@indigoai-us/hq-cli 5.345.87 → 5.345.89

package/dist/commands/core-delegate.js

@@ -11,6 +11,7 @@ import { buildCmdExeSpawnPlan, isWindowsBatchFile } from "../utils/windows-spawn
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
+import { brainstormFrontmatterSet, brainstormSummary, brainstormTitle } from "./core-delegate-brainstorm.js";
 export const CORE_NATIVE_DELEGATE_FLAG = "core-native-delegate";
 const SCRIPT_ASSETS = {
     resolve: "core/scripts/hq-delegate-resolve.sh",
@@ -52,7 +53,7 @@ const USAGE_TEXT = {
     pickup: "# hq-core: public\n# hq-delegate-pickup.sh — close the delegation loop with a receipt or a FAILED\n# state (2026-09-07).\n#\n# Why: the delegate pipeline ended at \"sent\", which is a send receipt, not a\n# delivery receipt. Seven delegations sat at sent/building with no way to tell\n# whether the recipient could act. This script adds the two missing states:\n#\n#   sent --(evidence)--> picked-up      recipient demonstrably has the work\n#   sent --(silence past window)--> failed   nobody picked it up; sender is told why\n#\n# Evidence, checked in order (any one suffices):\n#   1. --ack \"<text>\"            an explicit acknowledgement (DM reply, chat) —\n#                                recorded verbatim with a timestamp\n#   2. repo branch has a commit by the recipient after sentAt\n#      (manifest.repo.path + repo.branch, author email == to.principal)\n#   3. --evidence \"<free text>\"  any other proof the operator observed\n#\n# Usage:\n#   hq-delegate-pickup.sh --manifest <path> --ack \"<text>\"        # record receipt\n#   hq-delegate-pickup.sh --manifest <path> --evidence \"<text>\"   # record receipt\n#   hq-delegate-pickup.sh --manifest <path> --check [--window-hours N]   # probe repo; fail if silent past window (default 72)\n#   hq-delegate-pickup.sh --manifest <path> --status               # print state line\n#\n# Exit 0: picked-up (or already). Exit 5: failed (window elapsed, no evidence).\n# Exit 6: still waiting (inside window, no evidence). Exit 2: usage/precondition.\nset -uo pipefail\n",
     repo: "hq-delegate-repo.sh — code/branch handover for a delegation: make sure the\nproject's branch exists on the remote, record uncommitted work as NOT\ntransferred, and verify the recipient's repository access read-only.\n\nUsage:\n  core/scripts/hq-delegate-repo.sh --manifest <path> [--yes] [--github-user <login>]\n\nBehavior (driven by the manifest's repo{} block; no-op when repo is null):\n  - records remote URL and the branch's headSha into the manifest\n  - a branch that exists only locally requires confirmation: without --yes\n    the helper prints the plan and exits 2; with --yes it pushes via an\n    explicitly anchored `git -C <abs path> push -u origin <branch>`\n  - dirty/untracked files are captured into repo.dirtyFiles[] and appended\n    to BRIEF.md as work NOT transferred — never silently dropped\n  - recipient access is checked read-only via gh when --github-user is\n    given; otherwise (or on a gh failure) repo.accessVerified stays false\n    and the brief says so plainly — the helper never claims unverified access\n  - never touches vaultPrefixes[] and never pushes repo content to the vault\n\nEnv: HQ_ROOT — HQ root override (default: resolved from script location)\n",
     secrets: "hq-delegate-secrets.sh — grant a delegation recipient access to the secrets\na project needs, BY NAME ONLY. No command in this helper ever reads,\nprints, logs, or interpolates a secret value.\n\nUsage:\n  core/scripts/hq-delegate-secrets.sh --manifest <path> [--yes] [--no-secrets]\n    [--env-schema <path>]\n\nBehavior:\n  - derives required secret NAMES from the project's / repo's .env.schema\n    (--env-schema overrides discovery); no schema -> records secrets: []\n    and says so plainly rather than guessing at credentials\n  - without --yes: prints a full-prose confirmation listing every name and\n    the principal, then exits 2 granting nothing — this step is a privilege\n    handover and gets its own confirmation, separate from the file grants\n  - with --yes: hq secrets share <NAME> --with <principal> --permission read\n    per name, then records the names (and only the names) in the manifest\n  - --no-secrets: skips everything, records {secrets: [], secretsSkipped: true}\n\nConsumption on the recipient's side is via `hq run` / `hq secrets exec` —\ndocumented in the brief; values never appear in any delegation artifact\n(policy hq-delegate-never-inlines-secrets-or-share-urls).\n",
