@indigoai-us/hq-cloud 6.16.64 → 6.16.66

package/dist/bin/sync-runner-watch-loop.js

@@ -10,11 +10,12 @@ import { pickCanonicalPersonEntity } from "../vault-client.js";
 import { acquireOperationLock, withOperationLock, withOperationLockSync, OperationLockedError, OPERATION_LOCKED_EXIT, } from "../operation-lock.js";
 import { describeError } from "../lib/describe-error.js";
 import { TRANSIENT_NETWORK_EXIT } from "../lib/net-errors.js";
-import { PARTIAL_SYNC_EXIT } from "../lib/exit-codes.js";
+import { PARTIAL_SYNC_EXIT, UNRESOLVED_COMPANY_EXIT, } from "../lib/exit-codes.js";
 import { getOrCreateMachineId } from "../lib/machine-id.js";
 import { localPathForVaultKey } from "../local-path-codec.js";
 import { TreeWatcher, resolveEventDebounceConfig, systemClock, } from "../watcher.js";
-import { clearLocalDeleteIntent, getStateDir, markLocalDeleteIntent, PERSONAL_VAULT_JOURNAL_SLUG, openJournalStoreSession, openJournalStoreSessionAsync, listJournalSlugs, listJournals, maintainAreaJournalSlice, readJournal, releaseCachedAreaJournalMigrations, journalCacheCensusSizes, journalRows, readJournalScoped, writeJournal, } from "../journal.js";
+import { recoverHqRootLocalState } from "../hq-root-recovery.js";
+import { clearLocalDeleteIntent, getStateDir, markLocalDeleteIntent, PERSONAL_VAULT_JOURNAL_SLUG, openJournalStoreSession, openJournalStoreSessionAsync, listJournalSlugs, listJournals, maintainAreaJournalSlice, disposeScopedJournalStores, releaseScopedJournalStore, releaseCachedAreaJournalMigrations, journalCacheCensusSizes, journalRows, readJournalScoped, writeJournal, } from "../journal.js";
 import { isPersonalVaultDeletionExcluded } from "../personal-vault.js";
 import { NoopPushReceiver, } from "../sync/push-receiver.js";
 import { resolveEventSync, startEventSync as defaultStartEventSync, } from "../sync/event-sync.js";
@@ -30,6 +31,219 @@ import { InlineSyncWorkerAdapter, } from "../sync/sync-work.js";
 import { buildRoutePullArgv, buildScopedPushArgv, buildScopedDrainPullArgv, buildTargetedPullArgv, isWatchRouteSelected, routeChangeToTarget, routeKey, } from "./sync-runner-watch-routes.js";
 import { resolveSkipCompanies } from "./sync-runner-planning.js";
 const FULL_RECONCILE_EVERY_TICKS = 10;
+/** A deferred full chore must get the next admission after this long. */
+export const CHORE_STARVATION_CAP_MS = 15 * 60 * 1000;
+/**
+ * One durable-state owner at a time for a full chore. Realtime work never runs
+ * beside that chore: it explicitly awaits `checkpoint()` after a completed
+ * durable unit, then resumes once the hand-off is finished. A separately
+ * tracked, explicitly opted-in watcher fast pass may use the pre-existing
+ * scoped fast-over-slow exception, but never while a chore owns durable state.
+ */
+export class CooperativePassScheduler {
+    now;
+    starvationCapMs;
+    pending = [];
+    active = null;
+    // Scoped fast realtime work has the established in-process lock exception
+    // while a scoped slow realtime upload is in flight. Keep that slot separate
+    // from `active`: a chore still has exactly one durable-state owner.
+    activeFastRealtime = null;
+    stopped = false;
+    _handoffActive = false;
+    constructor(now, starvationCapMs = CHORE_STARVATION_CAP_MS) {
+        this.now = now;
+        this.starvationCapMs = starvationCapMs;
+    }
+    get handoffActive() {
+        return this._handoffActive;
+    }
+    get hasActiveChore() {
+        return this.active?.workClass === "chore";
+    }
+    get hasActiveSlowRealtime() {
+        return this.active?.workClass === "realtime" && this.active.lane === "slow";
+    }
+    pendingLaneCount(lane) {
+        return this.pending.filter((entry) => entry.lane === lane).length;
+    }
+    submit(task, workClass, lane = "slow", allowFastRealtimeOvertake = false) {
+        if (this.stopped)
+            return Promise.resolve(0);
+        const directEntry = {
+            task,
+            workClass,
+            lane,
+            allowFastRealtimeOvertake,
+            // An immediately admitted task cannot starve, so avoid sampling the
+            // cadence clock merely to stamp it. This preserves the loop's deadline
+            // accounting and keeps the timestamp meaningful only for real queues.
+            enqueuedAt: 0,
+            resolve: () => undefined,
+            reject: () => undefined,
+        };
+        if (this.canStartFastRealtime(directEntry)) {
+            return this.startFastRealtime(directEntry);
+        }
+        if (this.active === null &&
+            this.activeFastRealtime === null &&
+            this.pending.length === 0) {
+            return this.start(directEntry);
+        }
+        return new Promise((resolve, reject) => {
+            const entry = { ...directEntry, enqueuedAt: this.now(), resolve, reject };
+            this.pending.push(entry);
+            this.drain();
+        });
+    }
+    stop() {
+        this.stopped = true;
+        while (this.pending.length > 0)
+            this.pending.shift()?.resolve(0);
+    }
+    drain() {
+        if (this.stopped || this.pending.length === 0)
+            return;
+        if (this.active !== null) {
+            const fastRealtime = this.nextFastRealtime();
+            if (fastRealtime && this.canStartFastRealtime(fastRealtime)) {
+                this.pending.splice(this.pending.indexOf(fastRealtime), 1);
+                this.startFastRealtime(fastRealtime);
+            }
+            return;
+        }
+        if (this.activeFastRealtime !== null)
+            return;
+        const next = this.takeNext();
+        if (next)
+            this.start(next);
+    }
+    takeNext() {
+        const now = this.now();
+        const starvedChore = this.pending.findIndex((entry) => entry.workClass === "chore" && now - entry.enqueuedAt >= this.starvationCapMs);
+        if (starvedChore >= 0)
+            return this.pending.splice(starvedChore, 1)[0];
+        // A receiver's bulk drain is still realtime work, but its slow lane is the
+        // progress boundary for that delivery. Preserve its established turn
+        // before refilling later fast realtime arrivals; this does not let a
+        // chore overtake any realtime work.
