@indigoai-us/hq-cli 5.109.12 → 5.109.14

package/CHANGELOG.md

@@ -2,6 +2,44 @@
 
 ## [Unreleased]
 
+## [5.109.14] — 2026-09-13
+
+### Fixed
+
+- Repeated "install tree was being rewritten" reports from a background reinstall
+  now collapse into one stable issue per outcome instead of spawning a fresh crash
+  report on every occurrence (Sentry HQ-CLI-21, HQ-CLI-22, HQ-CLI-23). hq already
+  groups these by their recovery outcome, but the grouping key led with a
+  placeholder that also told Sentry to fold in its own default grouping — and for
+  this error that default is the underlying loader failure, whose details differ
+  every time (which dependency file the reinstall happened to be rewriting, under
+  each machine's install path). So each occurrence minted a new issue and the
+  family never settled down. The key is now fully explicit and no longer inherits
+  that default, so future occurrences with the same outcome share one group. The
+  existing issues HQ-CLI-21/22/23 stay open as they are: a grouping change only
+  affects events reported after it ships.
+
+## [5.109.13] — 2026-09-13
+
+### Fixed
+
+- A background reinstall no longer turns into a crash report in the CommonJS twin
+  of the shape 5.109.12 fixed for ES modules (HQ-CLI-20). When another program
+  reinstalls hq globally while a command is starting, it rewrites hq's files one
+  by one over a few seconds. If a bundled CommonJS dependency (here `ajv`, reached
+  while `hq core timeout-guard` registers its commands) had just resolved one of
+  its own files and that file vanished before Node read it, the low-level `ENOENT …
+  open` came from inside Node's CommonJS module loader — a shape the recovery only
+  recognized for ES modules, so it was still filed as a crash. It is now recognized
+  as "your install was mid-update, not an hq bug": the command waits for the
+  reinstall to settle and re-runs once on the healed tree, and the same noise is
+  dropped on the routes that bypass the top-level handler. The gate is deliberately
+  narrow — it fires only when Node's own loader was reading a module's source (the
+  frame directly beneath the file read is a `cjs/loader` frame, never the
+  dependency's own code) — so a third-party package whose own startup code reads a
+  missing file, or a fault in hq's own shipped files, still reports exactly once
+  (Sentry HQ-CLI-20).
+
 ## [5.109.12] — 2026-09-12
 
 ### Fixed

package/dist/main.js

@@ -565,8 +565,9 @@ export async function handleTopLevelError(err, deps = defaultTopLevelErrorDepend
         // install left a bundled file unwritten (HQ-CLI-1N, a CJS relative-sibling
         // MODULE_NOT_FOUND; HQ-CLI-1Q, a CJS BARE-specifier MODULE_NOT_FOUND for a
         // dependency the requiring third-party package's own manifest declares), or
-        // a concurrent global install rewrote the running tree so an ESM module
-        // present at resolve was gone at read (HQ-CLI-1M, an esm-loader ENOENT).
+        // a concurrent global install rewrote the running tree so a module present
+        // at resolve was gone at read (HQ-CLI-1M, an esm-loader ENOENT; HQ-CLI-20,
+        // its CJS loader-read twin).
         // All carry no hq-cli frames and reached the final else, filing a bare
         // crash and an unactionable line. An incomplete install is the caller's
         // machine, the disposition HQ-CLI-Y already established for the qmd CHILD —
@@ -574,11 +575,12 @@ export async function handleTopLevelError(err, deps = defaultTopLevelErrorDepend
         // environmental family (after the typed qmd carriers and the hq state-write
         // carrier, before environmentalFsErrorMessage): the signatures are disjoint
         // — ENVIRONMENTAL_FS_CODES is only ENOSPC/EDQUOT/EROFS (never
-        // ENOENT/MODULE_NOT_FOUND), no qmd carrier sets requireStack or an
-        // esm-loader frame, and the classified file must sit under
-        // <packageRoot>/node_modules — so ordering changes nothing that exists. The
+        // ENOENT/MODULE_NOT_FOUND), no qmd carrier sets requireStack or a loader
+        // source-read frame (esm/load or cjs/loader), and the classified file must
+        // sit under <packageRoot>/node_modules — so ordering changes nothing that
+        // exists. The
         // UNATTRIBUTABLE shapes are deliberately NOT suppressed and are captured
-        // WITH bounded context on the generic path below: an esm-loader ENOENT
+        // WITH bounded context on the generic path below: a loader/resolver ENOENT
         // whose path did not survive, and a bare miss the requirer does NOT declare
         // (a possible undeclared/peer dependency, now named in the context).
         const incompleteInstallMsg = qmdMsg || collectionMsg || terminatedMsg || llmDisabledMsg || moduleMissingMsg || storeMissingMsg || storeUnopenableMsg || queryDocumentMsg || modelDownloadMsg || workdirMissingMsg || stateWriteMsg
@@ -679,9 +681,10 @@ export async function handleTopLevelError(err, deps = defaultTopLevelErrorDepend
             // A genuinely unclassified fault is still captured exactly once. Two
             // shapes attach bounded, hq-derived context so the next occurrence
             // carries the evidence this one lacked: a qmd spawn-level failure the fix
-            // could not attribute (HQ-CLI-1A), and an esm-loader ENOENT whose path
-            // did not survive delivery (HQ-CLI-1M — the unattributable incomplete-
-            // install shape). Every other error captures bare, exactly as before.
+            // could not attribute (HQ-CLI-1A), and a loader/resolver ENOENT whose path
+            // did not survive delivery (HQ-CLI-1M esm-load, HQ-CLI-1S resolve-time,
+            // HQ-CLI-20 CJS load-time — the unattributable incomplete-install shape).
+            // Every other error captures bare, exactly as before.
             const spawnContext = qmdSpawnFailureCaptureContext(err);
             const installContext = incompleteInstallCaptureContext(err);
             if (spawnContext || installContext) {

