaultTranscriptFs, lastHookTurnEndAt);
+                noteHookSessionsFromSpoolFile(workMeshHeldPath(meshRoot), lastHookEventAt, at, defaultTranscriptFs, lastHookTurnEndAt);
+                const summary = await flushFn(shutdownController.signal);
                 try {
                     const replay = await replayFn();
                     const delivered = replay.delivered ?? 0;
@@ -326,13 +735,30 @@ export async function runMeshDaemon(deps = {}) {
             if (!fs.existsSync(spoolPath)) {
                 fs.writeFileSync(spoolPath, "", { mode: 0o600 });
             }
-            watcher = fs.watch(path.dirname(spoolPath), { persistent: true }, (_event, filename) => {
+            const spoolWatcher = fs.watch(path.dirname(spoolPath), { persistent: true }, (_event, filename) => {
                 if (stopped)
                     return;
                 if (shouldFlushOnSpoolDirEvent(filename)) {
                     scheduleDebouncedFlush();
                 }
             });
+            watcher = spoolWatcher;
+            spoolWatcher.on("error", (err) => {
+                // fs.watch can fail asynchronously after returning a watcher. Without
+                // an error listener Node treats EMFILE as an uncaught exception; the
+                // periodic flush below already provides a polling fallback.
+                if (watcher === spoolWatcher)
+                    watcher = null;
+                try {
+                    spoolWatcher.close();
+                }
+                catch (closeError) {
+                    const closeMessage = closeError instanceof Error ? closeError.message : String(closeError);
+                    log(dir, `fs.watch close failed after watcher error: ${closeMessage.slice(0, 120)}`);
+                }
+                const msg = err instanceof Error ? err.message : String(err);
+                log(dir, `fs.watch error; continuing interval flush: ${msg.slice(0, 120)}`);
+            });
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
@@ -351,7 +777,7 @@ export async function runMeshDaemon(deps = {}) {
     boardIntervalHandle = timers.setTimeout(function boardTick() {
         if (stopped)
             return;
-        void refreshFn()
+        void refreshBoardsWithDiagnostics()
             .catch(() => undefined)
             .finally(() => {
             if (stopped)
@@ -359,6 +785,14 @@ export async function runMeshDaemon(deps = {}) {
             boardIntervalHandle = timers.setTimeout(boardTick, BOARD_REFRESH_INTERVAL_MS);
         });
     }, BOARD_REFRESH_INTERVAL_MS);
+    // Version drift is independent of the legacy spool flush. Direct-mode
+    // daemons have no flush cycle, so they still need the same periodic restart
+    // check after an in-place CLI upgrade.
+    versionIntervalHandle = timers.setTimeout(function versionTick() {
+        if (stopped || requestRestartForVersionDrift())
+            return;
+        versionIntervalHandle = timers.setTimeout(versionTick, FLUSH_INTERVAL_MS);
+    }, FLUSH_INTERVAL_MS);
     const runTranscriptTick = async () => {
         if (!transcriptWatcher || stopped)
             return;
@@ -379,6 +813,9 @@ export async function runMeshDaemon(deps = {}) {
                 summary.turns > 0 ||
                 summary.ended > 0) {
                 log(dir, `transcript-watch: started=${summary.started} turns=${summary.turns} ended=${summary.ended} skippedHook=${summary.skippedHookCovered}`);
+                for (const sessionId of summary.endedSessionIds) {
+                    log(dir, `transcript-watch quiet session_end sessionId=${sessionId}`);
+                }
                 scheduleDebouncedFlush();
             }
         }
@@ -401,10 +838,13 @@ export async function runMeshDaemon(deps = {}) {
     }
     // Initial pass. Board refresh runs in both modes; the flush + transcript
     // scan are legacy emit-path only.
-    if (emitPath) {
+    if (!requestRestartForVersionDrift() && emitPath) {
         void doFlushCycle("start");
     }
-    void refreshFn().catch(() => undefined);
+    else {
+        void activateDefaultCompany();
+    }
+    void refreshBoardsWithDiagnostics().catch(() => undefined);
     if (emitPath) {
         void runTranscriptTick();
     }
@@ -412,11 +852,14 @@ export async function runMeshDaemon(deps = {}) {
         if (stopped)
             return;
         stopped = true;
+        shutdownController.abort();
         log(dir, "daemon stopping");
         if (debounceHandle !== null)
             timers.clearTimeout(debounceHandle);
         if (flushIntervalHandle !== null)
             timers.clearTimeout(flushIntervalHandle);
+        if (versionIntervalHandle !== null)
+            timers.clearTimeout(versionIntervalHandle);
         if (boardIntervalHandle !== null)
             timers.clearTimeout(boardIntervalHandle);
         if (transcriptIntervalHandle !== null) {
@@ -431,6 +874,15 @@ export async function runMeshDaemon(deps = {}) {
         // Final flush, then clean MQTT DISCONNECT so the broker emits the
         // lifecycle event; offline is published server-side only.
         await doFlushCycle("shutdown", { force: true });
+        if (workCache) {
+            try {
+                await workCache.stop();
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                log(dir, `work cache stop error: ${msg.slice(0, 120)}`);
+            }
+        }
         if (presence) {
             try {
                 await presence.stop();