-    transfer: "hq-delegate-transfer.sh — make a delegation real everywhere HQ tracks\nownership: board entry, PRD metadata, work mesh, and the project journal.\n\nUsage:\n  core/scripts/hq-delegate-transfer.sh --manifest <path>\n\nBehavior (mode \"transfer\"; mode \"share\" skips every mutation):\n  1. companies/<co>/board.json — the project's entry gets owner=<recipient>\n     and a bumped updated_at; created (once) if absent\n  2. prd.json metadata gains owner, delegatedFrom, delegatedAt\n  3. work-mesh: `done` event closes the delegator's in-progress thread and\n     broadcasts the reassignment; silently skipped when the helper is\n     unavailable (local/offline installs) — the transfer still succeeds\n  4. a dated \"Delegated\" stanza is appended to the project journal naming\n     the recipient, delegation id, and transferred scope\n\nIdempotent: re-running updates owner/timestamps in place — never a\nduplicate board entry, never a duplicated journal stanza.\n\nThe delegator's own vault access is untouched (granting the recipient\nwrite does not revoke anything).\n\nEnv: HQ_ROOT — HQ root override (default: resolved from script location)\n",
+    transfer: "hq-delegate-transfer.sh — make a delegation real everywhere HQ tracks\nownership: board entry, PRD metadata, work mesh, and the project journal.\n\nUsage:\n  core/scripts/hq-delegate-transfer.sh --manifest <path>\n\nBehavior (mode \"transfer\"; mode \"share\" skips every mutation):\n  1. companies/<co>/board.json — the project's entry gets owner=<recipient>\n     and a bumped updated_at; created (once) if absent. A brainstorm-stage\n     entry (status exploring, brainstorm_path set) is matched by\n     brainstorm_path and keeps its status.\n  2. prd.json metadata gains owner, delegatedFrom, delegatedAt; for a\n     brainstorm-stage project the same three keys land in the\n     brainstorm.md frontmatter (owner, delegated_from, delegated_at)\n  3. work-mesh: `done` event closes the delegator's in-progress thread and\n     broadcasts the reassignment; silently skipped when the helper is\n     unavailable (local/offline installs) — the transfer still succeeds\n  4. a dated \"Delegated\" stanza is appended to the project journal naming\n     the recipient, delegation id, and transferred scope\n\nIdempotent: re-running updates owner/timestamps in place — never a\nduplicate board entry, never a duplicated journal stanza.\n\n",
 };
 function usage(name) {
     return USAGE_TEXT[name];
@@ -189,7 +190,6 @@ export function moveFile(source, target, fileSystem = fs) {
 }
 export function writeJsonAtomically(target, value, siblingTemp = false, fileSystem = fs) {
     const serialized = serializeJqJson(value, "pretty");
-    // Native delegate JSON writers use LF on every platform.
     if (siblingTemp) {
         const temporary = `${target}.tmp.${randomBytes(6).toString("hex")}`;
         let fd;
@@ -918,14 +918,25 @@ function runTransfer(args, context) {
     }
     const now = jqRawPath(document, "ownershipTransferredAt") || new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
     const today = (process.env.HQ_DELEGATE_NOW || new Date().toISOString()).slice(0, 10);
+    const stage = jqRawPath(document, "project.stage", "prd");
     const prdPath = `companies/${company}/projects/${project}/prd.json`;
     const prdAbs = path.join(root, prdPath);
+    const brainstormPath = `companies/${company}/projects/${project}/brainstorm.md`;
+    const brainstormAbs = path.join(root, brainstormPath);
     const projectDir = path.join(root, "companies", company, "projects", project);
     const board = path.join(root, "companies", company, "board.json");
-    if (!fs.existsSync(prdAbs) || !fs.statSync(prdAbs).isFile()) {
+    if (stage !== "prd" && stage !== "brainstorm") {
+        writeErr(`${prefix} manifest project.stage is '${stage}' — expected prd or brainstorm\n`);
+        return 1;
+    }
+    if (stage === "prd" && (!fs.existsSync(prdAbs) || !fs.statSync(prdAbs).isFile())) {
         writeErr(`${prefix} prd not found: ${prdPath}\n`);
         return 1;
     }
+    if (stage === "brainstorm" && (!fs.existsSync(brainstormAbs) || !fs.statSync(brainstormAbs).isFile())) {
+        writeErr(`${prefix} brainstorm.md not found: ${brainstormPath}\n`);
+        return 1;
+    }
     if (fs.existsSync(board)) {
         if (!jqValid(board)) {
             writeErr(`${prefix} board.json is not valid JSON: ${board}\n`);
@@ -936,9 +947,9 @@ function runTransfer(args, context) {
         fs.mkdirSync(path.dirname(board), { recursive: true });
         fs.writeFileSync(board, '{"projects": []}\n');
     }
-    const prd = readJsonFile(prdAbs);
-    const title = jqRawPath(prd, "name");
-    const descriptionValue = jqFallback(jsonAt(prd, "description"), "");
+    const prd = stage === "prd" ? readJsonFile(prdAbs) : undefined;
+    const title = stage === "prd" ? jqRawPath(prd, "name") : brainstormTitle(brainstormAbs);
+    const descriptionValue = stage === "prd" ? jqFallback(jsonAt(prd, "description"), "") : brainstormSummary(brainstormAbs);
     const description = Buffer.from(serializeJqJson(descriptionValue, "raw"), "utf8")
         .subarray(0, 300).toString("utf8").replace(/\n+$/, "");
     const boardDocument = readJsonFile(board);
@@ -948,35 +959,46 @@ function runTransfer(args, context) {
     const projects = Array.isArray(projectsValue)
         ? projectsValue
         : isRecord(projectsValue) ? Object.values(projectsValue) : [];