+        const realtime = this.nextRealtimeIndex();
+        if (realtime >= 0)
+            return this.pending.splice(realtime, 1)[0];
+        return this.pending.shift();
+    }
+    nextRealtimeIndex() {
+        const slowRealtime = this.pending.findIndex((entry) => entry.workClass === "realtime" && entry.lane === "slow");
+        return slowRealtime >= 0
+            ? slowRealtime
+            : this.pending.findIndex((entry) => entry.workClass === "realtime");
+    }
+    nextFastRealtime() {
+        return this.pending.find((entry) => entry.workClass === "realtime" && entry.lane === "fast");
+    }
+    hasStarvedChore() {
+        const now = this.now();
+        return this.pending.some((entry) => entry.workClass === "chore" && now - entry.enqueuedAt >= this.starvationCapMs);
+    }
+    canStartFastRealtime(entry) {
+        return (!this._handoffActive &&
+            this.activeFastRealtime === null &&
+            entry.workClass === "realtime" &&
+            entry.lane === "fast" &&
+            entry.allowFastRealtimeOvertake &&
+            this.hasActiveSlowRealtime &&
+            !this.hasStarvedChore());
+    }
+    start(entry) {
+        this.active = entry;
+        let current;
+        try {
+            current = this.execute(entry);
+        }
+        catch (error) {
+            current = Promise.reject(error);
+        }
+        void current.then((outcome) => {
+            entry.resolve(outcome);
+            this.complete(entry);
+        }, (error) => {
+            entry.reject(error);
+            this.complete(entry);
+        }).catch(() => undefined);
+        return current;
+    }
+    complete(entry) {
+        if (this.active === entry)
+            this.active = null;
+        this.drain();
+    }
+    startFastRealtime(entry) {
+        this.activeFastRealtime = entry;
+        let current;
+        try {
+            current = this.execute(entry);
+        }
+        catch (error) {
+            current = Promise.reject(error);
+        }
+        void current.then((outcome) => {
+            entry.resolve(outcome);
+            this.completeFastRealtime(entry);
+        }, (error) => {
+            entry.reject(error);
+            this.completeFastRealtime(entry);
+        });
+        return current;
+    }
+    completeFastRealtime(entry) {
+        if (this.activeFastRealtime === entry)
+            this.activeFastRealtime = null;
+        this.drain();
+    }
+    execute(entry) {
+        return entry.task({ checkpoint: () => this.checkpoint(entry) });
+    }
+    async checkpoint(entry) {
+        if (this.stopped ||
+            entry.workClass !== "chore" ||
+            this.active !== entry ||
+            !this.pending.some((pending) => pending.workClass === "realtime")) {
+            return false;
+        }
+        // `entry` is suspended at a caller-declared durable boundary.  It remains
+        // the sole full-pass continuation and will resume after this bounded burst.
+        const deferredAt = this.now();
+        this.active = null;
+        this._handoffActive = true;
+        let handedOff = false;
+        try {
+            while (!this.stopped && this.now() - deferredAt < this.starvationCapMs) {
+                const realtimeIndex = this.nextRealtimeIndex();
+                if (realtimeIndex < 0)
+                    break;
+                const realtime = this.pending.splice(realtimeIndex, 1)[0];
+                handedOff = true;
+                this.active = realtime;
+                try {
+                    realtime.resolve(await this.execute(realtime));
+                }
+                catch (error) {
+                    realtime.reject(error);
+                }
+                finally {
+                    if (this.active === realtime)
+                        this.active = null;
+                }
+            }
+        }
+        finally {
+            this._handoffActive = false;
+            if (!this.stopped)
+                this.active = entry;
+        }
+        return handedOff;
+    }
+}
 const MAX_FULL_RECONCILE_REASONS = 7;
 /**
  * Area storage is AUTO by default and only applies after durable cutover.
@@ -62,7 +276,7 @@ function emitFullReconcileDecision({ mode, reasons, triggers, pollTick, configur
  * is drained in bounded chunks across successive ticks instead of one giant
  * scoped pass. Size is not a full-reconcile signal — unknown scope is
  * (`overflowed` with no route hints, warm-up catch-up failure, first tick,
- * scheduled interval, bare wake). The crossover for a *chunk* is the number
+ * scheduled interval, bare wake, vanished HQ-root coverage). The crossover for a *chunk* is the number
  * of `--scope-path` arguments a targeted pass can carry without becoming a
  * de-facto whole-tree walk. `HQ_SYNC_EVENT_BATCH_LIMIT` overrides; 0/invalid
  * = default. Do not raise this to "fix" a large warm-up catch-up: that only
@@ -509,6 +723,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
     const idleHeartbeatIntervalMs = deps.idleHeartbeatIntervalMs ?? WATCH_IDLE_HEARTBEAT_INTERVAL_MS;
     const monotonicNow = deps.monotonicNow ?? (() => performance.now());
     const runPass = deps.runPass ?? runtime.runPassWithOperationLockAlreadyHeld;
+    const runPassSupportsCooperativeCheckpoint = deps.runPass === undefined || deps.runPassSupportsCooperativeCheckpoint === true;
     const pollIdx = argv.indexOf("--poll-remote-ms");
     // An explicit --poll-remote-ms pins a fixed interval (menubar/CLI still set
     // one). When it is omitted, the interval is resolved fresh each cycle from
@@ -519,7 +734,11 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
     const eventPush = argv.includes("--event-push");
     const fullReconcileIntervalMs = resolveFullReconcileMs();
     const companiesMode = argv.includes("--companies");
-    const companyMode = argv.includes("--company");
+    const companyIdx = argv.indexOf("--company");
+    const companyMode = companyIdx >= 0;
+    // The tenant a single-company run owns. Carried into route selection so a
+    // watcher or receiver event under another company cannot queue a pass for it.
+    const companySlug = companyMode ? argv[companyIdx + 1] : undefined;
     const personalMode = argv.includes("--personal");
     // Keep this at the watcher ingress rather than importing the runner's
     // resolver: sync-runner imports this loop, and a reverse value import would
@@ -528,6 +747,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
     const watchRouteSelection = {
         companies: companiesMode,
         company: companyMode,
+        ...(companySlug !== undefined ? { companySlug } : {}),
         personal: personalMode,
         skipPersonal: parsed.skipPersonal === true ||
             skipPersonalEnv === "1" ||
@@ -672,7 +892,27 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             resolveNoOperationLockUsers = resolve;
         });
     };
-    const runPassWithLock = async (passArgvForRun, prepare, lane = "slow") => {
+    const passScheduler = new CooperativePassScheduler(monotonicNow);
+    const runPassWithLock = async (passArgvForRun, prepare, lane = "slow", workClass = "chore", checkpoint) => {
+        const reportedAppliedUpserts = new Set();
+        const recordDurableAppliedUpserts = (upserts) => {
+            for (const applied of upserts) {
+                const key = `${applied.relativePath}\u0000${applied.contentHash}`;
+                if (reportedAppliedUpserts.has(key))
+                    continue;
+                reportedAppliedUpserts.add(key);
+                rememberAppliedUpsert(applied.relativePath, applied.contentHash);
+            }
+        };
+        const invokePass = () => {
+            if (!runPassSupportsCooperativeCheckpoint)
+                return runPass(passArgvForRun);
+            // This callback is emitted by the production runner after journal
+            // repair/seed and before fanout. It starts ingress early, but never
+            // admits a second durable writer: queued realtime still waits for the
+            // existing scheduler's cooperative hand-off checkpoint.
+            return runPass(passArgvForRun, checkpoint, () => activateEventPushSurfaces(), recordDurableAppliedUpserts);
+        };
         // Observe the heap at pass boundaries — a gated checkpoint immediately before
         // admitting a pass and immediately after it returns. A pass that runs a long
         // synchronous stretch starves the interval timer, so these boundary
@@ -684,9 +924,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             heapCheckpoint?.();
             if (typeof outcome === "number")
                 return;
-            for (const applied of outcome.result?.appliedUpserts ?? []) {
-                rememberAppliedUpsert(applied.relativePath, applied.contentHash);
-            }
+            recordDurableAppliedUpserts(outcome.result?.appliedUpserts ?? []);
         };
         // Pre-admit boundary observation.
         heapCheckpoint?.();
@@ -695,13 +933,31 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         // its keyed journal delta and per-object mutation are independent from the
         // slow pass's bulk paths, and the slow pass already owns the root lock.
         // Never bypass the lock when no slow pass is active.
+        if (
+        // A full chore is paused at a caller-declared durable checkpoint.  Keep
+        // the root lock held by this process, but lend it to exactly one
+        // realtime pass; the suspended chore cannot mutate until this returns.
+        workClass === "realtime" &&
+            passScheduler.handoffActive &&
+            processOwnsOperationLock) {
+            acquireOperationLockUser();
+            try {
+                prepare?.();
+                const outcome = await invokePass();
+                recordAppliedUpserts(outcome);
+                return outcome;
+            }
+            finally {
+                releaseOperationLockUser();
+            }
+        }
         if (lane === "fast" &&
             processOwnsOperationLock &&
             coordinatorWholeMutationChores === 0) {
             acquireOperationLockUser();
             try {
                 prepare?.();
-                const outcome = await runPass(passArgvForRun);
+                const outcome = await invokePass();
                 recordAppliedUpserts(outcome);
                 return outcome;
             }
@@ -721,7 +977,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                     acquireOperationLockUser();
                 }
                 prepare?.();
-                const outcome = await runPass(passArgvForRun);
+                const outcome = await invokePass();
                 recordAppliedUpserts(outcome);
                 return outcome;
             }
@@ -755,7 +1011,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 }
                 try {
                     prepare?.();
-                    const outcome = await runPass(passArgvForRun);
+                    const outcome = await invokePass();
                     recordAppliedUpserts(outcome);
                     return outcome;
                 }
@@ -778,7 +1034,18 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             throw err;
         }
     };
-    const runTaskWithLock = async (task) => {
+    const runTaskWithLock = async (task, workClass = "chore") => {
+        if (workClass === "realtime" &&
+            passScheduler.handoffActive &&
+            processOwnsOperationLock) {
+            acquireOperationLockUser();
+            try {
+                return await task();
+            }
+            finally {
+                releaseOperationLockUser();
+            }
+        }
         try {
             const handle = acquireOperationLock(hqRoot, "sync", {
                 timeoutSec: 0,
@@ -872,102 +1139,15 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             heapCheckpoint?.();
         }
     };
-    let activeSlowPass = null;
-    let activeFastPass = null;
-    const pendingSlowPasses = [];
-    const pendingFastPasses = [];
     const resolveStoppedQueue = () => {
-        for (const queue of [pendingFastPasses, pendingSlowPasses]) {
-            while (queue.length > 0)
-                queue.shift()?.resolve(0);
-        }
-    };
-    const drainQueuedPasses = () => {
-        if (stopped) {
-            resolveStoppedQueue();
-            return;
-        }
-        // A queued slow pass is the bulk-drain progress boundary. Admit it before
-        // refilling the realtime queue; otherwise a steady stream of fast work
-        // perpetually leapfrogs a receiver's bulk batch and its SQS poll loop
-        // cannot issue another receive.
-        if (activeSlowPass === null &&
-            activeFastPass === null &&
-            pendingSlowPasses.length > 0) {
-            const slow = pendingSlowPasses.shift();
-            if (slow) {
-                const current = startGuardedTask(slow.task, "slow");
-                void current.then(slow.resolve, slow.reject);
-            }
-        }
-        if (activeFastPass === null) {
-            const fast = pendingFastPasses.shift();
-            if (fast) {
-                const current = startGuardedTask(fast.task, "fast");
-                void current.then(fast.resolve, fast.reject);
-            }
-        }
-        // A fast pass that acquired the operation lock normally (rather than
-        // bypassing an in-process slow holder) still owns the cross-process
-        // boundary. Slow work must queue behind it; only fast work is allowed to
-        // overlap an already-lock-owning slow pass.
-        if (activeSlowPass === null && activeFastPass === null) {
-            const slow = pendingSlowPasses.shift();
-            if (slow) {
-                const current = startGuardedTask(slow.task, "slow");
-                void current.then(slow.resolve, slow.reject);
-            }
-        }
-    };
-    const startGuardedTask = (task, lane) => {
-        // Claim the lane before invoking `task`: a task can synchronously activate
-        // a watcher/scheduler callback before returning its promise. Without this
-        // placeholder that re-entrant callback sees an idle lane and starts a
-        // second lock contender.
-        const placeholder = Promise.resolve(0);
-        if (lane === "fast")
-            activeFastPass = placeholder;
-        else
-            activeSlowPass = placeholder;
-        let current;
-        try {
-            current = stopped ? placeholder : task();
-        }
-        catch (err) {
-            current = Promise.reject(err);
-        }
-        if (lane === "fast")
-            activeFastPass = current;
-        else
-            activeSlowPass = current;
-        void current
-            .finally(() => {
-            if (lane === "fast" && activeFastPass === current) {
-                activeFastPass = null;
-                drainQueuedPasses();
-            }
-            else if (lane === "slow" && activeSlowPass === current) {
-                activeSlowPass = null;
-                drainQueuedPasses();
-            }
-        })
-            .catch(() => undefined);
-        return current;
+        passScheduler.stop();
     };
-    const runGuardedTask = (task, lane = "slow") => {
-        const active = lane === "fast"
-            ? activeFastPass
-            : activeSlowPass ?? activeFastPass;
-        const queued = lane === "fast" ? pendingFastPasses : pendingSlowPasses;
-        if (active === null && queued.length === 0) {
-            return startGuardedTask(task, lane);
-        }
-        return new Promise((resolve, reject) => {
-            queued.push({ task, lane, resolve, reject });
-            drainQueuedPasses();
-        });
-    };
-    const runGuarded = (passArgvForRun, prepare, lane = "slow") => runGuardedTask(() => runPassWithLock(passArgvForRun, prepare, lane), lane);
+    const runGuardedTask = (task, lane = "slow", workClass = "chore", allowFastRealtimeOvertake = false) => 
+    // Lanes still choose the pass execution profile, but no longer decide
+    // chore ownership. Realtime normally waits for a chore hand-off; the
+    // watcher fast path explicitly opts into its established scoped exception.
+    passScheduler.submit(task, workClass, lane, allowFastRealtimeOvertake);
+    const runGuarded = (passArgvForRun, prepare, lane = "slow", workClass = "chore", allowFastRealtimeOvertake = false) => runGuardedTask((context) => runPassWithLock(passArgvForRun, prepare, lane, workClass, workClass === "chore" ? context.checkpoint : undefined), lane, workClass, allowFastRealtimeOvertake);
     /*
      * Area storage and the parallel coordinator default to AUTO. AUTO turns
      * them on after durable personal-vault cutover; explicit off is the kill
@@ -1159,6 +1339,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 });
             },
             onCutOver: () => {
+                releaseScopedJournalStore(PERSONAL_VAULT_JOURNAL_SLUG);
                 parallelCoordinatorEnabled = refreshCoordinatorEnabled();
                 if (parallelCoordinatorEnabled && coordinator === null) {
                     coordinator = createCoordinator();
@@ -1167,6 +1348,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         })
         : { onTick() { } };
     let watcher = null;
+    let rootCoverageStale = false;
     let eventPushSurfacesActivated = false;
     let watcherUnavailableWarned = false;
     let watcherRetryAt = null;
@@ -1240,11 +1422,36 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             `watched-paths=${watchedPaths ?? "unknown"}, ` +
             `dropped-untracked-deletes=${watcher.untrackedDeletesDropped?.() ?? "unknown"}, ` +
             `drained-untracked-deletes=${drainedUntrackedDeletes})\n`);
+        const probe = watcher.probeCoverage?.();
+        if (probe && !probe.ok) {
+            process.stderr.write("hq-sync-runner: WARN event-push watcher coverage stale; " +
+                `reason=${probe.reason} stale-watches=${probe.staleWatches} ` +
+                `watched-paths=${watchedPaths ?? "unknown"}; restoring from vault, not pushing deletes\n`);
+            try {
+                recoverHqRootLocalState(hqRoot);
+            }
+            catch (err) {
+                process.stderr.write(`hq-sync-runner: WARN local HQ recovery failed: ${describeError(err)}\n`);
+            }
+            try {
+                watcher.rebuildCoverage?.();
+            }
+            catch (err) {
+                process.stderr.write(`hq-sync-runner: WARN watcher coverage rebuild failed: ${describeError(err)}\n`);
+            }
+            rootCoverageStale = true;
+            interruptWait();
+        }
     };
     /** Vanished never-journaled file deletes removed from batches at drain time. */
     let drainedUntrackedDeletes = 0;
     const pendingWatcherPaths = new Map();
     const pendingWatcherChanges = new Map();
+    // A warm-up scan observes filesystem state over time. Keep an ingress
+    // sequence so its older observations cannot overwrite a live watcher event
+    // that arrived while the scan was yielding.
+    const pendingWatcherChangeSequences = new Map();
+    let nextPendingWatcherChangeSequence = 0;
     let pendingWatcherOriginalBatch = null;
     // Every coalesced watcher batch gets one durable in-process generation.
     // A wake can cause the scheduler to revisit a drained batch, but an event
@@ -1268,11 +1475,11 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         const paths = new Map();
         const changes = new Map();
         for (const [absolutePath, relativePath] of batch.paths.entries()) {
-            const route = routeChangeToTarget(relativePath);
+            const change = batch.changes?.get(absolutePath);
+            const route = routeChangeToTarget(relativePath, change?.kind);
             if (!route || !isWatchRouteSelected(route, watchRouteSelection))
                 continue;
             paths.set(absolutePath, relativePath);
-            const change = batch.changes?.get(absolutePath);
             if (change)
                 changes.set(absolutePath, change);
         }
@@ -1280,7 +1487,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             return null;
         return { ...batch, paths, changes };
     };
-    const addPendingWatcherChange = (changedRelPath, batch) => {
+    const addPendingWatcherChange = (changedRelPath, batch, options) => {
         if (batch) {
             const selectedBatch = selectWatchBatch(batch);
             if (!selectedBatch)
@@ -1293,20 +1500,30 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 return false;
             }
         }
-        pendingWatcherBatchGeneration ??= ++nextWatcherBatchGeneration;
         if (batch) {
+            const entries = [...batch.paths.entries()].filter(([absolutePath]) => {
+                const previousSequence = pendingWatcherChangeSequences.get(absolutePath);
+                return previousSequence === undefined ||
+                    options?.preserveChangesAfter === undefined ||
+                    previousSequence <= options.preserveChangesAfter;
+            });
+            if (entries.length === 0)
+                return false;
+            pendingWatcherBatchGeneration ??= ++nextWatcherBatchGeneration;
             pendingWatcherOriginalBatch =
                 pendingWatcherPaths.size === 0 &&
                     !pendingWatcherBareChange &&
                     !pendingWatcherOverflowed &&
-                    !batch.overflowed
+                    !batch.overflowed &&
+                    entries.length === batch.paths.size
                     ? batch
                     : null;
-            for (const [absolutePath, relativePath] of batch.paths.entries()) {
+            for (const [absolutePath, relativePath] of entries) {
                 pendingWatcherPaths.set(absolutePath, relativePath);
                 const change = batch.changes?.get(absolutePath);
                 if (change)
                     pendingWatcherChanges.set(absolutePath, change);
+                pendingWatcherChangeSequences.set(absolutePath, ++nextPendingWatcherChangeSequence);
             }
             if (batch.overflowed) {
                 pendingWatcherOverflowed = true;
@@ -1323,6 +1540,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             }
             return true;
         }
+        pendingWatcherBatchGeneration ??= ++nextWatcherBatchGeneration;
         if (changedRelPath) {
             pendingWatcherOriginalBatch = null;
             // Codec boundary: `changedRelPath` is a canonical vault key (the
@@ -1331,6 +1549,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             // point at the impossible colon path on Windows.
             const absolutePath = localPathForVaultKey(hqRoot, changedRelPath);
             pendingWatcherPaths.set(absolutePath, changedRelPath);
+            pendingWatcherChangeSequences.set(absolutePath, ++nextPendingWatcherChangeSequence);
             // A bare path signal carries no delete intent; drop any change record
             // a prior batch left for this path so the stale intent cannot leak
             // into the coalesced batch (#227).
@@ -1372,6 +1591,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         const generation = pendingWatcherBatchGeneration;
         pendingWatcherPaths.clear();
         pendingWatcherChanges.clear();
+        pendingWatcherChangeSequences.clear();
         pendingWatcherOriginalBatch = null;
         pendingWatcherBareChange = false;
         pendingWatcherWarmupCatchup = false;
@@ -1390,6 +1610,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         pendingWatcherOriginalBatch = null;
         for (const [absolutePath, relativePath] of paths.entries()) {
             pendingWatcherPaths.set(absolutePath, relativePath);
+            pendingWatcherChangeSequences.set(absolutePath, ++nextPendingWatcherChangeSequence);
         }
     };
     /**
@@ -1470,8 +1691,8 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         }
         return null;
     };
-    const journalCoordinates = (relativePath) => {
-        const route = routeChangeToTarget(relativePath);
+    const journalCoordinates = (relativePath, kind) => {
+        const route = routeChangeToTarget(relativePath, kind);
         if (!route || !isWatchRouteSelected(route, watchRouteSelection))
             return null;
         if (route.kind === "personal") {
@@ -1506,7 +1727,8 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             declaredSize >= 0) {
             return declaredSize;
         }
-        const size = journalRows(readJournal(coordinates.slug)).get(coordinates.key)?.size;
+        const size = journalRows(readJournalScoped(coordinates.slug, [coordinates.key]))
+            .get(coordinates.key)?.size;
         return typeof size === "number" && Number.isSafeInteger(size) && size >= 0 ? size : null;
     };
     /**
@@ -1553,8 +1775,8 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         return session.get(coordinates.key) === undefined;
     };
     const captureLocalDeleteSnapshots = (relativePath, kind) => {
-        const coordinates = journalCoordinates(relativePath);
-        const route = routeChangeToTarget(relativePath);
+        const coordinates = journalCoordinates(relativePath, kind);
+        const route = routeChangeToTarget(relativePath, kind);
         if (!coordinates || !route)
             return [];
         // Desktop workspace Off toggles are authoritative before journal I/O.
@@ -1675,8 +1897,8 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
      * it scopes a push or pull for the affected batch.
      */
     const captureQueuedLocalDeleteSnapshots = async (relativePath, kind, isCurrent) => {
-        const coordinates = journalCoordinates(relativePath);
-        const route = routeChangeToTarget(relativePath);
+        const coordinates = journalCoordinates(relativePath, kind);
+        const route = routeChangeToTarget(relativePath, kind);
         if (!coordinates || !route)
             return [];
         if (route.kind === "company" &&
@@ -1770,8 +1992,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         }
         return snapshots;
     };
-    const warmupJournalPaths = () => {
-        const paths = [];
+    const warmupJournalPaths = function* () {
         const journals = listJournals();
         const vaultJournalPresent = journals.some(({ slug }) => slug === PERSONAL_VAULT_JOURNAL_SLUG);
         for (const { slug, journal } of journals) {
@@ -1804,10 +2025,9 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 // ~12.8k of them per runner start after a transcript prune.
                 if (route.kind === "personal" && isPersonalVaultDeletionExcluded(key))
                     continue;
-                paths.push(route.kind === "personal" ? key : `companies/${route.slug}/${key}`);
+                yield route.kind === "personal" ? key : `companies/${route.slug}/${key}`;
             }
         }
-        return paths;
     };
     const publishedContentHashLookup = (relativePath) => {
         const coordinates = journalCoordinates(relativePath);
@@ -1820,13 +2040,34 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         return publishedContentHashFromJournalEntryBeforeSession(entry, serviceStartedAt);
     };
     const prepareWatcherChanges = (changes) => {
+        const keysByJournal = new Map();
+        const rememberKey = (slug, key) => {
+            const keys = keysByJournal.get(slug) ?? new Set();
+            keys.add(key);
+            keysByJournal.set(slug, keys);
+        };
+        for (const [absolutePath, change] of changes.entries()) {
+            if (change.kind === "unlink" || change.kind === "unlinkDir") {
+                for (const snapshot of change.deleteSnapshots ?? []) {
+                    rememberKey(snapshot.journalSlug, snapshot.journalPath);
+                }
+                continue;
+            }
+            const relativePath = path
+                .relative(hqRoot, absolutePath)
+                .split(path.sep)
+                .join("/");
+            const coordinates = journalCoordinates(relativePath);
+            if (coordinates)
+                rememberKey(coordinates.slug, coordinates.key);
+        }
         const journals = new Map();
         const dirty = new Set();
         const journalFor = (slug) => {
             const loaded = journals.get(slug);
             if (loaded)
                 return loaded;
-            const journal = readJournal(slug);
+            const journal = readJournalScoped(slug, [...(keysByJournal.get(slug) ?? [])]);
             journals.set(slug, journal);
             return journal;
         };
@@ -1884,7 +2125,8 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
     const groupBatchByRoute = (batch) => {
         const grouped = new Map();
         for (const [absolutePath, relativePath] of batch.paths.entries()) {
-            const route = routeChangeToTarget(relativePath);
+            const change = batch.changes?.get(absolutePath);
+            const route = routeChangeToTarget(relativePath, change?.kind);
             if (!route)
                 continue;
             const key = routeKey(route);
@@ -1897,7 +2139,6 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                     deleteScopeRoots: [],
                 };
             existing.paths.set(absolutePath, relativePath);
-            const change = batch.changes?.get(absolutePath);
             if (change)
                 existing.changes.set(absolutePath, change);
             existing.relPaths = [...new Set([...existing.paths.values()])];
@@ -1981,7 +2222,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         }
         return false;
     };
-    const runScopedDrain = async (batch, watcherBatchGeneration, wakeOnPushFailure = false) => {
+    const runScopedDrain = async (batch, watcherBatchGeneration, wakeOnPushFailure = false, allowFastRealtimeOvertake = false) => {
         if (batch)
             await resolveDeleteSnapshotCaptures(batch);
         const grouped = batch && batch.paths.size > 0 ? groupBatchByRoute(batch) : null;
@@ -2010,11 +2251,11 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                             const scopedArgv = buildScopedPushArgv(group.route, admittedPaths, passArgv, group.deleteScopeRoots);
                             return runGuarded(scopedArgv, admittedChanges.size > 0
                                 ? () => prepareWatcherChanges(admittedChanges)
-                                : undefined, lane);
+                                : undefined, lane, "realtime", allowFastRealtimeOvertake);
                         })
                         : { result: await runGuarded(buildScopedPushArgv(group.route, group.relPaths, passArgv, group.deleteScopeRoots), group.changes.size > 0
                                 ? () => prepareWatcherChanges(group.changes)
-                                : undefined, lane), accepted: true, coordinatorRefusedPaths: [] };
+                                : undefined, lane, "realtime", allowFastRealtimeOvertake), accepted: true, coordinatorRefusedPaths: [] };
                     const result = execution.result;
                     if (execution.accepted && passExitCode(result) === 0) {
                         const refusedPaths = new Set(typeof result === "number"
@@ -2084,8 +2325,8 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                     ? "fast"
                     : "slow";
                 const execution = parallelCoordinatorEnabled
-                    ? await runRealtimePass("watcher", "pull", group.relPaths, lane, (slice) => runGuarded(buildTargetedPullArgv(group.route, passArgv, slice.paths.map((path) => path.canonicalPath)), undefined, lane))
-                    : { result: await runGuarded(pullArgv, undefined, lane), accepted: true };
+                    ? await runRealtimePass("watcher", "pull", group.relPaths, lane, (slice) => runGuarded(buildTargetedPullArgv(group.route, passArgv, slice.paths.map((path) => path.canonicalPath)), undefined, lane, "realtime"))
+                    : { result: await runGuarded(pullArgv, undefined, lane, "realtime"), accepted: true };
                 const exit = execution.accepted ? passExitCode(execution.result) : 1;
                 if (exit !== 0 && worstExit === 0)
                     worstExit = exit;
@@ -2290,13 +2531,13 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                     return;
                 }
                 if (lanes?.fast &&
-                    activeSlowPass !== null) {
+                    (passScheduler.hasActiveChore || passScheduler.hasActiveSlowRealtime)) {
                     const generation = ++nextWatcherBatchGeneration;
                     // Fast dispatch bypasses the pending-batch ingress, so preserve both
                     // of its contracts here: only selected routes may run, and V2 sees
                     // the same dirty signal as the compatibility drain.
                     realtimeState.scheduler?.signal("watcher");
-                    void runScopedDrain(lanes.fast, generation, true).then((exit) => {
+                    void runScopedDrain(lanes.fast, generation, true, true).then((exit) => {
                         if (exit === 0)
                             return;
                         restorePendingWatcherPaths(lanes.fast.paths, generation);
@@ -2320,6 +2561,12 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                     interruptWait();
                 }
             });
+            try {
+                recoverHqRootLocalState(hqRoot);
+            }
+            catch (err) {
+                process.stderr.write(`hq-sync-runner: WARN local HQ recovery failed: ${describeError(err)}\n`);
+            }
             watcher.start();
             const reportWatcherReady = () => {
                 if (stopped || watcher === null)
@@ -2345,29 +2592,36 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 watcherRediscoveryRetries = 0;
                 process.stderr.write(`hq-sync-runner: event-push watcher active (watched-paths=${watchedPaths ?? "unknown"})\n`);
                 const startedAt = Date.now();
-                try {
-                    const catchup = watcher.collectWarmupCatchup?.(serviceStartedAt - WATCHER_WARMUP_SAFETY_MARGIN_MS, warmupJournalPaths());
-                    if (!catchup)
-                        return;
-                    const queued = addPendingWatcherChange(undefined, catchup.batch);
-                    pendingWatcherWarmupCatchup ||= queued;
-                    process.stderr.write(JSON.stringify({
-                        type: "watcher-warmup-catchup",
-                        reason: "watch-set-ready",
-                        pathsFound: catchup.batch.paths.size,
-                        scannedPaths: catchup.scannedPaths,
-                        elapsedMs: Date.now() - startedAt,
-                        queued,
-                    }) + "\n");
-                    if (queued)
+                const liveChangeSequenceAtWarmupStart = nextPendingWatcherChangeSequence;
+                void (async () => {
+                    try {
+                        const catchup = watcher?.collectWarmupCatchupAsync
+                            ? await watcher.collectWarmupCatchupAsync(serviceStartedAt - WATCHER_WARMUP_SAFETY_MARGIN_MS, warmupJournalPaths())
+                            : watcher?.collectWarmupCatchup?.(serviceStartedAt - WATCHER_WARMUP_SAFETY_MARGIN_MS, warmupJournalPaths());
+                        if (!catchup || catchup.cancelled || stopped || watcher === null)
+                            return;
+                        const queued = addPendingWatcherChange(undefined, catchup.batch, {
+                            preserveChangesAfter: liveChangeSequenceAtWarmupStart,
+                        });
+                        pendingWatcherWarmupCatchup ||= queued;
+                        process.stderr.write(JSON.stringify({
+                            type: "watcher-warmup-catchup",
+                            reason: "watch-set-ready",
+                            pathsFound: catchup.batch.paths.size,
+                            scannedPaths: catchup.scannedPaths,
+                            elapsedMs: Date.now() - startedAt,
+                            queued,
+                        }) + "\n");
+                        if (queued)
+                            interruptWait();
+                    }
+                    catch (err) {
+                        process.stderr.write(`hq-sync-runner: watcher warm-up catch-up failed: ${describeError(err)}\n`);
+                        // A scan failure must not silently extend the warm-up blind spot.
+                        pendingWatcherWarmupCatchupFailed = true;
                         interruptWait();
-                }
-                catch (err) {
-                    process.stderr.write(`hq-sync-runner: watcher warm-up catch-up failed: ${describeError(err)}\n`);
-                    // A scan failure must not silently extend the warm-up blind spot.
-                    pendingWatcherWarmupCatchupFailed = true;
-                    interruptWait();
-                }
+                    }
+                })();
             };
             if (watcher.onReady)
                 watcher.onReady(reportWatcherReady);
@@ -2415,7 +2669,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             // Submit every route in this lane before awaiting any result. In
             // particular, a later route's fast receipt must never wait for an
             // earlier route's slow pull to finish.
-            const completed = await Promise.all([...eventsByRoute.values()].map(({ route, events }) => runRealtimePass("receiver", "pull", events.map((event) => event.relativePath), lane, (slice) => runGuarded(buildTargetedPullArgv(route, passArgv, slice.paths.map((path) => path.canonicalPath)), undefined, lane))));
+            const completed = await Promise.all([...eventsByRoute.values()].map(({ route, events }) => runRealtimePass("receiver", "pull", events.map((event) => event.relativePath), lane, (slice) => runGuarded(buildTargetedPullArgv(route, passArgv, slice.paths.map((path) => path.canonicalPath)), undefined, lane, "realtime"))));
             for (const execution of completed) {
                 if (!execution.accepted || passExitCode(execution.result) !== 0) {
                     throw new Error(`targeted pull failed with exit code ${passExitCode(execution.result)}`);
@@ -2469,7 +2723,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 }
                 for (const { route, paths } of pathsByRoute.values()) {
                     const targetedArgv = buildTargetedPullArgv(route, passArgv, paths);
-                    const result = await runGuarded(targetedArgv, undefined, lane);
+                    const result = await runGuarded(targetedArgv, undefined, lane, "realtime");
                     if (passExitCode(result) !== 0) {
                         throw new Error(`targeted pull failed with exit code ${passExitCode(result)}`);
                     }
@@ -2517,14 +2771,14 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                             const execution = await runRealtimePass("wake", "pull", [], "slow", async () => runGuardedTask(() => runTaskWithLock(async () => {
                                 await drain();
                                 return 0;
-                            })));
+                            }, "realtime"), "slow", "realtime"));
                             outcome = execution.accepted ? execution.result : 1;
                         }
                         else {
                             outcome = await runGuardedTask(() => runTaskWithLock(async () => {
                                 await drain();
                                 return 0;
-                            }));
+                            }, "realtime"), "slow", "realtime");
                         }
                     }
                     catch (err) {
@@ -2720,8 +2974,8 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 targetedJournalSessions: () => targetedJournalSessionCensusSizes().targetedJournalSessions,
                 targetedJournalRows: () => targetedJournalSessionCensusSizes().targetedJournalRows,
                 cachedAreaJournalMigrations: () => journalCacheCensusSizes().cachedAreaJournalMigrations,
-                pendingSlowPasses: () => pendingSlowPasses.length,
-                pendingFastPasses: () => pendingFastPasses.length,
+                pendingSlowPasses: () => passScheduler.pendingLaneCount("slow"),
+                pendingFastPasses: () => passScheduler.pendingLaneCount("fast"),
             },
             eventSyncSizes: () => eventSync?.censusSizes?.(),
             watcherSizes: () => watcher?.censusSizes?.(),
@@ -2909,6 +3163,8 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             const watcherWarmupCatchup = pending.warmupCatchup;
             const watcherWarmupCatchupFailed = pending.warmupCatchupFailed;
             const overflowRoutesUnknown = pending.batch?.overflowed === true && !overflowWithKnownRoutes;
+            const coverageStale = rootCoverageStale;
+            rootCoverageStale = false;
             const scheduledInterval = fullReconcileIntervalMs === undefined
                 ? pollTick % FULL_RECONCILE_EVERY_TICKS === 0
                 : lastFullReconcileAt !== null &&
@@ -2922,6 +3178,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 "watcher-warmup-catch-up": watcherWarmupCatchup,
                 "watcher-warmup-catch-up-failed": watcherWarmupCatchupFailed,
                 "scheduled-interval": scheduledInterval,
+                "root-coverage-stale": coverageStale,
             };
             const reasons = Object.entries(triggers)
                 .filter(([, matched]) => matched)
@@ -2931,7 +3188,8 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 bareWake ||
                 overflowRoutesUnknown ||
                 watcherWarmupCatchupFailed ||
-                scheduledInterval;
+                scheduledInterval ||
+                coverageStale;
             // Size is not unknown-scope. A fully-enumerated over-limit batch still
             // has every path listed, so drain it in bounded chunks and keep the
             // remainder queued. Skip this when a genuine full-reconcile trigger
@@ -3071,11 +3329,14 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 quarantinedDeleteRoots.delete(root);
             }
             // Delete snapshot capture needs a fresh keyed view while an episode is
-            // being assembled, but completed watch cycles do not. Releasing it here
-            // prevents the watcher from retaining another full-vault projection next
-            // to the targeted-pull and area-ledger views.
+            // being assembled, but completed watch cycles do not. Area-authoritative
+            // journals are different: their bridge owns the packed aggregate that a
+            // later watcher callback reuses. Dropping that bridge at every poll
+            // makes the next scoped callback synchronously re-pack the whole vault.
+            // Keep it for this runner's lifetime; layout/phase changes still close
+            // it in openAreaMigrationIfAuthoritative(), and final shutdown releases
+            // every bridge below.
             releaseWatcherJournalStores();
-            releaseCachedAreaJournalMigrations();
             const exitCode = passExitCode(result);
             if (exitCode === runtime.authRequiredPassExit) {
                 // The pass already emitted auth-error. Hand the sentinel to the
@@ -3110,8 +3371,19 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                         : "") +
                     "; staying alive, retrying next poll\n");
             }
+            else if (exitCode === UNRESOLVED_COMPANY_EXIT) {
+                // HQ-SYNC-COMPANY-ROUTE-UID: routed paths are derived from local
+                // company directory names, which may not be memberships. The runner
+                // has already emitted the resolution error; terminating here would
+                // restart the outpost watcher every 60 seconds for each such route.
+                // Keep the watcher alive while preserving the one-shot non-zero code.
+                process.stderr.write("hq-sync-runner: watch pass skipped — unresolved company target; retrying next poll\n");
+            }
             else if (exitCode !== 0) {
-                return exitCode;
+                // A scoped company-resolution or per-pass failure is isolated to that
+                // pass. The error was emitted by the runner; terminating the daemon
+                // recreates the startup blind window and strands newer watcher work.
+                process.stderr.write(`hq-sync-runner: watch pass failed (exit=${exitCode}); staying alive, retrying next poll\n`);
             }
             const completedPostRepairPass = !enqueuedFullChore && (typeof result === "number"
                 ? exitCode === 0
@@ -3215,6 +3487,10 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         releaseWatcherJournalStores();
         releaseCachedAreaJournalMigrations();
         await shutdown();
+        // Coordinator shutdown waits for any active pass before the retained
+        // projections are dropped. A shutdown must never evict a store that a
+        // final scoped writer is still refreshing or committing through.
+        disposeScopedJournalStores();
         detachSignal?.();
     }
 }