@indigoai-us/hq-cli 5.345.18 → 5.345.20

package/CHANGELOG.md

@@ -2,10 +2,20 @@
 
 ## [Unreleased]
 
+## [5.345.20] — 2026-10-06
+- Keep bundled scaffold scripts and `hq core register-project` aligned with the shared source, including company UID lookup from `companies/manifest.yaml`.
+
+## [5.345.19] — 2026-10-06
+- Fix installation and updates of the published hq-anywhere pack through its built-in alias while continuing to reject reserved names from user-supplied remote sources.
+- With `hq-anywhere-runtime` enabled, hqd now starts on Windows through the user-scoped named-pipe host and refuses service only when secure pipe setup or ACL verification fails. `hq doctor` describes unsafe named-pipe startup as an ACL setup failure and recommends the daemon install or restart action based on service state.
+
 ## [5.345.18] — 2026-10-06
 - Git Bash forwarders now keep slash commands intact and convert file path arguments that hq needs on Windows.
 - Lane placement and Claude account-balance refusals now show the requested placement, actual host, balance host when different, and the model values and sources used for an unavailable-account decision.
 
+## [5.345.17] — 2026-10-06
+- Git Bash forwarders now keep slash commands intact and convert file path arguments that hq needs on Windows.
+
 ## [5.345.16] — 2026-10-06
 - Claude account model settings are defaults, so explicit lane models remain eligible; explicit account selections on create, resume, and message are recorded as CLI choices.
 - When `hq-anywhere-runtime` is enabled, `hq install --global --runtime claude --via plugin` installs the `hq` plugin from the `indigoai-us/hq-packages` Claude marketplace, and `hq install @indigoai-us/hq-anywhere` installs the Codex pack from that repository. The flag-off path refuses the HQ Anywhere alias without fetching a package source.

package/assets/scaffold/core/scripts/hq-delegate-grant.sh

@@ -35,16 +35,23 @@ die()   { echo "hq-delegate-grant: $*" >&2; exit 1; }
 
 command -v jq >/dev/null 2>&1 || die "jq is required but not installed"
 
-# jq.exe's binary mode avoids CRT newline conversion without changing real CR bytes.
+# jq.exe on MSYS may use CRT text mode unless --binary is supported.
 case "${OSTYPE:-}:${MSYSTEM:-}" in
   msys*:*|*:MINGW*)
     jq() {
-      local stdout_file stderr_file status
+      local stdout_file stderr_file status binary_supported
       stdout_file="$(mktemp)" || return $?
       stderr_file="$(mktemp)" || { status=$?; rm -f "$stdout_file"; return "$status"; }
-      if command jq --binary "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
-      command sed -b 's/\r$//' "$stdout_file"
-      command sed -b 's/\r$//' "$stderr_file" >&2
+      if command jq --binary -n 'null' >/dev/null 2>&1; then binary_supported=1; else binary_supported=0; fi
+      if [[ "$binary_supported" == 1 ]]; then
+        if command jq --binary "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
+        command cat "$stdout_file"
+        command cat "$stderr_file" >&2
+      else
+        if command jq "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
+        command sed -b 's/\r$//' "$stdout_file"
+        command sed -b 's/\r$//' "$stderr_file" >&2
+      fi
       rm -f "$stdout_file" "$stderr_file"
       return "$status"
     }

package/assets/scaffold/core/scripts/hq-delegate-secrets.sh

@@ -90,7 +90,7 @@ fi
 
 # --- parse names (KEY= lines; comments and blanks ignored) --------------------
 
-NAMES="$(grep -E '^[A-Za-z_][A-Za-z0-9_]*=' "$ENV_SCHEMA" | cut -d= -f1 | sort -u)"
+NAMES="$(grep -E '^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*=' "$ENV_SCHEMA" | cut -d= -f1 | sort -u)"
 if [ -z "$NAMES" ]; then
   update_manifest '.secrets = [] | .secretsSkipped = false'
   echo "hq-delegate-secrets: $ENV_SCHEMA declares no secret names — nothing to grant"

package/assets/scaffold/core/scripts/hq-delegate-send.sh

@@ -40,16 +40,23 @@ die()   { echo "hq-delegate-send: $*" >&2; exit 1; }
 
 command -v jq >/dev/null 2>&1 || die "jq is required but not installed"
 
-# jq.exe's binary mode avoids CRT newline conversion without changing real CR bytes.
+# jq.exe on MSYS may use CRT text mode unless --binary is supported.
 case "${OSTYPE:-}:${MSYSTEM:-}" in
   msys*:*|*:MINGW*)
     jq() {
-      local stdout_file stderr_file status
+      local stdout_file stderr_file status binary_supported
       stdout_file="$(mktemp)" || return $?
       stderr_file="$(mktemp)" || { status=$?; rm -f "$stdout_file"; return "$status"; }
-      if command jq --binary "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
-      command sed -b 's/\r$//' "$stdout_file"
-      command sed -b 's/\r$//' "$stderr_file" >&2
+      if command jq --binary -n 'null' >/dev/null 2>&1; then binary_supported=1; else binary_supported=0; fi
+      if [[ "$binary_supported" == 1 ]]; then
+        if command jq --binary "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
+        command cat "$stdout_file"
+        command cat "$stderr_file" >&2
+      else
+        if command jq "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
+        command sed -b 's/\r$//' "$stdout_file"
+        command sed -b 's/\r$//' "$stderr_file" >&2
+      fi
       rm -f "$stdout_file" "$stderr_file"
       return "$status"
     }

package/assets/scaffold/core/scripts/hq-job-probe.sh

@@ -120,16 +120,23 @@ done
 command -v yq >/dev/null 2>&1 || die "yq is required (mikefarah/yq)"
 command -v jq >/dev/null 2>&1 || die "jq is required"
 
-# jq.exe's binary mode avoids CRT newline conversion without changing real CR bytes.
+# jq.exe on MSYS may use CRT text mode unless --binary is supported.
 case "${OSTYPE:-}:${MSYSTEM:-}" in
   msys*:*|*:MINGW*)
     jq() {
-      local stdout_file stderr_file status
+      local stdout_file stderr_file status binary_supported
       stdout_file="$(mktemp)" || return $?
       stderr_file="$(mktemp)" || { status=$?; rm -f "$stdout_file"; return "$status"; }
-      if command jq --binary "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
-      command sed -b 's/\r$//' "$stdout_file"
-      command sed -b 's/\r$//' "$stderr_file" >&2
+      if command jq --binary -n 'null' >/dev/null 2>&1; then binary_supported=1; else binary_supported=0; fi
+      if [[ "$binary_supported" == 1 ]]; then
+        if command jq --binary "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
+        command cat "$stdout_file"
+        command cat "$stderr_file" >&2
+      else
+        if command jq "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
+        command sed -b 's/\r$//' "$stdout_file"
+        command sed -b 's/\r$//' "$stderr_file" >&2
+      fi
       rm -f "$stdout_file" "$stderr_file"
       return "$status"
     }

package/assets/scaffold/core/scripts/jobs-validate.sh

@@ -40,16 +40,23 @@ command -v jq >/dev/null 2>&1 || {
   exit 2
 }
 
-# jq.exe's binary mode avoids CRT newline conversion without changing real CR bytes.
+# jq.exe on MSYS may use CRT text mode unless --binary is supported.
 case "${OSTYPE:-}:${MSYSTEM:-}" in
   msys*:*|*:MINGW*)
     jq() {
-      local stdout_file stderr_file status
+      local stdout_file stderr_file status binary_supported
       stdout_file="$(mktemp)" || return $?
       stderr_file="$(mktemp)" || { status=$?; rm -f "$stdout_file"; return "$status"; }
-      if command jq --binary "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
-      command sed -b 's/\r$//' "$stdout_file"
-      command sed -b 's/\r$//' "$stderr_file" >&2
+      if command jq --binary -n 'null' >/dev/null 2>&1; then binary_supported=1; else binary_supported=0; fi
+      if [[ "$binary_supported" == 1 ]]; then
+        if command jq --binary "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
+        command cat "$stdout_file"
+        command cat "$stderr_file" >&2
+      else
+        if command jq "$@" >"$stdout_file" 2>"$stderr_file"; then status=0; else status=$?; fi
+        command sed -b 's/\r$//' "$stdout_file"
+        command sed -b 's/\r$//' "$stderr_file" >&2
+      fi
       rm -f "$stdout_file" "$stderr_file"
       return "$status"
     }

package/assets/scaffold/core/scripts/lib/transcript-tail.sh

@@ -54,45 +54,55 @@ hq_transcript_tail() {
 }
 
 # hq_transcript_tail_with_latest_assistant <path> [max_bytes] [scan_cap_bytes]
-# Return the normal bounded suffix plus the latest complete assistant record
-# when later metadata records have pushed it outside that suffix. The fallback
-# scan is bounded; status 3 means the latest assistant could not be verified
-# within the cap and security-sensitive callers must fail closed.
+# Return the normal bounded suffix plus the newest complete assistant record
+# when later records pushed it outside that suffix. The third argument remains
+# accepted for caller compatibility, but reverse scanning is no longer capped.
+# Return 1 only when the transcript cannot be read or no reverse-line tool is
+# available; callers handling user-facing policy checks must fail open silently.
 hq_transcript_tail_with_latest_assistant() {
   [ "$#" -ge 1 ] && [ "$#" -le 3 ] || return 2
   local path="$1" max_bytes="${2:-$HQ_TRANSCRIPT_TAIL_MAX_BYTES}"
-  local scan_cap="${3:-16777216}" size normal_tail assistant_record scan_tail
+  local scan_cap="${3:-16777216}" normal_tail assistant_record reverse_mode line=""
   case "$scan_cap" in ''|*[!0-9]*) return 2 ;; esac
   [ "$scan_cap" -gt 0 ] || return 2
 
+  # Most turns keep their newest assistant record in the ordinary bounded
+  # suffix, so preserve that fast path before any reverse scan.
   normal_tail="$(hq_transcript_tail "$path" "$max_bytes")" || return $?
-  assistant_record="$(printf '%s\n' "$normal_tail" | jq -Rrc 'fromjson? | select(.type == "assistant")' | tail -n 1)"
+  assistant_record="$(printf '%s\n' "$normal_tail" | jq -Rrc 'fromjson? | select(.type == "assistant" or (.type == "response_item" and .payload.type == "message" and .payload.role == "assistant"))' | tail -n 1)"
   if [ -n "$assistant_record" ]; then
     [ -z "$normal_tail" ] || printf '%s\n' "$normal_tail"
     return 0
   fi
 
-  size="$(hq_transcript_size "$path")" || {
-    printf '%s\n' "hq_transcript_tail_with_latest_assistant: cannot read transcript size: $path" >&2
-    return 1
-  }
-  if [ "$size" -le "$scan_cap" ]; then
-    scan_tail="$(cat "$path"; printf '.')"
+  # GNU tac and BSD/macOS tail -r both stream records from EOF toward the
+  # beginning. grep discards ordinary tool-output lines before Bash reads them;
+  # jq confirms candidates and the loop exits at the newest assistant.
+  if command -v tac >/dev/null 2>&1; then
+    reverse_mode=tac
+  elif tail -r /dev/null >/dev/null 2>&1; then
+    reverse_mode=tail-r
   else
-    scan_tail="$(tail -c "$((scan_cap + 1))" "$path" | sed '1d'; printf '.')"
+    printf '%s\n' "hq_transcript_tail_with_latest_assistant: no reverse-line reader is available" >&2
+    return 1
   fi
-  scan_tail="${scan_tail%.}"
-  assistant_record="$(printf '%s\n' "$scan_tail" | jq -Rrc 'fromjson? | select(.type == "assistant")' | tail -n 1)"
+
+  assistant_record="$(
+    if [ "$reverse_mode" = tac ]; then
+      { tac "$path" 2>/dev/null || true; }
+    else
+      { tail -r "$path" 2>/dev/null || true; }
+    fi | { grep -E '"assistant"' || true; } | while IFS= read -r line || [ -n "$line" ]; do
+      # grep filters large non-assistant records before Bash reads their lines.
+      if printf '%s\n' "$line" | jq -Rre 'fromjson? | select(.type == "assistant" or (.type == "response_item" and .payload.type == "message" and .payload.role == "assistant"))' >/dev/null 2>&1; then
+        printf '%s\n' "$line"
+        break
+      fi
+    done
+  )"
   if [ -n "$assistant_record" ]; then
     printf '%s\n' "$assistant_record"
-    [ -z "$normal_tail" ] || printf '%s\n' "$normal_tail"
-    return 0
   fi
-
-  if [ "$size" -gt "$scan_cap" ]; then
-    printf '%s\n' "hq_transcript_tail_with_latest_assistant: latest assistant record exceeds the ${scan_cap}-byte verification window" >&2
-    return 3
-  fi
-
   [ -z "$normal_tail" ] || printf '%s\n' "$normal_tail"
+  return 0
 }

package/assets/scaffold/core/scripts/ontology-garden.mjs

@@ -80,6 +80,69 @@ function writeDoc(file, fm, body, dry) {
 const slugify = s => s.toLowerCase().normalize("NFKD").replace(/[^\p{L}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 const today = () => new Date().toISOString().slice(0, 10);
 const now = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+const yyyyMm = () => new Date().toISOString().slice(0, 7);
+
+// ── Fact-file compaction ─────────────────────────────────────────────
+// Fact pages append one line per signal-mention of an entity (see step 3
+// below). Without a bound a hot entity accumulates every mention it has
+// ever received, so the page becomes a flat log. Compaction keeps the
+// most recent N lines inline and rolls the older ones into a dated,
+// append-only archive next to the fact file. `signal_count` on the
+// entity itself is unaffected — it is the true total.
+const BACKREF_COMPACT_THRESHOLD = Number(process.env.HQ_ONTOLOGY_BACKREF_THRESHOLD || 50);
+const BACKREF_KEEP_INLINE = Number(process.env.HQ_ONTOLOGY_BACKREF_KEEP_INLINE || 25);
+const SUMMARY_MARKER = "<!-- backref-archive -->";
+
+function isBackrefLine(line) { return /^- \[[a-z_]+\] .+ \(signal [0-9a-f]{12}\)\s*$/.test(line); }
+function isSummaryLine(line) { return line.includes(SUMMARY_MARKER); }
+
+function readArchiveIndex(file) {
+  if (!fs.existsSync(file)) return { version: 1, signalIds: [] };
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (parsed && Array.isArray(parsed.signalIds)) {
+      return { version: 1, signalIds: parsed.signalIds.filter(s => typeof s === "string") };
+    }
+  } catch (err) {
+    console.warn(`ontology-garden: archive index unreadable at ${file}: ${err.message || err}; skipping compaction`);
+  }
+  // Present but unreadable: never compact on top of it, or the rewrite would
+  // drop every archived id it lists.
+  return { version: 1, signalIds: [], unreadable: true };
+}
+
+// Compact `body` when its backref-line count exceeds the threshold.
+// Returns { body, archivedLines, archivedIds, changed }.
+function compactFactBody(body, { slug, archivedTotalBefore, dry }) {
+  const lines = body.split("\n").map(l => l.trimEnd()).filter(l => l.length > 0);
+  const backrefLines = lines.filter(isBackrefLine);
+  const other = lines.filter(l => !isBackrefLine(l) && !isSummaryLine(l));
+  if (backrefLines.length <= BACKREF_COMPACT_THRESHOLD) {
+    return { body, archivedLines: [], archivedIds: [], changed: false };
+  }
+  const archiveCount = backrefLines.length - BACKREF_KEEP_INLINE;
+  const archivedLines = backrefLines.slice(0, archiveCount);
+  const inlineLines = backrefLines.slice(archiveCount);
+  const archivedIds = archivedLines
+    .map(l => (l.match(/\(signal ([0-9a-f]{12})\)$/) || [])[1])
+    .filter(Boolean);
+  const archivedTotal = archivedTotalBefore + archivedLines.length;
+  const stamp = yyyyMm();
+  const summary = `- ${SUMMARY_MARKER} _${archivedTotal} older mention${archivedTotal === 1 ? "" : "s"} archived in [history](./${slug}.history/${stamp}.md)_`;
+  const nextBody = [summary, ...other, ...inlineLines].join("\n");
+  return { body: nextBody, archivedLines, archivedIds, changed: true, stamp };
+}
+
+function appendArchiveFile(file, isoDate, lines, dry) {
+  if (dry) return;
+  const batch = `\n<!-- archived ${isoDate} -->\n${lines.join("\n")}\n`;
+  const prev = fs.existsSync(file) ? fs.readFileSync(file, "utf8").replace(/\s+$/, "") : "";
+  const next = prev ? `${prev}\n${batch}` : `# Back-reference archive\n${batch}`;
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.tmp`;
+  fs.writeFileSync(tmp, next);
+  fs.renameSync(tmp, file);
+}
 
 function listCandidates(dir) {
   if (!fs.existsSync(dir)) return [];
@@ -193,10 +256,30 @@ function main() {
       for (const slug of hit) {
         const e = entities.get(slug);
         const ffile = path.join(ont, "facts", `@${key}`, e.type, `${slug}.md`);
-        const line = `- [${type}] ${body.split("\n")[0]} (signal ${id.slice(0, 12)})`;
+        const sid12 = id.slice(0, 12);
+        const line = `- [${type}] ${body.split("\n")[0]} (signal ${sid12})`;
         const prev = fs.existsSync(ffile) ? readDoc(ffile) : { fm: { entity: slug, type: e.type, audience_key: key }, body: "" };
-        if (!prev.body.includes(`signal ${id.slice(0, 12)}`)) {
-          writeDoc(ffile, prev.fm, [prev.body, line].filter(Boolean).join("\n"), a.dryRun);
+        const idxFile = path.join(path.dirname(ffile), `${slug}.history`, "_index.json");
+        const archiveIndex = readArchiveIndex(idxFile);
+        const alreadyArchived = archiveIndex.signalIds.includes(sid12);
+        if (!prev.body.includes(`signal ${sid12}`) && !alreadyArchived) {
+          let nextBody = [prev.body, line].filter(Boolean).join("\n");
+          const compact = compactFactBody(nextBody, {
+            slug,
+            archivedTotalBefore: archiveIndex.signalIds.length,
+            dry: a.dryRun,
+          });
+          if (compact.changed && !archiveIndex.unreadable) {
+            const archiveFile = path.join(path.dirname(ffile), `${slug}.history`, `${compact.stamp}.md`);
+            appendArchiveFile(archiveFile, today(), compact.archivedLines, a.dryRun);
+            if (!a.dryRun) {
+              const nextIdx = { version: 1, signalIds: [...archiveIndex.signalIds, ...compact.archivedIds] };
+              fs.mkdirSync(path.dirname(idxFile), { recursive: true });
+              fs.writeFileSync(idxFile, JSON.stringify(nextIdx) + "\n");
+            }
+            nextBody = compact.body;
+          }
+          writeDoc(ffile, prev.fm, nextBody, a.dryRun);
           report.facts_written++;
         }
         if (key === "company") {

package/assets/scaffold/core/scripts/ontology-source-worklist.sh

@@ -32,10 +32,77 @@ while [ $# -gt 0 ]; do
   esac
 done
 [ -n "$co" ] && [ -n "$ch" ] || { echo "usage: ontology-source-worklist.sh --company <co> --channel <ch> [--limit N] [--force] [--mark-done <file>]" >&2; exit 2; }
-D="$root/companies/$co/sources/$ch"; Y="$D/source.yaml"; ledger="$D/.processed"
+D="$root/companies/$co/sources/$ch"; Y="$D/source.yaml"; ledger="$D/.processed"; skip_ledger="$D/.skipped"
+# Bumped when the audience parser gains new recognisable frontmatter fields; items
+# previously skipped as no-audience under an older PARSER_VERSION get re-evaluated
+# on the next run instead of staying stuck forever (see feedback_b8d61e28).
+PARSER_VERSION=2
 bash "$here/source-yaml-validate.sh" "$Y" >/dev/null || { bash "$here/source-yaml-validate.sh" "$Y" >&2; exit 2; }
 
-if [ -n "$done_item" ]; then echo "$(basename "$done_item")" >> "$ledger"; exit 0; fi
+if [ -n "$done_item" ]; then printf '%s\t%s\n' "$(basename "$done_item")" "$PARSER_VERSION" >> "$ledger"; exit 0; fi
+
+# Migrate `.processed` to parser-version stamps so a successfully processed item
+# stays processed across runs. Entries are `basename\tversion`; new mark-done
+# writes always include the stamp. Convergence rule for legacy UNSTAMPED
+# entries from the pre-fix slack-dm bug (254 DMs recorded in `.processed` as
+# plain basenames while no candidates were ever written): drop ones whose file
+# carries `resolved_participants:` (the exact bug signature) so the main loop
+# re-evaluates them exactly once; the next mark-done writes them back stamped
+# at the current version. Any other unstamped entry is upgraded in place to a
+# stamp — never re-stripped again. Stamped entries at a version below current
+# PARSER_VERSION are also dropped so a parser upgrade re-evaluates them.
+# ontology-candidate ids are content-addressed, so a true reprocess is idempotent.
+if [ -f "$ledger" ]; then
+  tmp="$ledger.heal.$$"
+  : > "$tmp"
+  changed=0
+  while IFS=$'\t' read -r b ver || [ -n "$b" ]; do
+    b="${b%$'\r'}"; ver="${ver%$'\r'}"
+    [ -n "$b" ] || continue
+    if [ -n "${ver:-}" ]; then
+      if [ "$ver" -lt "$PARSER_VERSION" ] 2>/dev/null; then changed=1; continue; fi
+      printf '%s\t%s\n' "$b" "$ver" >> "$tmp"
+      continue
+    fi
+    item="$D/$b"
+    if [ -f "$item" ] && awk '/^---$/{fm++; if(fm==2) exit} fm==1 && /^resolved_participants:/{found=1; exit} END{exit !found}' "$item" 2>/dev/null; then
+      changed=1; continue
+    fi
+    printf '%s\t%s\n' "$b" "$PARSER_VERSION" >> "$tmp"
+    changed=1
+  done < "$ledger"
+  if [ "$changed" = 1 ]; then mv "$tmp" "$ledger"; else rm -f "$tmp"; fi
+fi
+is_processed() { # 0 if $1 is recorded in .processed at >= current parser version (or unstamped — treated as current after migration)
+  [ -f "$ledger" ] || return 1
+  awk -F '\t' -v b="$1" -v v="$PARSER_VERSION" '
+    { sub(/\r$/, "") }
+    $1==b { if (NF < 2 || $2=="") { found=1; exit } if (($2+0) >= v) { found=1; exit } }
+    END { exit !found }
+  ' "$ledger"
+}
+
+# Walk `.skipped`: entries whose recorded version is < current PARSER_VERSION
+# are dropped so the main loop re-evaluates them. Entries at the current
+# version stay as the ignore set for this run.
+declare_skipped=""
+if [ -f "$skip_ledger" ]; then
+  tmp="$skip_ledger.rev.$$"
+  : > "$tmp"
+  changed=0
+  while IFS=$'\t' read -r b reason ver || [ -n "$b" ]; do
+    [ -n "$b" ] || continue
+    if [ -z "${ver:-}" ] || [ "$ver" -lt "$PARSER_VERSION" ] 2>/dev/null; then
+      changed=1; continue
+    fi
+    printf '%s\t%s\t%s\n' "$b" "$reason" "$ver" >> "$tmp"
+  done < "$skip_ledger"
+  if [ "$changed" = 1 ]; then mv "$tmp" "$skip_ledger"; else rm -f "$tmp"; fi
+fi
+skipped_at_current() { # 0 if $1 is recorded as skipped at the current parser version
+  [ -f "$skip_ledger" ] || return 1
+  awk -F '\t' -v b="$1" -v v="$PARSER_VERSION" '$1==b && $3==v { found=1; exit } END { exit !found }' "$skip_ledger"
+}
 
 get() { awk -v k="$1" '$0 ~ "^"k":" { sub("^"k":[[:space:]]*", ""); gsub(/^["\x27]|["\x27]$/, ""); print; exit }' "$Y"; }
 run="$(get run)"; rule="$(get audience_rule)"
@@ -53,11 +120,69 @@ item_list() { # frontmatter list field: inline [a, b] or block "- a"
   ' "$1"
 }
 
+# participant_ids: for a frontmatter block list of mappings under key $2 (e.g.
+# resolved_participants:), emit one id per entry: the entry's `person_uid:` if
+# present, otherwise its `email:`. Entries with only `slack_user_id:` (no
+# person_uid, no email) are skipped — the audience must stay exactly the
+# resolvable DM participants, never widened. Scope: ONLY the mapping list
+# directly under $2 in frontmatter.
+participant_ids() {
+  awk -v k="$2" '
+    { sub(/\r$/, "") }
+    BEGIN{fm=0; inlist=0; have_pid=0; have_email=0; pid=""; em=""}
+    function flush() {
+      if (have_pid && pid != "") { print pid }
+      else if (have_email && em != "") { print em }
+      have_pid=0; have_email=0; pid=""; em=""
+    }
+    /^---$/ { fm++; if (fm==2) { if (inlist) flush(); exit } next }
+    fm==1 && $0 ~ "^"k":" { inlist=1; next }
+    fm==1 && inlist {
+      # end of list = a line that is not indented beyond col 0 and not a bare "-"
+      if ($0 ~ /^[^ \t-]/) { flush(); inlist=0; next }
+      is_dash = ($0 ~ /^[[:space:]]*-[[:space:]]/)
+      if (is_dash) {
+        flush()
+        s=$0; sub(/^[[:space:]]*-[[:space:]]*/, "", s)
+        # inline mapping (JSON-style) on same line as the dash
+        if (s ~ /^\{/) {
+          gsub(/[{}"\x27]/, "", s); n=split(s, kv, ",")
+          for (i=1;i<=n;i++) {
+            gsub(/^[ \t]+|[ \t]+$/, "", kv[i])
+            if (match(kv[i], /^person_uid[[:space:]]*:[[:space:]]*/)) { pid=substr(kv[i], RLENGTH+1); have_pid=1 }
+            else if (match(kv[i], /^email[[:space:]]*:[[:space:]]*/)) { em=substr(kv[i], RLENGTH+1); have_email=1 }
+          }
+          flush()
+          next
+        }
+        # First mapping key on same line as the dash, e.g.
+        #   - person_uid: prs_01ALICE
+        # Fall through to the key/value handlers below with the de-dashed line.
+        line = s
+      } else {
+        line = $0; sub(/^[[:space:]]+/, "", line)
+      }
+      if (line ~ /^person_uid:/) {
+        v=line; sub(/^person_uid:[[:space:]]*/, "", v); gsub(/["\x27]/, "", v); gsub(/^[ \t]+|[ \t]+$/, "", v)
+        if (v != "") { pid=v; have_pid=1 }
+        next
+      }
+      if (line ~ /^email:/) {
+        v=line; sub(/^email:[[:space:]]*/, "", v); gsub(/["\x27]/, "", v); gsub(/^[ \t]+|[ \t]+$/, "", v)
+        if (v != "") { em=v; have_email=1 }
+        next
+      }
+    }
+    END { if (inlist) flush() }
+  ' "$1"
+}
+
 n=0
 for f in "$D"/*.md; do
   [ -f "$f" ] || continue
   b="$(basename "$f")"
-  [ -f "$ledger" ] && grep -qxF "$b" "$ledger" && continue
+  is_processed "$b" && continue
+  skipped_at_current "$b" && continue
   [ "$n" -ge "$limit" ] && break
   n=$((n+1))
   rel="sources/$ch/$b"
@@ -68,12 +193,24 @@ for f in "$D"/*.md; do
     *)
       aud="$(item_list "$f" audience | paste -sd, -)"
       [ -n "$aud" ] || aud="$(item_list "$f" attendees | grep -E '@|^(prs|agt)_' | paste -sd, -)"
+      # Slack DM items (hq-pro inbound slack-personal-dm.ts) only carry
+      # resolved_participants: a block list of mappings with person_uid /
+      # slack_user_id / email. Derive audience from those, scoped exactly to
+      # the DM's own participants (never widened to company). Only entries
+      # whose person_uid or email resolves become audience ids; a slack_user_id
+      # alone is not a usable audience key, so that entry is dropped — matching
+      # the frontmatter contract exercised in hq-pro
+      # test/sources/inbound/slack-personal-dm.test.ts.
+      [ -n "$aud" ] || aud="$(participant_ids "$f" resolved_participants | grep -E '@|^(prs|agt)_' | paste -sd, -)"
       if [ -z "$aud" ]; then
         aud="$("$HQ" files --company "$co" acl "$rel" --json 2>/dev/null \
           | jq -r '[.direct[]? | select(.granteeType=="person" or .granteeType=="email" or .granteeType=="agent") | select(.permission=="read" or .permission=="write" or .permission=="admin") | .granteeId] | unique | join(",")' 2>/dev/null)"
       fi ;;
   esac
-  if [ -z "$aud" ]; then jq -cn --arg f "$rel" '{file:$f, skip:"no-audience"}'; continue; fi
+  if [ -z "$aud" ]; then
+    printf '%s\t%s\t%s\n' "$b" "no-audience" "$PARSER_VERSION" >> "$skip_ledger"
+    jq -cn --arg f "$rel" '{file:$f, skip:"no-audience"}'; continue
+  fi
   key="$(HQ_ROOT="$root" bash "$here/ontology-candidate.sh" key "$aud")"
   jq -cn --arg f "$rel" --arg k "$key" --arg a "$aud" '{file:$f, audience_key:$k, audience:($a|split(","))}'
 done