@indigoai-us/hq-cli 5.345.178 → 5.345.180

package/dist/lib/hot-channels/sync-lock.js

@@ -0,0 +1,224 @@
+/**
+ * One hot-channel sync at a time per person per company. The bot's scheduled
+ * run and a manual `hq sources sync` can fire together; the index files are
+ * read-modify-write, so two runs at once can lose rows and process the same
+ * event twice. The lock is `sources/_runs/@{personKey}/.lock`, created with
+ * O_EXCL and holding the pid, host, start time and last heartbeat.
+ *
+ * A lock is stale when its holder on this host is no longer alive, or when its
+ * last heartbeat is older than `SYNC_LOCK_STALE_MS`. The holder heartbeats the
+ * lock while it runs, so a long signals pass is never taken over mid-write.
+ * Takeover runs under an O_EXCL `.takeover` guard: the guard holder renames the
+ * stale file to a unique name, checks it moved the file it judged stale, and
+ * every contender then competes on the O_EXCL create of a fresh lock.
+ * Release removes the file only while it still names this holder.
+ */
+import { randomUUID } from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { assertNotIntegrationSecretsPath, personDirName } from "./cursors.js";
+/** A lock whose last heartbeat is older than this is stale. */
+export const SYNC_LOCK_STALE_MS = 30 * 60 * 1000;
+/** How often a held lock is refreshed; well under the stale limit. */
+export const SYNC_LOCK_HEARTBEAT_MS = 60 * 1000;
+export const SYNC_LOCK_BUSY_REASON = "another sync is running";
+/**
+ * The run no longer holds its sync lock (another run took it over, for example
+ * after this machine slept past the stale limit). The run stops before its
+ * next write.
+ */
+export class SyncLockLostError extends Error {
+    constructor() {
+        super("sync lock lost to another run; stopped before the next write");
+        this.name = "SyncLockLostError";
+    }
+}
+export function syncLockPath(vaultRoot, personKey) {
+    const file = path.join(vaultRoot, "sources", "_runs", personDirName(personKey), ".lock");
+    assertNotIntegrationSecretsPath(file);
+    return file;
+}
+function serialize(body) {
+    return `${JSON.stringify(body)}\n`;
+}
+async function tryCreate(file, body) {
+    try {
+        await fs.writeFile(file, serialize(body), { encoding: "utf8", flag: "wx" });
+        return true;
+    }
+    catch (err) {
+        if (err.code === "EEXIST")
+            return false;
+        throw err;
+    }
+}
+async function readBody(file) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(file, "utf8"));
+        return parsed && typeof parsed === "object" ? parsed : null;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return "missing";
+        return null;
+    }
+}
+/** True when `pid` names a live process on this host. EPERM means it exists. */
+export function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === "EPERM";
+    }
+}
+async function isStale(file, nowMs, staleMs, alive) {
+    const body = await readBody(file);
+    if (body === "missing")
+        return "missing";
+    if (body && typeof body.pid === "number" && body.host === os.hostname() && !alive(body.pid))
+        return true;
+    const stamp = body?.heartbeatAt ?? body?.startedAt;
+    let at = typeof stamp === "string" ? Date.parse(stamp) : Number.NaN;
+    if (Number.isNaN(at)) {
+        try {
+            at = (await fs.stat(file)).mtimeMs;
+        }
+        catch {
+            return "missing";
+        }
+    }
+    return nowMs - at >= staleMs;
+}
+/**
+ * Take the sync lock, or return null when a live run holds it. A stale lock is
+ * moved aside and taken over once; a race lost during takeover returns null.
+ */
+export async function acquireSyncLock(vaultRoot, personKey, options = {}) {
+    const now = options.now ?? (() => new Date());
+    const staleMs = options.staleMs ?? SYNC_LOCK_STALE_MS;
+    const heartbeatMs = options.heartbeatMs ?? SYNC_LOCK_HEARTBEAT_MS;
+    const alive = options.pidAlive ?? pidAlive;
+    const file = syncLockPath(vaultRoot, personKey);
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    const startedAt = now().toISOString();
+    const body = { pid: process.pid, host: os.hostname(), startedAt, heartbeatAt: startedAt };