-    const hasProject = projects.some((entry) => jsonAt(entry, "prd_path") === prdPath);
+    const matchPath = stage === "prd" ? prdPath : brainstormPath;
+    const hasProject = projects.some((entry) => jsonAt(entry, stage === "prd" ? "prd_path" : "brainstorm_path") === matchPath);
     if (hasProject) {
-        boardDocument.projects = projects.map((entry) => jsonAt(entry, "prd_path") === prdPath && isRecord(entry)
+        boardDocument.projects = projects.map((entry) => jsonAt(entry, stage === "prd" ? "prd_path" : "brainstorm_path") === matchPath && isRecord(entry)
             ? { ...entry, owner: principal, updated_at: now }
             : entry);
     }
     else {
-        boardDocument.projects = [...projects, {
-                id: `proj-${project}`,
-                title,
-                description,
-                status: "in_progress",
-                owner: principal,
-                prd_path: prdPath,
-                created_at: now,
-                updated_at: now,
-            }];
+        const entry = {
+            id: `proj-${project}`,
+            title,
+            description,
+            status: stage === "prd" ? "in_progress" : "exploring",
+            owner: principal,
+            prd_path: stage === "prd" ? prdPath : null,
+            created_at: now,
+            updated_at: now,
+        };
+        if (stage === "brainstorm")
+            entry.brainstorm_path = brainstormPath;
+        boardDocument.projects = [...projects, entry];
     }
     boardDocument.updated_at = now;
     writeJsonAtomically(board, boardDocument);
-    if (!isRecord(prd))
-        throw new TypeError("Cannot update non-object prd.json");
-    if (!isRecord(prd.metadata))
-        prd.metadata = {};
-    const metadata = prd.metadata;
-    metadata.owner = principal;
-    metadata.delegatedFrom = from;
-    metadata.delegatedAt = now;
-    writeJsonAtomically(prdAbs, prd);
+    if (stage === "prd") {
+        if (!isRecord(prd))
+            throw new TypeError("Cannot update non-object prd.json");
+        if (!isRecord(prd.metadata))
+            prd.metadata = {};
+        const metadata = prd.metadata;
+        metadata.owner = principal;
+        metadata.delegatedFrom = from;
+        metadata.delegatedAt = now;
+        writeJsonAtomically(prdAbs, prd);
+    }
+    else {
+        brainstormFrontmatterSet(brainstormAbs, "owner", principal);
+        brainstormFrontmatterSet(brainstormAbs, "delegated_from", from);
+        brainstormFrontmatterSet(brainstormAbs, "delegated_at", now);
+    }
     if (commandExists("hq", context.cwd)) {
         const sessionId = process.env.HQ_SESSION_ID || "delegate";
         const mesh = subprocess("hq", ["mesh", "session", "note", "--enqueue", "--session-id", sessionId, "--seq", "1", "--harness", "claude-code", "--adapter-version", "1.0.0", "--company-slug", company, "--project", project, "--summary", `Delegated to ${display} (${principal}) — delegation ${delegationId}; ownership transferred`], context.cwd, { stdout: "inherit" });
@@ -993,12 +1015,17 @@ function runTransfer(args, context) {
         const prefixesValue = jqFallback(document.vaultPrefixes, []);
         const vaultPrefixes = Array.isArray(prefixesValue) ? prefixesValue : [];
         const scope = vaultPrefixes.map((entry) => jqRawPath(entry, "prefix")).join(", ");
-        fs.appendFileSync(journal, `\n## ${today} — Delegated to ${display}\n\n- Delegation: \`${delegationId}\`\n- From: ${from}\n- To: ${display} (${principal})\n- Transferred scope: ${scope}\n- Local board and PRD ownership updated; Work Mesh ownership is unconfirmed. Existing delegator access is unchanged.\n`);
+        const ownershipLine = stage === "prd"
+            ? "Local board and PRD ownership updated; Work Mesh ownership is unconfirmed. Existing delegator access is unchanged."
+            : "Brainstorm-stage project (no PRD yet). Local board and brainstorm.md ownership updated; Work Mesh ownership is unconfirmed. Existing delegator access is unchanged.";
+        fs.appendFileSync(journal, `\n## ${today} — Delegated to ${display}\n\n- Delegation: \`${delegationId}\`\n- From: ${from}\n- To: ${display} (${principal})\n- Transferred scope: ${scope}\n- ${ownershipLine}\n`);
     }
     document.ownershipTransferredAt = now;
     document.workMeshOwnership = "unconfirmed";
     writeJsonAtomically(file, document);
-    writeOut(`${prefix} ownership of '${project}' transferred to ${display} (${principal}) — local board, PRD, and journal updated; Work Mesh ownership unconfirmed\n`);
+    const sourceLabel = stage === "prd" ? "PRD" : "brainstorm.md";
+    const stageLabel = stage === "prd" ? "" : " (brainstorm stage)";
+    writeOut(`${prefix} ownership of '${project}'${stageLabel} transferred to ${display} (${principal}) — local board, ${sourceLabel}, and journal updated; Work Mesh ownership unconfirmed\n`);
     return 0;
 }
 function runNative(name, args, context) {

package/dist/commands/core.js

@@ -268,6 +268,7 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/lib/session-scope-capability.sh", root: "live", summary: "Session scope-capability lib sourced by hq-session" },
     { asset: "core/scripts/lib/session-id.sh", root: "live", summary: "Session-id resolver lib sourced by hq-session" },
     { asset: "core/scripts/lib/hq-cli-floor.sh", root: "live", summary: "Shared CLI version-floor helper sourced by generated forwarders" },
+    { asset: "core/scripts/lib/delegate-brainstorm.sh", root: "live", summary: "Shared brainstorm-stage data helper sourced by delegate assets" },
     { asset: "core/scripts/lib/forwarder.sh", root: "live", summary: "Shared runtime sourced by generated scaffold forwarders" },
     { asset: "core/scripts/lib/work-mesh-enqueue.sh", root: "live", summary: "Work Mesh Live spool enqueue lib sourced by hooks" },
     { asset: "core/scripts/lib/work-mesh-live-hook.sh", root: "live", summary: "Work Mesh Live hook helpers sourced by rebind" },

package/dist/lib/mesh/live/daemon/presence.d.ts

@@ -101,6 +101,12 @@ export interface PresenceClientOptions {
  * backoff counters.
  */
 export declare function backoffDelayMs(attempt: number, baseMs: number, maxMs: number, random: () => number, previousMs?: number, minMs?: number): number;
+/**
+ * Stable episode key for transport failures so a network drop logs once
+ * instead of once per reconnect/error event (those Error objects otherwise
+ * pin the heap while the daemon crash-loops).
+ */
+export declare function networkErrorEpisodeKey(err: unknown): string | null;
 export declare function buildPresencePayload(input: {
     status: "online" | "offline";
     actorUid: string;
@@ -129,6 +135,10 @@ export declare class PresenceClient {
     private publishedTopics;
     /** Last refusal code we logged via onError (episode dedupe). */
     private loggedRefusalKey;
+    /** Last transport-failure episode logged via onError (network-drop dedupe). */
+    private loggedNetworkErrorKey;
+    /** Serialize connect/vend so a drop cannot stack MQTT clients or fetches. */
+    private connectPromise;
     private refusal;
     private preferredHandle;
     private preferredSnapshot;
@@ -163,6 +173,9 @@ export declare class PresenceClient {
     /** Force a reconnect cycle (network change / sleep-wake). */
     reconnectNow(): void;
     private teardownClient;
+    private emitError;
+    private clearNetworkErrorEpisode;
+    private enqueueConnect;
     private onCredentialsRenewed;
     private handleRenewalError;
     private refusalKey;

package/dist/lib/mesh/live/daemon/presence.js

@@ -54,6 +54,27 @@ export function backoffDelayMs(attempt, baseMs, maxMs, random, previousMs = 0, m
     const raw = Math.max(0, random() * cap);
     return Math.min(maxMs, Math.max(previousMs, raw, minMs));
 }
+const NETWORK_ERROR_RE = /fetch failed|ETIMEDOUT|ENOTFOUND|ECONNREFUSED|EAI_AGAIN|ENETUNREACH|ECONNRESET|ENETDOWN|EHOSTUNREACH/i;
+/**
+ * Stable episode key for transport failures so a network drop logs once
+ * instead of once per reconnect/error event (those Error objects otherwise
+ * pin the heap while the daemon crash-loops).
+ */
+export function networkErrorEpisodeKey(err) {
+    const code = err !== null && typeof err === "object" && "code" in err &&
+        typeof err.code === "string"
+        ? err.code
+        : "";
+    const msg = err instanceof Error ? err.message : String(err);
+    if (code && NETWORK_ERROR_RE.test(code))
+        return code;
+    if (!NETWORK_ERROR_RE.test(msg))
+        return null;
+    if (/fetch failed/i.test(msg))
+        return "fetch_failed";
+    const match = msg.match(/ETIMEDOUT|ENOTFOUND|ECONNREFUSED|EAI_AGAIN|ENETUNREACH|ECONNRESET|ENETDOWN|EHOSTUNREACH/i);
+    return match ? match[0].toUpperCase() : "network";
+}
 export function buildPresencePayload(input) {
     return {
         v: 1,
@@ -92,6 +113,10 @@ export class PresenceClient {
     publishedTopics = [];
     /** Last refusal code we logged via onError (episode dedupe). */
     loggedRefusalKey = null;
+    /** Last transport-failure episode logged via onError (network-drop dedupe). */
+    loggedNetworkErrorKey = null;
+    /** Serialize connect/vend so a drop cannot stack MQTT clients or fetches. */
+    connectPromise = null;
     refusal = null;
     preferredHandle = null;
     preferredSnapshot = [];
@@ -202,7 +227,7 @@ export class PresenceClient {
         if (this.stopped)
             throw new Error("PresenceClient already stopped");
         this.setState("connecting");
-        await this.connectOnce();
+        await this.enqueueConnect();
     }
     /**
      * Graceful stop: disconnect cleanly (MQTT DISCONNECT so the broker emits
@@ -234,13 +259,20 @@ export class PresenceClient {
         }
         // Backoff counters reset only after a stable connection — not here.
         this.clearReconnect();
-        void this.connectOnce();
+        void this.enqueueConnect();
     }
     teardownClient(force) {
         const client = this.client;
         if (!client)
             return;
         this.client = null;
+        try {
+            const removable = client;
+            removable.removeAllListeners?.();
+        }
+        catch {
+            /* best-effort */
+        }
         try {
             if (force) {
                 client.end(true);
@@ -253,22 +285,43 @@ export class PresenceClient {
             /* best-effort */
         }
     }
+    emitError(err) {
+        const key = networkErrorEpisodeKey(err);
+        if (key) {
+            if (this.loggedNetworkErrorKey === key)
+                return;
+            this.loggedNetworkErrorKey = key;
+        }
+        this.options.onError?.(err);
+    }
+    clearNetworkErrorEpisode() {
+        this.loggedNetworkErrorKey = null;
+    }
+    enqueueConnect() {
+        if (this.connectPromise)
+            return this.connectPromise;
+        this.connectPromise = this.connectOnce().finally(() => {
+            this.connectPromise = null;
+        });
+        return this.connectPromise;
+    }
     async onCredentialsRenewed(bundle) {
         this.bundle = bundle;
         this.notePreferredVend();
         // Successful vend ends a refusal episode (renewal skips connectOnce's vend path).
         this.clearRefusal(true);
+        this.clearNetworkErrorEpisode();
         if (this.stopped)
             return;
         // Reconnect with the new presigned URL; backoff resets only after stable connect.
-        await this.connectOnce();
+        await this.enqueueConnect();
     }
     handleRenewalError(err, info) {
         if (err instanceof CredentialVendError && err.kind === "refused") {
             this.noteRefusal(err, info?.nextRetryAt);
             return;
         }
-        this.options.onError?.(err);
+        this.emitError(err);
     }
     refusalKey(err) {
         return err.code ?? `HTTP_${err.status}`;
@@ -314,6 +367,7 @@ export class PresenceClient {
                 this.bundle = await this.options.fetchCredentials();
                 // Successful vend ends a refusal episode (even before MQTT connects).
                 this.clearRefusal(true);
+                this.clearNetworkErrorEpisode();
                 this.renewal.schedule(this.bundle);
                 this.notePreferredVend();
                 this.armPreferredWatch();
@@ -334,7 +388,7 @@ export class PresenceClient {
                 });
             }
             catch (err) {
-                this.options.onError?.(err);
+                this.emitError(err);
                 this.scheduleReconnect();
                 return;
             }
@@ -342,6 +396,7 @@ export class PresenceClient {
             client.on("connect", () => {
                 if (this.stopped || generation !== this.generation)
                     return;
+                this.clearNetworkErrorEpisode();
                 // Do not reset attempt here — broker may accept then close immediately
                 // (denied publish / policy). Reset only after CONNECT_STABLE_GRACE_MS.
                 this.connectedAtMs = this.timers.now();
@@ -362,7 +417,7 @@ export class PresenceClient {
             client.on("error", (err) => {
                 if (this.stopped || generation !== this.generation)
                     return;
-                this.options.onError?.(err);
+                this.emitError(err);
             });
             client.on("close", () => {
                 if (this.stopped || generation !== this.generation)
@@ -381,7 +436,7 @@ export class PresenceClient {
                 this.scheduleReconnect({ refused: err });
                 return;
             }
-            this.options.onError?.(err);
+            this.emitError(err);
             this.scheduleReconnect();
         }
     }
@@ -401,7 +456,7 @@ export class PresenceClient {
         for (const company of bundle.companies) {
             const topic = company.presenceTopic;
             if (!isOwnPresenceTopic(topic, bundle.actorUid, companyUids)) {
-                this.options.onError?.(new Error(`refusing to publish to non-presence topic`));
+                this.emitError(new Error(`refusing to publish to non-presence topic`));
                 continue;
             }
             await new Promise((resolve) => {
@@ -412,7 +467,7 @@ export class PresenceClient {
                     }
                 }
                 catch (err) {
-                    this.options.onError?.(err);
+                    this.emitError(err);
                     resolve();
                 }
             });
@@ -451,7 +506,7 @@ export class PresenceClient {
             if (opts?.refused) {
                 this.bundle = null;
             }
-            void this.connectOnce();
+            void this.enqueueConnect();
         }, delay);
         return delay;
     }

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -24,6 +24,9 @@ export declare const FLUSH_INTERVAL_MS = 10000;
 /** Keep startup recovery bounded: the next daemon start continues the backlog. */
 export declare const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
 export declare const DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS = 2000;
+/** Skip further membership probes after a transport failure so a network drop
+ *  cannot fan out one hanging lookup per held session. */
+export declare const DEVICE_DEFAULT_MEMBERSHIP_UNAVAILABLE_COOLDOWN_MS = 30000;
 /** Three sequential async shutdown steps must finish within six seconds. */
 export declare const SHUTDOWN_STEP_TIMEOUT_MS = 2000;
 /** Non-zero exit reserved for CLI version drift so legacy Restart=on-failure units restart. */

package/dist/lib/mesh/live/daemon/run.js

@@ -45,6 +45,9 @@ export const FLUSH_INTERVAL_MS = 10_000;
 /** Keep startup recovery bounded: the next daemon start continues the backlog. */
 export const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
 export const DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS = 2_000;
+/** Skip further membership probes after a transport failure so a network drop
+ *  cannot fan out one hanging lookup per held session. */
+export const DEVICE_DEFAULT_MEMBERSHIP_UNAVAILABLE_COOLDOWN_MS = 30_000;
 /** Three sequential async shutdown steps must finish within six seconds. */
 export const SHUTDOWN_STEP_TIMEOUT_MS = 2_000;
 /** Non-zero exit reserved for CLI version drift so legacy Restart=on-failure units restart. */
@@ -172,6 +175,9 @@ export async function runMeshDaemon(deps = {}) {
     const resolveMembership = deps.resolveMembership ?? resolveActiveMembershipCompany;
     const machineIdentity = deps.machineIdentity ?? isMachineIdentity();
     /** The sole authorization seam for daemon tenant I/O derived from a device default. */
+    let membershipUnavailableUntilMs = 0;
+    let membershipUnavailableError = "membership lookup unavailable";
+    let membershipUnavailableLogged = false;
     const tenantGate = {
         authorize: async (input) => {
             const state = input.state ?? (input.sessionId
@@ -190,6 +196,9 @@ export async function runMeshDaemon(deps = {}) {
             const lookupKey = slug || state?.companyUid || (usingDefaultFallback
                 ? (defaultCompany?.slug || defaultCompany?.uid)
                 : undefined);
+            if (lookupKey && now().getTime() < membershipUnavailableUntilMs) {
+                return { status: "unavailable", error: membershipUnavailableError };
+            }
             let authorization;
             if (!lookupKey) {
                 authorization = { status: "denied" };
@@ -240,14 +249,21 @@ export async function runMeshDaemon(deps = {}) {
                 }
             }
             if (authorization.status === "unavailable") {
-                const prior = readDaemonState(dir)?.deviceDefaultMembershipLookupFailures ?? 0;
-                patchDaemonState(dir, {
-                    lastErrorCode: "DEVICE_DEFAULT_MEMBERSHIP_LOOKUP_FAILED",
-                    deviceDefaultMembershipLookupFailures: prior + 1,
-                }, now);
-                log(dir, `device-default membership lookup unavailable${slug ? ` company=${slug}` : ""}: ${authorization.error.slice(0, 160)}`);
+                membershipUnavailableUntilMs = now().getTime() + DEVICE_DEFAULT_MEMBERSHIP_UNAVAILABLE_COOLDOWN_MS;
+                membershipUnavailableError = authorization.error;
+                if (!membershipUnavailableLogged) {
+                    membershipUnavailableLogged = true;
+                    const prior = readDaemonState(dir)?.deviceDefaultMembershipLookupFailures ?? 0;
+                    patchDaemonState(dir, {
+                        lastErrorCode: "DEVICE_DEFAULT_MEMBERSHIP_LOOKUP_FAILED",
+                        deviceDefaultMembershipLookupFailures: prior + 1,
+                    }, now);
+                    log(dir, `device-default membership lookup unavailable${slug ? ` company=${slug}` : ""}: ${authorization.error.slice(0, 160)}`);
+                }
                 return authorization;
             }
+            membershipUnavailableUntilMs = 0;
+            membershipUnavailableLogged = false;
             if (!input.deviceDefault)
                 return authorization;
             if (authorization.status === "authorized" &&
@@ -351,12 +367,17 @@ export async function runMeshDaemon(deps = {}) {
                     lastHeldRetryAtMs = atMs;
                 },
                 log: (message) => log(dir, message),
-                authorizeDeviceDefaultTenant: async (state) => (await tenantGate.authorize({
-                    state,
-                    companySlug: state.companySlug,
-                    companyUid: state.companyUid,
-                    deviceDefault: true,
-                })).status === "authorized",
+                authorizeDeviceDefaultTenant: async (state) => {
+                    const authorization = await tenantGate.authorize({
+                        state,
+                        companySlug: state.companySlug,
+                        companyUid: state.companyUid,
+                        deviceDefault: true,
+                    });
+                    if (authorization.status === "unavailable")
+                        return "unavailable";
+                    return authorization.status === "authorized";
+                },
             });
         });
     const replayFn = deps.replayOutbox ??

package/dist/lib/mesh/live/flush.d.ts

@@ -45,8 +45,11 @@ export interface FlushDeps {
     heldMaxLines?: number;
     /** Optional logger (daemon wires this); used once per overflow trim. */
     log?: (message: string) => void;
-    /** Authoritative gate for state derived from a device default. */
-    authorizeDeviceDefaultTenant?: (state: SessionStateFile) => Promise<boolean>;
+    /** Authoritative gate for state derived from a device default.
+     *  `true` allow, `false` deny (hold NEEDS_COMPANY), `"unavailable"` skip the
+     *  network this cycle and keep the original held envelope.
+     */
+    authorizeDeviceDefaultTenant?: (state: SessionStateFile) => Promise<boolean | "unavailable">;
     /** Passed through to bind-best (catalog cache root and HQ_WORK_MESH_CACHE). */
     env?: NodeJS.ProcessEnv;
     home?: string;

package/dist/lib/mesh/live/flush.js

@@ -142,6 +142,10 @@ async function postBatchWithRetries(poster, body, deps) {
         lastBody = res.body;
         if (res.ok)
             return { ok: true, body: res.body };
+        if (res.status === 0) {
+            // Transport down (fetch failed): do not hot-loop five more attempts.
+            return { ok: false, retryable: true, status: 0, body: res.body };
+        }
         if (res.status === 429 || res.status === 503) {
             const retryAfterMs = typeof res.retryAfterMs === "number" &&
                 Number.isFinite(res.retryAfterMs) &&
@@ -279,12 +283,13 @@ export async function flushSessionEvents(inputDeps) {
             if (leaveResult.abort)
                 continue;
             const remainingItems = leaveResult.items;
+            state = bindHeldCompanyIfResolved(sessionId, remainingItems, state, deps, now);
             if (state?.companyConfidence === "device_default" &&
                 deps.authorizeDeviceDefaultTenant) {
                 const allowed = await deps.authorizeDeviceDefaultTenant(state);
                 // Authorization may restore a company the gate previously cleared.
                 state = readSessionState(sessionId, deps.workContextRoot) ?? state;
-                if (!allowed) {
+                if (allowed === false || allowed === "unavailable") {
                     const heldAt = now().toISOString();
                     summary.held += appendHeldLinesIfAbsent(remainingItems.map((item) => heldEnvelope(item.event, "NEEDS_COMPANY", item.heldAt ?? heldAt)), deps.workMeshRoot);
                     for (const item of remainingItems)
@@ -392,6 +397,8 @@ export async function flushSessionEvents(inputDeps) {
                     summary.restored += 1;
                     markDisposed(item.event);
                 }
+                if (result.status === 0)
+                    break sessionLoop;
                 if (result.status === 429 || result.status === 503)
                     break;
                 if (deps.signal?.aborted)
@@ -604,6 +611,72 @@ const SESSION_EVENT_HARNESSES = new Set([
     "agent-box",
     "agents-v2",
 ]);
+function bindHeldCompanyIfResolved(sessionId, items, state, deps, now) {
+    if (state?.companyUid)
+        return state;
+    const sample = items[0]?.event;
+    if (!sample)
+        return state;
+    const cwd = eventText(sample, "cwd");
+    const hqRoot = eventText(sample, "hqRoot");
+    const remoteOwnerSlug = cwd
+        ? deriveRemoteOwnerSlug({ cwd, hqRoot }) ?? undefined
+        : undefined;
+    const repoIdentityKey = cwd ? deriveRepoIdentityKey({ cwd }) : null;
+    const resolution = resolveCompany({
+        root: deps.workContextRoot,
+        sessionId,
+        existingState: state,
+        env: {
+            ...(deps.env ?? {}),
+            HQ_SPAWN_COMPANY: "",
+            HQ_AGENT_IDENTITY_FILE: "",
+        },
+        trusted: eventText(sample, "companySlug")
+            ? { companySlug: eventText(sample, "companySlug") }
+            : undefined,
+        cwd,
+        hqRoot,
+        remoteOwnerSlug,
+        repoIdentityKey,
+    });
+    if (resolution.status !== "resolved" || !resolution.company.uid)
+        return state;
+    if (resolution.company.source === "trusted_explicit" &&
+        !eventText(sample, "companySlug")) {
+        return state;
+    }
+    const uid = resolution.company.uid;
+    const slug = resolution.company.slug;
+    const nowIso = now().toISOString();
+    const next = updateSessionState(sessionId, deps.workContextRoot, (current) => {
+        const base = current ?? state;
+        if (!base)
+            return null;
+        if (base.companyUid && base.companyUid !== uid)
+            return null;
+        const contextStatus = base.contextStatus === "needs_company" ||
+            base.contextStatus === "unresolved" ||
+            !base.contextStatus
+            ? (base.projectId
+                ? (base.taskId ? "bound" : "needs_task")
+                : "needs_project")
+            : base.contextStatus;
+        return {
+            ...base,
+            sessionId,
+            contractVersion: base.contractVersion ?? 1,
+            companyUid: uid,
+            ...(slug ? { companySlug: slug } : {}),
+            ...(resolution.company.source === "device_default"
+                ? { companyConfidence: "device_default" }
+                : {}),
+            contextStatus,
+            updatedAt: nowIso,
+        };
+    });
+    return next ?? readSessionState(sessionId, deps.workContextRoot) ?? state;
+}
 function applySessionMetaCompanyRebind(sessionId, items, state, deps, now) {
     if (!state)
         return state;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.87",
+  "version": "5.345.89",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {