@indigoai-us/hq-cli 5.345.152 → 5.345.154

package/dist/lib/doctor/fix/refresh-sync-progress.js

@@ -49,13 +49,41 @@ export function readRefreshSyncProgress(hqRoot) {
     }
     return record;
 }
-function writeProgressFile(hqRoot, progress) {
-    const target = progressPath(hqRoot);
+function writeProgressFile(hqRoot, progress, relativePath = REFRESH_SYNC_PROGRESS_RELATIVE_PATH) {
+    const target = path.join(hqRoot, relativePath);
     fs.mkdirSync(path.dirname(target), { recursive: true });
     const temporaryPath = `${target}.${process.pid}.tmp`;
     fs.writeFileSync(temporaryPath, `${JSON.stringify(progress)}\n`, { mode: 0o600 });
     fs.renameSync(temporaryPath, target);
 }
+/**
+ * `--fix` manifest-upload cursor. Kept in its own file so the refresh-sync
+ * progress format, which doctor JSON reads, does not change. Written before
+ * each upload, like the pull cursor, so the next run starts after the last
+ * company attempted and one failing company cannot hold the front of the line.
+ */
+export const REFRESH_MANIFEST_PROGRESS_RELATIVE_PATH = path.join("workspace", "doctor", "refresh-manifest-progress.json");
+/** The last manifest scope `--fix` attempted, or null when absent or unreadable. */
+export function readRefreshManifestCursor(hqRoot) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(path.join(hqRoot, REFRESH_MANIFEST_PROGRESS_RELATIVE_PATH), "utf8"));
+    }
+    catch {
+        // The cursor only orders retries. A missing or damaged file restarts the
+        // rotation from the first scope instead of failing the repair run.
+        return null;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return null;
+    const record = parsed;
+    if (record.version !== 1 || typeof record.lastAttemptedScope !== "string")
+        return null;
+    return record.lastAttemptedScope;
+}
+export function writeRefreshManifestCursor(hqRoot, scope) {
+    writeProgressFile(hqRoot, { version: 1, lastAttemptedScope: scope }, REFRESH_MANIFEST_PROGRESS_RELATIVE_PATH);
+}
 /** Persist the resume cursor without claiming this run finished. */
 export function writeRefreshSyncCursor(hqRoot, slug) {
     const existing = readRefreshSyncProgress(hqRoot);

package/dist/lib/doctor/fix/remediation.js

@@ -87,8 +87,10 @@ export function deriveRemediation(result) {
             command: `chmod +x "${chmodPath}"`,
         };
     }
-    // gate-profile — a gated hook id present in some but not all three profiles.
-    if (checkId.endsWith(".gate-profiles") && result.status === "FAIL" && target) {
+    // gate-profile — a gated hook id missing from a profile its tier requires.
+    if (checkId.endsWith(".gate-profiles") &&
+        (result.status === "FAIL" || result.status === "WARN") &&
+        target) {
         return {
             autoFixable: true,
             fixClass: "gate-profile",

package/dist/lib/doctor/hook-gate-profiles.d.ts

@@ -52,4 +52,23 @@ export declare function parseHookGateProfiles(source: string): HookGateProfiles;
  * profile allowlists key on the hook id, not the script filename.
  */
 export declare function gateMembership(hookId: string, profiles: HookGateProfiles): GateMembership;
+/**
+ * The profiles `hookId` is REQUIRED in but missing from.
+ *
+ * The shipped gate declares the profiles as nested tiers: minimal is
+ * "critical safety hooks only", standard is "all minimal + ...", strict is
+ * "all standard + ...". A hook's lowest listed profile is its declared tier,
+ * and it must be listed in every profile from that tier up. Absence from a
+ * LOWER profile is an intentional exclusion, not a defect (feedback 299: a
+ * standard hook absent from minimal is by design). The tier is capped at
+ * standard, so an id listed only in strict is still required in standard. An
+ * id listed in no profile is required everywhere.
+ */
+export declare function requiredMissingProfiles(hookId: string, profiles: HookGateProfiles): GateProfile[];
+/**
+ * Resolve the runtime gate profile the way hook-gate.sh does:
+ * `HQ_HOOK_PROFILE`, default `standard`. An unrecognised value falls back to
+ * `standard` here (the gate itself errors on it).
+ */
+export declare function activeGateProfile(value?: string | null): GateProfile;
 //# sourceMappingURL=hook-gate-profiles.d.ts.map

package/dist/lib/doctor/hook-gate-profiles.js

@@ -104,4 +104,38 @@ function profileFunctionBody(source, profile) {
     const close = rest.search(/\n\s*\}/);
     return close >= 0 ? rest.slice(0, close) : rest;
 }
+/**
+ * The profiles `hookId` is REQUIRED in but missing from.
+ *
+ * The shipped gate declares the profiles as nested tiers: minimal is
+ * "critical safety hooks only", standard is "all minimal + ...", strict is
+ * "all standard + ...". A hook's lowest listed profile is its declared tier,
+ * and it must be listed in every profile from that tier up. Absence from a
+ * LOWER profile is an intentional exclusion, not a defect (feedback 299: a
+ * standard hook absent from minimal is by design). The tier is capped at
+ * standard, so an id listed only in strict is still required in standard. An
+ * id listed in no profile is required everywhere.
+ */
+export function requiredMissingProfiles(hookId, profiles) {
+    const { present, missing } = gateMembership(hookId, profiles);
+    if (present.length === 0)
+        return missing;
+    // The inferred tier is capped at standard, the default runtime profile. The
+    // strict list is reserved for future hooks and currently equals standard, so
+    // a strict-only id is a missed allowlist edit, not a strict tier: it never
+    // runs under the default profile and must still be required in standard.
+    const lowest = Math.min(GATE_PROFILES.indexOf(present[0]), GATE_PROFILES.indexOf("standard"));
+    return missing.filter((p) => GATE_PROFILES.indexOf(p) >= lowest);
+}
+/**
+ * Resolve the runtime gate profile the way hook-gate.sh does:
+ * `HQ_HOOK_PROFILE`, default `standard`. An unrecognised value falls back to
+ * `standard` here (the gate itself errors on it).
+ */
+export function activeGateProfile(value) {
+    const v = (value ?? "").trim();
+    return GATE_PROFILES.includes(v)
+        ? v
+        : "standard";
+}
 //# sourceMappingURL=hook-gate-profiles.js.map

package/dist/lib/doctor/types.d.ts

@@ -79,6 +79,11 @@ export interface CheckContext {
     company?: string;
     /** Internal test seam; production `hq doctor` always enables integrations. */
     integrations?: boolean;
+    /**
+     * The runtime hook-gate profile (minimal|standard|strict) to judge gate
+     * membership against. Absent reads `HQ_HOOK_PROFILE`, default `standard`.
+     */
+    hookProfile?: string;
 }
 /**
  * A check family: an id, a human title, and an async `run` returning per-item

package/dist/lib/install/provider-wrappers.js

@@ -94,7 +94,11 @@ function wrapperSource(provider) {
         'log_file="$log_dir/provider-auth.log"',
         'tmp=$(mktemp -d "${TMPDIR:-/tmp}/hq-provider.XXXXXX") || exit 1',
         'trap \'rm -rf "$tmp"\' EXIT HUP INT TERM',
-        `if command -v timeout >/dev/null 2>&1; then timeout 5 "$real" ${statusArgs} >"$tmp/status" 2>&1; auth_status=$?; elif command -v perl >/dev/null 2>&1; then perl -e 'alarm 5; exec @ARGV' "$real" ${statusArgs} >"$tmp/status" 2>&1; auth_status=$?; else auth_status=124; fi`,
+        // macOS ships no timeout(1), so the perl alarm fallback runs there. When the
+        // alarm fires the shell itself reports "Alarm clock: 14 perl ..." on its own
+        // stderr (the command's 2>&1 does not cover it); the brace group's 2>/dev/null
+        // keeps that report off the user's terminal. The exit status (142) is unchanged.
+        `if command -v timeout >/dev/null 2>&1; then timeout 5 "$real" ${statusArgs} >"$tmp/status" 2>&1; auth_status=$?; elif command -v perl >/dev/null 2>&1; then { perl -e 'alarm 5; exec @ARGV' "$real" ${statusArgs} >"$tmp/status" 2>&1; } 2>/dev/null; auth_status=$?; else auth_status=124; fi`,
         'case "$auth_status" in 124|142) : >"$tmp/status-timeout" ;; esac',
         'if [ "$auth_status" -ne 0 ]; then cat "$tmp/status" >>"$log_file" 2>/dev/null || :; fi',
         `if [ ! -e "$tmp/status-timeout" ] && grep -Eiq '${authFailure}' "$tmp/status"; then`,

package/dist/lib/lanes/autopilot.js

@@ -1265,7 +1265,10 @@ export async function runLeadAutopilotPass(input) {
     for (let attempt = 0; attempt < 2; attempt += 1) {
         try {
             lockFd = fs.openSync(lockPath, "wx", 0o600);
-            fs.writeFileSync(lockFd, `${process.pid}\n${input.now.toISOString()}\n${processStartIdentity(process.pid) ?? ""}\n`, "utf8");
+            // The created-at stamp is compared with Date.now() by reclaimStaleLock
+            // (the only liveness check where /proc is absent, e.g. macOS), so it must
+            // be wall-clock time, not the caller's injected logical `now`.
+            fs.writeFileSync(lockFd, `${process.pid}\n${new Date().toISOString()}\n${processStartIdentity(process.pid) ?? ""}\n`, "utf8");
             break;
         }
         catch (error) {

package/dist/lib/lanes/imported-question.d.ts

@@ -0,0 +1,5 @@
+export declare function importedQuestionMarker(root: string, id: string): string;
+/** A pending transfer is also read-only: its remote POST may already have succeeded. */
+export declare function assertQuestionNotImported(root: string, id: string): void;
+export declare function isQuestionImported(root: string, id: string): boolean;
+//# sourceMappingURL=imported-question.d.ts.map

package/dist/lib/lanes/imported-question.js

@@ -0,0 +1,17 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { createHash } from "node:crypto";
+import { LanesError } from "./errors.js";
+export function importedQuestionMarker(root, id) {
+    return path.join(root, "workspace", "decisions", "legacy-read-only", `${createHash("sha256").update(id).digest("hex")}.json`);
+}
+/** A pending transfer is also read-only: its remote POST may already have succeeded. */
+export function assertQuestionNotImported(root, id) {
+    if (isQuestionImported(root, id)) {
+        throw new LanesError("question_imported_read_only", "This question was transferred to hq decide and is read-only in hq lanes. Use hq decide list to find and answer the decision.", { question_id: id });
+    }
+}
+export function isQuestionImported(root, id) {
+    return fs.existsSync(importedQuestionMarker(root, id));
+}
+//# sourceMappingURL=imported-question.js.map

package/dist/lib/lanes/questions.d.ts

@@ -1,8 +1,3 @@
-/**
- * Raise a lane question (spec §6.1). One function for the CLI `hq lanes ask`
- * path and for envelope `decision: "ask"` ingestion. Two writers here would
- * drift on hop, origin, raised_via, body store, and routing_history.
- */
 import { type LaneEnvelope, type LaneRecord, type LaneCompanyRef, type QuestionBodyStore, type QuestionKind, type QuestionPriority, type QuestionRecord, type RaisedVia } from "./types.js";
 export interface QuestionBody {
     question: string;

package/dist/lib/lanes/questions.js

@@ -1,3 +1,4 @@
+import { assertQuestionNotImported } from "./imported-question.js";
 /**
  * Raise a lane question (spec §6.1). One function for the CLI `hq lanes ask`
  * path and for envelope `decision: "ask"` ingestion. Two writers here would
@@ -143,6 +144,7 @@ export function questionBodyAbsPath(hqRoot, question) {
     return path.join(hqRoot, "personal", "lanes", "questions", `${question.question_id}.json`);
 }
 export function writeQuestionBody(hqRoot, question, body) {
+    assertQuestionNotImported(hqRoot, question.question_id);
     assertQuestionBodySecretSafe(body);
     const store = parseQuestionBodyStore(question.body.store);
     const filePath = questionBodyAbsPath(hqRoot, question);

package/dist/lib/lanes/reconcile.js

@@ -17,6 +17,7 @@ import { loadLanesConfig, providerQuotaDefaultHoldMs } from "./config.js";
 import { MAX_LANE_DEPTH } from "./constants.js";
 import { laneDepthCap } from "./depth-cap.js";
 import { AccountResolutionError, LanesError, isLaneVersionConflict } from "./errors.js";
+import { isQuestionImported } from "./imported-question.js";
 import { loadWorkerProfile } from "./profile.js";
 import { terminalChildResumeHireGrantError, withHireGrantAdmission, } from "./grants.js";
 import { classifySessionLiveness, defaultLivenessDeps, loadLivenessIndex, readDaemonPresenceConnected, unindexedClaudeSessionLiveness, } from "./liveness.js";
@@ -650,16 +651,26 @@ async function closeInterruptedDoneStoryWorkers(hqRoot, lanes, questions, summar
             for (const question of questions) {
                 if (question.origin.id !== lane.lane_id || question.status !== "pending")
                     continue;
-                casQuestionIf(hqRoot, question.question_id, (current) => current.status === "pending", (current) => ({
-                    ...current,
-                    status: "cancelled",
-                    routing_history: appendCappedHistory(current.routing_history, {
-                        hop: current.hop,
-                        audience: { kind: "user" },
-                        at,
-                        reason: "cancelled",
-                    }),
-                }), false);
+                if (isQuestionImported(hqRoot, question.question_id))
+                    continue;
+                try {
+                    casQuestionIf(hqRoot, question.question_id, (current) => current.status === "pending", (current) => ({
+                        ...current,
+                        status: "cancelled",
+                        routing_history: appendCappedHistory(current.routing_history, {
+                            hop: current.hop,
+                            audience: { kind: "user" },
+                            at,
+                            reason: "cancelled",
+                        }),
+                    }), false);
+                }
+                catch (error) {
+                    // Import may acquire the record lock after our initial check. The
+                    // decision service owns that question; continue closing this lane.
+                    if (!(error instanceof LanesError) || error.error !== "question_imported_read_only")
+                        throw error;
+                }
             }
             appendWatcherEvent(watcherEventsPath(hqRoot, lane.lane_id), {
                 event: "story_closed",

package/dist/lib/lanes/store.d.ts

@@ -1,11 +1,3 @@
-/**
- * File-backed lane / question record store (spec §10, §10.1).
- *
- * Root: workspace/lanes/ under the HQ root. One stable path per record;
- * `status` is the pending/answered discriminator — files are never moved
- * between directories. Every mutation is temp-file-plus-rename and a
- * compare-and-set on `version`. Histories are capped at 50 at the append site.
- */
 import * as fs from "node:fs";
 import { type OutpostIdentity } from "./admission-host.js";
 import { type AttributionHistoryEntry, type LaneRecord, type LaneWriter, type QuestionRecord, type RoutingHistoryEntry, type SeniorHistoryEntry } from "./types.js";

package/dist/lib/lanes/store.js

@@ -1,3 +1,4 @@
+import { assertQuestionNotImported } from "./imported-question.js";
 /**
  * File-backed lane / question record store (spec §10, §10.1).
  *
@@ -2013,7 +2014,7 @@ export function createQuestion(hqRoot, init, deps = defaultStoreDeps()) {
     return created;
 }
 export function updateQuestion(hqRoot, questionId, expectedVersion, updater, deps = defaultStoreDeps()) {
-    const next = casWrite(questionRecordPath(hqRoot, questionId), expectedVersion, parseQuestionRecord, mergeQuestionRecords, updater, deps);
+    const next = casWrite(questionRecordPath(hqRoot, questionId), expectedVersion, parseQuestionRecord, mergeQuestionRecords, (current) => { assertQuestionNotImported(hqRoot, questionId); return updater(current); }, deps);
     syncPendingMarker(hqRoot, next, deps);
     syncLaneQuestionReference(hqRoot, next, deps);
     return next;

package/dist/lib/lanes/stories.d.ts

@@ -20,4 +20,19 @@ export declare function storyStatusForEnvelope(status: string): "in_progress" |
  * and explicit story commands own those transitions.
  */
 export declare function terminalEnvelopeStoryStatus(lane: LaneRecord, decision: "done" | "blocked" | "ask", envelopeStatus?: string): LaneStoryStatus | undefined;
+/**
+ * The stories array after attributing a lane to projectId/storyId.
+ *
+ * A lane with no story (empty story_id plus no_story_reason) carries no story
+ * rows, so attributing it to another project without a story keeps the rows
+ * unchanged. This is the single write site for attribution-driven appends:
+ * it never produces a row with an empty story_id, which the lane schema
+ * rejects (and which would roll back the whole write).
+ */
+export declare function storiesAfterAttribution(lane: LaneRecord, projectId: string, storyId: string, at: string): LaneStory[];
+/**
+ * The row attribution would append, or undefined when nothing is appended
+ * (the story is already carried, or there is no story id).
+ */
+export declare function attributedStoryRow(lane: LaneRecord, projectId: string, storyId: string, at: string): LaneStory | undefined;
 //# sourceMappingURL=stories.d.ts.map

package/dist/lib/lanes/stories.js

@@ -89,4 +89,29 @@ export function terminalEnvelopeStoryStatus(lane, decision, envelopeStatus = "in
         return "review";
     return storyStatusForEnvelope(envelopeStatus);
 }
+/**
+ * The stories array after attributing a lane to projectId/storyId.
+ *
+ * A lane with no story (empty story_id plus no_story_reason) carries no story
+ * rows, so attributing it to another project without a story keeps the rows
+ * unchanged. This is the single write site for attribution-driven appends:
+ * it never produces a row with an empty story_id, which the lane schema
+ * rejects (and which would roll back the whole write).
+ */
+export function storiesAfterAttribution(lane, projectId, storyId, at) {
+    const current = laneStories(lane);
+    const added = attributedStoryRow(lane, projectId, storyId, at);
+    return added ? [...current, added] : current;
+}
+/**
+ * The row attribution would append, or undefined when nothing is appended
+ * (the story is already carried, or there is no story id).
+ */
+export function attributedStoryRow(lane, projectId, storyId, at) {
+    if (!storyId.trim())
+        return undefined;
+    if (laneStory(lane, projectId, storyId))
+        return undefined;
+    return { project_id: projectId, story_id: storyId, status: "in_progress", added_at: at, updated_at: at };
+}
 //# sourceMappingURL=stories.js.map

package/dist/lib/mesh/client.d.ts

@@ -54,6 +54,14 @@ export declare function createWorkSessionDeliverer(opts: {
         body: unknown;
     }>;
 }): DeliverFn;
+/**
+ * Outbox error code for a 401/403 register refusal. Only real auth / identity
+ * refusals are AUTH_DENIED. A company whose work registry is off
+ * (WORK_REGISTRY_DISABLED) or an unknown company (INVALID_COMPANY) is not an
+ * auth problem, so those keep their own code and doctor does not point at
+ * login (Shepherd issue 2726, feedback_6a792ab4).
+ */
+export declare function registerDenialOutboxCode(serverCode: string | undefined): string;
 /**
  * Probe whether the server advertises migration capability (US-017A).
  * Failures return false (default-company stays locked).

package/dist/lib/mesh/client.js

@@ -4,7 +4,7 @@
  * vault HTTP + receipt-shaped responses (US-007A / US-007B).
  */
 import { listActiveMembershipCompanies, meshJson, requireToken, resolveMeshCompany, } from "./api.js";
-import { isWorkSessionDenialCode } from "./denial-codes.js";
+import { isWorkSessionDenialCode, WORK_SESSION_DENIAL_CODES, } from "./denial-codes.js";
 export { meshJson, requireToken, resolveMeshCompany, listActiveMembershipCompanies };
 export async function openMeshTransport(opts) {
     const token = await requireToken();
@@ -63,11 +63,11 @@ export function createWorkSessionDeliverer(opts) {
             if (status === 401 || status === 403) {
                 const serverCode = isWorkSessionDenialCode(errorFields.code)
                     ? errorFields.code
-                    : undefined;
+                    : denialCodeFromMessage(message);
                 return {
                     ok: false,
                     retryable: false,
-                    code: "AUTH_DENIED",
+                    code: registerDenialOutboxCode(serverCode),
                     httpStatus: status,
                     ...(serverCode ? { serverCode } : {}),
                 };
@@ -98,6 +98,15 @@ export function createWorkSessionDeliverer(opts) {
                     return { ok: false, retryable: false, code: `HTTP_${status}` };
                 }
             }
+            const messageCode = denialCodeFromMessage(message);
+            if (messageCode && registerDenialOutboxCode(messageCode) !== "AUTH_DENIED") {
+                return {
+                    ok: false,
+                    retryable: false,
+                    code: registerDenialOutboxCode(messageCode),
+                    serverCode: messageCode,
+                };
+            }
             if (/unauthorized|forbidden|auth/i.test(message)) {
                 return { ok: false, retryable: false, code: "AUTH_DENIED" };
             }
@@ -112,6 +121,27 @@ export function createWorkSessionDeliverer(opts) {
         }
     };
 }
+/**
+ * Outbox error code for a 401/403 register refusal. Only real auth / identity
+ * refusals are AUTH_DENIED. A company whose work registry is off
+ * (WORK_REGISTRY_DISABLED) or an unknown company (INVALID_COMPANY) is not an
+ * auth problem, so those keep their own code and doctor does not point at
+ * login (Shepherd issue 2726, feedback_6a792ab4).
+ */
+export function registerDenialOutboxCode(serverCode) {
+    if (serverCode === "WORK_REGISTRY_DISABLED" || serverCode === "INVALID_COMPANY") {
+        return serverCode;
+    }
+    return "AUTH_DENIED";
+}
+/** Find an allowlisted denial code in an error message when the error has no code field. */
+function denialCodeFromMessage(message) {
+    for (const code of WORK_SESSION_DENIAL_CODES) {
+        if (new RegExp(`\\b${code}\\b`).test(message))
+            return code;
+    }
+    return undefined;
+}
 function mapRegisterResponse(status, body, operationId) {
     if (status >= 200 && status < 300) {
         const rec = body && typeof body === "object" ? body : {};
@@ -124,6 +154,17 @@ function mapRegisterResponse(status, body, operationId) {
     if (status >= 500 || status === 429) {
         return { ok: false, retryable: true, code: `HTTP_${status}` };
     }
+    if (status === 401 || status === 403) {
+        const rec = body && typeof body === "object" ? body : {};
+        const serverCode = isWorkSessionDenialCode(rec.code) ? rec.code : undefined;
+        return {
+            ok: false,
+            retryable: false,
+            code: registerDenialOutboxCode(serverCode),
+            httpStatus: status,
+            ...(serverCode ? { serverCode } : {}),
+        };
+    }
     if (status >= 400 && status < 500) {
         return { ok: false, retryable: false, code: `HTTP_${status}` };
     }

package/dist/lib/mesh/denial-codes.js

@@ -26,7 +26,7 @@ export function isWorkSessionDenialCode(value) {
 }
 /** Plain-language reasons for denial codes the user can act on. */
 const WORK_SESSION_DENIAL_REASONS = {
-    WORK_REGISTRY_DISABLED: "Work tracking is turned off for this company. The company owner can turn it on with: hq company --company <slug> settings set --work-registry-enabled true",
+    WORK_REGISTRY_DISABLED: "Work registry is disabled for this company; ask a company admin to enable it with: hq company --company <slug> settings set --work-registry-enabled true. This is not a login problem.",
     FEATURE_DISABLED: "Live work tracking is turned off for this company. The company owner can turn it on with: hq company --company <slug> settings set --work-mesh-live-enabled true",
 };
 /** Plain reason for a server denial code, or undefined when there is none. */

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -24,6 +24,12 @@ export declare const SPOOL_DEBOUNCE_MS = 2000;
 export declare const FLUSH_INTERVAL_MS = 10000;
 /** Keep startup recovery bounded: the next daemon start continues the backlog. */
 export declare const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
+/**
+ * A long-running daemon re-runs the held backfill this often while held
+ * events remain, so a backlog larger than one batch keeps draining after a
+ * reinstall instead of waiting for the next daemon start (Shepherd 2361).
+ */
+export declare const HELD_BACKFILL_INTERVAL_MS: number;
 export declare const DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS = 2000;
 /** Skip further membership probes after a transport failure so a network drop
  *  cannot fan out one hanging lookup per held session. */
@@ -60,10 +66,12 @@ export interface DaemonRunDeps {
         quarantined: number;
         skipped?: number;
     }>;
-    /** Injected held-session recovery (tests). Runs once before the startup flush. */
+    /** Injected held-session recovery (tests). Runs before the startup flush and then periodically while held events remain. */
     backfillHeld?: () => Promise<BackfillHeldResult>;
     /** Maximum distinct held sessions reconciled during one daemon startup. */
     heldBackfillBatchSize?: number;
+    /** Minimum gap between periodic held backfills. Default HELD_BACKFILL_INTERVAL_MS. */
+    heldBackfillIntervalMs?: number;
     /** Injected board refresh (tests). */
     refreshBoards?: () => Promise<{
         refreshed: number;

package/dist/lib/mesh/live/daemon/run.js

@@ -46,6 +46,12 @@ export const SPOOL_DEBOUNCE_MS = 2_000;
 export const FLUSH_INTERVAL_MS = 10_000;
 /** Keep startup recovery bounded: the next daemon start continues the backlog. */
 export const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
+/**
+ * A long-running daemon re-runs the held backfill this often while held
+ * events remain, so a backlog larger than one batch keeps draining after a
+ * reinstall instead of waiting for the next daemon start (Shepherd 2361).
+ */
+export const HELD_BACKFILL_INTERVAL_MS = 15 * 60 * 1_000;
 export const DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS = 2_000;
 /** Skip further membership probes after a transport failure so a network drop
  *  cannot fan out one hanging lookup per held session. */
@@ -350,6 +356,19 @@ export async function runMeshDaemon(deps = {}) {
     };
     /** In-memory held re-attempt throttle (survives watch-triggered flushes). */
     let lastHeldRetryAtMs = 0;
+    /** Epoch ms of the last held backfill (startup or periodic). */
+    let lastHeldBackfillAtMs = 0;
+    const heldBackfillIntervalMs = deps.heldBackfillIntervalMs ?? HELD_BACKFILL_INTERVAL_MS;
+    const heldBackfillDue = (atMs) => {
+        if (atMs - lastHeldBackfillAtMs < heldBackfillIntervalMs)
+            return false;
+        try {
+            return fs.statSync(workMeshHeldPath(meshRoot)).size > 0;
+        }
+        catch {
+            return false;
+        }
+    };
     const shutdownController = new AbortController();
     const flushFn = deps.flush ??
         (async (signal) => {
@@ -380,6 +399,12 @@ export async function runMeshDaemon(deps = {}) {
                         return "unavailable";
                     return authorization.status === "authorized";
                 },
+                // Held sessions whose local evidence only names a slug need the
+                // membership slug -> uid lookup, or they stay NEEDS_COMPANY forever.
+                resolveCompanyUid: async (slug) => {
+                    const authorization = await tenantGate.authorize({ companySlug: slug, deviceDefault: false });
+                    return authorization.status === "authorized" ? authorization.uid : null;
+                },
             });
         });
     const replayFn = deps.replayOutbox ??
@@ -674,7 +699,11 @@ export async function runMeshDaemon(deps = {}) {
                 // A held session has already ended, so no later hook will naturally
                 // revisit its context. Repair a bounded batch before the first flush;
                 // recovered state is then retried immediately in this same cycle.
-                if (reason === "start") {
+                // A long-running daemon repeats the bounded batch on an interval
+                // while held events remain, so the cursor keeps rotating through a
+                // backlog larger than one batch.
+                if (reason === "start" || heldBackfillDue(now().getTime())) {
+                    lastHeldBackfillAtMs = now().getTime();
                     try {
                         const recovered = await backfillFn();
                         if (recovered.reconciled > 0 ||

package/dist/lib/mesh/live/flush.d.ts

@@ -58,6 +58,13 @@ export interface FlushDeps {
      * stripped. Defaults to a per-flush cached git resolver (tests inject).
      */
     resolveWorkLocation?: WorkLocationResolver;
+    /**
+     * Membership-validated slug -> companyUid lookup for held sessions whose
+     * local evidence names a company slug but no uid. Return the uid, or null
+     * when the caller is not a member or the lookup is unavailable (the events
+     * stay held and are retried). Called at most once per slug per flush.
+     */
+    resolveCompanyUid?: (slug: string) => Promise<string | null>;
 }
 export interface FlushSummary {
     claimed: number;