package/dist/sentry.js

@@ -37,7 +37,9 @@ export function epipeAwareBeforeSend(event, hint) {
     // (HQ-CLI-1N, a CJS relative-sibling MODULE_NOT_FOUND under its bundled
     // node_modules; HQ-CLI-1Q, a CJS BARE-specifier MODULE_NOT_FOUND the requiring
     // third-party package's own manifest declares; HQ-CLI-1M, an esm-loader ENOENT
-    // for a file present at resolve and gone at read). handleTopLevelError already
+    // for a file present at resolve and gone at read; HQ-CLI-20, its CJS loader-read
+    // twin — a bundled CJS dep gone between resolve and the loader's source read).
+    // handleTopLevelError already
     // prints the reinstall remedy for the top-level route; dropping the event here
     // suppresses the fatal regardless of route — the unhandled-rejection boundary,
     // the command-level captureException sites, and bin/hq-auth-refresh —
@@ -50,7 +52,7 @@ export function epipeAwareBeforeSend(event, hint) {
     if (incompleteInstallMessage(hint?.originalException))
         return null;
     // An incomplete-install shape that is NOT suppressed (a bare miss the requirer
-    // does not declare, or a path-less esm-loader ENOENT) should still arrive
+    // does not declare, or a path-less loader/resolver ENOENT) should still arrive
     // ATTRIBUTABLE on every capture route, not only the top-level boundary:
     // handleTopLevelError in main.ts is the ONLY caller of
     // incompleteInstallCaptureContext, so events reaching this hook directly — the

package/dist/utils/incomplete-install-error.d.ts

@@ -50,6 +50,8 @@ export type IncompleteInstallEsmDiagnostics = {
     esmLoaderFrame: boolean;
     /** The stack carried a module-resolver frame — the HQ-CLI-1S resolve-time route. */
     resolverFrame: boolean;
+    /** The stack carried a CJS loader (source-read) frame — the HQ-CLI-20 route. */
+    cjsLoaderFrame: boolean;
     code: string;
 };
 /**
@@ -119,9 +121,10 @@ export type IncompleteInstallDiagnostics = Partial<IncompleteInstallEsmDiagnosti
  *     (HQ-CLI-1N) → { code, relativeSpecifier:true, packageRoot,
  *     packageRootResolved, resolver, requirerScope };
  *   - a loader/resolver ENOENT whose path did not survive delivery (HQ-CLI-1M
- *     esm-load open, HQ-CLI-1S resolve-time lstat) — where neither the exception
- *     value nor node_system_error carried a `path` → { packageRoot,
- *     packageJsonExists, nodeModulesExists, esmLoaderFrame, resolverFrame, code };
+ *     esm-load open, HQ-CLI-1S resolve-time lstat, HQ-CLI-20 CJS load-time open) —
+ *     where neither the exception value nor node_system_error carried a `path` →
+ *     { packageRoot, packageJsonExists, nodeModulesExists, esmLoaderFrame,
+ *     resolverFrame, cjsLoaderFrame, code };
  *   - a module-EVALUATION throw that reached the boundary raw (HQ-CLI-1T) →
  *     { evalThrow, errorName, throwSitePackage, packageRoot, packageRootResolved,
  *     resolver }.