+    const ownsFile = async () => {
+        const current = await readBody(file);
+        return (current !== null &&
+            current !== "missing" &&
+            current.pid === body.pid &&
+            current.host === body.host &&
+            current.startedAt === body.startedAt);
+    };
+    const held = () => {
+        let released = false;
+        let timer;
+        const heartbeat = async () => {
+            if (released || !(await ownsFile()))
+                return;
+            const tmp = `${file}.${randomUUID()}.tmp`;
+            await fs.writeFile(tmp, serialize({ ...body, heartbeatAt: now().toISOString() }), "utf8");
+            await fs.rename(tmp, file);
+        };
+        if (heartbeatMs > 0) {
+            timer = setInterval(() => {
+                heartbeat().catch(() => undefined);
+            }, heartbeatMs);
+            timer.unref();
+        }
+        return {
+            file,
+            assertHeld: async () => {
+                if (released || !(await ownsFile()))
+                    throw new SyncLockLostError();
+            },
+            heartbeat,
+            release: async () => {
+                released = true;
+                if (timer)
+                    clearInterval(timer);
+                if (await ownsFile())
+                    await fs.rm(file, { force: true });
+            },
+        };
+    };
+    if (await tryCreate(file, body))
+        return held();
+    const stale = await isStale(file, now().getTime(), staleMs, alive);
+    if (stale === false)
+        return null;
+    if (stale === true && !(await takeOverStale(file, now, staleMs, alive)))
+        return null;
+    return (await tryCreate(file, body)) ? held() : null;
+}
+/** A takeover guard older than this belongs to a contender that died mid-takeover. */
+const TAKEOVER_GUARD_STALE_MS = 60 * 1000;
+/**
+ * Move a stale lock out of the way. Only the contender that O_EXCL-creates the
+ * `.takeover` guard may touch the lock file, so two contenders can never both
+ * remove it. Under the guard the lock is re-read, renamed to a unique name,
+ * and the moved file is compared with what was read: if it changed in between
+ * (its holder released and a new run took the lock), it is put back. Returns
+ * false when this contender should give up.
+ */
+async function takeOverStale(file, now, staleMs, alive) {
+    const guard = `${file}.takeover`;
+    const takeGuard = async () => {
+        try {
+            await fs.writeFile(guard, `${process.pid}\n`, { encoding: "utf8", flag: "wx" });
+            return true;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            return false;
+        }
+    };
+    if (!(await takeGuard())) {
+        let age = 0;
+        try {
+            age = now().getTime() - (await fs.stat(guard)).mtimeMs;
+        }
+        catch {
+            return false;
+        }
+        if (age < TAKEOVER_GUARD_STALE_MS)
+            return false;
+        const staleGuard = `${guard}.stale-${randomUUID()}`;
+        await fs.rename(guard, staleGuard).catch(() => undefined);
+        await fs.rm(staleGuard, { force: true });
+        if (!(await takeGuard()))
+            return false;
+    }
+    try {
+        const seen = await fs.readFile(file, "utf8").catch(() => null);
+        if (seen === null)
+            return true;
+        if ((await isStale(file, now().getTime(), staleMs, alive)) !== true)
+            return false;
+        const aside = `${file}.stale-${process.pid}-${randomUUID()}`;
+        try {
+            await fs.rename(file, aside);
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return true;
+            throw err;
+        }
+        const moved = await fs.readFile(aside, "utf8").catch(() => null);
+        if (moved !== seen) {
+            await fs.link(aside, file).catch(() => undefined);
+            await fs.rm(aside, { force: true });
+            return false;
+        }
+        await fs.rm(aside, { force: true });
+        return true;
+    }
+    finally {
+        await fs.rm(guard, { force: true });
+    }
+}
+//# sourceMappingURL=sync-lock.js.map

package/dist/lib/install/hook-target.d.ts

@@ -1,6 +1,10 @@
 import { type HookTarget } from './claude-targets.js';
-/** True when an hq daemon unit (launchd plist or systemd unit) exists. */
-export declare function isDaemonInstalled(home: string, platform?: NodeJS.Platform, queryTask?: (task: string) => boolean): boolean;
+/**
+ * True when this user's hq daemon unit (launchd plist, systemd unit, or the
+ * per-user Windows Scheduled Task) exists. On Windows the shared task an older
+ * install registered counts only when it runs as this user.
+ */
+export declare function isDaemonInstalled(home: string, platform?: NodeJS.Platform, queryTask?: (task: string) => boolean, taskName?: () => string, legacyTaskIsMine?: () => boolean): boolean;
 /**
  * US-010: with hqd installed (and the checkout shipping the shim), hooks go to
  * the hqd shim; otherwise to master-hook.sh / the Codex adapter.

package/dist/lib/install/hook-target.js

@@ -7,15 +7,20 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { realpathOrSelf } from '../../commands/mcp-registration.js';
-import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK, SYSTEM_UNIT_DIR } from '../daemon/install.js';
+import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, SYSTEM_UNIT_DIR, currentWindowsIdentity, legacyWindowsTask, windowsTaskName } from '../daemon/install.js';
+import { defaultRunCommand } from '../service-manager/launchd.js';
 import { readDaemonConfig } from '../daemon/config.js';
 import { daemonPaths } from '../daemon/paths.js';
 import { registrationEngine } from '../hook-engine/registration.js';
 import { shimPath } from './claude-targets.js';
-/** True when an hq daemon unit (launchd plist or systemd unit) exists. */
-export function isDaemonInstalled(home, platform = process.platform, queryTask = (task) => spawnSync('schtasks.exe', ['/Query', '/TN', task], { encoding: 'utf8', windowsHide: true }).status === 0) {
+/**
+ * True when this user's hq daemon unit (launchd plist, systemd unit, or the
+ * per-user Windows Scheduled Task) exists. On Windows the shared task an older
+ * install registered counts only when it runs as this user.
+ */
+export function isDaemonInstalled(home, platform = process.platform, queryTask = (task) => spawnSync('schtasks.exe', ['/Query', '/TN', task], { encoding: 'utf8', windowsHide: true }).status === 0, taskName = () => windowsTaskName(currentWindowsIdentity()), legacyTaskIsMine = () => legacyWindowsTask(defaultRunCommand, currentWindowsIdentity()).state === 'mine') {
     if (platform === 'win32')
-        return queryTask(DAEMON_WINDOWS_TASK);
+        return queryTask(taskName()) || legacyTaskIsMine();
     const candidates = platform === 'darwin'
         ? [path.join(home, 'Library', 'LaunchAgents', `${DAEMON_LAUNCHD_LABEL}.plist`)]
         : platform === 'linux'

package/dist/lib/lanes/accounts.d.ts

@@ -13,23 +13,7 @@
 import { type LaneRecord, type LaneProvider } from "./types.js";
 import type { LanesConfig } from "./types.js";
 import type { ClaudeCredentialReader, ClaudeTokenState } from "./claude-credential.js";
-export declare const PROVIDER_HOME_ENV: Record<LaneProvider, string>;
-/**
- * Claude Code keys its OS keychain credential by `CLAUDE_CONFIG_DIR`: with
- * the variable unset it reads the plain `Claude Code-credentials` item, and
- * with it set, even to the default `~/.claude`, it reads a hash-suffixed item
- * for that path. Setting the variable for the default home therefore makes a
- * lane use a different login than the interactive session (incident
- * 2026-10-13). A Claude account whose home is the default is launched with
- * the variable unset instead.
- */
-export declare function isDefaultProviderHome(provider: LaneProvider, home: string, homedir?: () => string): boolean;
-/**
- * Return a copy of `base` with the provider home variable set to `home`,
- * or, for a Claude account on the default home, with the variable removed
- * so the worker and the interactive session share one credential.
- */
-export declare function withProviderHomeEnv(base: NodeJS.ProcessEnv, provider: LaneProvider, home: string, homedir?: () => string): NodeJS.ProcessEnv;
+export { PROVIDER_HOME_ENV, isDefaultProviderHome, withProviderHomeEnv } from "./provider-home.js";
 /** Who `claude auth status` says a home is logged in as. Never a token. */
 export interface ClaudeIdentity {
     email: string | null;

package/dist/lib/lanes/accounts.js

@@ -11,57 +11,17 @@
  * This module never prints, copies, or hashes credentials.
  */
 import * as fs from "node:fs";
-import * as os from "node:os";
 import { effectiveAccountHome } from "./account-home.js";
 import * as path from "node:path";
 import { AccountResolutionError } from "./errors.js";
 import { isTerminalLaneState } from "./types.js";
-import { DEFAULT_ACCOUNT_HOMES, accountMaxRunning, canonicalizeHome } from "./config.js";
+import { accountMaxRunning } from "./config.js";
 import { listLaneIds, readLane } from "./store.js";
 import { loadQuotaState, quotaBlockFor } from "./quota.js";
-export const PROVIDER_HOME_ENV = {
-    claude: "CLAUDE_CONFIG_DIR",
-    codex: "CODEX_HOME",
-    grok: "GROK_HOME",
-};
-/**
- * Claude Code keys its OS keychain credential by `CLAUDE_CONFIG_DIR`: with
- * the variable unset it reads the plain `Claude Code-credentials` item, and
- * with it set, even to the default `~/.claude`, it reads a hash-suffixed item
- * for that path. Setting the variable for the default home therefore makes a
- * lane use a different login than the interactive session (incident
- * 2026-10-13). A Claude account whose home is the default is launched with
- * the variable unset instead.
- */
-export function isDefaultProviderHome(provider, home, homedir = () => os.homedir()) {
-    const deps = {
-        homedir,
-        realpathSync: (p) => fs.realpathSync(p),
-        existsSync: (p) => fs.existsSync(p),
-    };
-    try {
-        return canonicalizeHome(home, deps) === canonicalizeHome(DEFAULT_ACCOUNT_HOMES[provider], deps);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Return a copy of `base` with the provider home variable set to `home`,
- * or, for a Claude account on the default home, with the variable removed
- * so the worker and the interactive session share one credential.
- */
-export function withProviderHomeEnv(base, provider, home, homedir) {
-    const next = { ...base };
-    const envVar = PROVIDER_HOME_ENV[provider];
-    if (provider === "claude" && isDefaultProviderHome(provider, home, homedir)) {
-        delete next[envVar];
-    }
-    else {
-        next[envVar] = home;
-    }
-    return next;
-}
+// Provider home helpers live in a leaf module so bot code can use them
+// without importing the lane store; re-exported for existing callers.
+export { PROVIDER_HOME_ENV, isDefaultProviderHome, withProviderHomeEnv } from "./provider-home.js";
+import { PROVIDER_HOME_ENV, isDefaultProviderHome, withProviderHomeEnv } from "./provider-home.js";
 function optionalString(value) {
     return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
 }

package/dist/lib/lanes/loop.d.ts

@@ -222,6 +222,16 @@ export declare function inspectLoopRecovery(runDir: string): {
     kind: "pending" | "hold" | "protected" | "empty";
     reason?: string;
 };
+/**
+ * Budget for an envelope that carries an absolute deadline. The deadline is
+ * stamped when the phase is routed, so the budget is the time between enqueue
+ * and that deadline, counted from when the lane starts the envelope. Time the
+ * envelope spent waiting in the queue does not count against it. Without a
+ * usable queued_at the remaining time from start is used, as before.
+ * A deadline at or before its enqueue still gets a 1 s execution window.
+ * An unparsable deadline returns undefined so the caller uses the phase budget.
+ */
+export declare function absoluteDeadlineBudget(deadline: string, queuedAt: string | undefined, startedAtMs: number): number | undefined;
 /** Reset only after an explicit, durable disposition; this never starts work. */
 export declare function resetLoopAfterDisposition(runDir: string, laneId: string, decision: string, hasPending: boolean): void;
 /** Run queued phases serially. Sessions are isolated by story and provider. */

package/dist/lib/lanes/loop.js

@@ -985,6 +985,23 @@ function phaseDeadlineBudget(envelope, defaultSeconds) {
     const configured = Number(process.env.HQ_LANE_LOOP_PHASE_DEADLINE_SECS);
     return Number.isFinite(configured) && configured > 0 ? configured : defaultSeconds;
 }
+/**
+ * Budget for an envelope that carries an absolute deadline. The deadline is
+ * stamped when the phase is routed, so the budget is the time between enqueue
+ * and that deadline, counted from when the lane starts the envelope. Time the
+ * envelope spent waiting in the queue does not count against it. Without a
+ * usable queued_at the remaining time from start is used, as before.
+ * A deadline at or before its enqueue still gets a 1 s execution window.
+ * An unparsable deadline returns undefined so the caller uses the phase budget.
+ */
+export function absoluteDeadlineBudget(deadline, queuedAt, startedAtMs) {
+    const deadlineMs = Date.parse(deadline);
+    if (!Number.isFinite(deadlineMs))
+        return undefined;
+    const queuedMs = typeof queuedAt === "string" ? Date.parse(queuedAt) : Number.NaN;
+    const fromMs = Number.isFinite(queuedMs) && queuedMs <= startedAtMs ? queuedMs : startedAtMs;
+    return Math.max(1, Math.round((deadlineMs - fromMs) / 1000));
+}
 function persistStallCount(runDir, laneId, envelopeId, count) {
     const status = loopStatus(runDir, laneId);
     persistStatus(runDir, laneId, { stall_counts: { ...status.stall_counts, [envelopeId]: count } });
@@ -1121,7 +1138,7 @@ export async function runLoopLane(options) {
         const absoluteDeadline = envelope.deadline;
         const budget = record.deadline_budget_seconds ?? firstDeadline.get(record.envelope_id) ??
             (typeof absoluteDeadline === "string"
-                ? Math.max(1, Math.round((Date.parse(absoluteDeadline) - startedAtMs) / 1000)) // An absolute deadline already in the past still gets a 1 s execution window.
+                ? absoluteDeadlineBudget(absoluteDeadline, record.queued_at, startedAtMs) ?? phaseDeadlineBudget(envelope, defaultDeadlineSeconds)
                 : phaseDeadlineBudget(envelope, defaultDeadlineSeconds));
         firstDeadline.set(record.envelope_id, budget);
         record.deadline_budget_seconds = budget;

package/dist/lib/lanes/provider-home.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Provider home environment helpers, split from accounts.ts so callers that
+ * only need to point a provider at a home (bots) do not pull in the lane
+ * store and its daemon imports. accounts.ts re-exports these.
+ */
+import type { LaneProvider } from "./types.js";
+export declare const PROVIDER_HOME_ENV: Record<LaneProvider, string>;
+/**
+ * Claude Code keys its OS keychain credential by `CLAUDE_CONFIG_DIR`: with
+ * the variable unset it reads the plain `Claude Code-credentials` item, and
+ * with it set, even to the default `~/.claude`, it reads a hash-suffixed item
+ * for that path. Setting the variable for the default home therefore makes a
+ * lane use a different login than the interactive session (incident
+ * 2026-10-13). A Claude account whose home is the default is launched with
+ * the variable unset instead.
+ */
+export declare function isDefaultProviderHome(provider: LaneProvider, home: string, homedir?: () => string): boolean;
+/**
+ * Return a copy of `base` with the provider home variable set to `home`,
+ * or, for a Claude account on the default home, with the variable removed
+ * so the worker and the interactive session share one credential.
+ */
+export declare function withProviderHomeEnv(base: NodeJS.ProcessEnv, provider: LaneProvider, home: string, homedir?: () => string): NodeJS.ProcessEnv;
+//# sourceMappingURL=provider-home.d.ts.map

package/dist/lib/lanes/provider-home.js

@@ -0,0 +1,52 @@
+/**
+ * Provider home environment helpers, split from accounts.ts so callers that
+ * only need to point a provider at a home (bots) do not pull in the lane
+ * store and its daemon imports. accounts.ts re-exports these.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import { DEFAULT_ACCOUNT_HOMES, canonicalizeHome } from "./config.js";
+export const PROVIDER_HOME_ENV = {
+    claude: "CLAUDE_CONFIG_DIR",
+    codex: "CODEX_HOME",
+    grok: "GROK_HOME",
+};
+/**
+ * Claude Code keys its OS keychain credential by `CLAUDE_CONFIG_DIR`: with
+ * the variable unset it reads the plain `Claude Code-credentials` item, and
+ * with it set, even to the default `~/.claude`, it reads a hash-suffixed item
+ * for that path. Setting the variable for the default home therefore makes a
+ * lane use a different login than the interactive session (incident
+ * 2026-10-13). A Claude account whose home is the default is launched with
+ * the variable unset instead.
+ */
+export function isDefaultProviderHome(provider, home, homedir = () => os.homedir()) {
+    const deps = {
+        homedir,
+        realpathSync: (p) => fs.realpathSync(p),
+        existsSync: (p) => fs.existsSync(p),
+    };
+    try {
+        return canonicalizeHome(home, deps) === canonicalizeHome(DEFAULT_ACCOUNT_HOMES[provider], deps);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Return a copy of `base` with the provider home variable set to `home`,
+ * or, for a Claude account on the default home, with the variable removed
+ * so the worker and the interactive session share one credential.
+ */
+export function withProviderHomeEnv(base, provider, home, homedir) {
+    const next = { ...base };
+    const envVar = PROVIDER_HOME_ENV[provider];
+    if (provider === "claude" && isDefaultProviderHome(provider, home, homedir)) {
+        delete next[envVar];
+    }
+    else {
+        next[envVar] = home;
+    }
+    return next;
+}
+//# sourceMappingURL=provider-home.js.map

package/dist/lib/lanes/spawn.d.ts

@@ -204,6 +204,18 @@ export declare const FOREGROUND_ONLY_RULE: string;
  * install has it, the command fails with "No such file".
  */
 export declare function tempHomeRule(hqRoot: string): string;
+/**
+ * Self-review rule carried next to the temp-home rule in every composed
+ * brief, for every provider. A PR URL reaches the core-pr-reviews channel only
+ * after two zero-critical reviews of its head: the lane's own review and an
+ * independent senior review. The lane supplies the first one and never posts.
+ *
+ * The report file under workspace/reviews/ uses the format the hq-core
+ * channel guard (block-core-pr-reviews-dm.sh) reads before a URL is posted.
+ * The skill path is absolute so codex and grok lanes, which have no /review
+ * slash command, can read and follow it.
+ */
+export declare function selfReviewRule(hqRoot: string): string;
 /**
  * The answers as written by the reconcile pass (`answered-questions.json`),
  * reduced to id + choice. A malformed file reads as no inline answers; the

package/dist/lib/lanes/spawn.js

@@ -1378,6 +1378,33 @@ export function tempHomeRule(hqRoot) {
         "each fresh home re-downloads the Rust toolchain and pnpm store and is never deleted. " +
         "The wrapper keeps the real caches and removes the temp home when the command exits.");
 }
+/**
+ * Self-review rule carried next to the temp-home rule in every composed
+ * brief, for every provider. A PR URL reaches the core-pr-reviews channel only
+ * after two zero-critical reviews of its head: the lane's own review and an
+ * independent senior review. The lane supplies the first one and never posts.
+ *
+ * The report file under workspace/reviews/ uses the format the hq-core
+ * channel guard (block-core-pr-reviews-dm.sh) reads before a URL is posted.
+ * The skill path is absolute so codex and grok lanes, which have no /review
+ * slash command, can read and follow it.
+ */
+export function selfReviewRule(hqRoot) {
+    const root = path.resolve(hqRoot);
+    const skill = path.join(root, ".claude", "skills", "review", "SKILL.md");
+    const reviews = path.join(root, "workspace", "reviews");
+    return ("SELF-REVIEW. Before reporting done on work that opens or updates a PR, " +
+        `run the paranoid /review (${skill}) on your own final diff, fix every critical, ` +
+        "and re-run until there are 0 criticals. " +
+        "Put the report in the PR body under a 'Self-review' heading with the head SHA. " +
+        `Also save it as a file under ${reviews}/ whose first lines are ` +
+        "`Review-Report: hq-pr-review.v1`, `PR: <url>`, `Head: <40-char head SHA>`, " +
+        "`Reviewer-Role: self-review` and `Criticals: 0`. " +
+        "Save only the final zero-critical run in that file: no other line may start with " +
+        "`PR:`, `Head:`, `Reviewer-Role:` or `Criticals:`. " +
+        "A new commit needs a new review of the new head. " +
+        "Never post to core-pr-reviews. If you cannot produce the report, mark the PR as draft.");
+}
 /**
  * The answers as written by the reconcile pass (`answered-questions.json`),
  * reduced to id + choice. A malformed file reads as no inline answers; the

package/dist/lib/mesh/live/daemon/doctor.d.ts

@@ -3,6 +3,7 @@
  * outbox/last-flush, and unhealthy when unacked spool age > 60s while online.
  */
 import { type CognitoActorKind, type CognitoTokenSource } from "../../../../utils/cognito-session.js";
+import { type OwnerPushStatus } from "./owner-inbox-push.js";
 import { type UnattributedEventCounts } from "../spool.js";
 import { type DaemonStateFile } from "./state.js";
 import { type LegacyListenPlatform } from "./legacy-listen.js";
@@ -70,6 +71,8 @@ export interface DaemonDoctorReport {
     }>;
     /** True when PATH lists more than one hq. */
     multipleHqOnPath: boolean;
+    /** Owner DM push signal (person accounts). Content-free counter only. */
+    ownerPush?: OwnerPushStatus;
 }
 export interface DaemonDoctorDeps {
     home?: string;

package/dist/lib/mesh/live/daemon/doctor.js

@@ -11,6 +11,7 @@ import { readSessionState } from "../../../work-context/state.js";
 import { workContextRoot } from "../../../work-context/paths.js";
 import { outboxQuarantineStatusEnabled } from "../../../work-context/outbox-quarantine-status-flag.js";
 import { formatDroppedPresenceCompany } from "./credentials.js";
+import { formatOwnerPushStatus, ownerPushStatusForAccount, readOwnerInboxPushState, } from "./owner-inbox-push.js";
 import { countDistinctHeldEvents, countJsonlLines, countUnattributedEvents, } from "../spool.js";
 import { workMeshDeadLetterPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "../paths.js";
 import { daemonDir, daemonPidPath } from "./paths.js";
@@ -248,6 +249,14 @@ export function collectDaemonDoctor(deps = {}) {
     if (emitRetry > 0) {
         unhealthyReasons.push(`direct-emit retry depth=${emitRetry}`);
     }
+    // Only a person account has an owner DM topic; any other account reports off.
+    const ownerPush = ownerPushStatusForAccount(readOwnerInboxPushState(meshRoot), now(), auth.actorKind);
+    // Only a subscribed push whose heartbeat stopped counts. A rejected or
+    // retrying best-effort subscribe writes connected:false, and an offline
+    // daemon stops the heartbeat; neither makes the daemon unhealthy.
+    if (running && online && ownerPush.connected && ownerPush.status === "stale") {
+        unhealthyReasons.push(`owner push stale (last event ${ownerPush.lastAt ?? "never"})`);
+    }
     return {
         running,
         pid: running ? record?.pid : undefined,
@@ -282,6 +291,7 @@ export function collectDaemonDoctor(deps = {}) {
         emitMode,
         subscribed,
         emitRetryDepth: emitRetry,
+        ownerPush,
         lastPostAt: emitState?.lastPostAt,
         lastEmit: emitState
             ? {
@@ -341,6 +351,9 @@ export function formatDaemonDoctor(report) {
             ` unassigned=${report.lastEmit.unassigned ?? 0}` +
             ` rejected=${report.lastEmit.rejected ?? 0}`
         : ""}`, `emit retry depth: ${report.emitRetryDepth}`);
+    if (report.ownerPush) {
+        lines.push(formatOwnerPushStatus(report.ownerPush));
+    }
     if (report.presenceRefusal) {
         lines.push(`presence refusal: ${report.presenceRefusal.code} (HTTP ${report.presenceRefusal.status}); next retry at ${report.presenceRefusal.nextRetryAt}`);
     }