package/dist/utils/incomplete-install-error.js

@@ -7,7 +7,7 @@
 // failure inside THIS process rather than a qmd child's captured stderr, which
 // is the gap HQ-CLI-Y's classifier cannot cover.
 //
-// Three shapes, one cause — a partial/interrupted global install left a file
+// Four shapes, one cause — a partial/interrupted global install left a file
 // unwritten, or a concurrent global install rewrote the running tree
 // underneath a command:
 //
@@ -36,6 +36,14 @@
 //   ERR_MODULE_NOT_FOUND at resolve, never ENOENT at load; an ENOENT at load
 //   proves the file vanished between resolve and read.
 //
+//   HQ-CLI-20 (Sentry 7724280783) — CJS load, in-process. The CJS twin of
+//   HQ-CLI-1M: `hq core timeout-guard` registers the full command graph, which
+//   reaches a bundled CommonJS dependency (ajv) whose internal require() resolved
+//   a sibling from Module._pathCache and then read its source after a concurrent
+//   reinstall had vanished it. Node raised `ENOENT` with syscall 'open' from the
+//   CJS loader's source read (defaultLoadImpl/loadSource) — a cjs/loader frame but
+//   NO esm/load frame, so the esm-loader gate missed it and it filed a bare crash.
+//
 // All shapes carry no hq-cli frames, reach the boundary's final `else`, and —
 // before this classifier — filed a bare captureException plus an unactionable
 // `hq: <fallback>` line. The disposition is the one HQ-CLI-Y already
@@ -59,12 +67,15 @@
 //      optional-dependency miss (not guaranteed installed), and an undeclared or
 //      peer-only miss (`Cannot find module 'mqtt'` from a requirer that does not
 //      declare it) all stay loud — the last two enriched with both package names.
-//   3. The ESM shape additionally requires an esm-loader frame — an ordinary
-//      `fs.readFileSync` ENOENT written by hq's own code stays captured.
+//   3. The loader shapes additionally require a loader SOURCE-READ frame — the ESM
+//      shape an `esm/load` frame, the CJS shape (HQ-CLI-20) a cjs/loader frame
+//      immediately beneath the node:fs read. An ordinary `fs.readFileSync` ENOENT
+//      written by hq's own code, or one escaping a third-party module's own
+//      EVALUATION, carries no such frame and stays captured.
 import * as fs from "fs";
 import * as path from "path";
 import { packageRoot, stringDerivedPackageRoot } from "./hq-roots.js";
-import { evalThrowShape, packageNameOf } from "./install-tree-torn.js";
+import { evalThrowShape, hasCjsLoaderSourceReadFrame, packageNameOf } from "./install-tree-torn.js";
 import { boundedDiagnosticValue } from "./package-root-diagnostics.js";
 /**
  * The actionable remedy shown to the operator. Input-free — nothing from the
@@ -348,6 +359,25 @@ function isResolveEnoent(err) {
         record.syscall === "lstat" &&
         hasResolverFrame(record.stack));
 }
+/** True when `stack` is a CJS loader SOURCE-READ stack (HQ-CLI-20). */
+function hasCjsLoaderFrame(stack) {
+    return typeof stack === "string" && hasCjsLoaderSourceReadFrame(stack);
+}
+/**
+ * The CJS loader-read ENOENT SIGNATURE (HQ-CLI-20): `code === 'ENOENT'`,
+ * `syscall === 'open'`, and a CJS loader SOURCE-READ stack (the positional gate
+ * shared from install-tree-torn.ts) — the CJS twin of {@link isEsmLoaderEnoent},
+ * independent of whether a usable `path` survived. The message classifier
+ * additionally requires a `path` under node_modules.
+ */
+function isCjsLoaderEnoent(err) {
+    if (err === null || typeof err !== "object")
+        return false;
+    const record = err;
+    return (record.code === "ENOENT" &&
+        record.syscall === "open" &&
+        hasCjsLoaderFrame(record.stack));
+}
 /**
  * If `err` is an in-process incomplete-install module-load failure — the CJS
  * relative-sibling shape (HQ-CLI-1N), the ESM vanished-at-read shape (HQ-CLI-1M),
@@ -421,6 +451,17 @@ export function incompleteInstallMessage(err, resolvePackageRoot = safePackageRo
         hasResolverFrame(record.stack)) {
         return isUnderNodeModules(record.path, root) ? INCOMPLETE_INSTALL_REMEDY : null;
     }
+    // Shape B'' (CJS load-time, HQ-CLI-20): the CJS twin of Shape B — an ENOENT from
+    // the CJS loader's source read (syscall 'open' + a CJS loader SOURCE-READ stack,
+    // NO esm/load frame) for a bundled dependency file present at resolve and gone at
+    // read. Same disposition as B: a vanished file under the running install's
+    // node_modules is a torn install, so print the remedy and skip capture; a miss
+    // under the install's own dist/ or assets/ stays captured.
+    if (record.syscall === "open" &&
+        typeof record.path === "string" &&
+        hasCjsLoaderFrame(record.stack)) {
+        return isUnderNodeModules(record.path, root) ? INCOMPLETE_INSTALL_REMEDY : null;
+    }
     return null;
 }
 /** A readFileSync surface, defaulting to the real fs when the caller injects none. */
@@ -550,9 +591,10 @@ function relativeSpecifierCaptureContext(err, resolvePackageRoot, fileSystem) {
  *     (HQ-CLI-1N) → { code, relativeSpecifier:true, packageRoot,
  *     packageRootResolved, resolver, requirerScope };
  *   - a loader/resolver ENOENT whose path did not survive delivery (HQ-CLI-1M
- *     esm-load open, HQ-CLI-1S resolve-time lstat) — where neither the exception
- *     value nor node_system_error carried a `path` → { packageRoot,
- *     packageJsonExists, nodeModulesExists, esmLoaderFrame, resolverFrame, code };
+ *     esm-load open, HQ-CLI-1S resolve-time lstat, HQ-CLI-20 CJS load-time open) —
+ *     where neither the exception value nor node_system_error carried a `path` →
+ *     { packageRoot, packageJsonExists, nodeModulesExists, esmLoaderFrame,
+ *     resolverFrame, cjsLoaderFrame, code };
  *   - a module-EVALUATION throw that reached the boundary raw (HQ-CLI-1T) →
  *     { evalThrow, errorName, throwSitePackage, packageRoot, packageRootResolved,
  *     resolver }.
@@ -570,11 +612,12 @@ export function incompleteInstallCaptureContext(err, resolvePackageRoot = safePa
     const relative = relativeSpecifierCaptureContext(err, resolvePackageRoot, fileSystem);
     if (relative)
         return relative;
-    // (C) HQ-CLI-1M / HQ-CLI-1S — the path-less loader/resolver ENOENT, made
-    // attributable. An ENOENT whose `path` survived and sits under node_modules is
-    // classified and printed above, never captured; only the unattributable shape
-    // (no usable path, or a path outside node_modules) reaches here.
-    if (isEsmLoaderEnoent(err) || isResolveEnoent(err)) {
+    // (C) HQ-CLI-1M / HQ-CLI-1S / HQ-CLI-20 — the path-less loader/resolver ENOENT
+    // (esm-load open, resolve-time lstat, or CJS load-time open), made attributable.
+    // An ENOENT whose `path` survived and sits under node_modules is classified and
+    // printed above, never captured; only the unattributable shape (no usable path,
+    // or a path outside node_modules) reaches here.
+    if (isEsmLoaderEnoent(err) || isResolveEnoent(err) || isCjsLoaderEnoent(err)) {
         if (incompleteInstallMessage(err, resolvePackageRoot, readFileFrom(fileSystem)) === null) {
             const record = err;
             const code = typeof record.code === "string" ? record.code : "";
@@ -593,9 +636,11 @@ export function incompleteInstallCaptureContext(err, resolvePackageRoot = safePa
                 packageRootResolved: root !== null,
                 resolver: resolution.source,
                 // Which route raised it — the esm-loader (source-read) frame for 1M, the
-                // resolver frame for 1S; either or both are recorded from the stack.
+                // resolver frame for 1S, the CJS loader source-read frame for HQ-CLI-20;
+                // any are recorded from the stack.
                 esmLoaderFrame: hasEsmLoaderFrame(record.stack),
                 resolverFrame: hasResolverFrame(record.stack),
+                cjsLoaderFrame: hasCjsLoaderFrame(record.stack),
                 code: boundedDiagnosticValue(code, CODE_DIAGNOSTIC_BYTES),
             };
             // Report the existence booleans ONLY when a root was resolved. Reported for

package/dist/utils/install-tree-torn.d.ts

@@ -32,9 +32,10 @@
 /**
  * The loader-error `code`s recovery classifies. The first two mean "a module
  * could not be resolved"; `ENOENT` is the loader/resolver dialect where a module
- * was present at one step and gone at the next (HQ-CLI-1M esm-load open, HQ-CLI-1S
- * resolve-time lstat); `EVAL_THROW` is the synthetic code for a module-EVALUATION
- * throw that carries NO real `code` (HQ-CLI-1T) — see {@link ModuleErrorDialect}.
+ * was present at one step and gone at the next (HQ-CLI-1M esm-load open, HQ-CLI-20
+ * cjs-load open, HQ-CLI-1S resolve-time lstat); `EVAL_THROW` is the synthetic code
+ * for a module-EVALUATION throw that carries NO real `code` (HQ-CLI-1T) — see
+ * {@link ModuleErrorDialect}.
  */
 export type ModuleNotFoundCode = "ERR_MODULE_NOT_FOUND" | "MODULE_NOT_FOUND" | "ENOENT" | "EVAL_THROW";
 /**
@@ -56,6 +57,13 @@ export type ModuleNotFoundCode = "ERR_MODULE_NOT_FOUND" | "MODULE_NOT_FOUND" | "
  *   - `esm-enoent`:  ESM loader ENOENT (HQ-CLI-1M) — a module present at RESOLVE
  *                    and gone at READ, so getSourceSync/openSync raises ENOENT
  *                    (not ERR_MODULE_NOT_FOUND). `err.path` is the vanished file.
+ *   - `cjs-enoent`:  CJS loader ENOENT (HQ-CLI-20) — the CJS twin of esm-enoent: a
+ *                    require() whose target was present at RESOLVE (its filename
+ *                    held in Module._pathCache) and gone at READ, so the CJS
+ *                    loader's source read (defaultLoadImpl/loadSource, or the older
+ *                    Module._extensions..js handler) raises ENOENT with syscall
+ *                    'open' and a cjs/loader frame but NO esm/load frame. `err.path`
+ *                    is the vanished file.
  *   - `resolve-enoent`: ESM/CJS RESOLVE-time ENOENT (HQ-CLI-1S) — a path component
  *                    stat'ed OK, then vanished before realpathSync's lstat, so the
  *                    resolver (finalizeResolution / Module._findPath→toRealPath)
@@ -69,7 +77,7 @@ export type ModuleNotFoundCode = "ERR_MODULE_NOT_FOUND" | "MODULE_NOT_FOUND" | "
  *   - `unknown`:     a module-not-found whose message did not parse; recovery
  *                    still waits on the lock / retired-dir / quiet signals.
  */
-export type ModuleErrorDialect = "esm-path" | "esm-package" | "cjs-path" | "cjs-package" | "cjs-relative" | "esm-enoent" | "resolve-enoent" | "eval-throw" | "unknown";
+export type ModuleErrorDialect = "esm-path" | "esm-package" | "cjs-path" | "cjs-package" | "cjs-relative" | "esm-enoent" | "cjs-enoent" | "resolve-enoent" | "eval-throw" | "unknown";
 /**
  * The missing thing, re-resolvable by the readiness probe:
  *   - `path`:     an absolute filesystem path (a `.js` file, or a package dir).
@@ -115,6 +123,7 @@ export interface ClassifiedModuleError {
     /** The thrown error's `name` for the eval-throw dialect (HQ-CLI-1T), else absent. */
     errorName?: string;
 }
+export declare function hasCjsLoaderSourceReadFrame(stack: string): boolean;
 /**
  * Reduce a bare specifier to its PACKAGE name: `@scope/name/sub` → `@scope/name`,
  * `name/sub` → `name`, `name` → `name`. This is the unit the readiness probe

package/dist/utils/install-tree-torn.js

@@ -82,6 +82,51 @@ const ESM_EVAL_FRAME = /node:internal[\\/]modules[\\/]esm[\\/]module_job\b/;
 function hasModuleEvalFrame(stack) {
     return CJS_EVAL_FRAME.test(stack) || ESM_EVAL_FRAME.test(stack);
 }
+/**
+ * The Node CJS loader's SOURCE-READ position (HQ-CLI-20) — the CJS twin of
+ * {@link ESM_LOADER_FRAME}. A CJS require whose target was present at RESOLVE (its
+ * filename cached in Module._pathCache) and gone at READ fails inside the loader's
+ * source read: `readFileSync (node:fs)` called by `defaultLoadImpl`/`loadSource`
+ * (Node ≥22) or, on older Node, the `Module._extensions..js` extension handler —
+ * all frames in `node:internal/modules/cjs/loader`, and (unlike HQ-CLI-1M) with NO
+ * `esm/load` frame.
+ *
+ * The discriminator is POSITIONAL: the innermost `node:fs` read frame's
+ * IMMEDIATELY-following (caller) frame must be a cjs/loader frame that is NOT a
+ * module-EVALUATION frame (Module._compile / wrapSafe). That is what proves the
+ * LOADER was reading the module's source. An ordinary `fs.readFileSync`/`openSync`
+ * ENOENT that merely ESCAPES a third-party module's own EVALUATION has the
+ * third-party FILE directly beneath `node:fs`, not a cjs/loader frame, so it stays
+ * captured (both shapes reproduced frame-for-frame on Node v22.23.1). The
+ * positional rule is the PRIMARY discriminator; the source-read helper NAMES are
+ * an accepted closed set, not the sole requirement, so a renamed helper still
+ * classifies.
+ *
+ * The whole-stack presence of Module._compile is deliberately NOT a rejection
+ * signal: under a raised Error.stackTraceLimit the torn shape ALSO carries the
+ * requiring module's own Module._compile frame — always at depth 11, past the
+ * default limit of 10 — so only the frame immediately beneath the node:fs read is
+ * consulted. Exported so incomplete-install-error.ts (which already imports from
+ * this module) shares the exact gate rather than duplicating the positional logic,
+ * mirroring how {@link evalThrowShape} and {@link packageNameOf} are shared.
+ */
+const NODE_FS_READ_FRAME = /^at (?:[\w$.]+\.)?(?:readFileSync|openSync) \(node:fs\b/;
+const CJS_LOADER_FRAME = /node:internal[\\/]modules[\\/]cjs[\\/]loader\b/;
+export function hasCjsLoaderSourceReadFrame(stack) {
+    const frames = stack
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith("at "));
+    for (let i = 0; i < frames.length; i++) {
+        if (!NODE_FS_READ_FRAME.test(frames[i]))
+            continue;
+        const caller = frames[i + 1];
+        if (caller === undefined)
+            return false;
+        return CJS_LOADER_FRAME.test(caller) && !CJS_EVAL_FRAME.test(caller);
+    }
+    return false;
+}
 /**
  * A stack LOCATION token — the absolute filesystem path in either an
  * `at <fn> (<abs>:L:C)` frame or a bare `<abs>:L` header line (the source
@@ -214,6 +259,31 @@ export function classifyModuleNotFound(err) {
                 target: { kind: "path", path: record.path },
             };
         }
+        // cjs-loader source-read ENOENT (HQ-CLI-20): the CJS twin of esm-enoent — a
+        // require() whose target was present at RESOLVE (its filename held in
+        // Module._pathCache) and gone at READ, so the CJS loader's source read raises
+        // ENOENT with syscall 'open' and a cjs/loader frame but NO esm/load frame
+        // (which is why arm (0) missed it and classifyModuleNotFound returned null,
+        // filing the bare HQ-CLI-20 capture). Gated on the FULL conjunction — code
+        // ENOENT AND syscall 'open' AND a string path AND the POSITIONAL CJS
+        // source-read gate — so a third-party module's own top-level fs.readFileSync
+        // ENOENT (module EVALUATION, its own frame directly beneath node:fs) stays null
+        // and keeps its capture. Ordered AFTER the esm-enoent arm so HQ-CLI-1M keeps
+        // its byte-for-byte classification. Target 'path': the vanished file is a
+        // regular .js/.json file Node's CJS LOAD_AS_FILE step re-resolves, so the probe
+        // and settle wait reuse the same machinery as esm-enoent, unchanged.
+        if (record.syscall === "open" &&
+            typeof record.path === "string" &&
+            typeof record.stack === "string" &&
+            hasCjsLoaderSourceReadFrame(record.stack)) {
+            return {
+                code,
+                dialect: "cjs-enoent",
+                specifier: record.path,
+                importer: "",
+                target: { kind: "path", path: record.path },
+            };
+        }
         // resolve-time ENOENT (HQ-CLI-1S): Node's resolver stat'ed a path OK, then
         // realpathSync lstat'ed a component that a concurrent reinstall renamed away
         // between the two, throwing ENOENT with syscall `lstat` from a RESOLVER frame

package/dist/utils/sentry-fingerprint.d.ts

@@ -3,11 +3,16 @@
  * carries no discriminator from the closed allowlist (in which case the caller
  * must leave the fingerprint unset so Sentry's default grouping applies).
  *
- * The shape is always `[DEFAULT_GROUPING, errorName, discriminator]`:
+ * For the rpc/http carriers the shape is `[DEFAULT_GROUPING, errorName,
+ * discriminator]`:
  *   - a numeric `rpcCode` (only the gateway's IntegrationsCliError carries one)
  *     yields `rpc:<code>` for a known code, else `rpc:other`;
  *   - otherwise a numeric HTTP `status` yields `http:<status>` for a known
  *     status, else `http:other`.
+ * The InstallTreeTornError branch is the deliberate exception: it returns a
+ * fully explicit `["InstallTreeTornError", "outcome:<token>"]` with NO
+ * DEFAULT_GROUPING lead, because its chained loader cause makes the default
+ * component unbounded (see the module header — HQ-CLI-21/22/23).
  *
  * `rpcCode` is checked first so a gateway JSON-RPC fault groups by its protocol
  * code; the two carriers are disjoint in practice (the JSON-RPC throw site sets

package/dist/utils/sentry-fingerprint.js

@@ -16,12 +16,33 @@
 // bucket destroys the regression watermark for every lane keyed on the issue.
 //
 // The remedy is a client-side fingerprint that SPLITS by a bounded machine
-// discriminator while preserving Sentry's default grouping. The returned array
-// leads with the `{{ default }}` placeholder (Sentry expands it to the normal
-// stack-based grouping hash) and appends the error's own name plus a single
-// discriminator token drawn from a finite set — so genuinely different failure
-// classes form distinct, PREDICTABLE groups, and everything else is left to
-// default grouping untouched.
+// discriminator. Two shapes are used, and the difference between them is
+// load-bearing — it is the lesson HQ-CLI-21/22/23 taught:
+//
+//   - MOST branches (qmd, rpc, http) LEAD the array with the `{{ default }}`
+//     placeholder, then append the error's own name plus one discriminator token
+//     from a finite set. Sentry expands `{{ default }}` into the event's default
+//     grouping component and SALTS the appended tokens with it, so the key is only
+//     as bounded as that default component. For those carriers that is fine: they
+//     are thrown from hq-cli's own code with no chained third-party cause, so
+//     their default component is itself bounded.
+//
+//   - The InstallTreeTornError branch must NOT lead with the placeholder. Its
+//     carrier wraps a CHAINED loader failure whose stack differs on every
+//     occurrence — whichever dependency file a concurrent global reinstall was
+//     mid-rewrite, under each machine's absolute install path — so its default
+//     component is UNBOUNDED. Leading with `{{ default }}` salted the bounded
+//     `outcome:` key with that unbounded component and minted a brand-new Sentry
+//     issue per occurrence: three events carrying the byte-identical array
+//     ["{{ default }}", "InstallTreeTornError", "outcome:unsettled"] still landed
+//     in three different groups (hashes a4289a5e530e166ebdedea9d34dcad0a,
+//     b563c1b891bd975bdc605efc86034b44, b4ee254473ea249758617de1a98848fa —
+//     HQ-CLI-21/22/23). So that branch returns a FULLY EXPLICIT key with no
+//     default lead: ["InstallTreeTornError", "outcome:<token>"].
+//
+// Genuinely different failure classes therefore form distinct, PREDICTABLE
+// groups, and everything with no bounded discriminator is left to default
+// grouping untouched.
 //
 // Two hard rules, mirroring HQ-CLI-S:
 //   1. CLOSED ALLOWLIST. The discriminator is one of a finite set of known
@@ -169,11 +190,16 @@ function qmdDispositionToken(status, signal) {
  * carries no discriminator from the closed allowlist (in which case the caller
  * must leave the fingerprint unset so Sentry's default grouping applies).
  *
- * The shape is always `[DEFAULT_GROUPING, errorName, discriminator]`:
+ * For the rpc/http carriers the shape is `[DEFAULT_GROUPING, errorName,
+ * discriminator]`:
  *   - a numeric `rpcCode` (only the gateway's IntegrationsCliError carries one)
  *     yields `rpc:<code>` for a known code, else `rpc:other`;
  *   - otherwise a numeric HTTP `status` yields `http:<status>` for a known
  *     status, else `http:other`.
+ * The InstallTreeTornError branch is the deliberate exception: it returns a
+ * fully explicit `["InstallTreeTornError", "outcome:<token>"]` with NO
+ * DEFAULT_GROUPING lead, because its chained loader cause makes the default
+ * component unbounded (see the module header — HQ-CLI-21/22/23).
  *
  * `rpcCode` is checked first so a gateway JSON-RPC fault groups by its protocol
  * code; the two carriers are disjoint in practice (the JSON-RPC throw site sets
@@ -214,8 +240,22 @@ export function sentryFingerprintFor(err) {
     }
     // A torn-install failure carries neither an rpcCode nor an HTTP status; its
     // only bounded discriminator is the recovery `diagnostics.outcome`. Keyed
-    // BEFORE the rpc/status branches so the family groups into ≤4 predictable issues
-    // (guarded / unsettled / reexec-failed / lock-held) rather than one fungible bucket.
+    // BEFORE the rpc/status branches so the family groups into a bounded set of
+    // predictable issues (guarded / unsettled / reexec-failed / lock-held, plus the
+    // `outcome:other` fallback) rather than one fungible bucket.
+    //
+    // The key is FULLY EXPLICIT — it does NOT lead with DEFAULT_GROUPING. Leading
+    // with the placeholder salts the appended tokens with Sentry's default grouping
+    // component, and THIS carrier's default component is UNBOUNDED: it wraps a
+    // chained loader cause whose stack differs on every occurrence (the dependency
+    // file a concurrent global reinstall was mid-rewrite, under each machine's
+    // absolute install path). With the placeholder lead, three events carrying the
+    // byte-identical array ["{{ default }}", "InstallTreeTornError",
+    // "outcome:unsettled"] still split into three Sentry groups —
+    // a4289a5e530e166ebdedea9d34dcad0a, b563c1b891bd975bdc605efc86034b44 and
+    // b4ee254473ea249758617de1a98848fa (HQ-CLI-21/22/23) — defeating the very bound
+    // this branch exists to enforce. The explicit key collapses them to one stable
+    // group per outcome, independent of machine, install path and which module tore.
     if (rawName === "InstallTreeTornError") {
         const diagnostics = record.diagnostics;
         const outcome = diagnostics !== null && typeof diagnostics === "object"
@@ -224,7 +264,7 @@ export function sentryFingerprintFor(err) {
         const token = typeof outcome === "string" && KNOWN_INSTALL_TREE_OUTCOMES.has(outcome)
             ? `outcome:${outcome}`
             : "outcome:other";
-        return [DEFAULT_GROUPING, "InstallTreeTornError", token];
+        return ["InstallTreeTornError", token];
     }
     const name = KNOWN_ERROR_NAMES.has(rawName) ? rawName : FALLBACK_ERROR_NAME;
     const rpcCode = record.rpcCode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.109.12",
+  "version": "5.109.14",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {