@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/CHANGELOG.md

@@ -2,7 +2,4317 @@
 
 ## [Unreleased]
 
-## [5.314.0] — 2026-10-02
+## [5.315.0] — 2026-10-02
+- The CLI loads the Sentry error-reporting library only when it first needs it, so commands that report nothing start with fewer imports. Reporting, scrubbing and flushing work as before.
+- Keep first-sync guidance enabled without its rollout gate and remove the obsolete plan-limit fallback flag-off test.
+
+- Gate autopilot nudge deduplication behind a default-off company flag, preserving message IDs and requiring a 30-minute active-condition cooldown for repeat nudges.
+- Let lane autopilot skip malformed lead inputs individually behind a default-off flag and notify the affected lead once.
+- Lead autopilot can batch stale KPI reminders into one oldest-first message per pass when the company enables `lanes.autopilot-kpi-staleness-batch`.
+- Preserve the last policy tag when migrating trigger policies.
+- Add read-only `hq lanes keep-alive-audit` reporting for lead keep-alive timing, early resumes, and missed restarts.
+- Resolve bare lane IDs to their stored lane record before messaging or showing them, preventing messages from being written under unresolved IDs.
+
+## [5.313.0] — 2026-10-02
+- Gate live-only lane hire-grant counting by company; blocked and awaiting-input children no longer occupy slots when enabled, and their resume is checked against current capacity.
+- Add company-gated lane low-disk admission protection and Codex rollout retention.
+
+## [5.312.1] — 2026-10-02
+- Fix checkpoint Stop hook-state creation and the jq-absent early exit to match the bundled shell.
+- Add native `hq core eval-trigger`, `migrate-policy-triggers`, `register-project`, and `work-mesh-live-rebind` on the fast route behind the default-off `core-native-hook-helpers` flag.
+- Prevent concurrent QMD reindex workers from replacing each other's lock owner record.
+- Add a default-off `hq company rename <new name>` command to update a cloud-backed company's display name.
+- Preserve HTTP status and safe server denial codes in work-mesh registration diagnostics.
+
+## [5.312.0] — 2026-10-02
+- The desktop app can turn event-driven daemon sync on or off with its Instant Sync setting. The daemon stores the preference and restarts when a running daemon needs to apply it.
+- `hq dm channel` now explains empty channels and displays a readable fallback for bodyless system notifications.
+
+- Personal vault browsing now treats slash and dot paths as the root and normalizes leading slashes on nested paths.
+- Personal and company file browsing normalize root markers before listing.
+- Schedule the first eligible lead keep-alive check from the lane terminal watcher when the opt-in flags are enabled.
+- Add default-off KPI freshness reporting and deduplicated re-measurement nudges to lane autopilot.
+- Add company-scoped Outpost owner lookup for hostless lane ULIDs used by `hq lanes message`.
+- Add opt-in autopilot nudges and operator escalation for missed lead deadlines.
+- Report the bounded host BASH_ENV class for hook telemetry so HQ-CLI-2C startup timing can be distinguished accurately.
+- Add gated `hq vault retention get|set` commands for the per-vault default retention period.
+
+## [5.311.4] — 2026-10-02
+- Preserve existing local company starter files during cloud provisioning by having the CLI request that hq-pro skip blank starter seeding; older servers are detected before company creation.
+
+## [5.311.3] — 2026-10-01
+- Match company file access checks against the company-anchored paths printed by `hq files browse`.
+- Record a placement resolved to the current host as local so the lane starts without dispatching back through Outpost pickup.
+
+## [5.311.2] — 2026-10-01
+- Reduce fast-path startup work by loading network compatibility only on routes that need it.
+- Make envelope `next_check_at` an unconditional keep-alive hold and remove its completed rollout flag.
+- Lead autopilot no longer asks a lead to review its own lane as a finished worker, or to relaunch a worker for a story assigned to the lead itself.
+- Lead autopilot counts a story's current `lane` together with its `lanes` history, so `lanes: []` no longer hides the assigned lane.
+- Keep the CLI company seed fixture byte-matched to the hq-core starter golden, including the session sentinel ignore rule.
+- Record lane-watcher continuations as `watcher` resumes and label their prompt source accurately; record monitor-event and system-notice message sources distinctly in lane resume history.
+
+## [5.311.1] — 2026-10-01
+- Preserve shell-compatible diagnostics when delegate pickup receives a malformed manifest.
+- Print URLs returned by `hq integrations call` without redacting their paths or query values. Other integration JSON output keeps its existing URL redaction.
+
+## [5.311.0] — 2026-10-01
+- Add native `hq core hq-session` and `checkpoint-stop-gate` handlers on the fast route behind the default-off `core-native-session` flag, retaining bundled shell rollback companions.
+
+- Claude lane account selection now skips accounts held for the lane's model and preserves the quota reset details when no eligible account is available.
+- Require a latency regression to recur across benchmark rounds before failing the fast-route gate.
+- Detect inline private keys when validating job definitions.
+- Deliver each Outpost its own lead autopilot registry rows from the primary reconcile pass, and report a missing or stale registry on the Outpost.
+- Add an opt-in, default-off hq-flags gate that lets the first keep-alive retry after a done turn run after a 30-second settle while preserving later backoff.
+- Add the default-off cli.personal-connector-settings flag to store imported local connector manifests in the personal vault instead of the company vault.
+
+## [5.310.0] — 2026-10-01
+- Move directly controlled Linux CI checks to ARM runners where their tools support ARM.
+- Lead autopilot resolves a lead's company through its project when the lane record does not carry a company, and skips project paths registered to a different company.
+- Install-tree recovery errors now report bounded sibling, target, version-gate phase, and updater-liveness enums.
+
+## [5.309.1] — 2026-10-01
+- Fixed `hq agents rm` to remove external agents through revoke rather than the hosted-agent teardown path.
+
+- Wait for asynchronous integration approvals to reach a terminal queue state and report pending work accurately.
+
+- Add privacy-safe qmd exit diagnostics to Sentry reports.
+
+- `hq files delete` help now explains exact-key and wildcard-prefix matching.
+- Add native `hq core worker lint` and `hq core worker share` behind the default-off `core-native-worker-skills` gate.
+
+- Port `hq core dm-bind` and `hq core work-mesh-bind-trusted` to native TypeScript behind `core-native-utilities`, retaining the bundled-script fallback.
+
+- Move directly controlled Linux CI checks to ARM runners where their tools support ARM.
+- Lead autopilot resolves a lead's company through its project when the lane record does not carry a company, and skips project paths registered to a different company.
+- Install-tree recovery errors now report bounded sibling, target, version-gate phase, and updater-liveness enums.
+
+## [5.309.0] — 2026-10-01
+- `hq lanes autopilot run` now evaluates leads based on lane ownership rather than a host label, and reports registered leads assigned to another host as skipped.
+- Allow non-overlapping story-prefix teams to share a project in lane checks and reports.
+
+## [5.308.0] — 2026-10-01
+- Added native `hq core audit-log`, `git-pack-extension-check`, `pin`, and `refresh-vault-access` commands behind the default-off `core-native-utilities` flag.
+- CI now cancels superseded pull-request benchmarks and reserves the additional Windows and macOS checks for changes that affect those platform paths. Main pushes retain all platform checks.
+- `hq lanes list` now settles legacy failed-dispatch mirrors as undispatched only after a successful strict owner snapshot returns no row; snapshot errors and mirrors with a host report remain unverified.
+- Outpost pickup and remote database requests now time out, and failed pending DM lookups are reported.
+
+## [5.307.0] — 2026-10-01
+- Add native `hq core resolve-company` on the fast route behind the default-off `core-native-utilities` gate.
+
+- Stop immediately when hq-deploy repeats an app-list cursor while resolving apps.
+
+- Added native `hq core audit-log`, `git-pack-extension-check`, `pin`, and `refresh-vault-access` commands behind the default-off `core-native-utilities` flag.
+- CI now cancels superseded pull-request benchmarks and reserves the additional Windows and macOS checks for changes that affect those platform paths. Main pushes retain all platform checks.
+- `hq lanes list` now settles legacy failed-dispatch mirrors as undispatched only after a successful strict owner snapshot returns no row; snapshot errors and mirrors with a host report remain unverified.
+- Outpost pickup and remote database requests now time out, and failed pending DM lookups are reported.
+
+## [5.306.0] — 2026-10-01
+- End long install-tree waits early when a named retired npm sibling's deep activity scan is incomplete, report the recovery as unverified, and give safe wait-and-repair guidance.
+
+## [5.305.0] — 2026-10-01
+
+- Work Mesh project discovery skips projects whose matching local lifecycle state is archived or retired.
+
+- `hq lanes show` now treats a newer terminal primary mirror as authoritative when an Outpost owner snapshot is behind, avoiding a misleading refresh warning while preserving warnings for nonterminal conflicts.
+- Self-updates detect an unwritable npm global prefix before install, show the command to repair that install, and report the handled permission state as a rate-limited warning.
+- Keep Work Mesh held events unique by event ID across retries, including interrupted overflow recovery.
+- Added `hq mcp list` as an alias for the existing MCP status command. `hq version` can show cached CLI update guidance on stderr when the default-off `cli.version-update-nudge` flag is enabled. Bare `hq --version` prints only the installed CLI semver and starts no flag or network work.
+- Keep-alive no longer lets a newer terminal lane or a same-profile lane under a distinct lane senior supersede a running lane.
+- With `cli.company-errors-sdk-warning` enabled, `hq people` uses shared active-company guidance when local metadata is missing, and files commands show the AWS SDK Node-version notice only with verbose diagnostics.
+- Remove the unrelated secret-sharing hint from active member listings.
+
+## [5.304.0] — 2026-10-01
+- `hq lanes show` skips owner refresh only when a failed Outpost dispatch explicitly recorded `pickup_persisted: false` and no owner heartbeat; it reports `remote_refresh: "skipped_undispatched"` in that case.
+
+## [5.303.0] — 2026-10-01
+- Fixed bundled shell scripts failing on Windows when Git Bash is installed but `bash` is not on `PATH`.
+- The bundled token usage script now reads Claude sessions from `CLAUDE_CONFIG_DIR/projects` and the standard Claude project directories, including nested session folders (subagent transcripts are skipped), when no project directory is given.
+
+## [5.302.0] — 2026-10-01
+
+- Generate company project indexes while preserving hand-written content unless `--accept` is used.
+
+- Follow all hq-deploy app-list pages when resolving apps for comments and report publishing.
+- Let a senior message or resume an `awaiting_input` lane when its pending question is gone or cannot be reached from the senior's host. Pending questions remain answer-first, including across registered Outpost routes.
+- A senior can resume or send a fallback message to an `awaiting_input` lane when its pending questions are addressed to another audience. Once the resume is accepted, those questions are cancelled on their owner; unreachable owners are reported while the lane continues.
+- When a blocker escalation targets a session without a registered monitor inbox, record the reason and deliver it through the lane's existing inbox instead of retrying the failed escalation every watcher pass.
+- `hq integrations disconnect` can now remove company integrations that were created outside the app catalog.
+- Lead envelopes can set `next_check_at` to defer automatic keep-alive resumes
+  until a scheduled check, with pending work continuing to resume immediately.
+- Reconcile records deduplicated keep-alive skip reasons in each lane's watcher event log.
+- Add a company-scoped reconcile gate that closes local interrupted worker lanes after 24 hours when all carried project stories are done or dropped and no pending work remains.
+- Skip refreshing failed-dispatch lane mirrors that never reached their Outpost owner.
+- Keep lane keep-alive, retry-context, and monitor history readers moving past torn JSONL records.
+- Refresh primary mirror heartbeats from fresh running Outpost reports before dead-host reconciliation.
+- Report answerable awaiting-input questions as the `hq lanes show` delivery path, and retry blocker-freshness fallback messages after a failed append.
+- Let `hq integrations connect` send an API key in a custom HTTP header.
+- Bound `hq rescue` GitHub release and tag lookups to 30 seconds with a clear timeout error.
+- hq-cli now logs live-board refresh failures and recovery while continuing to retry.
+- On Windows, background jobs started by `/handoff` and search indexing no longer open console windows.
+
+## [5.301.0] — 2026-10-01
+- `hq meetings transcript` and `hq meetings notes` stop a stalled document download after two minutes and say so, instead of waiting forever.
+
+- Keep `hq access` from reporting a denied vault path as missing or exposing matching paths.
+- Fix self-updates for npm installs whose global prefix contains spaces.
+- `hq files acl companies/<slug>` and `hq files unshare companies/<slug> --with ...` now handle ACL rows at that exact company path instead of treating it as the vault root.
+- Add native hq core job notify and remediate commands behind core-native-jobs, retaining bundled shell companions.
+- Allow owners to disconnect custom Factory connections without installation records, and send the company UID required by the revoked-connection purge endpoint.
+- Fail company provisioning when its initial sync reports per-file upload failures, while retaining the successful upload count in failure details.
+- Treat plan-limited files as initial-sync failures and keep provisioning progress snapshots updated.
+- Preserve story attribution after a message is durably queued by lane admission or an account move.
+- The token usage report accepts `--project-dir <path>` to read one Claude activity folder instead of the default folders.
+
+## [5.300.0] — 2026-09-30
+- `hq files unshare --with agt_...` removes a grant made to an agent. Before, agent uids were rejected as invalid principals.
+- `hq daemon` no longer drops remote-control sessions when claude or codex is reinstalled at the same version or when hq-cli is released. The daemon's plan leaves out the tool's path (the host finds it when it starts), the host restarts a session only for a new tool version, and a tool that looks missing for one plan read does not pause the session. On outpost primary, a long-running Claude session's auto-updater reinstalled claude every few minutes and each reinstall restarted remote-control two or three times.
+- With the default-off hq-flags gate `files.share-empty-prefix-warning`, `hq files share` warns when a granted prefix has no files. A failed or timed-out list check does not block the grant.
+- Recognize pnpm v11+ global installs and handle Windows drive-path tar archives without waiting for the asynchronous feature-flag snapshot.
+- Self-update failure reports now include the npm error code and a sanitized reason.
+
+### Fixed
+
+- `hq core rebuild-index companies --company <slug>` scopes the generated write to that company (behind the default-off `cli.rebuild-index-company-scope` flag), and `--help` exits without reading or writing company indexes. The unscoped run also ignores orchestrator state tied to another company's PRD.
+
+- Lane messages and resumes that switch project or story attribution now tell the provider which story is active. Reused completion artifacts no longer close the new story.
+- Make signed-out `hq sync` commands fail fast with `hq login` guidance when stdin or stdout is not a terminal, while keeping browser login in a terminal.
+
+## [5.299.0] — 2026-09-30
+- Add `hq lanes accounts clear-quota` and clear future quota marks after successful lane turns.
+- On macOS, `hq daemon` retires a loaded legacy mesh LaunchAgent even when its plist is missing, and daemon uninstall boots the job out before deleting its plist. Mesh-owner wait logs now repeat at most every ten minutes.
+- Restore npm command links after a failed hq-cli self-update and repair or report missing links after successful installs.
+
+## [5.298.0] — 2026-09-30
+- [feedback_d4a080e9-de79-4290-81c3-06ba26990a38] Preserve raw substring matches while normalizing company path searches.
+- `hq agents` now prints the Slack app settings link and the console paste link whenever an agent is waiting on its Slack app-level token, and follows the pending actions and paste URL the server returns.
+- When an app install is already running, `hq integrations connect` tells you to wait instead of showing a generic conflict error.
+- Validate policy trigger expressions when loading worker policies (feedback_3982db47-ceb8-4148-8ee0-4dd533f5138b).
+
+## [5.297.0] — 2026-09-30
+- When enabled by hq-flags, show the quarantined work-context outbox count and latest reason in hq doctor and mesh daemon status.
+- `hq daemon` now exits after shutdown when handles remain open, and its mesh service waits when another live mesh daemon owns the process lock.
+
+## [5.296.0] — 2026-09-30
+- Upgrade varlock to 1.21.1. `hq run` skips Varlock cache setup and reports malformed env files promptly without sending them to Sentry.
+- Record bounded actor and trigger history for lane worker starts and expose it through `hq lanes show --json`. Preserve history through conflict merges and envelope repair, and record answered-question callers for immediate and queued resumes.
+- `hq lanes` no longer lets a late terminal lane envelope change a story the senior already marked done or dropped, and `hq lanes story review <lane> <story>` moves a carried story to review before senior verification (feedback_d0164732-22b0-4426-9b66-c9758ba205e3).
+
+## [5.295.0] — 2026-09-30
+- Add native `hq core job run` behind the default-off `core-native-jobs` gate, retaining its bundled shell rollback companion.
+
+- Remove the unused direct client-health Sentry route; the existing server-side reporting path remains unchanged.
+
+- Add native `hq core job probe` behind the existing default-off `core-native-jobs` gate.
+- Self-update supervisor copy and cleanup failures now log their error class.
+- Report failed and ineffective self-updates to Sentry with bounded context.
+
+- hq-cli release notes now use per-branch fragments that are folded into the next version section, reducing conflicts between parallel pull requests.
+- Claude keep-alive resume events now retain a compact account-load selection snapshot, including when the lane stays on its current account.
+- After a successful missing-envelope repair reports unfinished work, the watcher can queue one automatic continue behind the default-off `lanes.envelope-repair-continue` flag. The repair prompt now gives the required unfinished-story envelope fields.
+- Add a private machine-session token-file command for supported machine-auth handoffs.
+- Apply the 5x fast-route speedup gate only when the base p95 is at or above the 200 ms target; retain the p95 latency and base/PR regression gates.
+- The changelog fragment check runs only on pull requests again, so pushes to main no longer fail it.
+- Refresh terminal Outpost lane mirrors before applying `hq lanes list` state filters, so a lane whose owner is still running is listed as running.
+- Remove the unused Outpost snapshot cache flag and its cache-first lane-list path.
+- The mesh daemon logs spool watcher failures and continues flushing on its polling interval instead of exiting on an unhandled watcher error.
+- Make the manager status gate always active and remove its rollout flag lookup.
+- Compare fast-route latency with a PR-build full-graph baseline so the 5x gate remains valid after the base build gains fast routing.
+
+## [5.294.0] — 2026-09-30
+- Record automatic keep-alive resumes in each lane's durable, bounded history and expose it in `hq lanes show --json` and `hq lanes list --json`.
+
+### Fixed
+
+- Outpost `hq lanes message` now reaches primary-hosted lanes through the
+  primary owner command, which checks sender rights and includes the
+  destination in JSON output.
+- Split the lane story command handlers into a dedicated module without changing behavior.
+- On a box, `sudo hq daemon migrate --apply` now finds the login user's own systemd user units (hq-mesh-daemon, hq-lanes-reconcile and the rest) and stops them through that user's systemd manager. `sudo hq daemon uninstall --restore-legacy` restarts them the same way. Before, root looked only in its own home and could not reach the login user's manager.
+
+## [5.293.0] — 2026-09-30
+- [HQ-CLI-HOOK-TIMEOUT-KIND] Group hook timeout events by normalized kind (`warning` or `exceeded`) across scripts; keep script and platform tags for triage. Existing per-script issues will stop receiving new events, and the lead handles their status.
+- [HQ-CLI-2C] Label unmeasured SessionStart delay as entry Bash startup when BASH_ENV is set; doctor follows the env-prefixed hook command.
+- `hq lanes move` now reports an already-on-target no-op without dispatching or changing the queued lane.
+- Keep bundled scheduled-job reconciliation units on the live scaffold runner, and preserve caller spelling in job-validation paths.
+- On Linux, `hq daemon run` sets XDG_RUNTIME_DIR for its services when the system unit left it unset, so `systemctl --user` from jobs-reconcile no longer fails with "Failed to connect to bus: No medium found".
+
+- With the default-off lanes.keep-alive-resume-blocked gate enabled, reconcile
+  resumes an opted-in blocked lead after 15 minutes when it has open stories and
+  no pending question. After two blocked resumes, it records another blocked
+  episode for operator review.
+- Lead autopilot dry runs no longer start workers, append repeat wakes, or write escalation records. Passed stories count as closed and canonical story-ledger lane objects are accepted.
+- Autopilot checks status paths against the lead company, scopes escalation deduplication to each lead, includes carried stories in stale-worker checks, and recovers locks left by reused PIDs.
+- The lead autopilot adds prompts for available grant slots, flat KPI reports, stale blockers, completed projects, stale worker ledgers, and stories without live lanes, with escalation after two unanswered wakes.
+
+- Preserve empty directory paths and modes in recorded corpus cases. The recorder rejects tree entries the case format cannot replay, and CI checks committed snapshots after a clean Git archive extraction.
+- Cross-Outpost resume and hire-grant dispatch verify the senior from the
+  senior's owning Outpost before signing the caller's grant context.
+- Run the no-Hermes source guard with the required Changelog gate in one runner job.
+
+### Added
+
+- Add the read-only `hq lanes autopilot report` metrics command for operator nudges, review latency, idle capacity with ready work, and nudge defects.
+
+- Add `hq lanes ask --priority P0|P1|P2` and show question urgency in the queue; warn when omitted during the compatibility release.
+- Route ported native hq core commands through the fast-startup gate while preserving each family's bundled shell fallback.
+
+### Fixed
+
+- Skip malformed remote lane mirrors with a lane and field warning while
+  keeping local lane validation strict. Refresh mirror queue reason and details
+  from one owner snapshot.
+- Primary-side Outpost question show and answer skip the current Outpost during owner lookup. Remote answers require the lane senior; when the owner is reachable, an unrelated unavailable Outpost is returned as `lookup_errors` without blocking the answer.
+- CI-only: keep the same-binary Node control case measured without applying performance regression thresholds.
+- Fix npm global self-updates, which have failed with MODULE_NOT_FOUND since 5.290.0. The update moved the hq-cli package aside and then started its installer through a supervisor script inside that package. It now runs the installer through a copy of the supervisor outside the package.
+
+## [5.292.0] — 2026-09-30
+- Add native `hq core jobs reconcile` behind `core-native-jobs`, retaining the bundled shell rollback and scheduled-job helpers.
+- Behind the default-off `cli.staged-self-update` flag, an npm global self-update installs the new version beside the running package, checks that it answers `--version`, then swaps it in with two renames. The running `hq` stays on disk for the whole install, so services the daemon starts during an update no longer fail with "hq: command not found" or MODULE_NOT_FOUND. pnpm, Bun, Windows and linked installs keep the in-place update.
+
+- Disable Git auto-maintenance, auto-gc, and detached gc during CM-W2b corpus
+  creation so fixture snapshots cannot race lock files.
+
+### Added
+
+- `hq core ontology merge-copies --listed --only <file>` (flag `checkpoint.ontology.merge-listed-pairs`, default off) merges exactly the copy -> original pairs in the file, including pairs whose names differ, such as a company listed under two names. Each pair must name two entities of one type; a copy listed twice, or listed as both a copy and an original, is skipped as `listed_conflict`. Signal and link holds apply as for other pairs.
+- `hq core ontology drop-aliases --only <file>` (flag `checkpoint.ontology.drop-aliases`, default off) removes reviewed wrong aliases, given as `{ entity, alias }` pairs, from entity files. It is a dry run unless `--apply` is given, and it writes through the multi-writer outbox so sync uploads the change.
+
+### Fixed
+
+- `hq core ontology merge-copies --rewrite-refs` no longer edits signal or source files, which sync cannot upload. A pair whose copy a signal or source still names is now held as `server_owned_refs`, and its copy is kept.
+### Added
+
+- Add `hq core delegate bundle`, `grant`, `publish`, `send`, and `verify` as
+  native TypeScript handlers behind the default-off `core-native-delegate`
+  flag, with their shell companions retained as rollback assets.
+- Match native handoff open-steps JSON nulls and invalid-JSON exit codes, and sync zero-change handoffs to the calling session's bound company after mirroring the thread.
+
+## [5.291.0] — 2026-09-29
+- Add native `hq core jobs schedule-parse` and `validate` commands behind the default-off `core-native-jobs` gate, retaining their shell rollback companions.
+
+- Offline mesh reconcile does not refresh person tokens or start interactive sign-in; valid cached tokens still validate device defaults.
+- Retry daemon state replacement briefly when Windows reports transient rename contention, while keeping the previous state file intact on failure.
+- When a lane has no Board story ID, `hq lanes` records the lane event without sending a story PATCH.
+- `hq core policy age-report` now matches the legacy script when a missing reference has no hidden sibling under a dot directory.
+- Keep bundled scaffold scripts current with staging and check their pinned source revision in CI.
+- Starter plan-limit refusals now show why and how to fix them. The CLI reads
+  hq-pro's hard-stop 402 body (and the older shapes) and prints the server
+  message, the usage, the fix options, the free-month offer when one stands,
+  and the upgrade link, including in non-interactive runs. `hq secrets set`,
+  `hq secrets generate-link`, `hq members invite` and `hq integrations connect`
+  all use this renderer and exit non-zero.
+- `hq sync push`, `hq sync push --all`, `hq sync now`, `hq sync now --all` and
+  `hq skill create` no longer print a success line when a plan limit refused a
+  file. They list the refused files the runner names, show the upgrade link and
+  exit non-zero. `hq sync push --json` adds `planLimitRefused` to its `complete`
+  event instead.
+
+## [5.290.0] — 2026-09-29
+- Ignore stale but well-formed worker-profile queue details when another valid queue reason is stored, and remove them on the lane's next write.
+
+### Added
+
+- Gate `hq sync push --personal <paths>` behind the default-off `cli.personal-targeted-push-paths` flag; explicit paths are normalized and checked against personal-vault scope and exclusions before upload.
+- `hq core ontology merge-copies --rewrite-refs` (flag `checkpoint.ontology.merge-rewrite-refs`, default off) re-points signal refs, invoice and bill links, source and knowledge links from a merged copy to its survivor and carries the copy's external ids and web domains; a pair whose files hold different values for one external id stays held (`external_id_conflict`).
+- A `--only` entry can carry `resolve_external_ids: { <provider>: { primary, namespace, object_type? } }`. With `--rewrite-refs`, a conflicting provider id then keeps `primary` in `external_ids` and moves the pair's other id to the survivor's `external_refs` (`system`, `namespace`, `objectType`, `recordId`), so no id is dropped. A `primary` that matches neither id still holds the pair.
+
+### Fixed
+
+- `hq core ontology merge-copies --variants` no longer counts a copy's own `# Name` heading as unmerged text, so a merged variant copy can be deleted.
+- `merge-copies` no longer moves a copy's links to itself or to its original into the original, and does not count them or the `## Relationships` heading as unmerged text.
+- `merge-copies` now finds signal `entity_refs` written with a `.md` suffix, so it holds (or, with `--rewrite-refs`, re-points) them instead of deleting a copy they still name.
+- `merge-copies --rewrite-refs` no longer holds a survivor as `merge_invalid` when it gains external ids but has no `web_domains` key (or the reverse).
+- `merge-copies` treats an annotation list item whose first key is `path:` as a link to the copy, so it no longer deletes a copy such an annotation still names.
+
+## [5.289.0] — 2026-09-29
+- A failed `hq update` restores the previous working hq-cli install when it could be backed up, instead of leaving the CLI partially updated.
+
+## [5.288.0] — 2026-09-29
+
+### Added
+
+- Add lead autopilot prompts to the lanes reconcile pass behind
+  `lanes.lead-autopilot` (off by default) and expose
+  `hq lanes autopilot run --dry-run --json`. It asks registered leads to review
+  finished, blocked, or missing workers or fill unused grant slots, starts a
+  ready worker after an
+  unanswered fill prompt ages 15 minutes, and relies on keep-alive to resume
+  completed leads with open work.
+
+### Fixed
+
+- Retry daemon state replacement briefly when Windows reports transient rename
+  contention, while keeping the previous state file intact on failure.
+
+## [5.287.0] — 2026-09-29
+- Group hook-timeout events by script while preserving triage diagnostics.
+- Preserve safe slow-child script basenames in hook-timeout diagnostics.
+- Cloud provisioning and retirement now stop after 15 seconds when a Vault API request stalls, with a clear timeout error.
+- In the HQ desktop app, clicking "Explain HQ first" in the setup bot now shows the fixed explanation of HQ at once, with no model turn. The setup worker ships that text in `skills/explain-hq.md`, and the bot reads the same file when someone asks in their own words.
+- Add native TypeScript implementations for four `hq core` worktree and
+  handoff scripts behind the default-off `core-native-handoff` flag. The
+  original shell assets remain bundled as the rollback path.
+- Add default-off native `hq core handoff finalize`, `post`, and `open-steps` commands with the staging scripts retained as the rollback path.
+- Add a default-off `core-native-jobs` rollout gate for native `hq core jobs
+  schedule-parse` and `validate` commands.
+
+### Fixed
+
+- `hq team-sync` keeps its successful no-team result, reports which company
+  directories are cloud-backed, and points to `hq sync pull --all` and
+  `hq sync status` for cloud-backed companies.
+- An unconfirmed Outpost pickup acknowledgement keeps its mirror queued with
+  `outcome_unknown` and its command id. Reconcile uses a strict owner snapshot;
+  it marks the mirror `remote_lost` only after the 15-minute grace when the
+  owner confirms the lane is missing. Unreachable owners remain counted.
+
+### Fixed
+
+- Confirm primary-dispatched Outpost profile recovery when it is queued for
+  reconcile, and sync the cleared recovery state to the primary lane mirror.
+- Cache-first `hq lanes list` now allows one detached Outpost summary refresh
+  per HQ root at a time, avoiding duplicate work from overlapping list calls.
+
+### Fixed
+
+- The lanes hook reads only transcript bytes appended since its last check.
+  It still replays compaction messages and resets the offset when a transcript
+  is replaced or truncated.
+
+### Added
+
+- `hq core ontology merge-copies --only <file>` handles only the copy -> original pairs listed in a JSON file and reports every other found pair as skipped (`not_listed`).
+
+### Changed
+
+- The checkpoint ontology step always applies its ten quality rules (company
+  brief, annotation stripping on grok, grok-first backend, no link aliases,
+  first-name people, ambiguous concept links, dominant sibling link, hub
+  mention floor, concept-project link, named evidence). Their
+  `checkpoint.ontology.*` flags, on for everyone since 2026-09-29, are no
+  longer read.
+
+### Added
+
+- Record company-scoped exposure for printed CLI plan-limit notices when the default-off `billing.limit-at-action-prompt` flag is enabled; count an upgrade engagement only after the user confirms opening the link.
+
+### Fixed
+
+- `hq secrets` and other noninteractive person-token callers reuse a fresh same-principal session written by another process while a stale refresh is rejected.
+
+## [5.286.0] — 2026-09-29
+
+### Changed
+
+- On Linux the daemon's sync runner writes its protocol output to a named
+  pipe, `~/.hq/daemon/protocol/sync.fifo`, instead of an anonymous pipe. With
+  `daemon.supervisor-handoff` on, an outpost daemon restart now hands sync to
+  the next daemon like the other services instead of stopping and restarting
+  it, and output the old daemon had not read reaches the new one. Other
+  platforms keep the anonymous pipe.
+
+## [5.285.0] — 2026-09-29
+
+- Route eligible Linux CI jobs onto ARM runners while retaining existing test and platform gates.
+
+## [5.284.0] — 2026-09-29
+- The existing Work Mesh MQTT subscriber can signal agent inbox wakes through a private local marker without persisting MQTT message contents.
+- Add `hq agents jobs resume <uid> <jobId>` to re-enable paused agent job schedules.
+
+### Fixed
+
+- Recover a queued Outpost lane held for `worker_profile_changed` with its
+  printed `hq lanes resume <id> --worker <profile>` command. The lane owner's
+  profile copy is authoritative: the command records an authorized re-pin in
+  history, leaves the lane queued for normal reconcile admission, and syncs the
+  cleared recovery state back to the primary mirror. Other queued lanes still
+  require `hq lanes admit`.
+
+- A remote `hq lanes list` read no longer dispatches owner hire summaries,
+  capacity probes, or mirror snapshots to other Outposts. Two Outposts that
+  each held a lane placed on the other ran `hq lanes list --json` on each other
+  without end, which filled both boxes with SSM commands.
+- `hq doctor` labels the detected agent runtime value as `Agent platform` in human output. The JSON platform field and schema are unchanged.
+
+### Fixed
+
+- Refresh remote lane mirrors on hosts with an Outpost identity, while excluding
+  mirrors owned by that host. Resolve company attribution before checking the
+  mirror gate for refreshes and remote logs; unresolved lanes stay local.
+  Remote-read invocations skip refresh to prevent reciprocal Outpost fan-out.
+
+## [5.283.0] — 2026-09-29
+
+### Added
+
+- `hq core ontology merge-copies --variants` merges two-file duplicate entity
+  groups whose names differ only in case, spacing or punctuation, keeping the
+  spaced name. Behind `checkpoint.ontology.merge-variants` (off by default).
+
+## [5.282.0] — 2026-09-29
+
+### Added
+
+- Add native TypeScript handlers for `hq core knowledge-prefs` and `hq core
+  policy age-report`, `retire`, and `frontmatter`, gated by the default-off
+  `core-native-policy` flag. Bundled shell assets remain available for rollback
+  during the first release.
+
+### Changed
+
+- Pin the third-party package setup action in the fast-route benchmark workflow to its resolved commit.
+- When the default-off `lanes.outpost-snapshot-cache` flag is enabled,
+  `hq lanes list` returns the last cached Outpost hire summaries immediately
+  and refreshes stale or missing summaries in the background. JSON rows show
+  snapshot age and stale/loading markers; text output includes a short stale or
+  loading note. `--fresh` waits for current owner summaries. Validated Outpost
+  snapshots live for three seconds; failed reads or lock acquisition are not
+  cached.
+
+### Fixed
+
+- `hq lanes reconcile` admits every queued lane that fits its caps in one pass
+  once CPU throttle clears or the starvation bound is reached.
+- Reconcile compares cumulative CPU counters between passes and records the
+  measurement source; a queued Outpost lane with a changed worker profile now
+  reports the expected and actual hashes plus the senior re-pin command without
+  blocking later eligible lanes.
+
+## [5.281.0] — 2026-09-29
+
+### Added
+
+- Add native TypeScript handlers for six `hq core ontology` commands. The new path is gated by `core-native-ontology`, which defaults off; the original scripts stay bundled for rollback.
+
+### Fixed
+
+- The default-off `lanes.remote-done-mirror` hq-flags gate refreshes nonterminal
+  Outpost mirrors before hire admission and during reconcile. It copies the
+  owner's terminal state and envelope summary to the primary. Unreachable
+  mirrors stay counted and are reported as unverified. `hq lanes logs` reads
+  logs from the owning Outpost.
+
+## [5.280.0] — 2026-09-29
+
+### Fixed
+
+- Single-lane commands for Outpost-hosted lanes use a configurable pickup wait,
+  defaulting to 120 seconds. `hq lanes list` capacity probes use a separate
+  15-second timeout. A lane ID with a registered host suffix routes to that
+  Outpost first.
+- hq group-grants outbound help now makes --group required. hq auth status
+  displays token expiry as a UTC time and relative duration.
+
+## [5.279.0] — 2026-09-29
+
+### Fixed
+
+- Claude keep-alive resumes use the same account selection as manual resumes,
+  including profile pins and the optional recent-use tiebreak. If no eligible
+  account can be selected, the lane resumes on its current account and records
+  the failure.
+
+## [5.278.0] — 2026-09-29
+
+### Changed
+
+- The CI and no-hermes pull request checks use read-only repository access, and CI pins its third-party actions to fixed commits. The fast-route benchmark workflow is pinned in a follow-up.
+
+### Added
+
+- Reconcile can stop an over-budget same-user search process descended from a
+  running lane when `rg`, `grep`, `ugrep`, or `ag` disables ignores on a broad
+  HQ root, or `find` searches a broad root without a shallow-depth or prune
+  exemption. The `lanes.runaway-tool-guard` hq-flags key is off by default. A
+  stopped search records its command and duration, then gets a notice to narrow
+  the search.
+
+- Add the default-off `checkpoint.ontology.hub-mention-floor` hq-flags key.
+  When it is on, checkpoint ontology apply rejects a knowledge link to a
+  non-person entity that 50 or more other entity files link to when the input
+  names it fewer than 2 times in the text the model read (the chunk's line
+  range of the annotation-stripped copy when there is one). Concept links
+  redirected to a project are checked the same way. The rejection is reported
+  as `hub_under_mentioned`.
+
+## [5.277.0] — 2026-09-29
+
+### Fixed
+
+- `hq lanes accounts list` and `accounts balance` now report a Claude account
+  whose home is missing on the current host and show the `set-home` repair
+  command. Balance exits non-zero for an enabled account in that state. On
+  Linux, account login stores a host-specific home and requires `--home` when
+  an existing account only has a shared home.
+- Claude account balancing can use the default-off
+  `lanes.claude-account-balance-signals` hq-flags key to break equal live-lane
+  counts by the age of each account's latest completed lane run when provider
+  percentage data is unavailable.
+
+### Added
+
+- Add a default-off `cli.secrets-env-fast-path` hq-flags route for `hq secrets
+  env`. It skips the full CLI graph while reusing the existing credential,
+  usage-audit, server authorization, and offline-cache behavior.
+- `hq lanes list --json` accepts repeatable `--lane` filters, `--active`, and
+  owner-only hire-hierarchy snapshots. Remote lane lookup now requests the
+  needed hierarchy once per Outpost invocation and falls back to an unfiltered
+  list when an older owner CLI rejects a new filter. Internal snapshot switches
+  stay out of normal help and the generated command catalog.
+- Add the default-off `checkpoint.ontology.dominant-sibling-link` hq-flags key.
+  When it is on, checkpoint ontology apply moves a knowledge link from an entity
+  whose name another type also holds to the same-name entity that other entity
+  files link to most. The move needs at least three times the inbound links and
+  at least five. An example is project Build Your Own AGI moving to the concept,
+  or the numbered copy `hq-core 2` moving to `hq-core`. Moves are reported
+  under `dominant_sibling_redirects`, and no entity file is written.
+- Add the default-off `lanes.running-superseded-message-delivery` hq-flags key
+  so messages can reach otherwise messageable superseded lanes outside the done
+  and interrupted states. Accepted messages include a warning; done and
+  interrupted lanes keep the existing senior and successor checks.
+- `hq core delegate resolve`, `pickup`, `repo`, `secrets`, and `transfer` are
+  available through native implementations when the default-off
+  `core-native-delegate` flag is enabled; the bundled scripts remain as the
+  rollback path.
+
+- `hq lanes set <lane> --model <model> --effort <level> [--reason <text>]`
+  changes the model or effort a lane uses from its next resume, including the
+  keep-alive resume of a done lead. Before, keep-alive always resumed on the
+  recorded values, so a lead's model could not change without racing it. The
+  lane itself or its senior may run it; each change is kept in
+  `settings_history` and shown by `hq lanes show`.
+- `hq daemon sync` reports runner ownership and health, starts an immediate sync pass, pauses or resumes sync, and sets per-company sync mode. The daemon waits for an existing desktop runner to release its lease before starting its own.
+- `hq lanes interrupt <lane-id>` stops a running lane's turn and leaves it
+  `interrupted` (reason `operator_interrupt`) with its provider session, so
+  `hq lanes resume` continues it. Keep-alive does not resume it. The command
+  records the session id from the interrupted turn's output, holds the
+  provider's admission lock until the worker has stopped, and reports
+  `resumable: false` with a stderr warning when the turn produced no session id.
+- An operator `hq lanes resume` clears keep-alive's `terminal_state` block, so
+  keep-alive can continue the lane after that turn.
+
+### Changed
+
+- `hq lanes stop` on a running lane warns on stderr that the lane is killed and
+  cannot be resumed, names `hq lanes interrupt`, and adds `terminal: true` and
+  `resumable: false` to its JSON output, including for Outpost lanes stopped
+  from the primary.
+- The lane drain hook avoids loading the lanes module graph when no lane is
+  resolved or its drop box is empty, while continuing to record tool activity
+  and using the full drain path whenever delivery or replay may be needed.
+
+### Fixed
+
+- Doctor command tests use temporary home and state directories and skip the
+  live integrations inventory, so their results do not depend on a developer's
+  local HQ state.
+- Outpost resume account moves forward the primary's hire-grant context through
+  the owner-side session move. The owner checks the current senior and hire
+  capacity before starting the worker.
+- Security: `hq dm inbox --json` and agent-side raw message output omit the delegated `actingContext` object.
+
+## [5.276.0] — 2026-09-28
+
+### Added
+
+- Suggest inviting a teammate after the billing link in an over-limit Starter
+  notice for a one-member company, behind the default-off
+  `cli.limit-invite-teammate-v1` flag.
+- Add a default-off native route for `hq core timeout-guard`, backed by a
+  private company flag snapshot and a paired CI latency benchmark.
+
+### Changed
+
+- Starter setup guidance now says it includes one integration.
+
+### Fixed
+
+- `hq core checkpoint` no longer loses the company files of a checkpoint that
+  was queued behind a busy sibling, behind the `checkpoint.ontology.queued-touches`
+  flag (off by default). The queued checkpoint records its company files, and
+  the next sibling run adds them to the ontology plan. A run whose own
+  checkpoint names no company takes the ontology step for the company whose
+  files have waited longest.
+- `hq feedback bug|feature` validates report content and the serialized request
+  size before uploading screenshots or logs, avoiding orphaned attachments when
+  the server would reject the submission.
+
+- Reconcile clears a stale `superseded` keep-alive block when no active successor
+  remains; the five-minute minimum retry delay still applies. The block is
+  cleared even when the lead then waits on backoff or a full queue, and the
+  clear does not move a done lead's retry clock past its done envelope.
+
+## [5.275.0] — 2026-09-28
+
+### Fixed
+
+- `hq lanes` accepts full Claude model ids such as `claude-sonnet-5-5` and
+  `claude-opus-5-5` (spawn, `resume --from-failed`, account moves) when
+  `claude --help` names only the aliases. Before, the model check refused them
+  with `model_unsupported`.
+
+### Added
+
+- Track CLI feature events behind the default-off `cli.feature-used-telemetry-v1`
+  hq-flags key with a separate one-time disclosure.
+
+- Outpost daemons can take over running services after a CLI update instead
+  of restarting all of them, behind the `daemon.supervisor-handoff` flag (off
+  by default). On Linux, the updated daemon adopts the services the previous
+  one left running and replaces only the ones whose command changed, one at a
+  time. Bots finish their running turns first. hq-cloud services keep running,
+  and the remote-control hosts restart their session once it is quiet. This
+  needs the systemd unit from this release: run `sudo hq daemon install` again
+  on each outpost.
+- Company owners can turn the checkpoint Stop gate off or on for their company:
+  `hq company settings set --checkpoint-gate-enabled false|true`. Any member can
+  read the value with `hq company settings get`. The Stop gate reads a local
+  cache (`~/.hq/cache/checkpoint-gate/<company>.json`, refreshed in the
+  background at most every ten minutes by `hq core checkpoint-gate-setting
+  --refresh`) and skips the checkpoint block only when the session's company has
+  the gate turned off. Unset, unreachable with no cache, and sessions with no
+  company keep today's behaviour; `HQ_CHECKPOINT_GATE` still wins. Gated by the
+  hq-flag `checkpoint.gate.company-setting` (default off).
+
+### Changed
+
+- The systemd system unit now uses `KillMode=process`, so systemd signals only
+  the daemon. The daemon still stops its services on `systemctl stop`, and it
+  stops any service left over from a crashed daemon before starting new ones.
+
+### Fixed
+
+- `hq lanes create --placement auto` now runs on the caller when it is the best
+  capacity candidate. It matches the host id, machine identity or registered
+  Outpost id. Explicit `--outpost` self-targets still return
+  `outpost_self_target`.
+- `hq sync status` validates an explicit `--hq-root` and continues to read
+  journals from the configured state directory, which it now prints.
+- Root daemon tests use a temporary system adopted-record file; the CLI still
+  defaults to `/var/lib/hq/daemon/adopted.json`.
+
+## [5.274.1] — 2026-09-28
+
+### Fixed
+
+- With lineage-aware supersession enabled, same-profile workers under the same
+  session senior no longer supersede each other. The recorded senior can
+  message its worker if it is later superseded.
+
+## [5.274.0] — 2026-09-28
+
+### Fixed
+
+- `hq lanes grant` and other senior-authorized actions treat a missing `senior`
+  key in valid session metadata as `user`; explicit non-user values still refuse
+  authorization with a reason.
+- Native Outpost message and resume routes now carry the owner's hire hierarchy,
+  authorize local-host resume contexts on their owner, and continue lane lookup
+  when another registered Outpost is unavailable.
+
+### Added
+
+- Guide interactive CLI users to their first work-bearing sync and confirm it
+  once, behind the `cli.first-sync-next-step` HQ flag.
+- Add `hq core commands --json` for the registered command catalog and guard the fast path, sibling references, and packaged assets.
+- Add a corpus recorder and differential runner for scaffold migration scripts.
+- Add `hq deploy comments list` and `read` for comments on apps in the caller's org.
+- Checkpoint ontology: behind `checkpoint.ontology.named-evidence` (off by
+  default), a knowledge link to the company's own company entity, or a
+  concept linked to its same-name project, needs evidence that names it as a
+  word. A name that only appears inside a path, domain, handle or tag, such as
+  `indigoai-us/hq` or `scope: company:indigo`, is rejected as
+  `unnamed_in_evidence` (CO-57).
+
+### Fixed
+
+- Add byte-for-byte checks for files fetched by `hq files get` and for
+  `company.yaml` after cloud demotion, using hq-core-staging's company seed.
+
+### Changed
+
+- Internal: moved the move, move-target and placement subcommands out of
+  `src/commands/lanes.ts`; no behaviour change.
+
+## [5.273.0] — 2026-09-28
+
+### Fixed
+
+- `hq doctor --fix` rechecks after each repair and applies newly found fixes
+  for up to three passes. It reports each repair's pass and lists every backup
+  restore command.
+- `hq doctor --fix --json` includes each repair's pass and backup, and its
+  restore command now undoes changes from every repair pass.
+- Wrapped merge commands now pass through both hold and review checks. If a
+  merge command cannot be parsed, it is allowed with an unresolved repository
+  when no enabled hold or review check applies.
+- A superseded worker still accepts messages from its recorded senior or a
+  successor lead in the same company and project. Company identity is resolved
+  from the lane or its project when the lane record has no company.
+- `hq lanes orphans` resolves null-company lanes through their senior chain and
+  can list unresolved lanes with `--unscoped`. Idle user-senior lanes without
+  open stories are reported after `--user-idle-hours` (default 72).
+
+### Added
+
+- `hq doctor` checks whether the installed CLI meets the scaffold's declared
+  `requiresHqCli` version floor.
+
+### Removed
+
+- Removed the dead `lanes.tracker` record and import commands. Existing project
+  tracker files stay in place; `hq lanes checks` and `hq lanes report` retain
+  read-only access to the records they use.
+
+## [5.272.0] — 2026-09-28
+
+### Added
+
+- Add `hq core ontology merge-copies`, gated by
+  `checkpoint.ontology.merge-copies`. It merges each `<name> N.md` entity copy
+  into its own original (aliases, back-references, relationship links and
+  signal count), repoints links to the copy, and with `--delete` removes merged
+  copies from the vault. Dry run by default.
+
+## [5.271.0] — 2026-09-28
+
+### Fixed
+
+- `hq lanes create --outpost` reads `lanes.outpost-load-balancing` for the
+  resolved company, so enabled personal worker profiles can run on an Outpost.
+- Resolve host-suffixed lanes created on a registered Outpost for grant,
+  message, and resume commands while keeping senior authorization on the primary.
+- `hq lanes move-target` keeps the company placement gate, and unfiltered
+  `hq lanes list` resolves the active company for host capacity.
+
+## [5.270.0] — 2026-09-28
+
+### Fixed
+
+- Company billing links in CLI plan-limit notices no longer depend on the
+  rollout flag.
+
+### Removed
+
+- Removed stale gate language from hire-grant command help. Enforcement remains
+  unconditional; backfill remains dry-run only.
+
+### Fixed
+
+- `hq files unshare --with` now accepts the same person UID principals as direct grants.
+- The update gate no longer retries failed Windows installs through `sudo -n`.
+
+## [5.269.0] — 2026-09-28
+
+### Fixed
+
+- Keep-alive no longer treats cancelled, killed, or failed project workers as
+  replacement leads, and recognizes descendants whose session senior belongs
+  to the lead.
+- Company-scoped lane flags resolve ownership from a complete lane company,
+  then a complete mesh company, then the lane's unique project company.
+
+- Merge hold and review checks unwrap commands through common shell wrappers.
+  Unparseable merge commands are blocked only when an enabled hold or review
+  enforcement applies.
+
+### Added
+
+- Add `hq lanes review` records and optional reviewed-head checks to
+  `hq lanes hold check` for senior lanes.
+
+## [5.268.0] — 2026-09-28
+
+### Fixed
+
+- `hq core ontology duplicates` now proposes the original entity file as the
+  survivor when it ties with its numbered copies (`hq-core 2.md`). Before, the
+  path tiebreak picked the copy, which it did for 129 of 530 Indigo groups.
+
+## [5.267.0] — 2026-09-28
+
+- Company billing links opened by CLI plan-limit flows now carry cli_limit attribution into checkout telemetry.
+
+### Fixed
+
+- Local bots now read the idle inbox backoff flag with a 2 s budget. The
+  150 ms budget timed out from home networks, so bots kept polling every 2 s
+  even when the flag was on for them.
+
+## [5.266.0] — 2026-09-28
+
+### Added
+
+- `hq daemon run --host desktop` lets the HQ desktop app run the daemon as its
+  own child process. The daemon then runs sync even though the app is open, and
+  records the app as its host in `state.json`. Older per-service installers
+  such as `hq mesh daemon install` treat a hosted daemon as installed and hand
+  their service to it.
+
+## [5.265.0] — 2026-09-28
+
+### Added
+
+- The `lanes.kr-freshness` flag tracks each manager KPI in a runtime-owned
+  ledger and queues one corrective resume for each stalled KPI set. The
+  freshness window defaults to six hours and can be set with
+  `kr_freshness_hours` in the lanes config.
+
+### Fixed
+
+- Reconcile resolves a missing lane company for keep-alive and supersession
+  flag reads, and watch applies the same resolution to keep-alive checks.
+  Unusable project ownership remains unresolved; reconcile reports
+  `keep_alive_company_unresolved` or `keep_alive_flag_off` instead of silently
+  skipping those candidates.
+
+## [5.264.0] — 2026-09-28
+
+### Removed
+
+- The `checkpoint.ontology.entity-hints` flag and its per-input `known_entities`
+  list. It was never turned on outside measurement runs.
+
+## [5.263.0] — 2026-09-28
+
+### Fixed
+
+- The version gate compares offers with the running CLI and recognizes
+  generated global shims before reporting a PATH shadow.
+
+## [5.262.0] — 2026-09-28
+
+### Added
+
+- The `checkpoint.ontology.concept-project-link` flag (off by default) lets
+  checkpoint ontology link a knowledge concept whose alias is ambiguous to the
+  one project with the same canonical name, such as HQ. It writes nothing.
+
+### Fixed
+
+- `hq doctor --live-runtimes` uses a Windows `.cmd` shim only when the sibling file exists.
+- Flag reads validate company UIDs before registry requests while preserving local
+  override precedence; Work Mesh ignores malformed UID overrides.
+
+## [5.261.0] — 2026-09-28
+
+### Fixed
+
+- Standing keep-alive leads now resume stories that remain open. Completed
+  stories resume only on standing leads with queued work, and reconcile reports
+  why other completed lanes stay idle.
+
+## [5.260.0] — 2026-09-28
+
+### Added
+
+- The `lanes.blocker-freshness` flag checks manager blockers after each turn.
+  It resumes once for stale blockers, then alerts the senior on a repeated
+  stale set. The window defaults to four hours and can be set with
+  `blocker_freshness_hours` in the lanes config.
+
+### Fixed
+
+- Blocker-freshness escalations now reach session seniors through the existing
+  monitor-session inbox. Work Mesh is an optional signal, not delivery, and a
+  failed delivery is retried on a later stale turn.
+
+## [5.259.0] — 2026-09-28
+
+### Fixed
+
+- The checkpoint stop gate now recognizes path-qualified `hq core checkpoint`
+  commands without treating lookalike text as a checkpoint.
+- `hq doctor --live-runtimes` now invokes Windows npm shims through their `.cmd`
+  entry points.
+
+## [5.258.0] — 2026-09-28
+
+### Fixed
+
+- Envelope repair runs through the currently installed CLI so a long-lived
+  watcher cannot use stale worker-profile validation.
+- Updated the external-agent CLI guide to match the kit services, probe checks,
+  shipped skills, and MCP tools.
+- Fixed the Docker agent-kit launcher to supervise configured services through
+  `hq agent kit run all`.
+- `hq packages list` and `hq packs list` return an error when run outside an HQ tree.
+- `hq index collections` prints a summary when no collections are expected or registered.
+
+## [5.257.0] — 2026-09-28
+
+### Added
+
+- Add `hq lanes hold` to record company-scoped repository merge holds and
+  refuse recognized merge commands while the `lanes.repo-merge-hold` gate is
+  enabled. Hold history and release reasons stay in the local record. Checks
+  fail open with a named error when they cannot parse a command or read a hold,
+  and recognize pull-request URLs plus assignment, `env`, and `timeout` forms.
+
+## [5.256.0] — 2026-09-28
+
+## [5.255.0] — 2026-09-28
+
+### Changed
+
+- Internal: moved watch, monitor-check, and wait handlers to src/commands/lanes-watch.ts; behavior is unchanged.
+
+## [5.254.0] — 2026-09-28
+
+### Added
+
+- The `lanes.manager-status-gate` flag checks a manager lane's declared
+  status file after each provider turn. It queues at most one corrective
+  resume if the file was not updated. An invalid or out-of-boundary mapping
+  disables the gate for that lane and lets the lane start.
+
+### Fixed
+
+- The end-of-session work report is no longer dropped when the background
+  transcript watcher polls late or adopts a session after a restart. A
+  synthesized `turn_end` now carries the transcript time, capped at now, and
+  is never earlier than the last event sent for the session.
+- `hq db sql --remote` is hidden because remote SQL is not available in this
+  CLI build. Existing scripts get a clear error, and local SQL remains
+  available without `--remote`.
+- `hq secrets` and `hq run` now use cached secrets during a temporary server outage, up to each secret’s configured cache lifetime. The default is three hours; revoked and high-security secrets still fail closed.
+
+## [5.253.0] — 2026-09-27
+
+### Added
+
+- `hq publish --handle <handle>` publishes a pack under one of the creator handles your
+  account owns, for accounts that own more than one. The server refuses a handle you do
+  not own with a plain message. `--as` is unchanged and cannot be combined with `--handle`.
+
+## [5.252.0] — 2026-09-27
+
+### Added
+
+- `hq report publish` takes a snapshot of the finished page and publishes it as the report's preview image, using a browser already installed on the computer. A page that names its own preview image keeps it. If no browser is found the report publishes without a preview.
+
+## [5.251.0] — 2026-09-27
+
+## [5.250.0] — 2026-09-27
+
+### Fixed
+
+- A Work Mesh session bound to a project and task keeps the binding episode the
+- An enrolled agent that sets `HQ_AGENT_DIR` now acts as that agent in every
+  command, not only under `hq agent`. `hq dm` and `hq secrets` used to look
+  for a person's session instead, find none, and open a browser sign-in. On
+  the Runneth pilot that hung the first reply for four minutes. Only the
+  explicit variable counts, so a bot living beside its owner on the owner's
+  computer never takes over the owner's commands.
+- On an agent host (Linux, no terminal, no display), a missing session now
+  fails at once with the fix instead of opening a browser sign-in that
+  nobody can complete.
+- `hq agent enroll --name` no longer overrides `HQ_AGENT_DIR`. A bot that
+  pointed its identity at persistent storage had it written under `$HOME`
+  instead, where a rebuild erases it, with a message claiming a person was
+  signed in when nobody was.
+- `wake.log` no longer records the wake command's standard output. A wake
+  command's normal output (a routine record, an echoed prompt) is not
+  diagnostic, and on a share without permissions the log is readable by
+  anything with access to the share. Errors are still logged.
+- Bots now reply in the group or channel a message came from. Their inbox
+  shows the channel id, `hq dm <channelId>` and the `hq_dm_send` tool post by
+  that id (including unnamed group DMs), and the wake and inbox instructions
+  say to answer there. Before, a bot answered a group message with a private
+  DM to the sender, so the group never heard back. The instructions also tell
+  bots not to answer another bot's greetings or sign-offs, so two bots stop
+  acknowledging each other in a loop.
+- An agent whose identity files were moved or copied no longer goes silent an
+  hour later. The credentials file records where the host key lives; when that
+  path is gone and the key sits beside the credentials file, the CLI now points
+  at it before running any agent command. `hq agent probe` also fails when the
+  host key is missing, instead of passing on a cached token and leaving the
+  agent to fail at its next refresh.
+
+## [5.249.1] — 2026-09-27
+
+## [5.249.0] — 2026-09-27
+
+### Fixed
+
+- Lanes flags with no registry row now quietly resolve off. Actual registry
+  read failures still emit their `flag_read_failed` event.
+- Plan-limit notices prefer the current usage-limits upgrade URL and can use
+  the company console billing page as a default-off hq-flags fallback.
+
+## [5.248.0] — 2026-09-27
+
+### Changed
+
+- Internal: moved the message and resume subcommands out of src/commands/lanes.ts; no behaviour change
+
+## [5.247.1] — 2026-09-27
+
+### Fixed
+
+- `hq core hq-session set company_slug` accepts case-sensitive ASCII company
+  IDs that match company directory names and writes the same value to the
+  session scope capability.
+- `hq bot create setup` stops before creating a bot when the reserved setup slug exists but its record cannot be verified.
+
+## [5.247.0] — 2026-09-27
+### Changed
+
+- The default-off `lanes.supersession-lineage-aware` flag lets a worker's lane
+  keep-alive and message delivery continue when its newer lane senior or a
+  same-profile sibling under that senior would otherwise look like a replacement.
+- Keep-alive setup reads lineage settings before provider locks, and message
+  eligibility rechecks lane and retirement state after that read.
+
+### Changed
+
+- `hq agent kit install` no longer implies the `@reboot` crontab entry is
+  enough on its own. The entry is installed and does restart the kit on an
+  ordinary host, but on a container whose root filesystem is rebuilt each boot
+  both cron and the CLI are erased along with it. The line now says so and
+  says what to do instead.
+
+## [5.246.0] — 2026-09-27
+
+### Fixed
+
+- Every file the agent kit writes now works on storage that has no file
+  permissions. A bot whose agent home is a CIFS/SMB share (Azure Files) gets
+  EPERM from `chmod`, and the writes were hitting that one at a time: the wake
+  config could not be saved, so the bot could never be told mail had arrived,
+  and any message carrying an attachment failed on download. All of them now
+  go through one writer that asks for owner-only permissions, reports whether
+  they actually took, and carries on either way. The same writer makes those
+  writes atomic, so the inbox mirror, the seen/handled id lists, the kit
+  config, the heartbeat record and saved attachments can no longer be read
+  half-written by a concurrent poller. A chmod refused for any reason other
+  than a missing capability is still a real error.
+- Picks up hq-cloud 6.18.10, which publishes the token refresh lock without
+  hard links so a bot on a network share can mint a token at all.
+
+## [5.245.0] — 2026-09-27
+
+### Fixed
+
+- Work Mesh sessions registered without a bound project (unresolved,
+  needs_project, needs_task) no longer store the register receipt as their
+  binding episode, and `hq mesh context bind-project` clears it. The server
+  dropped every session-event batch carrying that id, so turn and session ends
+  never landed and no work report posted. Existing state files are repaired on
+  the next flush.
+
+## [5.244.0] — 2026-09-27
+
+### Fixed
+
+- A bot whose agent home is on a network share can now mint a token. The
+  refresh lock was a POSIX hard-link lock, and CIFS/SMB shares — Azure Files
+  again — do not implement `link()` at all, so every mint failed with
+  ENOTSUP and took the whole probe down with it: no heartbeat ever posted
+  and the inbox poller retried and failed every 15 seconds. The lock now
+  falls back to an exclusive create, which gives the same guarantee and
+  works there. Contention still surfaces as EEXIST on both paths, so
+  stale-owner reclamation is unchanged, and a link that fails for any other
+  reason is still a real error.
+
+### Changed
+
+- The setup bot no longer posts "This one takes a minute. I'll reply here as
+  soon as it's done." when a step runs long. Other bots keep their notice.
+- After the bundled setup bot connects its first app, it says "Great, <Tool> is
+  connected" with a link to the company's integrations page on hq.computer.
+- The bundled setup bot invites teammates through the new-hire flow when HQ
+  has it, and tells the person to have the invitee check their spam folder.
+
+## [5.243.0] — 2026-09-27
+### Added
+
+- `hq auth login` remembers the last provider used on this computer and shows the Cognito provider choice page on first login. Only the provider name is stored locally.
+
+### Changed
+
+- Internal: moved the accounts, sessions and questions subcommands out of src/commands/lanes.ts; no behaviour change
+
+### Fixed
+
+- Removed the unused `cli.network.force-ipv4` hq-flags lookup and forced IPv4
+  startup path. The existing Node family-attempt timeout remains unchanged.
+- `hq auth login` continues when it cannot read or save the remembered provider. It prints a dim warning with the state path and error code; a save failure does not turn a successful sign-in into a login failure.
+- `hq doctor`, client health metadata, and feedback attachments now use the
+  newest sync-log source from the desktop app or configured daemon directory.
+  Daemon `HQ_DAEMON_DIR` overrides and log rotations are supported, and
+  numeric runner error levels count in health metadata.
+
+## [5.242.0] — 2026-09-27
+
+### Changed
+
+- Removed the completed `lanes.message-compaction-replay`,
+  `lanes.outpost-question-visibility`, and
+  `lanes.host-scoped-account-homes` gates. Their shipped behaviors now run
+  unconditionally.
+- Account-home login and `set-home` no longer require an unrelated active
+  company selection when `--company` is omitted; explicit `--company` values
+  remain validated.
+
+### Fixed
+
+- The `cli.install-path-compatibility` hq-flags key enables pnpm v11+ global-path recognition. On Windows, it also passes drive-path tarballs to tar by filename from the archive directory. The flag defaults to off.
+
+## [5.241.0] — 2026-09-27
+
+### Fixed
+
+- A bot whose only persistent storage is a network share can now enroll.
+  Enrollment wrote its credentials and then locked them to the owner, and on
+  a CIFS/SMB share mounted with a fixed file mode — Azure Files is the one
+  that found this — that last step fails outright. Enrollment died there,
+  left a temp file holding the private key behind, and offered no way
+  forward: the only writable alternative was storage a container rebuild
+  erases.
+
+  The write now reports whether owner-only permissions actually took, rather
+  than assuming they did, and `hq agent enroll` says plainly when they did
+  not: the credential is readable by anything else with access to that
+  share. The file is still requested owner-only, the result is read back
+  from the filesystem instead of trusted, a refused chmod on ordinary
+  storage still fails loudly, and a failed write no longer leaves the secret
+  behind in a temp file.
+- Resume can keep a lane on its recorded account when it uses a CLI-selected
+  model, even if that account's configured default differs. A lane without an
+  account allowlist may use any otherwise eligible account.
+- With a worker-profile account pin, resume keeps a healthy recorded account
+  that is allowed by the pin even when the pin includes other accounts and the
+  recorded account's default differs from the lane's CLI-selected model.
+
+## [5.240.0] — 2026-09-27
+
+### Added
+
+- `hq lanes` worker profiles can pin a registry persona from `worker.yaml`.
+  The composed prompt includes the worker's instructions, skill paths, done
+  criteria, and stop checkpoints. Registry approval requirements are passed to
+  workers, enforced on external-action envelopes, and recorded through the new
+  senior-only `hq lanes approve` command.
+
+## [5.239.0] — 2026-09-27
+
+### Added
+
+- `hq core checkpoint` can skip a knowledge link to a concept entity whose
+  name is also the name of an entity of another type, such as a concept
+  `hq-secrets` beside a project `HQ Secrets`. The report lists the skipped
+  link as rejected with reason `ambiguous_type`. Signal and session inputs,
+  other links and new entities are unchanged. Behind the hq-flags flag
+  `checkpoint.ontology.skip-ambiguous-concept-links`, off by default.
+
+## [5.238.0] — 2026-09-27
+
+### Added: Lane orphan reporting
+
+- `hq lanes checks` includes an orphaned-lane check. The company-scoped
+  `hq lanes orphans` report lists candidates without changing their state. Add
+  `--stop --reason <text>` to stop candidates that remain orphaned on recheck
+  and record the reason in lane history.
+
+## [5.237.0] — 2026-09-27
+
+### Added
+
+- Lane-store creates and updates record their hq-cli version. User-invoked
+  writes from older CLIs are refused, while background writers preserve newer
+  stamps and record Outpost owner versions separately. `hq lanes checks` warns
+  about newer stamps, and `HQ_LANES_ALLOW_OLDER_WRITE=1` provides a one-command
+  override with a warning.
+
+## [5.236.0] — 2026-09-27
+
+### Changed
+
+- The bundled setup bot introduces itself by the name the desktop app gives
+  it. For someone who started their own company it offers, once, to put a copy
+  of itself in Slack (on the Workforce plan, checked rather than guessed), and
+  flags its finish card so the card offers it too. It never offers this to
+  someone who joined an existing company.
+
+- The bundled setup bot now starts by asking whether you want HQ explained
+  before setup or want to jump straight in. Its explanation puts the agents
+  you already use first (Claude Code, Codex, Cursor, agents in Slack, and
+  other agents connected in the HQ console), then your team, then bots. It
+  can walk you through a Slack agent, an outside agent, inviting a teammate,
+  and sharing a connected app or a key. It checks your company's plan before
+  talking about limits or prices instead of guessing, and it no longer says
+  inviting or sharing needs a paid plan. Same change as the setup worker in
+  hq-core.
+- The bundled setup bot can end a message with two to four suggested replies
+  (likely answers to a closed question, or clear next steps) that the desktop
+  app shows as reply buttons. It leaves them out when the answer is something
+  only you can type, like a name or an email. Needs a desktop app that renders
+  them.
+
+### Added
+
+- `hq bot create --display-name <name>` gives a bot the human name people see
+  in HQ (the DM list and how the bot introduces itself), up to 35 characters.
+  The handle stays the key for every `hq bot` command, and the server slug is
+  pinned to the handle, so the reserved setup bot and restore keep matching.
+
+### Fixed
+
+- The setup bot no longer posts its notes to itself ("Now write the worker.")
+  into the chat. A message it writes right before a tool call is dropped; only
+  messages a turn ends on reach the person. When a step runs past 30 seconds
+  it now says "This one takes a minute. I'll reply here as soon as it's done."
+- Bots no longer post a stray "(no reply)" right after a real message. The
+  fallback counted only posts whose delivery had finished, so a message still
+  being sent when the turn ended looked like silence.
+
+## [5.235.0] — 2026-09-27
+
+### Changed
+
+- `hq lanes` blocker, KPI, OKR, and directive commands, checks, imports, and
+  reports read and write records in each project's local `tracker/` directory.
+  The retired Work Mesh tracker path and question index were removed. KPI and
+  OKR approvals also verify and save any supplied answered question ID.
+
+### Fixed
+
+- Removed the unused `cli.network.force-ipv4` hq-flags lookup and forced IPv4
+  startup path. The existing Node family-attempt timeout remains unchanged.
+
+## [5.234.2] — 2026-09-27
+
+### Fixed
+
+- The flag-registry worker now uses source embedded in the CLI, so package
+  updates can no longer cause startup failures by removing its script.
+
+## [5.234.1] — 2026-09-27
+
+### Fixed
+
+- A primary resume now confirms and syncs an Outpost lane queued during
+  owner-side admission. (#926)
+- Outpost messages and account moves for children of primary-hosted lanes now
+  carry the bounded hire-grant context required by the owner. (#926)
+- Outpost message resumes, moves, and admission queues now sync the returned
+  owner lane record back to the primary. (#926)
+
+## [5.234.0] — 2026-09-27
+
+### Added
+
+- A lane's senior can explicitly resume a failed lane's recorded provider
+  session with `hq lanes resume --from-failed --reason`; the secret-scanned
+  reason and recovered failure are recorded in lane history. Failed lanes
+  continue to refuse ordinary messages. (#927)
+
+### Fixed
+
+- `hq agents stop` says the stop was accepted and shows the status the API returns, instead of saying the agent has already stopped. (#922)
+
+## [5.233.0] — 2026-09-27
+
+### Added
+
+- `hq lanes wait` exits on the first selected envelope, pending-question, or
+  state change across the requested lanes. It uses a startup baseline and a
+  bounded two-second poll interval.
+
+## [5.232.0] — 2026-09-27
+
+### Added
+
+- `checkpoint.ontology.sync-gated` (off by default) turns the checkpoint
+  ontology step on like `checkpoint.ontology`. Older CLI builds do not read it,
+  so it can be turned on widely without them. With either flag on, the step runs
+  only when the hq-cloud bundled with this CLI and the one the hq daemon runs
+  are both 6.18.7 or later; otherwise it skips and says which copy is older.
+  It also skips while the daemon's sync still runs from before its hq-cloud
+  copy was installed. `hq core ontology apply` checks again before it writes and
+  reports `sync_client_old` with the reason. Earlier hq-cloud releases pushed
+  stale copies of deleted entities.
+
+## [5.231.1] — 2026-09-27
+
+### Fixed
+
+- `hq crm entity upsert` checks CRM settings first and prints the enable hint without sending a write when CRM is disabled.
+
+## [5.231.0] — 2026-09-27
+
+### Added
+
+- Behind the off-by-default `checkpoint.ontology.first-name-people` flag, the
+  checkpoint ontology instructions tell the model to name a person by their
+  first name when neither the input nor the company's entities give more,
+  instead of leaving them out. With the flag on, apply also defers a one-word
+  person whose word starts an existing person's fuller name or alias (`John`
+  when `John Smith` exists), since the model cannot see the entity tree. With
+  the flag off the instructions and apply are unchanged.
+
+## [5.230.2] — 2026-09-27
+
+### Fixed
+
+- Resuming a terminal Outpost lane whose senior lives on the primary now checks
+  hire-grant capacity on both hosts using the primary hierarchy, then syncs the
+  running owner record back to the primary. An owner CLI that rejects the
+  hierarchy context now fails with an upgrade-required error instead of retrying
+  without the grant check.
+
+## [5.230.1] — 2026-09-27
+
+### Fixed
+
+- A queued account move keeps its pending resume without reserving a running slot.
+
+## [5.230.0] — 2026-09-27
+
+### Added
+
+- Behind the off-by-default `checkpoint.ontology.no-link-aliases` flag, a
+  checkpoint ontology candidate that links to an existing entity no longer adds
+  aliases to that entity's file. The plan records `link_aliases: false` and
+  apply reports the link without writing. New entities keep their aliases.
+  Most aliases written through links were other names the text mentioned next
+  to the entity, such as `Publisher` on `indigo`.
+
+## [5.229.2] — 2026-09-27
+
+### Fixed
+
+- Standing keep-alive leads now wait after done turns for drop-box messages,
+  undelivered answers, or pending resumes; queued answers are included in the
+  next turn.
+- An unreadable question record no longer aborts reconciliation of other lanes.
+
+## [5.229.1] — 2026-09-27
+
+### Fixed
+
+- An authorized `hq lanes resume --worker` on an Outpost re-pins a changed
+  worker profile before spawn, preserves the provider session, records the
+  hash change in lane history, and syncs the resulting lane record to primary.
+
+## [5.229.0] — 2026-09-27
+
+### Added
+
+- Behind the off-by-default `checkpoint.ontology.entity-hints` flag, each
+  knowledge input in the checkpoint ontology plan lists up to 25 existing
+  entities whose name appears in the text the model reads
+  (`known_entities`). The model is told to use those names instead of naming a
+  new entity, and to skip glossary or translation table rows, paths and names
+  built from tags or slugs.
+
+## [5.228.4] — 2026-09-27
+
+### Fixed
+
+- Account history now distinguishes automatic moves caused by a quota hold, an
+  unavailable or logged-out account, or uneven load.
+
+## [5.228.3] — 2026-09-27
+
+### Fixed
+
+- Work Mesh tracker rows use the local record fields. Missing blocker
+  `opened_at` values use `createdAt`, and invalid mesh rows identify Work Mesh
+  as their source.
+- KPI and OKR records retain their status when read from Work Mesh, including in
+  `kpi list`, `okr list`, and `team --json` output.
+
+## [5.228.2] — 2026-09-27
+
+## [5.228.1] — 2026-09-27
+
+### Fixed
+
+- Reparenting an Outpost lane from the primary now dispatches to the owner,
+  where the hierarchy, tenant, depth, and enabled hire-grant checks are repeated.
+  The primary syncs the changed lane and each descendant whose depth changed.
+  `hq lanes show <lane-id>` refreshes that Outpost lane and its descendants
+  from the owner, including senior history, depth, and grants. Lane sessions
+  now share their lane's depth, and an SSM owner dispatch can change a
+  user-senior lane's grant without allowing a lane caller to impersonate the
+  user.
+
+## [5.228.0] — 2026-09-27
+
+### Changed
+
+- Lane hire grants and Claude account balancing are always active.
+  `backfill-grants --apply` refuses to write; dry-run output remains available.
+
+## [5.227.1] — 2026-09-27
+
+### Fixed
+
+- `hq files browse` and `hq files search` no longer crash on vaults with many objects.
+
+## [5.227.0] — 2026-09-27
+
+### Added
+
+- `hq lanes tracker`, `checks`, `import`, and `report` use the Work Mesh tracker
+  store when `lanes.tracker-mesh` is enabled. Company questions are indexed and
+  shared across hosts; reconcile polls for remote answers, wakes the owning lane,
+  and stamps delivery once.
+
+## [5.226.0] — 2026-09-26
+
+### Added
+
+- `hq staff reset-test-account <email>` wipes a designated test account through
+  the hq-pro admin API. Defaults to a dry-run that lists what would be deleted;
+  `--execute` prompts for the typed email confirmation before wiping, and
+  `--yes` skips the prompt. Refuses to run for callers whose stored email is
+  not on the staff list.
+- `hq staff test-account add|remove|list` manages the designated-test-account
+  registry through the same admin API. `add` and `remove` require staff
+  callers; `list` returns the current registry entries.
+
+### Fixed
+
+- `hq lanes message` now probes the worker PID and start time before queueing.
+  Watcher and reconcile recover accepted inbox messages through the same
+  resume path after classifying an exited worker; undrained messages on done,
+  killed, retired, or superseded lanes are archived as undeliverable.
+- Failed queued-message recovery restores unaccepted claims to the inbox and
+  records the failure. Recovery also sees leftover draining and inflight files,
+  and synchronous classification shares watcher ownership to prevent duplicate
+  repair and resume work.
+- `hq agent enroll --name <bot>` now works on a computer where a person is signed in. It enrolls into `~/.hq-agent/<bot>/` and refuses only if that folder already holds an agent. Before, it refused because of the person's login and told you to pass `--name`, which you already had. Enrolling with no name on such a computer (the default local folder) had the same bug.
+- Pushes made as an agent now record the agent as the uploader. Before, on a computer where a person was also signed in, the files were stamped with the person's email and id.
+- When the server refuses some paths in a push (for example, another member's file in a private folder `foo/`), the warning now says the server refused them, in `hq sync push`, `hq sync now` and `hq sync push --all`. Before, it said the files were outside your write access and to ask an admin for a grant.
+
+## [5.225.0] — 2026-09-26
+
+### Changed
+
+- Local bots can use the default-off `agents.inbox-poll-backoff-local-cli`
+  gate to increase idle inbox polling from 2 seconds to a capped 30-second
+  backoff. New messages and completed turns reset the cadence.
+
+## [5.224.0] — 2026-09-26
+
+### Added
+
+- `hq lanes import --company <slug> --dry-run` previews tracker records from
+  the mapped team ledgers and status files. `--apply` writes stable, proposed
+  records; later runs update changed imports and leave unchanged records alone.
+
+### Fixed
+
+- When `hq daemon pin-hq-cloud` names a version that is not installed yet, the
+  daemon keeps running the newest installed hq-cloud instead of falling back
+  to the older copy bundled with the CLI, and logs a warning naming the
+  missing version. The updater then installs the pinned version and the
+  daemon switches to it. Before, a pin that did not match the installed copy
+  silently ran the bundled copy, which on one outpost meant a months-old sync
+  runner without recent fixes.
+
+## [5.223.0] — 2026-09-26
+
+### Fixed
+
+- Manual resume and explicitly opted-in keep-alive reconcile can move a lane
+  off a disabled or logged-out Claude account on the same host, preserving the
+  provider session, provider, and model. `hq lanes watch` reports each
+  logged-in-to-logged-out transition once with the affected lane ids. The
+  watcher stops polling terminal keep-alive lanes when no resume can run and
+  shares one local account probe across matching lanes per poll. Quota and
+  model failures keep their existing account-selection path and reason.
+
+- Client-health flag checks refresh expired person identity and use machine
+  identity when available. Identity refresh has a separate bound, and failed
+  lookups keep the existing doctor fallback path.
+
+## [5.222.0] — 2026-09-26
+
+- Checkpoint ontology, behind `checkpoint.ontology.multi-writer` (off by
+  default): entity versions that sync set aside after losing a push race are
+  merged back at the start of each plan (aliases, back-references, the higher
+  `signal_count`, the later `last_updated`). Any other difference keeps both
+  and leaves the set-aside copy, and an entity deleted since is not
+  re-created. Every entity file the step writes is recorded in
+  `.hq/ontology-outbox/<company>.json`. The apply report counts duplicate
+  entity groups, and `hq core ontology duplicates --company <slug> [--json]`
+  lists them.
+
+## [5.221.0] — 2026-09-26
+
+### Added
+
+- `hq lanes report` prints the company-scoped owner report and `hq lanes team
+  <slug>` shows OKRs, KPI trends, work, blockers, and questions. Successful
+  reports save their per-company report time for the next report and team page.
+  PR, release, and deployment references on stories may be strings, integers,
+  or objects. Only timestamped objects count as activity. Invalid rows appear
+  under their team's errors, set exit status 2, and leave the saved report time
+  unchanged.
+## [5.220.0] — 2026-09-26
+
+### Fixed
+
+- Lane questions now resolve their company from the lane's project before using
+  the active HQ company. Project ownership is used only when unique; otherwise
+  active-company selection applies without choosing a project owner. Legacy
+  questions can be answered with `--company <slug>` when lane or project
+  ownership cannot be resolved.
+
+- CLI updates no longer interrupt background flag refreshes when the
+  self-contained worker rollout is enabled.
+
+## [5.219.0] — 2026-09-26
+
+### Added
+
+- `hq lanes checks` reports six company-scoped tracker checks, prints the
+  records that need attention, and exits with status 2 when any check fails.
+  Input errors return a path-bearing error envelope with status 1. Teams come
+  from `juniors.json` mappings or projects with blocker, KPI, OKR, or directive
+  tracker records, so unrelated project PRDs are not read. Thresholds can be
+  adjusted in `personal/lanes/config.json`.
+
+### Fixed
+
+- `hq lanes` questions now record their company and `delivered_at` when a lane
+  receives an answer. Secret-shaped question text and answer notes are rejected
+  before storage. Existing questions without a company remain readable.
+
+- Legacy personal-store answer notes continue to load from personal storage
+  after their lane gains mesh-company attribution.
+
+## [5.218.0] — 2026-09-26
+
+### Fixed
+
+- The reconcile summary now lists opted-in lanes it could not resume and why.
+  Stderr provides reason-specific guidance and recommends reapplying opt-in only
+  when that can help.
+
+## [5.217.0] — 2026-09-26
+
+### Fixed
+
+- Keep-alive resumes a lane interrupted by `exited_with_partial_output` when
+  the interruption followed its explicit opt-in. Quota and host-loss
+  interruptions, login failures, and stopped lanes remain ineligible.
+
+## [5.216.0] — 2026-09-26
+
+### Fixed
+
+- Lane watchers keep valid questions from a malformed `ask` envelope when
+  repair is skipped, cannot start, or still produces invalid output. The lane
+  stores the validation errors, and recovered question context includes them.
+  Repair spawns ignore unknown profile metadata and log the field names.
+  `hq lanes create` and `hq lanes resume --worker` keep strict validation.
+
+- `hq lanes` stops sending status updates for stories missing from the project
+  board. The watcher reports the refusal once per lane run and keeps appending
+  lane events.
+
+## [5.215.0] — 2026-09-26
+
+### Fixed
+
+- hq-cli 5.211.0 could resume a retired lead from its worker profile's
+  `keep_alive` value. Reconcile now requires an explicit lane opt-in written
+  after the latest envelope, and skips retired or superseded leads.
+
+## [5.214.0] — 2026-09-26
+
+### Added
+
+- `hq lanes keep-alive <lane-id> --on|--off` lets a lane's senior opt in on
+  the host that owns the lane.
+
+- `hq doctor` now checks the last hour of the sync runner log for stuck
+  realtime lag, cloud permission refusals, runner restart loops, device-limit
+  backoff, and repeated conflicts. Client health reports send these to Sentry
+  as reason codes and counts only.
+
+### Fixed
+
+- The desktop app's first sync push now uploads files inside private folders.
+  The credentials the app hands to `hq sync push --creds-from-stdin` cannot
+  write there directly, so the push also passes the vault config to hq-cloud
+  6.18.5, which sends those files through presigned uploads.
+
+## [5.213.0] — 2026-09-26
+
+### Fixed
+
+- `hq lanes accounts set-home` and `login` return
+  `company_selection_failed` for company-selection errors without a stack
+  trace. Other resolver failures remain `internal` and include a stack trace.
+
+## [5.212.0] — 2026-09-26
+
+### Changed
+
+- `checkpoint.ontology.ignore-annotations` now strips annotator entity lists from the ontology inputs only when the checkpoint sibling runs on grok. On a machine that falls back to claude or codex the model reads the annotated inputs as before, because Claude on stripped inputs lost 0.139 recall on the gold-v2 set.
+
+## [5.211.0] — 2026-09-26
+
+### Fixed
+
+- Reconcile now applies `keep_alive` from a recorded worker profile to older
+  lanes whose lane field is unset. An explicit lane value wins, unreadable
+  profiles fail closed and are reported, and `lanes show --json` identifies
+  the source of its effective value.
+
+## [5.210.0] — 2026-09-26
+
+### Fixed
+
+- Lane messages delivered during a provider turn are replayed after transcript
+  compaction when `lanes.message-compaction-replay` is enabled, limited to that
+  provider turn. Monitor events keep their data framing.
+
+## [5.209.0] — 2026-09-26
+
+### Added
+
+- Behind the off-by-default `checkpoint.ontology.grok-backend` flag, `hq core checkpoint --backend auto` tries grok first for the payload company and falls back to the usual order when grok is missing or crashed last time. The detached ontology plan reads the flag and records it in the company state directory, so the foreground checkpoint makes no network call; a flag change applies from the checkpoint after the next plan.
+- Behind the off-by-default `checkpoint.ontology.ignore-annotations` flag, the checkpoint ontology plan gives the model a copy of each knowledge input without the old cloud annotator's `entities:` front-matter list and entity links, which were mostly wrong and which the model copied.
+
+## [5.208.0] — 2026-09-26
+
+### Fixed
+
+- `hq lanes accounts set-home` and `login` accept `--company <slug|uid>` and
+  scope the host-account-home flag read to that company.
+- The `hq daemon` updater now installs new hq-cloud patch releases. It looks up the newest release in the bundled major version and installs that exact version. Before, `npm install` with a version range kept an installed copy that already matched the range, so the updater stayed on 6.18.1 after 6.18.2 was published. A failed lookup is reported as a failed update and installs nothing.
+
+## [5.207.0] — 2026-09-26
+
+### Added
+
+- The SessionStart hook can send client health reports straight to Sentry when
+  the company enables `client-health.sentry-direct`. Reports exclude doctor
+  text and company names. With the flag off, the hook keeps using the existing
+  feedback route.
+
+## [5.206.0] — 2026-09-26
+
+### Fixed
+
+- Startup recovery no longer waits the full install deadline when an unchanged retired hq-cli package remains beside the install. Node 24 ESM loader file-read `ENOENT` errors also enter the existing recovery path and receive a report tag.
+
+## [5.205.0] — 2026-09-26
+
+### Added
+
+- `hq lanes create` and `hq lanes resume` accept `--keep-alive`. When the
+  default-off `lanes.lead-keep-alive` flag is enabled, an opted-in lead lane
+  resumes after a `done` turn that leaves its story open. The first resume
+  waits at least five minutes; later attempts back off to an hour and stop
+  after 24 consecutive attempts.
+  `hq lanes show --json` reports the counter and next eligible time.
+- Worker profiles accept boolean `keep_alive`. Add this key only after the
+  hq-cli release with this change is installed; older CLIs reject unknown
+  profile metadata.
+
+### Fixed
+
+- Claude result text that says `Not logged in` or `Please run /login` now marks
+  a lane failed with `account_not_logged_in` when no envelope was written.
+
+## [5.204.0] — 2026-09-26
+
+### Added
+
+- `hq lanes accounts set-home` adds a host-specific home to the synced lane
+  account registry. Account status and Claude balancing now distinguish a
+  missing home from a signed-out account.
+
+## [5.203.0] — 2026-09-26
+
+### Added
+
+- `hq monitor` runs a script in the background and delivers each line it prints to a lane or to a Claude, Codex, or Grok session, marked as monitor data. `--persistent` keeps it running past the 30-minute limit of Claude's Monitor tool and cannot be combined with `--timeout`. An idle target gets a check-in every 55 minutes so its next turn still reads from the prompt cache. The command is off unless the `monitor.enabled` flag is on.
+- `hq lanes message` and `hq lanes resume` now reach a Grok lane that has finished or is blocked. The lane records Grok's session id when it exits, and the follow-up continues that session with `grok --single --resume`. A Grok lane still cannot move to another Grok account.
+
+## [5.202.1] — 2026-09-26
+
+### Fixed
+
+- Security: `hq integrations` now masks credentials in MCP endpoint URLs in
+  text, JSON, connect hints, errors, and `hq doctor` integration remediation.
+  API requests still use the original endpoint URL.
+
+## [5.202.0] — 2026-09-26
+
+### Added
+
+- Behind the off-by-default checkpoint.ontology.company-brief flag, the checkpoint ontology plan writes company-brief.md from the local entities, signals and source index, with no model call; recent signals are dated through their source.
+
+## [5.201.4] — 2026-09-25
+
+### Fixed
+
+- Claude account balancing on lane resume now respects the attached worker
+  profile's account pin, skips accounts pinned to a different model, and treats
+  `--account` naming the current account as a keep request for message/resume.
+
+## [5.201.3] — 2026-09-25
+
+### Fixed
+
+- A flag-registry worker whose startup fails because the working directory was deleted or its package files were being replaced no longer creates a Sentry issue. Other flag-registry worker errors remain visible with a worker tag.
+
+## [5.201.2] — 2026-09-25
+
+### Changed
+
+- The checkpoint ontology plan tells the model to name a person by the full name the input or the company's entities give, not a first name alone.
+
+## [5.201.1] — 2026-09-25
+
+### Fixed
+
+- Outpost grant checks now include child lanes from the owning Outpost. Owner
+  records take precedence over duplicate primary records, and each grant
+  command reads the owner lane list once.
+- Outpost grant checks re-read owner lanes under the hire lock and use the
+  validated Outpost CLI override for the lane-list probe.
+
+## [5.201.0] — 2026-09-25
+
+### Added
+
+- `hq daemon pin-hq-cloud <version>` pins the daemon-managed hq-cloud version to an exact semver within the bundled major, including prereleases; `--clear` removes the pin.
+
+### Fixed
+
+- The daemon carries `Environment=` assignments from Linux `outpost-sync.service` drop-ins into its sync unit.
+
+## [5.200.1] — 2026-09-25
+
+### Fixed
+
+- `hq lanes questions show` and `answer` preserve `question_not_found` when
+  Outpost question visibility is disabled, even if an owned Outpost lane has
+  no company. `questions list --all-hosts` also omits the company-unavailable
+  error while the gate is off.
+
+## [5.200.0] — 2026-09-25
+
+### Fixed
+
+- `hq lanes list` now fetches Outpost hire summaries once per host and reuses
+  them for 60 seconds. Missing or invalid owner rows keep the local summary and
+  include a warning.
+
+## [5.199.0] — 2026-09-25
+
+### Added
+
+- `hq lanes questions list --all-hosts` reads questions from Outposts that own
+  this primary's lanes. Rows include the host, and an unavailable Outpost is
+  named in `errors` while local questions remain available. Remote rows use the
+  audience computed by the owner, and eligible Outpost reads run with bounded
+  concurrency. The primary can show and answer an Outpost-only question, then
+  save the owner's confirmed answer locally. Cross-host lookup requires the
+  company-scoped `lanes.outpost-question-visibility` hq-flags gate. Use
+  `--company` to limit a list or answer to one company.
+
+### Fixed
+
+- Registry-backed hq-flags readers now use the central registry endpoint when
+  `HQ_FLAGS_API_URL` is unset or blank. Explicit endpoints and local overrides
+  keep precedence, and process-wide gates retain their legacy fallback until a
+  registry snapshot is ready.
+
+## [5.198.1] — 2026-09-25
+
+### Fixed
+
+- Session questions stay with live or unknown sessions until their configured
+  unanswered timeout; only a positive `session_end` advances immediately. When
+  there is no Work Mesh entry, hq-cli checks Claude transcript metadata in
+  configured account homes without opening transcript contents, using the
+  newest matching mtime. Metadata errors remain visible and do not block the
+  independent timeout. The timeout defaults to 600 seconds. A running-lane
+  answer reports `awaiting_next_tool_call` after its durable dropbox append.
+
+## [5.198.0] — 2026-09-25
+
+### Added
+
+- `hq lanes blocker`, `kpi`, `okr`, and `directive` commands record project
+  tracker data locally when the company-scoped `lanes.tracker` gate is enabled.
+  KPI and OKR sets remain proposals until explicitly approved, and resolved
+  blockers are hidden unless listed with `--all`.
+
+### Fixed
+
+- A local bot no longer posts "I didn't finish that — I was restarted while I
+  was working on it" into a room on messages nobody addressed to it. An
+  unmentioned room turn interrupted by a restart or owner stop is now acked
+  and cleared silently on the next start; a saved final answer for that turn
+  is still posted, and DMs and @-mentioned room turns still get the notice
+  (2026-09-25 hq-launch-ga-testing incident). Markers written by older
+  versions without the new `silenceable` field keep today's behaviour.
+- A grok turn that exits non-zero with a whole-stdout pretty-printed JSON
+  envelope (rather than NDJSON events) now logs the real error text —
+  `result` / `error.message` / `subtype` — instead of the last characters of
+  the JSON tail (`"costUsdTicks" | } | "numTurns" | }`). Log only; never
+  posted to a person.
+
+## [5.197.0] — 2026-09-25
+
+### Fixed
+
+- Concurrent QMD reindex runs after sync and `hq index sync` are serialized behind the shared lock when the default-off `qmd.reindex-single-flight` hq-flags canary is enabled. A skipped sync reports no successful update.
+- Process-wide hq-flags gates now resolve with the active company's identifier when a company is bound.
+- Concurrent `hq lanes` updates now wait for an in-progress project story-ledger
+  lock receipt, avoiding transient `story_ledger_lock_invalid` errors.
+
+## [5.196.0] — 2026-09-25
+
+## [5.195.1] — 2026-09-25
+
+### Fixed
+
+- Local bots can no longer loop with each other in a room. Three guards close
+- A checkpoint run from inside an HQ lane no longer passes the lane's identity
+  (`HQ_LANE_ID`, `HQ_PROJECT_ID`, `HQ_STORY_ID`, `HQ_POLICY_WORKER_DIR`) to the
+  background sibling. Before, the lane drop-box hook delivered the lane's
+  operator messages to the sibling instead of the lane.
+
+## [5.195.0] — 2026-09-25
+
+### Fixed
+
+- Work Mesh transcript-watch quiet `session_end` for hook-covered sessions now
+  uses the shared sequence and counts hook turns (#818).
+
+## [5.194.1] — 2026-09-25
+
+### Fixed
+
+- `hq core ontology apply` no longer creates a new entity that is probably an
+  existing one. A candidate whose alias is already another entity's name or
+  alias, or a person whose name contains every word of an existing person's
+  full name (for example "Chaudhry Hassaan Saleem" and "Hassaan Saleem"), is
+  held back and reported as a suspect duplicate.
+
+- `hq auth` and other CLI fetches can opt into IPv4-first networking through the
+  default-off `cli.network.force-ipv4` hq-flags gate. The canary is bounded and
+  keeps explicit Node network options in control.
+
+## [5.194.0] — 2026-09-25
+
+### Added
+
+- `hq core checkpoint` can now maintain the company ontology, the job the
+  cloud ontology gardener did. It is off unless the hq-flags flag
+  `checkpoint.ontology` is on for the checkpoint's company
+  (`HQ_FLAG_CHECKPOINT_ONTOLOGY` is the local override). When a checkpoint
+  names a company, the background sibling runs `hq core ontology plan`, which
+  checks the flag and lists the company knowledge and signal files that
+  changed since the last run, within a fixed input and token budget. The
+  sibling writes entity candidates for those files, and
+  `hq core ontology apply` validates them and writes them. It updates an
+  existing entity rather than creating a duplicate, and keeps entity ids in
+  the cloud's format. It writes only to the checkpoint's own company and never
+  follows a symlink. It adds a back-reference to each signal that names an
+  entity, skipping signals the gardener already linked, and a rerun changes
+  nothing. Files under `@{key}` audience folders are not read.
+
+## [5.193.1] — 2026-09-25
+
+### Fixed
+
+- Work Mesh project sync maps ledger states (`todo` to `queued`, `in_progress` to
+  `in_progress`, `in_review`/`verification`/`blocked` to `review`, and `done`/`dropped`
+  to `done`), with explicit `status` taking precedence and `passes` preserved. PRD
+  sync emits review transitions; Board readers preserve unknown status strings and
+  ignore unknown ledger states. `hq mesh project ensure --dry-run` previews merged
+  Board statuses without writing.
+- Claude lane balance reports now normalize Outpost lane-list and queued show
+  views before strict lane-record validation, including `no_story_reason: null`.
+
+## [5.193.0] — 2026-09-25
+
+### Fixed
+
+- `hq secrets set` now handles a closed stdin descriptor during terminal cleanup.
+
+### Improved
+
+- Sentry reports for failed skill-wrapper replacement now include bounded ownership-state tags.
+
+## [5.192.2] — 2026-09-25
+
+### Fixed
+
+- Create, resume, automatic repair, and apply now read
+  `lanes.claude-account-balance` from hq-flags. `HQ_FLAG_*` remains the local
+  override, and a registry read failure keeps the gate off. The
+  `accounts balance --json` report includes `balance_gate_enabled`.
+- `hq lanes accounts balance --apply` now honors each lane's company-scoped
+  gate, skips disabled company lanes, and rechecks the gate before moving.
+
+## [5.192.1] — 2026-09-25
+
+### Fixed
+
+- `hq lanes questions answer` now resumes an asking lane as soon as its final
+  pending question is answered. When capacity or throttling prevents a start,
+  hq-cli queues the lane with an `answered_questions` resume and the answer
+  timestamp. It sends Outpost answers to the lane's owner and reports any
+  unanswered sibling questions or a named wake error. After the owner confirms
+  the answer, the primary's question copy is marked answered as well.
+
+## [5.192.0] — 2026-09-25
+
+### Added
+
+- `hq agents models` lists cloud-agent catalog entries by provider and supports JSON output.
+  Provision and update validate model IDs against the catalog. They use the cached
+  catalog when the endpoint is unavailable, and rely on server validation if no cache exists.
+
+### Fixed
+
+- `hq report adopt` checks whether scheduled jobs are enabled for the company before creating a cloud job, and explains when the server rejects a disabled job.
+
+## [5.191.0] — 2026-09-25
+
+### Fixed
+
+- `hq agents provision` now rejects an invalid `--slug` before sending the agent create request.
+
+## [5.190.0] — 2026-09-25
+
+### Added
+
+- `hq lanes` validates story references against project `prd.json` files and records
+  explicit `--no-story` reasons. When `lanes.story-ledger` is enabled, lane state,
+  blockers, questions, and PR links sync back to project stories. Terminal history
+  writes are atomic and retry-safe. Stale-lock cleanup reclaims abandoned ownerless
+  locks after their directory ages while preserving fresh replacements.
+  `hq lanes status --project` summarizes workers, PRs, blockers, questions, and story
+  counts.
+
+### Fixed
+
+- `hq bot promote` accepts server-signed upload URLs without SSE headers when the bucket supplies encryption. SSE header names are checked case-insensitively, and any supplied encryption must be a complete SSE-KMS pair.
+- Company slug lookup errors now point to the supported `hq sources entities` command.
+
+### Added
+
+- QMD native-binding startup failures after sync can emit an actionable warning
+  when the `qmd.reindex-startup-warning` hq-flags canary is enabled. The flag
+  defaults off, and sync still succeeds when indexing cannot run.
+
+## [5.189.0] — 2026-09-25
+
+### Added
+
+- `hq lanes resume` and `hq lanes message` accept `--effort <level>` for the next resumed provider turn. Attaching a worker profile applies its configured effort when the command has no effort flag. With neither option, the lane keeps its recorded effort. Outpost commands forward the flag and report `outpost_effort_unsupported` when the remote CLI rejects it.
+
+## [5.188.1] — 2026-09-25
+
+### Fixed
+
+- `hq lanes grant` now applies grants for Outpost-hosted lanes on their owner.
+  The primary sends a bounded hierarchy snapshot and its evaluated hq-flags
+  decision; the owner revalidates the authorized senior, applies carve,
+  occupancy, and terminal-parent checks, then syncs the changed record to the
+  primary. Dispatched lane errors include sanitized owner details.
+
+## [5.188.0] — 2026-09-25
+
+### Added
+
+- `hq lanes accounts balance --provider claude` reports per-host account load,
+  login state, and proposed moves. `--apply` moves only sessions between turns
+  and requires the default-off `lanes.claude-account-balance` hq-flags gate.
+  Claude lane creation now considers live lane counts across readable hosts,
+  including lanes whose real host identity is local on an Outpost. It checks
+  login on the target host, reports unknown login state separately, and records
+  the selection and any host gaps on the lane. Explicit `--account` choices
+  remain in effect. Automatic resume repair runs only while the balance gate is
+  enabled; with the gate off, disabled and logged-out accounts keep their usual
+  refusal behavior without reading other hosts.
+
+## [5.187.0] — 2026-09-25
+
+### Fixed
+
+- `hq mesh context prd-sync` sends only stories whose Board status changed (a first snapshot of already-done stories is not re-emitted). Quiet `session_end` summaries read Claude Code `result` lines and Codex/Grok `item.completed` agent messages, not only `type=assistant` turns.
+
+## [5.186.0] — 2026-09-25
+
+### Changed
+
+- A local bot's scheduled jobs now live with the bot. `hq bot jobs` stores them in the bot's folder (`jobs.json`) and the running bot fires them itself, through the same path as a cloud-fired job. No cloud setting is involved. A run missed while the computer slept or the bot was stopped runs once as a catch-up; a job never overlaps itself. The 25-job cap per bot is unchanged.
+
+## [5.185.1] — 2026-09-25
+
+### Fixed
+
+- `lanes.hire-grants` resolves its company-scoped hq-flags value before gating.
+  A valid local override wins; missing rows or failed reads leave enforcement
+  off. Backfills check the unscoped value and each target company's value
+  before writing. `hire_grant_exhausted` names the grantor and includes the
+  same recovery message in JSON and on stderr.
+
+## [5.185.0] — 2026-09-25
+
+### Fixed
+
+- Local bots no longer post their no-reply signal, narration, blank messages, or raw model errors into rooms. On a room message that does not mention the bot, in-between messages and the working notice are held until the turn ends, and nothing is posted when the reply is the `{"action":"no_reply"}` signal or empty. Any model failure on such a turn (not only a Grok `reasoning_only` empty response, but every model error) is now silent instead of leaking "I didn't finish that — <model> stopped with an error: <raw excerpt>" into the room. When the turn does produce content, the held in-between messages are posted alongside the final answer, so a bot that answers mid-turn and ends with a short sign-off (claude/codex) no longer loses the answer; a Grok final that just concatenates the in-between messages still posts once with no duplication. The signal is never posted as progress anywhere. DMs and @-mentions still stream and still get a reply; a `reasoning_only` failure there now says "the model returned no answer" instead of the raw internal error, and other failures there keep the existing "did not finish" message. The room prompt also tells the model to produce no output rather than explain that it is staying silent.
+
+## [5.184.0] — 2026-09-25
+
+### Fixed
+
+- Work Mesh transcript-watch now emits `session_end` for hook-covered sessions that have already been quiet for 10 minutes when first seen (the live skip path that left `skippedHook=411 ended=0`). Held/spool rescans stamp last hook activity from each event's `at`, not the scan clock, so leftover `held.jsonl` lines cannot reset the quiet timer.
+- Quiet `session_end` (and SessionEnd flush) send an optional one-sentence summary of the last assistant reply (~140 chars, tokens and secrets-file paths redacted), plus git repo, branch, and PR URLs when cheap.
+
+### Added
+
+- `hq lanes` validates story references against project `prd.json` files and records
+  explicit `--no-story` reasons. When `lanes.story-ledger` is enabled, lane state,
+  blockers, questions, and PR links sync back to project stories. Terminal history
+  writes are atomic and retry-safe. Stale-lock cleanup reclaims abandoned ownerless
+  locks after their directory ages while preserving fresh replacements.
+  `hq lanes status --project` summarizes workers, PRs,
+  blockers, questions, and story counts.
+
+- `hq doctor --json` includes stable sync `reasonCode` enums. Client-health reports add `checkId: reasonCode` pairs only when the company-scoped `client-health-sync-reason-codes` hq-flags gate is enabled. `hq doctor --fix --json` reports refresh-sync outcomes without raw error details.
+
+- Repair known stale QMD collection paths behind the default-off `qmd.collection-path-repair` hq-flags canary while preserving collection metadata.
+
+## [5.183.0] — 2026-09-25
+
+### Added
+
+- `hq core sentry report` can attach bounded hook-timeout timing context to Sentry events when the company-scoped `hook-timeout-debug-context` flag is enabled. The flag defaults off.
+
+## [5.182.0] — 2026-09-24
+
+### Fixed
+
+- `hq mesh daemon status` now asks the service manager whether the daemon is loaded (`launchctl print` on macOS, `systemctl --user is-active` on Linux). Before, it never probed and always reported "installed (not loaded)" or "installed (inactive)", even while the daemon was running.
+
+## [5.181.0] — 2026-09-24
+
+### Changed
+
+- `hq daemon` runs the session host from the hq-cloud copy it keeps up to date (hq-cloud's `hq-outpost-session-host`, when that copy has it), the same way it already runs sync and the outpost heartbeat, and restarts it after an hq-cloud update. Session-host fixes, such as starting on an Outpost that signs in with machine credentials, now reach boxes without an hq CLI release.
+
+## [5.180.0] — 2026-09-24
+
+## [5.179.1] — 2026-09-24
+
+### Added
+
+- `hq dm send` now takes `--audience <human|agent|both>` so a bot or operator
+  can declare who a DM is for, and the `hq_dm_send` bot tool accepts the same
+  optional field. Local bot turns tag in-between progress messages as `agent`
+  and the final reply as `human` by default, so status chatter stays out of a
+  person's inbox while the answer they need still reaches them. `hq dm inbox`
+  and `hq dm thread` mark agent-audience messages with an `[agent]` tag.
+
+### Fixed
+
+- Windows checkpoint stamps now use atomic replacement and bounded retries for
+  transient filesystem errors, so a brief lock does not abort the checkpoint.
+
+## [5.179.0] — 2026-09-24
+
+### Fixed
+
+- `hq integrations connect --client-id` with a Google OAuth client (`*.apps.googleusercontent.com`) now warns that the client must be of type "Web application" and prints the redirect URI to register. A "Desktop app" client cannot accept HQ's hosted callback, and Google reports that only after the browser is open.
+
+## [5.178.0] — 2026-09-24
+
+### Fixed
+
+- Work Mesh transcript-watch still tracks hook-covered sessions (interactive Claude/Codex) and enqueues `session_end` after 10 minutes of quiet. Hooks keep owning start/turn events; the quiet `session_end` is the channel work-report trigger those sessions were missing. Resume (transcript mtime or a later hook event) resets the timer. A SessionEnd hook within 60s of that emit is not treated as resume, so `/exit` does not double-fire.
+- Reloading a macOS LaunchAgent (`hq mesh daemon install`, including `--if-stale` and the post-update restart, `hq daemon install`, `hq agent kit` services, and bot agents) now waits for `launchctl bootout` to finish before bootstrapping. Before, bootstrap could race the old job's teardown, fail with "Bootstrap failed: 5: Input/output error", and leave the service unloaded with nothing running. Bootstrap now polls `launchctl print` for up to 10 seconds, retries EIO with backoff (0.5s to 8s), and on final failure either restarts the still-loaded previous job or reports that the service is NOT loaded with the `launchctl bootstrap` command to fix it.
+
+## [5.177.0] — 2026-09-24
+
+### Added
+
+- `hq lanes create --hire-grant`, `hq lanes grant`, and `hq lanes backfill-grants`
+  manage alive child-lane grants. `lanes.hire-grants` defaults off; lane list and
+  show include grant and alive-child counts. Terminal child resume, message, and
+  account-move paths recheck occupancy and remaining grant allocation. The
+  backfill defaults to dry-run.
+- When `lanes.hire-grants` is enabled, `hq lanes list` and `hq lanes show` use counts
+  from the owning Outpost for active remote lanes. If the Outpost does not return
+  counts, both commands show local counts and a warning.
+
+## [5.176.0] — 2026-09-24
+
+### Fixed
+
+- `hq bot create setup` restores the account's existing setup bot when the local copy is missing.
+
+## [5.175.0] — 2026-09-24
+
+### Fixed
+
+- `hq agent kit` now shows missing external credentials at a home-relative path and reports the missing enrollment as an actionable precondition.
+- Missing external agent credentials show an actionable error without creating a Sentry fault.
+
+## [5.174.0] — 2026-09-24
+
+### Fixed
+
+- Outpost worktree pruning now tolerates cwd `EACCES` only for the verified
+  same-user systemd `(sd-pam)` helper. Other same-user cwd failures and all fd
+  scan failures remain fail-closed. This entry was listed under 5.173.0 by
+  mistake: 5.173.0 was tagged before the change merged, so it first ships here.
+
+## [5.173.0] — 2026-09-24
+
+### Fixed
+
+- `hq bot stop <name>` run from inside that bot's own turn now lets the turn finish: it signals the bot to drain (finish the running turn, post the reply, exit 0), which launchd leaves stopped. Before, it booted out the bot's own launchd job, which killed the bot, the turn, and the stop command itself (exit 137), so no reply was posted. `hq bot restart <name>` from inside the bot's own turn is refused with instructions, and `hq bot start` from inside the bot skips the agent reload.
+- Bot LaunchAgents and systemd units, the Work Mesh daemon unit, the `hq daemon` unit, and the lanes and agent-kit units now name node by its upgrade-stable path (`/opt/homebrew/bin/node` or `/opt/homebrew/opt/<formula>/bin/node`, or nvm's `current` link) instead of the versioned `/opt/homebrew/Cellar/node/<version>/bin/node`. Before, `brew upgrade node` deleted that path and launchd could no longer start the bots. The stable path is used only when it resolves to the same node binary; otherwise the unit keeps the resolved path as before.
+- Installed bot LaunchAgents that still name a versioned or missing node are repaired: `hq bot start` rewrites and reloads the agent, a bot started by launchd rewrites its own agent and reloads it from a detached shell before it takes any message, and `hq doctor` reports it (`bots.<name>.daemon-node`), with `hq doctor --fix` rewriting only the plist file and not reloading launchd. `hq bot list` and `hq bot status` flag a missing node binary. `hq mesh daemon install --if-stale` also reinstalls a same-version unit whose node path is missing or versioned.
+
+## [5.172.0] — 2026-09-24
+
+### Changed
+
+- The `hq daemon` updater keeps hq-cloud current as well. Every 6 hours it
+  installs the newest hq-cloud with the same major version into
+  `~/.hq/daemon/hq-cloud`, and it restarts sync and the outpost heartbeat
+  right after an update. The daemon runs sync, and the heartbeat when that
+  hq-cloud has `hq-outpost-heartbeat`, from whichever copy is newer: this one
+  or the one bundled with the CLI.
+- `hq daemon` sync pushes local changes as they happen (`--event-push`), the
+  same as outpost sync does today.
+
+## [5.171.0] — 2026-09-24
+
+### Fixed
+
+- Local bots (`hq bot run`) now restart onto an updated hq-cli install. A
+  running bot checks the installed package behind its launch path every
+  minute. When a complete, valid, different version is seen on two checks in a
+  row, it stops taking new inbox items, lets running turns finish (queued items
+  stay un-acked for the next process), logs
+  `hq-cli updated <old> -> <new>; restarting to load it`, and exits 75 so
+  launchd, systemd, or `hq daemon` starts it again. A bot with no supervisor
+  starts its own replacement first. The new process logs its version at
+  startup and whether the update converged. A restart that comes back on the
+  old version blocks that target for 6 hours, and update restarts are capped
+  at 4 per hour. `hq bot status` shows the hq-cli version a bot is running.
+  Set `HQ_BOT_NO_CLI_UPDATE_RESTART=1` to turn this off.
+
+## [5.170.0] — 2026-09-24
+
+### Fixed
+
+- Switching the HQ session company (including `hq-session.sh set company_slug`) clears the Work Mesh project and task, posts `session_end` to the previous company, and holds a personal target as `needs_company`.
+
+## [5.169.0] — 2026-09-24
+
+### Fixed
+
+- `hq lanes create` and `hq lanes story <add|start|block|done>` keep story work
+  local when an existing Work Mesh Board rejects a missing story. The
+  `story_warning` identifies the project and story and suggests:
+  `hq mesh project ensure <projectId> --company <slug> --stories-file prd.json`.
+
+## [5.168.0] — 2026-09-24
+
+### Fixed
+
+- `hq mesh project set --stories-file` keeps live Board story status and
+
+- `hq mesh` ignores nonpositive, malformed, and expired `Retry-After` hints.
+
+### Added
+
+- `hq daemon` keeps the hq CLI, Claude, Codex and Grok up to date on every machine type, desktops included, every six hours. It updates the login user's own copy of each tool through that tool's npm package or its own `update` command, and leaves a copy the user cannot write (for example one root installed in /usr) alone. On outposts the daemon also runs Codex remote control (the box's Codex runner) next to Claude remote control, keeps the session name the box's runner used, and restarts either one onto a newly installed Claude or Codex once the session has been quiet for 10 minutes, or after 2 hours at the latest. `hq daemon install` never sets the daemon up to run as root: a box runs it as the login user from `/etc/hq/machine-type`, the outpost runner unit, `--user` or `sudo`, and an outpost without the marker file is recognised from its runner unit. `hq daemon migrate --apply` also takes over the outpost runner watchdogs and the Codex update timer.
+- Added outpost worktree cleanup commands for dry runs and pruning clean, aged
+  worktrees. Lane, session, and process references keep their worktrees. Pressure
+  and daily timers use the `outpost.worktree-pruner` hq-flags key, which starts off.
+  Live-lane `worker.out` files and matching Claude session transcripts are read in
+  bounded chunks. Transcript lookup reads only the file matching the lane's
+  provider session ID under `.claude*/projects/*`. An unresolved lane keeps
+  worktrees whose root, linked Git index, or linked Git `HEAD` changed at or after
+  its `created_at`; a missing or invalid start time keeps every candidate. A
+  never-spawned queued lane without a provider session does not hold a worktree.
+
+## [5.167.0] — 2026-09-24
+
+### Fixed
+
+- `hq lanes stop` sends Outpost-hosted stops to the owning host and updates the
+  local record after confirmation. If the Outpost already finished the lane,
+  the CLI syncs its terminal state.
+- Story updates, reparenting, admission, question creation, and active answer
+  delivery return `lane_remote` when another host owns the lane. Message, resume,
+  and move keep their Outpost dispatch paths.
+
+## [5.166.0] — 2026-09-24
+
+### Changed
+
+- The setup bot can explain what HQ is: the shared context layer for a whole
+  team, their coding tools (Claude Code, Codex, Cursor) and every bot. It no
+  longer repeats the finish card in replies after setup ends.
+
+## [5.165.0] — 2026-09-24
+
+### Fixed
+
+- Codex lane starts and resumes now pass the assigned worker policy directory to
+  policy hooks.
+
+## [5.164.0] — 2026-09-24
+
+### Fixed
+
+- When a startup import fails, hq-cli checks for an update lock, a retired package
+  directory, or install-tree changes for 1.5 seconds. If none appears, it exits
+  with `npm install -g @indigoai-us/hq-cli@latest` instead of waiting 90 seconds.
+  Sentry context replaces the home-directory prefix with `~`.
+- Sentry keeps the `guarded`, `unsettled`, `reexec-failed`, and `lock-held`
+  outcomes, adds `stale_tree` and `tree_state`, and tags `updater_source` when
+  known. The fingerprint remains `["InstallTreeTornError", "outcome:<token>"]`,
+  so the four existing outcome groups keep their keys.
+
+## [5.163.0] — 2026-09-24
+
+- Workforce plan refusals in the CLI keep direct checkout for eligible companies.
+  The server upgrade URL stays visible; personal refusals and checkout failures can
+  open it. Non-TTY and JSON runs print only the URL and exit non-zero.
+
+- `hq mesh` sends at most 25 replayed events for a session in one flush. It honors `Retry-After` on 429 and 503 responses and stops waiting when the daemon shuts down.
+
+### Added
+
+- `hq daemon` now also runs the `updater` (hq CLI and Codex updates every six hours, then restarts the daemon onto the new version), `remote-control` (`claude remote-control` in a private tmux session on outposts) and `jobs-reconcile` (the outpost jobs reconcile script every ten minutes). `hq bot`, `hq mesh daemon install` and `hq lanes reconcile install` hand their service to the daemon when it is installed instead of adding their own background unit. `hq daemon migrate --apply` stops the older HQ background units and moves their definitions aside so the daemon runs those services, and `hq daemon uninstall --restore-legacy` puts them back; The desktop app's own sync agent is never taken over.
+- `hq daemon` runs all of a machine's HQ background services under one supervisor. `hq daemon install` works out whether the machine is a desktop, self-hosted server, outpost, agent box or agent kit, installs one background service, and starts that machine type's default services (sync, mesh, heartbeat, bots, lanes cleanup, search indexing and log rotation, depending on the type). `hq daemon enable|disable <service>` changes the list for one machine. `status`, `logs`, `restart` and `trigger` manage the running services. A service that an older background unit already runs is left to that unit, and `hq daemon migrate` only lists what it would take over. The command is hidden from `hq --help` while it rolls out. It needs no feature flag.
+
+## [5.162.0] — 2026-09-24
+
+### Fixed
+
+- An invalid envelope that remains after its repair turn no longer leaves a
+  lane inaccessible. Operators can resume or message a failed lane with a
+  recorded provider session, and the next envelope slot gets one new repair
+  attempt with the validation errors in the prompt.
+
+## [5.161.0] — 2026-09-24
+
+### Fixed
+
+- No-reader flag gates now honor only `true` and `false` in `HQ_FLAG_<KEY>`
+  overrides when the registry endpoint is unset or its reader is unavailable.
+
+## [5.160.0] — 2026-09-24
+
+### Added
+
+- Worker profiles can deliver validated policy files through an installed HQ
+  hook or include them in the prompt when the hook is unavailable. Resume and
+  message can attach a profile, and resume can attach a mesh company. Bot-owned
+  Claude profiles may rely on provider configuration for optional model,
+  account, effort, and fast-mode values.
+
+- Added `hq agents login-code`, which submits a Claude subscription code from
+  an argument or stdin. Provisioning help shows the Agents v2 command and
+  account requirement. Claude subscription creates print the console URL and
+  login-code command.
+
+### Fixed
+
+- If a Codex or Claude worker exits without writing this run's envelope, hq lanes
+  gives its session one resume turn to write the expected file. The watcher and
+  dead-host recovery ignore earlier envelopes. If the repair still writes no
+  valid envelope, the lane remains interrupted.
+
+## [5.159.0] — 2026-09-24
+
+### Fixed
+
+- Hook timeout reports now identify the slow child hook and group concurrent
+  session-wide slowness together. Update checks have bounded network calls, and
+  the core-write guard avoids repeated subprocess work.
+- Machine-wide hook warnings and exceeded timeouts now keep separate Sentry
+  groups, and per-script rate limits no longer suppress a later machine-wide
+  report from the same session.
+
+## [5.158.0] — 2026-09-24
+
+### Added
+
+- `hq lanes create --placement auto` selects a host with room for the provider and account. Managers can set `--default-placement` for their workers, `hq lanes list` shows capacity by host while `lanes.outpost-load-balancing` is enabled, and `hq lanes move` can relocate a queued lane that has not started. Remote worker profiles must match the creator's content hash.
+- `hq lanes outpost-identity backfill --id <id>` fills a missing Outpost marker without replacing another value. New Outposts write their id to `/etc/outpost/outpost-id` so lane commands can identify the host.
+
+## [5.157.0] — 2026-09-24
+
+### Fixed
+
+- Local bots (`hq bot run`) now receive HQ chat attachments. The runner reads
+  `attachments` on each inbox item, downloads every file with the bot's own
+  machine identity through the same checks `hq_attachment_fetch` uses (chat
+  attachment path only, DM must include the bot, company must be one of the
+  bot's own, 26 MiB cap), and saves it under `~/.hq/bots/<name>/attachments/`
+  (dir 0700, files 0600). The turn text lists each file's name, type, size and
+  local path, with small text files inlined; a file that could not be fetched
+  gets a one-line reason, which is also logged. A message that is only an
+  attachment is answered instead of being acked and dropped. Claude turns get
+  `--add-dir` for the attachments folder so gated permission modes can read it.
+  The MIME type is also read from the server's `kind` field.
+
+## [5.156.0] — 2026-09-24
+
+### Fixed
+
+- Project-thread lookup treats an omitted server `kind` as the project thread,
+  preventing duplicate project threads when a newer lane thread is present.
+- Lane admission reservations are refreshed after Work Mesh lane-thread
+  registration so slow registration cannot age the reservation before spawn.
+
+### Added
+
+- `hq mesh project register --channel` and `project set --channel` can bind an
+  existing channel to project events. `hq mesh check --project` shows lane
+  identity and status, including terminal lane threads.
+- Lane mesh threads keep a stable lane id across resume and account moves.
+  Events include the worker profile, model, account, parent lane, and senior
+  owner. Stop and dead-host recovery events close terminal threads.
+
+### Tests
+
+- Cover server-shaped project-thread results and reservation timing after
+  lane-thread registration.
+
+## [5.155.0] — 2026-09-24
+
+### Fixed
+
+- Lane respawns keep their recorded account to preserve provider sessions and
+  prompt caches. Automatic moves now record why they happened and are limited
+  to model changes, usage limits, and unavailable or logged-out accounts.
+- Account retries share the provider admission lock and the host-scoped provider,
+  account, and profile checks used by normal admission. Active reservations and
+  earlier eligible queue entries keep their place; blocked retries remain queued
+  for normal admission. Retries skip accounts already rejected for login and
+  retain message, resume, and answer context when queued.
+- Watcher retries resolve the current process hostname and Outpost identity, so
+  local-kind and Outpost-kind lanes on one Outpost share admission caps.
+- Account enable and registration now require a positive login check. Provider
+  startup messages for logged-out accounts trigger failover to another eligible
+  account or a named `account_not_logged_in` failure.
+
+### Added
+
+- Provider config can list accounts in preference order for a lane's first
+  assignment. Disabled, logged-out, usage-limited, and capped accounts are
+  skipped. If no preferred account is eligible, hq-cli chooses the least-loaded
+  eligible account. Running and resumed lanes keep their recorded account.
+
+## [5.154.0] — 2026-09-24
+
+### Fixed
+
+- Local bots can now open files attached in HQ chat. The new `hq_attachment_fetch` agent tool downloads a chat or DM attachment into a private folder under the bot's agent directory and returns its local path, content type, and size (text files also come back inline). It accepts only the scope-relative `chat/attachments/...` paths that `hq_inbox_read` reports, fetches only from the bot's own company or from a DM the bot is part of, refuses files over 26 MiB, and uses the API the bot enrolled against. Because the attachment reference comes from the sender, any other vault path (for example `knowledge/...`, or a folder) is refused and the bot is pointed at `hq_files_read`. Previously `hq_files_read` rejected those paths and could not read binary files such as .xlsx.
+
+## [5.153.0] — 2026-09-23
+
+### Fixed
+
+- `hq mesh context prd-sync` rebinds a session to the PRD's project when that project is in the same company, then emits `task_status` against the new project so the Board and channel line land there. A PRD in another company is still skipped and does not rebind.
+
+### Tests
+
+- Cover Outpost admission when account a is at its Codex cap and account b
+  has queued work with available capacity.
+- Cover fresh pending resumes and answered-lane resumes against provider
+  capacity.
+
+## [5.152.1] — 2026-09-23
+
+### Fixed
+
+- Windows bot runtimes resolve provider binaries through PATH and PATHEXT, safely launch npm .cmd and .bat shims, pass multiline and long prompts through stdin or Grok ACP, and stop the full process tree.
+
+## [5.152.0] — 2026-09-23
+
+### Fixed
+
+- `hq mesh daemon install` (plain and `--if-stale`) now bootouts, bootstraps, and kickstarts the LaunchAgent after writing the plist. Bootstrap retries launchd `5: Input/output error` up to five times, one second apart. After a CLI upgrade, a loaded job whose program no longer matches the plist is reloaded the same way.
+
+## [5.151.0] — 2026-09-23
+
+- `hq report publish` no longer fails when another app it cannot see holds the report's address. It publishes at the next free address (`<slug>-2`, then `-3`) and saves that address on the report.
+
+## [5.150.0] — 2026-09-23
+
+### Fixed
+
+- `hq lanes` now admits queued lanes by priority, then queue age, as provider, account, profile, or throttle capacity opens. Auto-balanced lanes can move to another eligible account when that account frees first. Create, message, resume, and pickup use the same admission checks. `hq lanes admit <lane-id>` reports the blocker, and authorized `--force` records `operator_force`. Reconcile refreshes queued reasons, and Outpost-hosted queued lanes appear as remote.
+
+## [5.149.1] — 2026-09-23
+
+### Fixed
+
+- The package now ships `scripts/mesh-daemon-if-stale.mjs`, which its postinstall step runs; a failure in that step never fails the install.
+
+### Added
+
+- Lanes can carry several project stories with a warning for parallel active
+  work. Story commands now add, start, block, list, and complete carried work.
+- Mesh lifecycle events include the story id, and board status moves through
+  `in_progress`, `blocked`, `review`, and senior-verified `done`. Missing
+  project views are repaired before a status patch is retried.
+
+### Fixed
+
+- `hq mesh context prd-sync` adds missing Board stories before it emits, and
+  records a snapshot only for stories the server accepted or left unassigned.
+  A rejected story stays changed so the next `prd.json` write sends it again.
+- The checkpoint Stop gate now accepts any non-whitespace reply by default.
+  `HQ_CHECKPOINT_REPLY_MIN` can still require a longer reply or disable the check.
+- `hq lanes message` and text resumes now reach the lane's Outpost through the existing exec transport and report failure when delivery is not confirmed. Resumes keep the last known provider session id and recover its transcript from registered account homes before spawning.
+
+## [5.148.0] — 2026-09-23
+
+## [5.147.0] — 2026-09-23
+
+### Fixed
+
+- Reinstalling an MCP server now updates its definition when the existing
+  Claude or Codex entry belongs to the same HQ pack. Unmarked and other-pack
+  entries still refuse replacement.
+- `hq mesh context prd-sync` now moves the Board. Its task_status events carry the session's company and project, and take sequence numbers from the session's shared counter (the same file the hooks use), so the server no longer rejects them as duplicates. Rejections print their codes.
+- The mesh daemon no longer treats a missing company slug, a membership timeout, or a lookup error as proof that the device owner is not a member. A device-default session that was cleared to `needs_company` is checked once against the configured default company and, when that membership is active, the company is put back and held events flush. The same cleared session is not counted as a new denial on every later flush.
+- `hq mesh daemon install` records the absolute path of the CLI that ran it (realpath of `process.argv[1]`) and the absolute node binary. It does not look up `hq` on `PATH`. The daemon logs `daemon version=<x> entry=<path>` at start and stores both in `daemon/state.json`. `hq mesh doctor` and `hq mesh daemon doctor` say when that record does not match this CLI and name `hq mesh daemon install` as the fix, and they list every `hq` on `PATH`. `hq mesh daemon install --if-stale` reinstalls and restarts only when this CLI is newer. The package postinstall runs that flag.
+- `hq mesh project ensure` no longer fails when the server refuses to close the extra genesis thread; it leaves that thread open and prints one line. Registration and the calling session's binding complete.
+- The mesh daemon re-checks a `needs_project` or unresolved session when it flushes that session's events. If the project Board is now an exact or clear catalog match, the batch is posted with that project and the session file is bound. A tie or near miss stays `needs_project`. The check runs at most once a minute per session.
+
+## [5.146.0] — 2026-09-23
+
+### Fixed
+
+- The mesh daemon asks for presence in the device-default company and the companies with a session updated in the last day (at most five), and asks again within a minute when that set changes. `hq mesh doctor` says when a company was left out because presence is off or because one credential cannot cover every company.
+- `hq mesh project ensure` closes a genesis thread only when that same call created it and register returns a different server `proj-` thread. An already-open project thread stays open on a re-run. The register route does not accept a client thread id.
+- `hq mesh project ensure` on a new project closes the client genesis thread when register returns the server `proj-` thread, so the project has one open thread. The register route does not accept a client thread id.
+- A session that registers or creates a project is bound to it. `hq mesh project ensure` and `hq mesh project set --create` bind the calling session when it is the same company and still `needs_project` or unresolved, and they leave a session that is already on a different project alone. The next prompt re-checks `needs_project` against the current catalog. `hq mesh context prd-sync --session <sid> --file <prd.json>` emits `task_status` when a bound session's story `passes` or `status` changes (`passes: true` is done, `in_progress` is in progress) and does not call the network when nothing changed.
+- `hq report publish` now fills a report's missing company from its channel and keeps it across updates. Before, a report saved without a company was published under a personal access policy and the deploy refused it.
+
+## [5.145.0] — 2026-09-23
+
+- `hq files` now preserves a trailing-slash private-folder pattern such as
+  `foo/` rather than rewriting it to `foo/*`, identifies private folders in
+  ACL and discovery output, and explains the conflict with an existing shared
+  glob. Quote a shared glob such as `'foo/*'` when invoking it from a shell.
+- `hq report` now finds reports on project channels. It listed only personal channels and treated only company-wide channels as valid, so every publish from a bot on a project channel failed with a generic deploy error. Channel lookup errors now say what went wrong.
+
+## [5.144.0] — 2026-09-23
+
+- Worker-profile models now use the same provider catalog validation as
+  `--model` during creation and before every later provider launch. The error
+  names the profile when its model is unsupported.
+- Worker resolution continues to use the existing personal, core, installed
+  package, and company worker sources. hq-cli does not ship starter profiles.
+
+## [5.143.0] — 2026-09-23
+
+### Fixed
+
+- `hq dm` and report commands now reject non-recipient and non-company channel
+  requests locally, and report updates retry one fresh revision after a
+  conflict.
+- `hq mesh project register` now verifies the company's Board view before
+  registering and reports an actionable local error when the Board is missing.
+
+## [5.142.0] — 2026-09-23
+
+### Added
+
+- Added reusable personal worker profiles for `hq lanes create --worker`, with
+  strict `meta.yaml` validation, content hashes, profile-default precedence,
+  provider-specific prompt/settings carriers, and reapplication on every fresh,
+  resumed, moved, repaired, and compaction spawn.
+- Personal lanes can now use explicit `--mesh-company` attribution so their
+  project thread, presence, and lifecycle events appear in Work Mesh after
+  membership validation.
+
+### Fixed
+
+- Account login now reuses a registered account home when `--home` is omitted.
+  Codex account login also accepts `--device-auth` for remote boxes without a
+  localhost browser callback.
+- Checkpoint Stop-gate reply detection now uses the Stop payload when the
+  transcript has not flushed yet, and fails open with an ambiguity log when
+  neither reply source is reliable.
+
+## [5.141.0] — 2026-09-23
+
+- `hq bot jobs` now checks the bot's configured agent ID against the machine credential before calling the jobs API. A mismatch reports both IDs and explains how to fix the bot configuration or re-mint its credentials.
+
+## [5.140.0] — 2026-09-23
+
+### Fixed
+
+- `hq lanes monitor-check` now recognizes a live Claude Monitor task launched through the CLI's shell/node process wrapper, so active lanes are not reported as uncovered.
+
+- A session hint now binds to the best existing project. An exact Board is used as-is. An exact local PRD gets a Board through the same genesis-thread, view, then register path as `project ensure`, and is bound. A single clear match is bound with a recorded reason. When nothing matches, or two candidates are close, the session stays `needs_project` and the start hook lists the candidates. `hq mesh context bind-project` applies the answer. A flush HTTP 404 downgrades that session, holds its events, and logs one line instead of dead-lettering them. `hq mesh doctor` lists `needs_project` sessions.
+
+## [5.139.0] — 2026-09-23
+
+### Added
+
+- `hq mesh project ensure <projectId> --company <slug> --stories-file prd.json` registers a missing Board view, merges an existing one without replacing live story status or assignee, then checks the company, project id, story ids, and repo paths. `hq mesh project set --create` writes a view when the GET is a 404.
+
+### Fixed
+
+- `hq report` now resolves report ids through local channel context and channel report lists instead of probing every channel with a report GET that can produce avoidable 404s.
+
+## [5.138.0] — 2026-09-23
+
+### Fixed
+
+- `hq dm accept`, `decline`, and `block` now resolve pending requests to the
+  server's `personUid` field instead of sending unsupported action body fields.
+
+## [5.137.0] — 2026-09-23
+### Added
+
+- Added `hq channels members <channel>` to print channel members for human and machine-principal sessions, with a `--json` format for scripts.
+
+## [5.136.0] — 2026-09-23
+
+### Added
+
+- Your local bots can now do work on a repeating schedule. Ask a company bot for something regular — "check the overnight errors every weekday morning" — and it sets the schedule up itself; you can also see and remove its schedules with `hq bot jobs <name>`. The schedule is kept in the cloud, not on your computer. If the Mac is asleep when a run is due, the run happens as a catch-up when it wakes, as long as that is within about an hour, and the bot's report says it ran late; after a longer outage that run is skipped and the job carries on at its next scheduled time. Personal bots can't schedule work yet.
+
+## [5.135.0] — 2026-09-23
+
+### Added
+
+- Claude lanes now set Claude Code's `CLAUDE_CODE_AUTO_COMPACT_WINDOW=200000`
+  control on fresh launches and session resumes.
+  `providers.claude.auto_compact_tokens` sets a positive-integer override, and
+  Codex and Grok launch environments are unchanged.
+
+- Added `hq lanes watch` for bounded state and question polling, plus
+  `hq lanes monitor-check` for Claude Monitor coverage with distinct exit codes
+  for uncovered lanes and unreadable evidence. The reminder text is available
+  from `hq lanes monitor-check --reminder`.
+- Corrected watch JSONL output and question status transitions, bounded Monitor
+  recommendations to the watch limit, and made stale or unreadable Monitor
+  evidence fail closed.
+
+- Lanes can opt selected Codex model ids into fast mode with
+  `providers.codex.fast_mode_models`. Matching fresh and resumed runs pass
+  Codex's `service_tier="fast"` and `fast_mode` settings and record the
+  decision in the lane record and `spawn.json`.
+
+## [5.134.0] — 2026-09-22
+
+### Fixed
+
+- Agent-kit and local-bot heartbeat loops now stop after the server reports an
+  agent identity mismatch instead of retrying indefinitely. `hq doctor` shows
+  the configured and token agent IDs for the mismatch.
+
+## [5.133.0] — 2026-09-22
+
+### Fixed
+
+- Lane follow-ups now probe all enabled, logged-in accounts for an unpinned
+  model, preserve the later quota reset and its source, expire abandoned pickup
+  validation markers with a terminal reason, and parse Codex's ordinal
+  `try again at` reset time.
+
+- `hq sync push` no longer fails every file when the target vault was
+  provisioned on or after 2026-09-19. Those vaults carry an S3 Object Lock
+  default retention rule, and S3 refuses a PutObject into them unless the
+  request carries a content checksum; the CLI's declared `@indigoai-us/hq-cloud`
+  range still allowed a client that sends none, so an affected push reported
+  `400 InvalidRequest: Content-MD5 OR x-amz-checksum- HTTP header is required
+  for Put Object requests with Object Lock parameters` on every file. The
+  dependency floor now starts at the release that attaches the checksum, so no
+  install can resolve a client that cannot write to a locked vault. A CI guard
+  holds the floor.
+
+- Lane creation and re-parenting now allow depth 3. A depth-3 caller and any
+  derived depth 4 lane are refused with `max_lane_depth`.
+
+- Question ageing now derives its two-advance cap from the depth-3 lane cap, so
+  an unanswered worker-lane question reaches the user after two hourly hops.
+
+## [5.132.0] — 2026-09-22
+
+### Added
+
+- `hq lanes resume <lane-id> --account <id>` and `hq lanes message <lane-id>
+  --account <id>` move a lane's provider session to another account of the
+  same provider and continue it there, with its full history. The claude
+  transcript (`projects/<encoded cwd>/<session>.jsonl`, plus the session's
+  subagent directory) or the codex rollout
+  (`sessions/YYYY/MM/DD/rollout-*-<session>.jsonl`) is copied into the target
+  account's home; the source copy stays, and a copy the target already holds
+  is refreshed when it differs, so a lane moved back resumes the turns it ran
+  elsewhere. Every check runs before anything is copied or written: the lane must not be running (`lane_running`), the
+  target must be an account of the lane's provider
+  (`account_provider_mismatch`), exist, be enabled, be logged in, hold no
+  quota hold (`account_quota_held`), and know the lane's model; a target that
+  pins a different model needs `--model <id>` (new on both commands, accepted
+  only with `--account`). Grok lanes are refused with
+  `provider_session_not_portable`; a missing transcript or rollout with
+  `provider_session_missing`, naming the path searched. The record's
+  `account` moves, `account_history` gains an `operator_move` entry,
+  `last_resume.account` names the account the run started on, and
+  `hq lanes show` prints them; a record that changed after the move was
+  prepared is refused with `account_move_conflict`. The capacity decision
+  runs under the target account's admission lock, and a moved lane holds its
+  slot (`pending_resume`) until its spawn claims it, so two moves cannot share
+  one free slot. A target at its running cap queues the lane there with
+  `pending_resume`, and the reconcile pass resumes the session on the target,
+  honouring `--no-compact`. Mesh events for a moved lane carry `account` and
+  `account_move`. Credential files are never copied.
+
+- A provider-level turn failure is a named lane failure. When the worker's
+  stdout carries a codex `turn.failed` event, a Claude error result with an
+  HTTP status, or a grok error object, the watcher classifies the lane
+  `failed` with `terminal_reason: provider_rejected` and writes the
+  provider's message (capped), status, error class, `retryable`, and the
+  model and account the run used to `terminal_details`. Such an exit is never
+  `interrupted` and never spawns the envelope repair turn. A 429 stays on the
+  quota path. `hq lanes show` prints `terminal_reason` and
+  `terminal_details`.
+- `hq lanes create --model` is validated against the provider's own model
+  list before anything is written: codex from the account home's
+  `models_cache.json`, grok from `grok models`, claude from the aliases and
+  full-name prefix in `claude --help`. An unknown id is refused with
+  `model_unsupported` naming the provider, the value, the source and the
+  accepted ids. A provider whose list cannot be read (missing, corrupt, or
+  unreadable cache; failed probe) is not validated. Validation runs before
+  the mesh thread is ensured and before the admission lock is taken, so a
+  refusal leaves nothing behind and a slow provider probe never holds the
+  lock. An unpinned create reads the list of every enabled account the
+  balanced choice could land on before the lock; the account is still chosen
+  under the lock, restricted to the accounts whose list accepted the model,
+  so nothing is refused once the mesh thread exists and no probe or catalog
+  read runs while the lock is held. A `grok models` or `claude --help` probe that exits nonzero
+  is not a catalog, whatever it printed, and skips validation. Every outpost
+  lane is validated at pickup on the executing host, after its account
+  binds, and fails with `model_unsupported` there; a lane cancelled during
+  the pickup probe stays cancelled and is not spawned. A picked-up lane is
+  stored ineligible for admission (`pickup_validation_pending`) until its
+  account binds, so the reconcile pass cannot spawn it while the probe is
+  out, and the failure write refuses an already-terminal or running record
+  inside its compare-and-swap.
+- A codex `turn.failed` or grok error with status 429, or with no status and
+  a usage-limit or rate-limit message, now reaches the quota path (reset time
+  and account hold recorded) instead of ending `interrupted`, and skips the
+  envelope repair turn so the hold applies at once; an explicit non-429
+  status wins over quota-sounding text. The reconcile pass applies the same
+  routing when it recovers a lane whose worker and watcher both died. The
+  provider's output is scanned from the tail one line at a time, so a long
+  run's events are never all parsed and held at once. A 429 whose message
+  names no reset time holds the account for the provider's
+  `quota_default_hold_ms` (fifteen minutes unless configured), recorded with
+  `reset_source: default_hold`; a message with a reset time keeps that time.
+
+### Fixed
+
+- `hq lanes reconcile install` no longer copies the installing shell's PATH
+  into the systemd unit. The unit PATH is, per resolved provider, the
+  directory holding the command name and the real binary's directory when a
+  symlink points elsewhere, then the hq binary's directory, then the node
+  binary's directory, then `/usr/local/bin:/usr/bin:/bin`, deduplicated; directories synced from
+  another machine's profile are left out.
+
+## [5.131.0] — 2026-09-22
+
+### Added
+
+- `hq files share` can post the share record to a project channel instead of a
+  DM: `--channel <name>` names the channel and `--mention <person>` (repeatable)
+  tags people in it. Using `--mention` without `--channel` is an error. If you
+  or a mentioned person are not members of that channel, access is still
+  granted and the record falls back to a DM, with a short note on the CLI.
+- Offline preflight results the CLI can emit are published at
+  `contracts/preflight/v1/schema.json` and `fixtures.json` (included in the
+  package). `hq mesh contract preflight --print-fixtures` prints the same
+  document. A test fails if the committed fixtures drift from the emitter.
+  contractVersion stays pinned at 1 until hq-core's vendored copy moves with it.
+
+### Fixed
+
+## [Unreleased]
+
+### Fixed
+
+- `hq mesh daemon install` and `hq mesh daemon run` unload and remove the
+  legacy `ai.getindigo.hq-work-mesh-listen` unit (LaunchAgent, systemd user
+  unit, or Scheduled Task) so only the daemon subscribes. The daemon writes
+  `~/.hq/work-mesh/live-cache.json` and bumps its cursor once per project-view
+  push. MQTT reconnect logs once per transition into reconnecting instead of
+  on every close. `hq mesh daemon doctor` reports "legacy listener still
+  installed" while that unit remains (US-006).
+
+## [Unreleased]
+
+- Held-event repair no longer treats a later event timestamp as proof that
+  metadata belongs to the current session instance. A reused session id stays
+  unresolved when the held event's binding episode does not match the current
+  one. A CLI self-update now records the verified HQ root and rewrites a
+  legacy daemon unit (no `HQ_ROOT`, or `Restart=on-failure`) before restarting
+  it, so the new process does not come up with an empty root allowlist.
+
+## [Unreleased]
+
+- A machine credential (fleet box or local bot) no longer posts mesh events
+  with no company. `HQ_SPAWN_COMPANY`, the bot's company, or the identity
+  file is sent with the event. When none of those is set, the event is held
+  as `needs_company` and `hq mesh daemon doctor` shows the held count.
+  A membership probe that a machine token cannot answer leaves the company
+  in place and retries, instead of clearing it.
+
+## [Unreleased]
+
+- Expected caller errors from company resolution, membership, and qmd lookups
+  no longer create Sentry issues. Windows filesystem failures remain visible
+  and now include redacted path context plus a sync-aware diagnostic.
+
+- An acknowledged Work Mesh register keeps the company on the session even
+  when there is no project, or a project and no task. The next flush posts a
+  held event for that session instead of leaving it held for lack of a company.
+  Tests cover each acked-register branch.
+
+- `hq mesh project set` sends the project version it just read (`If-Match` and
+  `expectedVersion`). A 409 prints "The Board changed while you were editing.
+  Re-run to pick up the latest." and exits non-zero. `--json` includes
+  `VERSION_CONFLICT`.
+
+- `hq mesh session` prints each rejected event's server code (and `--json`
+  includes `rejections`). A flush dead-letter row for a per-event rejection
+  stores that code next to `reason`.
+
+- A Cognito refresh that comes back for a different subject is refused and the
+  active `cognito-tokens.json` is left unchanged. `hq mesh daemon doctor`
+  prints the whoami subject and the subject the daemon is using.
+
+### Changed
+
+- Local bots can reply to other people and bots in direct messages and in
+  connected rooms without an owner-only sender restriction. Each DM
+  correspondent has a separate conversation, and the owner's private context
+  stays out of other people's conversations. Bots retain their configured
+  owner and check suspicious requests before taking sensitive actions.
+
+## [5.130.0] — 2026-09-22
+
+### Fixed
+
+- Hook-timeout reports remain visible as warning events with stable grouping and
+  diagnostic tags. Repeated reports are rate-limited while the next capture
+  records the suppressed count.
+
+## [5.129.0] — 2026-09-22
+
+### Added
+
+- `hq report` publishes a channel report folder to a fixed hq-deploy slug,
+  injects a strict Content-Security-Policy, and writes the run back onto the
+  report record. The same command group covers draft publish, promote,
+  discard-draft, access, adopt (install the bot's own job), and decommission.
+
+- `hq report templates --json` lists the shipped report templates
+  (`daily-digest`, `blank`). The cloud job prompt is the `update-report`
+  runbook stored in `templates/runbooks/update-report.md`.
+
+## [5.128.0] — 2026-09-22
+
+### Fixed
+
+- Expected hook-timeout warnings are counted as Sentry metrics, so a slow hook
+  does not create its own Sentry issue. Genuine timeouts use stable grouping.
+
+## [5.127.0] — 2026-09-22
+
+### Added
+
+- Every composed lane brief and every resume turn carries a foreground-only
+  rule after the standing authorization: run every command, test suite and
+  check in the foreground and wait for it; a turn that ends before the envelope
+  is written is classified interrupted.
+- The spec §4 envelope repair turn now runs for grok as well. A provider with
+  no session resume gets one fresh single-turn invocation on the same account
+  carrying the schema, the parser error and the raw failed output. The lane
+  records `envelope_repair.mode` as `resume` (claude, codex) or `fresh_turn`
+  (grok) and `hq lanes show` prints it as `envelope_repair_mode`.
+- Lane records now reject omissions of required `hq-lane.v1` fields, and lane
+  mutations enforce the durable field-writer ownership map at the store boundary.
+  The map grants `reconcile` the quota fields it writes during dead-host
+  recovery, the outpost pickup account bind carries the `spawn` writer, and
+  `terminal_details` and `outpost_command_id` are typed and owned. The writer
+  argument is a required writer name; the function-form call that skipped the
+  ownership check is gone. The updater receives a deep clone and the check
+  compares against the pre-update snapshot, so mutating the argument in place
+  cannot bypass ownership.
+- Answer notes reach a resumed lane: `answered-questions.json` carries the
+  operator's `--notes` text read from the lane's own body store, and the resume
+  prompt renders each answer as its choice followed by the notes.
+- Every lane brief and every resume turn carries a standing authorization
+  paragraph: the brief authorises completing every item it lists, and a
+  `decision: ask` envelope is only for a decision the brief does not settle.
+- A question whose options are only continue and stop is recorded with
+  `question_kind: "continue"` and `hq lanes questions list` prints it with
+  `flag: "continue-loop"`. Nothing answers it automatically.
+- `hq lanes list` reports `senior_lost: true` for a running lane whose senior
+  session is absent, ended, or lost, without mutating the lane.
+- `hq lanes questions answer --freeform <text>` answers a question that offered
+  options with free text and records `answer_kind: freeform`.
+- `hq lanes resume <lane-id> [--text <message>]` resumes an `interrupted`,
+  `done` or `blocked` lane on its recorded provider session and records
+  `resumed_from`. Codex lanes record their session id at spawn and resume with
+  `codex exec resume`, so `hq lanes message` and the envelope repair turn now
+  work for exited Codex lanes as they do for Claude.
+- Lanes now report to the work mesh from the watcher, not only at create. A
+  lane that finishes posts a completion event and moves its story to review;
+  one that stops to ask posts the question ids; one that is blocked posts the
+  reason. While a lane is working, the watcher posts a progress event when it
+  sees a new tool call or new output, at most once per five minutes per lane
+  (`providers.<provider>.progress_event_min_interval_ms` in
+  `personal/lanes/config.json`), and never for silence. The watcher signs in
+  the same way the session hooks do and never opens a browser; when it cannot
+  reach the mesh it writes `mesh_event_failed` to the lane's watcher log and
+  the lane's state is unchanged. On the wire, lane events use the mesh's
+  existing activity, question, and note kinds, because the server rejects
+  unknown kinds.
+- A lane whose final output is not a valid envelope gets one repair turn: the
+  same session is resumed with the schema, the parser error, and the raw text,
+  and asked for the corrected JSON only. If that also fails the lane is
+  `failed` with reason `envelope_invalid`, and `envelope_repair` on the record
+  carries both errors. Codex and Grok lanes cannot be resumed after exit, so
+  they still fail on the first parse error; the record says why no repair ran.
+- A worker with `verification.approval_required` or `human_checkpoints` now
+  briefs its lane to stop at each checkpoint with a `decision: ask` envelope
+  naming the checkpoint. The resume prompt after the answer carries the answer
+  inline as well as naming the answers file.
+- `hq lanes ask` retries delivery three times, waiting 5 s then 15 s, when the
+  CLI is being replaced under it. On final failure it writes
+  `ask_delivery_failed.json` and returns `ask_delivery_failed`; the lane's
+  state is never changed.
+- You can hand a piece of work off to run on its own, and it keeps going after
+  you close the window. If it hits something only you can decide, it stops and
+  asks instead of guessing, and picks up again the moment you answer — you no
+  longer have to sit and watch it. If it goes quiet for twenty minutes, you are
+  told. Work sent to a second machine that would have landed back on the one
+  that asked is stopped before it starts.
+- `hq lanes create --model` records the model on the lane and passes the
+  provider's own flag (`--model` for Claude, `-m` for Codex and Grok).
+  Account and provider `model` keys in `personal/lanes/config.json` are
+  defaults; `--model` wins. An empty `--model` is refused.
+- Lane envelopes may include `story_complete` and `story_complete_reason`.
+  `story_complete true` requires `story_status done`; `false` forbids it.
+  Both are copied onto the lane record when an envelope is ingested.
+- `hq lanes create --effort <level>` sets reasoning effort per provider
+  (`--effort` for Claude, `-c model_reasoning_effort` for Codex,
+  `--reasoning-effort` for Grok), validated against each provider's own set.
+  `effort` on an account or provider in `personal/lanes/config.json` is the
+  default; with nothing set, an Opus or Fable model runs at `low`.
+- A resumed Claude lane whose last message is older than `compact_after_ms`
+  (default one hour) is compacted with `/compact` before the resume, and the
+  lane records the outcome and the before/after context size. `hq lanes
+  message --no-compact` skips it once. `accounts list` and `show` report
+  model, effort and the last compaction.
+- `--worker` resolves workers from `core/workers`, `personal/workers`,
+  `companies/<co>/workers`, and packages mounted by `hq core scan-packages`.
+  A worker id present in two trees is refused; a pack worker that is declared
+  but not mounted is `package_workers_unmounted`.
+- A provider 429 is recorded per account and model in
+  `personal/lanes/quota.json` (`account_quota_exhausted` with the reset time,
+  or `account_model_unavailable` when a model needs credits). The balancer
+  skips only what cannot run and never rewrites the operator's `enabled`.
+- `hq mesh story` accepts `--assignee <uid|me|none>` with or without `--status`.
+  `me` uses the authenticated person or agent and refuses the synthetic session
+  identity. `none` clears the assignee. The command does not send an actor.
+- `hq mesh project set <projectId> --company <slug>` now reads and merges the
+  current Board view before replacing it, so a name or description update keeps
+  existing stories and repository bindings. It accepts repository bindings from
+  PRD `metadata.repos`, `--repos-json`, or repeatable `--repo <path[@branch]>`.
+  `hq mesh project register <projectId> --company <slug>` registers the Board's
+  deterministic project channel and genesis thread without raw API calls.
+- A work-context session-state lock or directory creation failure is reported
+  as not tracking (exit 3) instead of an uncaught filesystem error.
+- The Work Mesh daemon now distinguishes an explicit device-default membership
+  revocation from malformed or unavailable membership lookups. Temporary
+  failures preserve attribution and retry later; explicit denials clear only
+  the unchanged device-default binding through the shared session-state lock,
+  so concurrent rebinds are preserved. Transcript-start discovery also leaves
+  unavailable lookups unstarted and retries with bounded backoff.
+
+### Fixed
+
+- `hq agents status` no longer tells you to sign in to a brain that is already
+  signed in. A device pairing file can outlive the sign-in it started, so the
+  box sign-in probe now decides whether the prompt is shown. Grok and Codex
+  prompts are matched to their own brain slot; a Claude prompt has no slot and
+  is unaffected.
+- Lane watcher mesh calls now time out, progress events only follow new
+  activity, and a persisted progress timestamp prevents duplicate events after
+  a watcher restart. Invalid-envelope repair is limited to one attempt even
+  when the repair writes a different envelope filename.
+- Completion mesh delivery attempts the thread event and story review update
+  independently. Repair prompts cap inlined malformed JSON while retaining the
+  raw envelope path.
+
+- `hq lanes reconcile install --enable` now enables the systemd user timer; the
+  generated unit uses `KillMode=process` so admitted lanes survive the pass, and
+  its PATH carries the directories of the resolved provider binaries. A provider
+  binary missing from PATH at spawn leaves the lane `queued` with
+  `provider_binary_missing` instead of failing it.
+- A provider binary missing from PATH re-queues a lane only on admission. An
+  answered-question or operator-message resume keeps the lane's recorded state
+  and returns `provider_binary_missing` with the searched PATH, so the next
+  reconcile resumes the recorded session instead of starting a fresh run and
+  the operator message is not lost.
+- `hq lanes reconcile install` succeeds on a box with only one provider
+  installed. The unit PATH carries the providers that resolve; the result lists
+  `providers_resolved`, `providers_unresolved`, and a `warnings` line per
+  missing provider. It refuses with `provider_binary_unresolved` only when no
+  enabled provider resolves.
+- `hq lanes questions answer` treats a whitespace-only `--freeform` as absent,
+  so `--choice` is validated against the options and recorded as an option
+  answer instead of an empty freeform answer.
+- A synced question conflict sidecar whose `answer_history` is not an array is
+  skipped like any other unreadable sidecar instead of failing every read of
+  the question.
+- `hq lanes resume` now keeps terminal lanes terminal when account binding
+  fails, records project or story attribution without requiring `--text`, and
+  rejects a concurrent resume that has already become running. Blocked mesh
+  notes use the accepted `audit` note kind and include their reason in text so
+  the server preserves the marker.
+
+- `hq agents list` shows an agent whose removal is under way as `removing`
+  rather than the runtime status it had before the removal started. An agent
+  that never finished setting up and is then removed used to keep reading
+  `provisioning` until the teardown completed, so a removal that stalled
+  looked like a removal that was never accepted. A finished teardown reads
+  `removed`; every other agent is unchanged.
+- `hq lanes accounts list` treats Claude as logged in when
+  `.credentials.json` exists. Missing Claude credentials are reported as
+  unknown, not logged out. Codex and Grok still use `auth.json`.
+- With no `--account`, a lane is assigned the least-loaded enabled
+  logged-in account rather than `default_account`.
+- A lane watcher now writes a JSON line to `logs/watcher.out` for each
+  decision that changes what it believes: a liveness transition, a silence
+  deadline, an envelope appearing, the exit classification, and the
+  terminal record write. `hq lanes logs` reports each stream's path, size
+  in bytes, and lines, so an empty log file is distinguishable from a
+  missing lane. `watcher.out` is capped at 256 KiB by dropping the oldest
+  complete lines. `hq lanes message` refuses a lane that will never read
+  the drop box (`awaiting_input`, `blocked`, and every terminal state) and
+  still accepts a queued lane. After the HQ root is resolved, `hq lanes`
+  chdirs into it; relative `--brief-file` and `--payload-file` paths still
+  resolve against the caller's original directory.
+- `hq lanes` no longer treats a git worktree's `.claude` folder as the HQ
+  root, and it honours `$HQ_ROOT` the same way the watcher and reconcile
+  timer already did. Listing or creating a lane from a worktree talks to
+  the real store, or fails out loud — it does not return an empty success
+  against a directory nothing else reads.
+- Creating a lane with `--outpost` now pushes it through `hq outposts exec`
+  instead of leaving a queued row that no machine will pick up. If the
+  Outpost is unreachable, the lane is failed, not queued.
+- A lane that finishes by asking a question now actually queues that question,
+  so someone can answer it and the lane can continue. Stopping a lane now
+  stops the process, not only the record. The drain hook that delivers
+  mid-run answers is installed into the account home instead of sitting unused
+  in the package. The periodic reconcile timer now names this HQ tree, so it
+  does not wander into `$HOME/.claude`. A live lane heartbeats from its
+  watcher; a dead watcher is started again; a reused PID is not treated as
+  the worker still running; a malformed drop-box line no longer wedges every
+  tool call.
+- `hq mesh start` now resolves its claimant from the token that authenticates
+  the request before considering a same-identity cache entry. This prevents an
+  agent from claiming work as a cached human and stops locally before creating
+  a thread when no authenticated claimant can be established.
+
+- `hq mesh context backfill-held` no longer reports `reconciled: 0` when
+  `--dry-run` predicts non-zero reconcilable sessions. The check that decides
+  whether reconcile produced a durable company binding now recognises a
+  persisted `companySlug` as sufficient — the daemon resolves the uid on its
+  next retry — instead of requiring `companyUid`, which is absent when the
+  reconciler runs without a network membership call. Sessions that have no
+  company evidence at all now appear in a separate `noEvidence` counter so
+  operators can tell them apart from sessions that were genuinely reconciled
+  as slug-only bindings.
+
+## [5.126.0] — 2026-09-21
+
+### Fixed
+
+- `hq mesh start` works for people again. It was sending your email address as
+  the claimant, and the server compares that to your person id, so every human
+  start failed with "claimedBy must match the authenticated author" and left
+  the thread unclaimed. Claims now carry your resolved person id (bots keep
+  their agent id).
+
+### Changed
+
+- On Windows, the mesh daemon's Scheduled Task now names the HQ root it was
+  installed for right in the task command (`mesh daemon run --hq-root <path>`)
+  instead of relying on a remembered list of roots. Install only wraps the
+  daemon in `conhost.exe --headless` when the machine is new enough to support
+  it (Windows 10 1809 or later) and says which mode it chose. `hq mesh daemon
+  status` now reports when the task's last start failed, and reminds you that
+  the task only runs while you are logged on. macOS and Linux are unchanged.
+
+- `hq mesh daemon install` no longer mistakes a code repo for your HQ. It
+  accepts `--hq-root <path>`, otherwise uses `HQ_ROOT`, otherwise walks up
+  from the current folder to the nearest real HQ tree (one with
+  `companies/manifest.yaml` and `core/`, `.claude/`, or `personal/`). A folder
+  that only has `.claude/` does not count. If nothing qualifies, install stops
+  and tells you to pass `--hq-root` instead of recording the wrong root. The
+  install confirmation now leads with the root it chose and how, and `hq mesh
+  daemon status` prints the root the task actually carries and warns when that
+  folder has since moved or been deleted.
+
+- The setup bot now recognises when you have joined a company that someone
+  else already built. Instead of asking what kind of business you own and
+  offering to connect apps your team connected months ago, it shows you what
+  is already there in real names and counts, answers one real question from
+  your company's own memory, asks what you do there, and offers only what is
+  missing for you. Things only an owner can do now name the owner instead of
+  failing.
+
+- The setup bot asks which tools you actually use and connects each one
+  however that tool needs it, after recommending the few things a business
+  like yours should set up. It no longer works from a fixed list of apps.
+
+- Setup no longer asks for your name when you are already signed in, and no
+  longer offers to skip itself.
+
+### Fixed
+
+- The desktop grok bot talks to grok 0.2.56 again. That CLI dropped
+  `--output-format streaming-messages-json` (only `plain`, `json`, and
+  `streaming-json` remain). The bot now reads the value from `grok --help`
+  once and caches it, retries with `streaming-json` if grok rejects the old
+  flag, and concatenates `streaming-json` text deltas for the reply instead
+  of treating them as Anthropic Messages events.
+
+- `hq core scan-packages` writes pack-mount symlinks relative to the host
+  directory, so they survive a tree moving between machines. A leftover
+  absolute link from another host, or an absolute link that still points at
+  this pack's payload, is rewritten to the relative form on the next scan; a
+  correct relative link is left alone.
+
+- Work Mesh reconcile now owns company attribution explicitly on the acked
+  path for every register where `resolvedCompany.uid` is set, not only fully
+  bound sessions. Previously the non-bound acked path had no reconcile-owned
+  attribution write and relied on an incidental side effect of
+  `writeAckedRegisterState` → `writeAcknowledgedRegisterBinding`; that side
+  effect already wrote `companyUid`/`companySlug` for ops carrying a uid, so
+  the tenant was not dropped in practice, but any future acked path that
+  preceded or skipped that call would silently lose it. The fix makes
+  attribution explicit: a company-only ack is projected as `needs_project`
+  with its tenant intact, the write reflects the true classification, and no
+  `projectId`, `taskId`, or binding episode is fabricated on partial paths.
+  Note: a company resolved by slug only (no uid) is still not attributed on
+  either path. Tests disable each of those two writers in turn
+  (`writeAckedRegisterState`, and the post-ack `writeSessionState`) and
+  require the other one to still land the company for a company-only ack
+  and a company-plus-project ack. The production write itself landed in
+  `28aee9e` (#670).
+
+- The setup bot no longer posts the same question twice when a turn takes a
+  while: a question asked in an interim update is held back if the final
+  answer repeats it.
+
+- On Windows, the work-context config safety check now inspects the file's
+  Windows ACL instead of POSIX mode bits, so `hq mesh context reconcile` no
+  longer refuses every run with "unsafe permissions 666" and session state and
+  register operations are written again. The config file and its directory must
+  be writable only by the current user, SYSTEM, and Administrators; any other
+  principal with write access is rejected, matched by SID so localized account
+  names do not matter, and named in the error. When the ACL cannot be read
+  at all (icacls missing, non-NTFS volume), the check follows a documented
+  reduced-guarantee path: it prints one diagnostic that the config is
+  unprotected on this platform and continues rather than blocking. macOS and
+  Linux behaviour is unchanged.
+
+### Added
+
+- `hq mesh daemon install` now works on Windows. It registers a per-user
+  Scheduled Task (`ai.getindigo.hq-mesh-daemon`) that starts the mesh daemon at
+  logon, hidden, with no execution time limit and a restart-on-failure policy,
+  and starts it right away. `hq mesh daemon status` reports whether the task is
+  registered and running, `hq mesh daemon uninstall` ends and removes it, and a
+  CLI update restarts it like the macOS and Linux services. Before this the
+  three commands answered "No service manager integration on this platform",
+  so the session-event spool never drained on Windows. The task definition is
+  written as XML under `~/.hq/work-mesh/daemon/` and registered with
+  `schtasks.exe`; no new dependencies. macOS and Linux behaviour is unchanged.
+
+- `hq bot list --json` reports `busy` and `busySince` for each bot on this
+  computer, and `hq bot status` shows an `answering:` line. Apps use this to
+  keep a "thinking" indicator up for a whole turn, rather than ending it the
+  moment the bot posts a progress note.
+
+- Library layer for `hq lanes` (`src/lib/lanes/`): lane/question record store
+  with compare-and-set writes, provider-account resolution, CPU/memory throttle,
+  session liveness from the work-mesh spool, and path-keyed worker tenancy.
+
+- `hq lanes` command surface: create/list/show/message/reparent/logs/stop,
+  non-blocking ask, questions list/show/answer/escalate/cancel, accounts
+  list/login/enable/disable, and sessions list/show. Create admits against
+  provider caps, the bounded queue, and the host throttle, then leaves the
+  lane queued — process spawn is an explicit not-implemented seam.
+
+## [5.125.0] — 2026-09-20
+
+### Fixed
+
+- Work Mesh now preserves an acknowledged company binding through later
+  company-less hook writes, preventing repeated registrations and held events.
+  Held recovery accepts only durable registrations, canonical metadata under a
+  verified HQ root, or manifest-backed repository ownership; conflicting or
+  event-only hints stay unresolved. Its batch cursor rotates across restarts.
+  Both legacy and direct-mode daemons detect an upgraded CLI, and systemd units
+  use `Restart=always` so the installed service reloads the new code.
+
+- Held-session recovery now accepts session metadata only from the daemon's
+  configured HQ root, requires current-session evidence before restoring an
+  acknowledged registration, and retains batch position when held records are
+  compacted. Repeated hook activity no longer re-registers an unchanged binding.
+  CLI updates report installed system units that need their host service manager
+  to restart them. Daemon installs persist verified HQ-root allowlists, inject
+  the primary root into service environments, and rewrite/reload existing user
+  units so upgraded daemons restart reliably.
+
+### Added
+
+- Work Mesh now activates a device default company automatically when a signed-in
+  person has exactly one active membership. Devices with several memberships ask
+  for a choice in interactive CLI paths and show the stored state in `hq mesh
+  context default get --json`. Clearing the default is a durable opt-out until
+  the person explicitly sets one again. Historical held sessions remain unchanged
+  unless `hq mesh context backfill-held --use-device-default` is supplied; those
+  repaired records are labeled lower-confidence and counted by daemon doctor.
+
+## [5.124.0] — 2026-09-20
+
+### Added
+
+- `hq billing sponsor` — ask a company to cover your $50/mo HQ Individual plan
+  from the terminal, and answer those requests if you run the company.
+  `request <company>` asks, `list` shows the queue you can answer or — if you
+  are not an admin there — your own single status for that company, and
+  `approve` / `decline` / `revoke` / `withdraw` resolve one. Pass `--company`
+  to `list` when you are asking about your own state.
+
+  Approving does not always finish the job: if the company has no card on file,
+  HQ accepts the yes but nothing is covered yet, and `approve` says so with the
+  link to add one. This is off until HQ turns it on; until then the commands
+  say it is not available yet rather than failing with a validation error.
+
+## [5.123.2] — 2026-09-19
+
+### Fixed
+
+- Company slug lookup no longer prints `Failed to resolve company slug '…':`
+  with nothing after the colon. Transient failures (timeouts, 429, 5xx) are
+  retried once, and the error names the HTTP status and says it is a temporary
+  lookup failure rather than a missing company.
+
+## [5.123.1] — 2026-09-19
+
+### Fixed
+
+- Work Mesh now preserves an acknowledged company binding through later
+  company-less hook writes, preventing repeated registrations and held events.
+  Held recovery accepts only durable registrations, canonical metadata under a
+  verified HQ root, or manifest-backed repository ownership; conflicting or
+  event-only hints stay unresolved. Its batch cursor rotates across restarts.
+  Both legacy and direct-mode daemons detect an upgraded CLI, and systemd units
+  use `Restart=always` so the installed service reloads the new code.
+
+- Held-session recovery now accepts session metadata only from the daemon's
+  configured HQ root, requires current-session evidence before restoring an
+  acknowledged registration, and retains batch position when held records are
+  compacted. Repeated hook activity no longer re-registers an unchanged binding.
+  CLI updates report installed system units that need their host service manager
+  to restart them. Daemon installs persist verified HQ-root allowlists, inject
+  the primary root into service environments, and rewrite/reload existing user
+  units so upgraded daemons restart reliably.
+
+## [5.123.0] — 2026-09-19
+
+### Fixed
+
+- `hq mesh check --project` lists that project's open threads. The CLI queries
+  `/v1/work-mesh/threads` with `projectId` (and `status=open`) and merges the
+  result with the status listing, because the status index can omit project
+  threads.
+
+- First signed-in interactive run prints a one-line telemetry disclosure on
+  stderr (once per machine). `HQ_TELEMETRY=0` (also `false` or `off`) disables
+  CLI telemetry posts. After the notice has been shown, events send
+  `consentBasis: "disclosed"` instead of `"no-consent"`.
+
+### Added
+
+- Channel messages can now be posted as thread replies: `hq dm <channel>
+  --thread <eventId> "…"` sends `rootEventId` on the POST, and `--thread last`
+  replies to your most recent top-level message in that channel. `hq dm channel
+  <name>` prints each root's eventId and indents replies under their root
+  (`--json` is still the ungrouped oldest-first array). `@name` mentions were
+  already resolved against the roster into the structured `mentions` array;
+  unknown names still fail the send and list the roster (`--no-mentions` posts
+  the text literally).
+
+### Changed
+
+- `hq whoami --company` and the bind notice no longer read `planLock`. They
+  render the Starter over-limit nag from `GET /v1/billing/usage-limits`
+  (including the top-level `freeMonth` CTA). Customer copy does not say
+  "locked" or "read-only".
+
+### Fixed
+
+- Work Mesh board snapshots now read live story status from ProjectView before
+  falling back to the vault board, and `hq mesh daemon doctor` warns when a
+  presence credential omitted companies.
+
+## [5.122.2] — 2026-09-19
+
+### Fixed
+
+- Local bots no longer retry inbox polls and heartbeats every couple of seconds
+  after HQ returns 429. They honour Retry-After when present and otherwise back
+  off, so a rate limit can clear instead of being held forever. `hq bot status`
+  now says unreachable / cannot receive when those calls are failing, instead of
+  HQ online from the last attempt, and `hq doctor` checks the same.
+
+- `hq bot start` / `restart` rewrites a LaunchAgent that still points at the
+  old toolchain `node/bin/hq` path after an HQ update moved the CLI to
+  `npm-global/bin/hq`, which previously failed with MODULE_NOT_FOUND until
+  someone ran `hq bot daemon install` by hand.
+
+## [5.122.1] — 2026-09-19
+
+### Fixed
+
+- `hq cloud provision company` no longer silently accepts a server-suffixed
+  slug. When another owner already holds the requested name, the vault assigns
+  `<slug>-<tag>` and used to write local config as if the original name had
+  been granted — sync then cannot push, because it looks for a folder matching
+  the cloud slug. Provision now fails before writing, and retires the
+  just-created entity so it does not leave a suffixed orphan.
+
+- Work Mesh now keeps the company you selected when its session context is
+  acknowledged or recovered after a restart. Mesh activity stays attached to
+  the right company instead of being held for missing attribution.
+
+## [5.122.0] — 2026-09-18
+
+### Added
+
+- A bot can now join HQ from the computer its owner already uses. Before,
+  `hq agent enroll` refused on such a machine — the owner is signed in there,
+  and an agent identity must not share a host account with a person's login —
+  which left two bad options: a second user account, or `--replace`.
+
+  Enrollment now moves the bot into its own directory instead of refusing:
+  `~/.hq-agent/<name>/`, with its own credentials, key, state and logs. The
+  owner's session file is never read, moved, or changed. `hq agent probe`,
+  `hq agent kit`, `hq agent inbox` and `hq agent mcp` all find that directory
+  on their own, so the bot is itself without anyone exporting environment
+  variables. Use `--name <bot>` to choose the directory, or to run a second
+  bot on the same computer.
+
+  Two or more local bots are deliberately ambiguous: `hq agent` commands then
+  ask for `HQ_AGENT_DIR` rather than guessing which identity to act as.
+
+## [5.121.2] — 2026-09-18
+
+### Added
+
+- `hq cloud retire company <slug>` soft-tombstones a cloud company (owner
+  only, confirm unless `--yes`) so `hq cloud demote company` can run without
+  `--propagate-deletes`. Vault files stay; local folders are not touched.
+
+## [5.121.1] — 2026-09-18
+
+### Fixed
+
+- `hq --version` prints only the CLI version again. The labelled HQ vs CLI vs
+  latest hq-core report stays on `hq version` (and `--json`). Older updaters
+  compare the whole `--version` output to the CLI they just installed; reading
+  the HQ line made every successful update look like a second install was
+  shadowing it.
+
+### Documentation
+
+- The 2026-09-18 fleet-bots GA notes group the published CLI changes for plan
+  notices, DM attachments, staged skills, version reporting, knowledge-index
+  protection, and ambiguous people resolution (#634, #636, #641, #642, #643,
+  #644, #645, #647, #648, #649).
+
+## [5.121.0] — 2026-09-18
+
+### Changed
+
+- The agent kit no longer installs a work-mesh doorbell listener, and
+  `hq agent probe` no longer checks one. The doorbell was never what made a
+  bot reachable — messages arrive over the inbox either way — but it was the
+  loudest part of setup: it needed a realtime connection that restricted bot
+  hosts routinely intercept, so a perfectly healthy bot reported a failure it
+  could do nothing about.
+
+  The probe's `work-mesh` line becomes `presence`: the agent's own inbox
+  answers and its heartbeat is fresh. That is what the check was really
+  proving. `hq mesh` remains available to a bot that is asked to use it; the
+  kit simply no longer runs a listener or ships a skill telling it to.
+
+  One trade-off: an inbox doorbell used to trigger an immediate poll. Without
+  it, incoming messages are picked up by the inbox poller on its own interval
+  (15 seconds by default) rather than instantly.
+
+## [5.120.1] — 2026-09-18
+
+- A local bot no longer replaces your own sign-in. Bots that run on your
+  computer (the setup bot included) keep their session in their own folder
+  now, instead of the file HQ uses to know who you are. Before, a bot could
+  overwrite that file and HQ would then treat the bot as you: its name in
+  place of yours, no companies, a profile that would not save, and sync
+  failing. If that already happened on your computer, `hq` now ignores the
+  bot's session there and asks you to sign in as yourself. (hq-cloud 6.16.60)
+
+## [5.120.0] — 2026-09-18
+
+### Added
+
+- `hq agents provision` can reuse an existing Slack bot token through flags,
+  environment variables, or stdin. Socket Mode agents can also accept their
+  app-level token. HQ validates both tokens and the bot's required Slack scopes
+  before it creates the agent.
+
+## [5.119.15] — 2026-09-18
+
+### Fixed
+
+- `hq people resolve <name>` now reports ambiguity when the name matches more
+  than one person instead of selecting the first match.
+
+## [5.119.13] — 2026-09-18
+
+### Added
+
+- `hq version` (and `hq --version`) print the installed HQ version, the CLI
+  version labelled as CLI, and the latest hq-core release. If a newer HQ is
+  out it says to run `/update-hq`; if the lookup cannot reach the network it
+  says so instead of going quiet. `hq version --json` prints the same payload.
+
+### Fixed
+
+- `hq core rebuild-index company-knowledge` no longer silently replaces a
+  hand-written company knowledge INDEX. If the file is not the last generated
+  output, the command refuses, prints a short diff, and asks for `--accept`.
+  `<!-- hq:keep -->` opts the whole file out; `<!-- hq:keep -->` … `<!-- /hq:keep -->`
+  fences are kept while the table regenerates. Subdirectory README headings
+  are projected into the description column so the generated index is usable
+  without hand edits.
+
+## [5.119.12] — 2026-09-18
+
+### Fixed
+
+- `hq files cat … --company prs_<person-uid>` now reads the file instead of
+  refusing with "No company found for slug". Reading a DM attachment needs the
+  sender's vault as the scope, and `cat` resolved that value as a company slug
+  of its own, after the same fix landed on the presign path.
+
+## [5.119.11] — 2026-09-18
+
+### Added
+
+- On a personal account, My Telemetry is part of the paid Individual plan
+  ($50/mo). When the server withholds it, the CLI now prints a short notice
+  naming the plan and where to upgrade, instead of the raw refusal. Company
+  plans are unaffected, and the notice has nothing to do with the plan-limit
+  nags — it is a plan fact, printed once, where it happened.
+
+### Fixed
+
+- `hq files … --company prs_<person-uid>` now reaches that person's vault
+  instead of failing with "Company slug ... was not found". This is how a DM
+  recipient reads a file attached to a message: the attachment lives in the
+  sender's personal vault, so naming the sender is the only scope that works.
+
+## [5.119.10] — 2026-09-18
+
+### Added
+
+- `hq skill register` reserves a company skill UID from a proposal-lane
+  source and writes the server-stamped bytes only to `--stamped-output`.
+  It does not write `companies/<company>/skills/`, create a discovery
+  wrapper, or sync. `hq skill promote` copies those exact bytes into the
+  canonical skill path only after `--expected-sha256` matches and the
+  stamped `skill_uid` matches the server registration. A differing
+  canonical file requires `--reviewed-update`. Use `--no-sync` to leave
+  upload to a later steward command.
+
+## [5.119.9] — 2026-09-17
+
+### Added
+
+- The CLI now prints a one-time notice when your workspace crosses a plan
+  threshold — reaching 80% of a Starter limit, or going past one. The server
+  decides when a threshold has been crossed and sends it with the response, so
+  a session you already have open surfaces the notice on its next API call
+  rather than on its next launch. Each `{resource}:{band}` is printed exactly
+  once per episode, remembered in `~/.hq/plan-limit-nag.json`; a dimension that
+  drops back under the threshold and climbs again is announced again.
+  `HQ_NO_PLAN_LIMIT_NAG=1` silences it along with the other plan-limit lines.
+
+### Fixed
+
+- A file attached to a DM is now visible to a bot reading its mail. `hq dm
+  inbox`, `hq dm thread`, `hq dm channel` and `hq agent inbox` print each
+  attached file's name, type and vault path under the message body; the JSON
+  forms carry an `attachments[]` field. Previously only the body text was
+  rendered, so an agent sent a screenshot answered "no image came through".
+
+## [5.119.8] — 2026-09-17
+
+### Fixed
+
+- Channel posts that mention people by full name no longer show the parsing
+  quotes in the room. `@"Jacob Posel"` is still how a multi-word name is
+  typed, but the message is posted as `@Jacob Posel`, the way a person would
+  have written it. The structured mention itself is unchanged.
+
+## [5.119.7] — 2026-09-17
+
+### Fixed
+
+- When the kit cannot install its `@reboot` entry because the host has no
+  `crontab` at all, the install now says so and names the package to install,
+  instead of reporting a raw ENOENT the operator cannot act on. A minimal
+  container image routinely ships without cron; the Muse pilot hit this the
+  first time the reboot entry was attempted.
+
+## [5.119.6] — 2026-09-17
+
+### Fixed
+
+- Slack token paste links now use the company's canonical Console slug. Links
+  built with an internal company ID redirected to the company home and lost the
+  agent setup form.
+
+## [5.119.5] — 2026-09-17
+
+### Fixed
+
+- When a new Slack agent is waiting for a Socket Mode app-level token, `hq
+  agents status` now shows a link to create the token and a direct link to the
+  HQ form where it can be pasted. The same links are included in JSON output.
+
+### Changed
+
+- Starter now includes 1 integration instead of none, and the lock copy says
+  so. The notice reads "too many integrations", quotes "Integrations allowed
+  on Starter: 1", and tells you to "disconnect integrations until you are at 1
+  or fewer"; the per-turn line reads "over its 1-integration limit". Nothing in
+  the CLI says Starter has no integrations any more.
+- Plan-limit messages now say what is actually happening. Going over a Starter
+  limit never stopped the workspace, and the copy no longer implies it did:
+  the words "locked" and "read-only" are gone from every line `hq` prints, and
+  the notice states the two things that do pause — adding new files and adding
+  new secrets — while everything else keeps working. A test scans every
+  rendered string for both words so the copy cannot drift back.
+- The over-limit per-turn nag is one line instead of a box, and it repeats at
+  most once every 6 hours (was once a day). `HQ_NO_PLAN_LIMIT_NAG=1` still
+  silences it.
+
+## [5.119.4] — 2026-09-17
+
+### Fixed
+
+- On a host with no usable service manager, `hq agent kit install` now installs
+  the `@reboot` crontab entry that restarts the kit, instead of printing the
+  line and trusting it to be pasted. A supervisor that does not survive a
+  reboot is not a supervisor: on the Muse pilot the host restarted, the
+  supervisor died with it, nothing brought it back, and the agent silently
+  stopped seeing new messages while every surface still reported healthy. The
+  entry is marked and replaced on reinstall rather than stacked, and every
+  other crontab line is preserved. If the crontab cannot be written the install
+  still succeeds but says so in red, naming the consequence and printing the
+  line to add by hand.
+
+## [5.119.3] — 2026-09-17
+
+### Fixed
+
+- `hq agent inbox` now merges the agent's own server inbox with the kit's local
+  mirror instead of reading the mirror alone. The mirror is only as fresh as
+  the kit's poller, and when that process dies nothing says so — the listing
+  simply stops growing. On the Muse pilot the host rebooted, the kit supervisor
+  died with it and was never restarted, and the command kept confidently
+  answering with the eight messages from before the reboot while the server had
+  every newer one: no error, no empty result, no stale marker, just an agent
+  that had gone deaf and could not tell. When the server cannot be reached the
+  mirror is still returned, with a note saying it may be stale. `hq_inbox_read`
+  already merged; both now share one implementation.
+
+## [5.119.2] — 2026-09-17
+
+### Fixed
+
+- The work-mesh listener falls back to its periodic refetch when the MQTT
+  doorbell is unreachable, instead of retrying forever and reporting
+  `component-mesh=error` the whole time. The doorbell is an optimisation over a
+  REST source of truth, so a host that cannot reach AWS IoT has a slower
+  doorbell, not a broken agent. Some bot sandboxes sit behind an egress proxy
+  that intercepts the connection and answers with non-TLS bytes
+  (`tls_validate_record_header:wrong version number`). After five failed
+  attempts the listener says so once, keeps the cache current on the periodic
+  cadence, and retries MQTT every 30 minutes so a bot moved to an unrestricted
+  network recovers its instant doorbell on its own. Incoming DMs are
+  unaffected either way — the inbox poller is a separate service.
+
+## [5.119.1] — 2026-09-17
+
+### Fixed
+
+- A kit.json written before `syncFiles` existed now reads as NOT syncing, the
+  same as a fresh install. 5.119.0 read it as `true` to preserve the behaviour
+  it recorded, which was wrong twice over: the bots with such a file are
+  exactly the ones the mirror is failing on, and because a bare reinstall keeps
+  recorded settings, the documented fix — reinstall the kit — left the sync
+  loop running and `hq agent probe` still pulling the whole vault. A reinstall
+  now removes that loop. A bot that genuinely wants the local mirror passes
+  `--sync-files` once.
+
+## [5.119.0] — 2026-09-17
+
+### Changed
+
+- External agents no longer copy the company vault onto their own machine.
+  `hq agent kit install` used to install a sync loop that mirrored the whole
+  vault to disk; a bot reads and writes vault files on demand through the `hq`
+  MCP server and the `hq files` commands, so the copy bought nothing for the
+  common case and cost a full download of the company's assets. On a team with
+  a large brand library that is hundreds of megabytes, and on a sandboxed bot
+  host whose egress truncates large responses it could never finish at all —
+  every file retried three times and failed with `ERR_HQ_TRUNCATED_RESPONSE`,
+  which left the probe stuck and the agent reporting a sync error while it was
+  otherwise a healthy team member.
+
+  Pass `--sync-files` if the bot genuinely needs files on disk for shell-based
+  work; a reinstall without it removes a sync loop an earlier install left
+  behind. An existing install is unchanged until it is reinstalled.
+
+- `hq agent probe` reports a `files` check in place of `team-sync`. Without a
+  local copy it proves the read path the bot actually uses — a vault listing
+  answers — instead of downloading the vault to prove a folder exists. With
+  `--sync-files` it checks the pull exactly as before.
+
+- The heartbeat reports only the components the kit runs. A component that was
+  never installed is omitted rather than reported as an error, so a bot with no
+  sync loop no longer looks broken.
+
+- `hq_search` no longer runs a local index search on an agent that has no local
+  copy, where it could only ever return nothing. It runs the server-side vault
+  search instead, and says plainly that content and semantic search need a kit
+  installed with `--sync-files`.
+
+## [5.118.2] — 2026-09-17
+
+### Changed
+
+- The locked-workspace notice now says what you can still do. A locked
+  workspace is read-only for new things, but deleting still works — which
+  matters, because every fix the notice lists (remove members, disconnect
+  integrations, delete secrets, deprovision agents) is a delete. The notice
+  states that outright instead of leaving "read-only" to be guessed at.
+
+- The plan-limit box names the plan: "HQ Starter plan limit exceeded" rather
+  than "HQ plan limit exceeded".
+
+### Added
+
+- `hq agents provision --model` now sets the brain model during creation. A
+  model such as `gpt-5.5` or `grok-4.6` selects the agents-v2 runtime unless
+  `--provider` is specified, avoiding a later box recreation to change brains.
+
+## [5.118.1] — 2026-09-17
+
+### Fixed
+
+- The locked-workspace notice now names the real reason. A workspace locked
+  because of secrets or agents no longer reads "over its 5-member limit"; each
+  reason gets its own explanation, its own Starter cap and its own fix, and a
+  lock with no recognised reason says only that the workspace is over the
+  Starter limits. The plan-limit warning also names the dimension it is quoting
+  ("users at 9/10 (90%) (members)").
+
+- You can now remove an HQ Agents v2 agent from the CLI without bypassing its
+  safety check. `hq agents rm` accepts `--confirm-destroy-agents-v2
+  <instance-id>` alongside `--yes` and sends only the instance ID you name; HQ
+  still refuses an ID that does not match the live box.
+
+## [5.118.0] — 2026-09-16
+
+### Added
+
+- External agents can now be woken the moment an HQ message arrives. `hq agent kit wake set-url --stdin` points the kit at a webhook, such as a Grok Bot routine webhook trigger. `hq agent kit wake set-command -- <cmd>` runs a local command for frameworks with a CLI. The kit sends a short notice with no message text when mail is pending, and again every 10 minutes until it is handled. The webhook URL is stored privately and never logged.
+- `hq agent inbox` lists an external agent's pending HQ messages and `hq agent inbox done <id>` marks them handled, so a woken bot never answers the same message twice. The MCP server gains a matching `hq_inbox_done` tool.
+
+### Fixed
+
+- The `hq_inbox_read` MCP tool no longer fails with 403 AGENT_ROUTE_NOT_SUPPORTED. It reads the agent's own inbox instead of the person-only DM inbox, and by default returns only messages not yet handled.
+- The HQ direct-message skill shipped to external agents no longer tells them to use person-only read commands.
+
+## [5.117.3] — 2026-09-16
+
+### Fixed
+
+- `hq doctor --fix` no longer breaks Claude Code sessions. Since HQ moved to a single master hook, the doctor saw every hook script as unregistered. It then added one hook entry per script with no tool filter, so guards such as the Glob path check and core protection ran on every tool call and blocked Bash, Skill and Read with "Glob needs a path" or "Edit to locked path is not allowed". An HQ update could then move those entries into `.claude/settings.local.json`. The doctor no longer auto-registers orphan scripts. It now detects the stray entries in both settings files and `hq doctor --fix` removes them, keeping your permissions and any hooks you added yourself. Scripts listed in `.claude/hooks/hook-registry.json` also no longer show as orphans.
+
+### Fixed
+
+- `hq doctor` now keeps its hook-health compatibility verdict in step with
+  `check-hq-hooks.sh` when either required command hook is missing.
+
+## [5.117.2] — 2026-09-16
+
+### Fixed
+
+- External agents: the work-mesh listener no longer fails every refresh with
+  "Agent callers may only use DM, channel comms, and reaction routes". It now
+  re-reads the agent's own inbox on each doorbell instead of the person-only
+  conversation routes.
+- External agents: `hq agent probe` no longer waits for a DM to itself to show up
+  in the inbox, which the server never delivers. The dm check passes when the
+  send is accepted and the agent inbox is readable.
+- External agents: kit service logs no longer write every line twice when the
+  services run under a supervisor.
+
+### Changed
+
+- HQ now calls the paid plan by its real name everywhere you see it. If your
+  workspace went over its Starter limit, the notice, the error you got when you
+  tried to write something, and the upgrade prompt used to give three different
+  names for the same plan — "HQ Workforce", "HQ Team", and "Team" — which made
+  it genuinely unclear what you were being asked to buy. They all say HQ
+  Workforce now. The free plan is called Starter rather than "free plan", to
+  match the pricing page.
+
+### Fixed
+
+- `hq doctor` now reports failed hook wiring when `.claude/settings.json` has
+  no usable command hook for `SessionStart` or `PreToolUse`. The file can still
+  be present and valid JSON, but it no longer reads as healthy when nothing runs.
+
+## [5.117.1] — 2026-09-16
+
+### Fixed
+
+- `hq agent probe` works for external agents. The work-mesh check no longer
+  reads the owner-only company roster (which answered "Not found" to an agent);
+  it passes when the realtime credential vend names the agent, the agent's own
+  inbox answers, and this host's heartbeat and mesh listener are live. The DM
+  check reads the probe message back from the agent's inbox instead of the
+  human-only thread view that refused agents. Output format is unchanged.
+- The agent kit's mesh listener stays connected. It now asks for the personal
+  realtime credentials that cover the agent's own doorbell topics (the company
+  presence credentials it used made the connection drop before subscribing),
+  subscribes only to topics those credentials grant, and polls the inbox
+  immediately when an inbox doorbell rings.
+- Inbox poll failures are diagnosable: the log names the method, full URL,
+  status and the first 300 characters of the response, and the inbox URL keeps
+  any base path from `apiBaseUrl` without doubling `/v1`.
+- `hq dm inbox` works for agent identities by reading the agent inbox;
+  `hq dm thread` tells agents to use `hq dm inbox` instead of failing with a
+  server refusal.
+- `hq agent kit install` works on hosts with no systemd user session or
+  launchd: it starts the services under one background `hq agent kit run all`
+  supervisor (restarting any service that exits), records its pid in
+  `~/.hq-agent/kit.pid`, and prints the `@reboot` crontab line that keeps it
+  running after a restart. `kit status` and `kit uninstall` understand this
+  mode.
+
+## [5.117.0] — 2026-09-16
+
+### Added
+
+- Your local bots can come back after a reinstall. A bot is an identity HQ
+  keeps for you plus the state that runs it on one computer; wiping that
+  computer's HQ folder, or moving to a new Mac, used to leave every bot dead
+  with no way back — making a new one was refused, because the old one still
+  existed. Now `hq bot restore` brings back every bot you own that is missing
+  from this computer, with its own settings, memory folder and startup agent,
+  keeping the same identity and the same conversation. `hq bot adopt <name>`
+  does one bot, `hq bot list --remote` shows every bot you own and which of
+  them are set up here, and trying to create a bot you already own now says so
+  and points at adopting it instead. Bots made before this shipped come back on
+  sensible defaults, and HQ tells you it did that.
+
+### Fixed
+
+- `hq bot restore` no longer brings back a bot this Mac cannot run. A company
+  bot — one that acts for a company rather than as you — was being set up here
+  as a personal bot: it got credentials, a folder, a memory folder and a startup
+  entry, was counted as restored with nothing reported as failed, and then died
+  at every start and at every login, while the Mac offered "check that Claude
+  Code is signed in" as the remedy, which could never help. Restore, `hq bot
+  adopt` and `hq bot list --remote` now ask exactly the question the bot's own
+  startup asks, before anything is written or any password is rotated. A bot
+  that cannot run here is listed plainly, counted as skipped rather than
+  restored, and refused by adopt with one sentence saying where it does run —
+  and nothing is left behind on this computer.
+- Bringing a bot back no longer leaves a second copy of it. A bot you created
+  here as `qa-x` is `qa-x-<your suffix>` in HQ, and bringing it back built a
+  whole second folder under that longer name: a second startup entry, a second
+  memory folder, and the original folder left behind holding the live password
+  of a bot nothing could reach any more. HQ now recognises the folder a bot
+  already has on this computer — by the identity inside it, even when a wipe
+  left only its credentials — and repairs that one in place. A bot that is not
+  here at all comes back under the name you created it with. If that name
+  already belongs to a different bot, both are kept, under names that tell them
+  apart.
+- `hq bot list --remote --json` now says `ok: true` when it worked. Every
+  failure said `ok: false`, and the success document had no `ok` at all, so
+  anything that learned to check it read a good listing as a failure.
+- A bot's long answer now reaches you, in several messages. HQ Cloud refuses any
+  single message over 4000 characters, and nothing split one up: an answer over
+  that length was refused, saved, and sent again unchanged on every check — a
+  test machine recorded the same rejection 231 times in eight minutes while the
+  person saw no reply and no error at all, and the bot's 44 seconds of work was
+  thrown away. A reply that is too long is now cut into numbered parts — on
+  paragraph breaks where it can, on sentences otherwise, and never leaving a
+  block of code half-open — and posted in order. If something goes wrong partway
+  through, only the parts you have not seen are sent again. And if a message
+  truly cannot be delivered, the bot stops after five tries and tells you so in
+  one short line, instead of asking the server to do the impossible for as long
+  as it runs.
+- A bot's startup entry no longer outlives the bot. When a bot's local setup was
+  gone, the startup entry macOS keeps for it relaunched it every five seconds,
+  forever, filling its log with the same failure (one test machine recorded 267
+  of them in a row). HQ now says once what happened, tells you how to bring the
+  bot back, removes the startup entry it no longer needs, and stops cleanly so
+  nothing relaunches it. This works when macOS itself is the one running the
+  bot, which is the case that matters: the first version did its tidying in an
+  order that had macOS shut the bot down before it could finish, so the startup
+  entry survived and brought the same dead bot back at every login, and the
+  explanation never reached the bot's log. HQ now writes the explanation and
+  removes the entry first, and lets go of itself last.
+
+- You can remove a bot whose settings this computer has already lost. A wiped
+  HQ folder could leave a bot half-here — a folder and a startup entry, no
+  settings — and nothing could clear it: removing it said there was no such
+  bot and suggested creating one, and creating one said you already had it.
+  `hq bot rm <name>` now clears whatever is actually left on this computer, and
+  `hq bot rm <name> --remote` also removes the bot HQ still holds under that
+  name. It checks with HQ before it deletes anything local, so a service that
+  cannot answer leaves nothing half-done.
+
+- Removing a bot now tells the truth when HQ only gets part of the way. When
+  HQ's own teardown of a bot's cloud identity stopped half-way, the
+  machine-readable form said the removal had failed but gave no reason and no
+  explanation, reported success to anything checking the exit code, and printed
+  the raw cloud error — including internal infrastructure addresses — straight
+  at you. It now says one plain sentence, names the reason in the same
+  vocabulary as everything else, and exits non-zero, and no internal detail is
+  repeated anywhere. It also stops making you run the command twice for
+  nothing: when the part HQ could not finish would fail the same way every
+  time, the bot is removed from this computer and you are told the leftover is
+  HQ's to clear; when it is something HQ may yet finish, your settings are kept
+  exactly as they were so running the same command again picks the job back up.
+
+- Bringing bots back now fails in plain language when HQ Cloud is too old for
+  it. `hq bot adopt`, `hq bot restore`, and `hq bot list --remote` all ask HQ
+  which bots you own; against an HQ Cloud without that capability, the raw
+  network error was printed at you, and the machine-readable form printed
+  nothing at all — so the desktop app had nothing it could read. Each now says
+  one plain sentence, and `--json` always returns a result naming the reason,
+  so the app can quietly fall back to showing the bots that are on this
+  computer.
+
+## [5.116.0] — 2026-09-16
+
+### Added
+
+- External bots as team members (host side). `hq agent enroll <code>`
+  redeems a one-time enrollment code from the console: it generates an
+  Ed25519 host key at `~/.hq-agent/host-key` (0600), POSTs the public half to
+  `POST /v1/agents/enroll`, and writes `~/.hq-agent/machine-creds.json` (0600)
+  with `runtime: "external"`. It refuses to run on a host that already holds a
+  human session file or another machine identity unless `--replace`, and
+  never reads `~/.hq/cognito-tokens.json`. Every contract error (expired,
+  already redeemed, invalid, revoked, plan-gated, throttled, unreachable) maps
+  to a message that names the fix.
+- `hq agent kit install|status|uninstall|run <service>`: user-level services
+  (LaunchAgent on macOS, systemd `--user` on Linux) for the company-vault sync
+  loop, a work-mesh doorbell listener (ids-only MQTT → REST refetch into
+  `~/.hq/work-mesh/cache`), an inbox poller that mirrors new items to
+  `~/.hq-agent/inbox/` (server ack opt-in via `--inbox-ack`), and a 60 s
+  heartbeat posting `{ components: { sync, mesh, inbox } }`. Each unit just
+  runs `hq agent kit run <service>`; logs land in `~/.hq-agent/logs/`. The
+  install also ships `~/.hq-agent/skills/{dm,search,files,secrets-exec,work-mesh-status}/SKILL.md`
+  (agentskills.io format). `docker/hq-agent-kit/` runs the same four
+  processes from a mounted creds volume.
+- `hq agent probe`: whoami → vault sync → mesh presence → DM round trip to
+  self → secrets list, one PASS/FAIL line each, non-zero exit on any failure,
+  a final `heartbeat  <age>` line (the recipe format), and the result POSTed to
+  `POST /v1/agents/{uid}/probe-result` so the console flips to Enrolled.
+- `hq agent mcp`: a stdio MCP server (no SDK dependency; initialize / ping /
+  tools/list / tools/call) backed by the enrolled machine identity, exposing
+  `hq_whoami`, `hq_search`, `hq_files_list`, `hq_files_read`,
+  `hq_secrets_list`, `hq_secrets_exec` (exit code + output only, never
+  values), `hq_dm_send`, `hq_inbox_read`, `hq_work_mesh_status`. Console
+  recipes register it as `command: hq, args: [agent, mcp]`.
+- `hq agents rotate <uid>` (fresh enrollment code, shown once) and
+  `hq agents revoke <uid> [--remove] --yes` for external agents. Both fail
+  closed under `HQ_API_KEY` (JWT-only routes).
+
+### Changed
+
+- `@indigoai-us/hq-cloud` pinned to `~6.16.48`, whose machine mint signs the
+  server's nonce with the host key when creds carry `runtime: "external"`.
+
+### Fixed
+
+- When a new agent needs an owner action, `hq agents provision` prints the
+  current Codex sign-in code or a link to finish setting up the Slack app. `hq agents status
+  <slug>` gets the current action again. The `--json` output adds a
+  `pendingActions` array, plus `slackInstallPending` and `slackInstallUrl` for
+  Slack installs.
+
+- `hq secrets` now fails promptly instead of waiting for a browser sign-in
+  that cannot be completed when stdin or stderr is not a terminal, or in CI.
+  Run `hq login` from an interactive shell first if no valid session exists.
+
+- hq gives both visible and quiet version-gated updates 30 minutes to finish.
+  When that limit expires, it tries to terminate the updater's process group
+  on POSIX or process tree on Windows. If the operating system denies that
+  request, hq reports it instead of waiting forever. Set `HQ_UPDATE_TIMEOUT_MS`
+  to another whole number of milliseconds up to 2,147,483,647. hq ignores an
+  invalid value and tells you it is using the 30-minute limit.
+
+- HQ's housekeeping pass now clears out add-on shortcuts that lead nowhere,
+  instead of warning about them forever. A pack that stops shipping one of its
+  files, or a pack whose folder was installed from a scratch directory someone
+  later deleted, used to leave shortcuts behind that nothing would ever remove.
+  HQ now clears a shortcut only when it sits in a folder the add-on system
+  manages, only when it points into the add-on folder, and only when the thing
+  it points at is definitely not there. A shortcut it cannot check, one leading
+  somewhere else, or a real folder with real files in it are all left alone. On
+  one real setup this cleared eight dead shortcuts that had been warning on
+  every run.
+
+- Add-on packs now repair their own shortcuts after your HQ folder moves to a
+  new machine. Those shortcuts point at a full path, so on a new computer they
+  all point somewhere that does not exist, and HQ used to leave them alone on
+  the grounds that something was already there. That made the breakage
+  permanent: every later tidy-up skipped them for the same reason. HQ now
+  repoints a shortcut that leads nowhere, while still refusing to touch one
+  that leads to real content. Repairing a tree this way fixed a batch of
+  long-broken pack shortcuts in one pass.
+
+## [5.115.6] — 2026-09-16
+
+### Fixed
+
+- `hq doctor --fix` can now refresh a company sync journal that is stale or
+  has never synced, when that company still has a folder under `companies/`.
+  It pulls that company only, keeps your local copy if there is a conflict,
+  and does not push. Company journals left over from memberships you do not
+  keep locally are reported as unused rather than broken, so a session-start
+  health check no longer files "could not repair" reports for folders that
+  were never on this machine. Personal journals are unchanged: they still
+  warn when stale, and `--fix` will not pull your personal vault on its own.
+  The repair pass also skips the integrations inventory, which it cannot
+  repair, so a slow connection check cannot stall the fix.
+
+## [5.115.5] — 2026-09-15
+
+### Fixed
+
+- The setting that turns the end-of-turn checkpoint requirement off,
+  `HQ_CHECKPOINT_GATE`, now works from `.claude/settings.json` on every runtime.
+  Before, only Claude Code passed that setting through to the checkpoint hook,
+  so if you work in Codex or Grok, writing it in the settings file did nothing
+  and there was no sign of why. hq now reads the file itself. As with the other
+  checkpoint settings, `settings.local.json` overrides it, anything you set in
+  your terminal overrides both, and `false` or `0` written as plain JSON works
+  as well as `"0"`. If the value is something the setting does not understand,
+  hq names it and leaves the requirement on rather than guessing.
+
+## [5.115.4] — 2026-09-15
+
+### Changed
+- Search indexing now leaves qmd embeddings for a later pass when CPU or memory
+  use reaches 50%, while still updating the index. Set
+  `HQ_INDEX_MAX_LOAD_PERCENT` to another percentage, or to `0` or `off` to
+  disable this check. After 12 skipped passes or six hours, hq runs an embed
+  despite the load so search results do not fall behind forever.
+- HQ's housekeeping pass (`hq reindex`, which runs after an agent finishes a
+  turn) is much faster on large setups. On a root with 21 companies it took
+  about two and a half minutes even with nothing to do. Two things were to
+  blame. The scan that finds your workers read every folder inside any source
+  code you keep under a company, `node_modules` and `.git` included, which on
+  that root meant reading 83,950 folders to find 126 worker files. It now skips
+  those folders instead of walking them, and takes 0.4 seconds instead of 22.
+  Separately, the hook health check ran every `hq doctor` check in order to
+  read six of them; it now asks only for the group those six live in.
+- `hq doctor` takes `--only <families>`, so you can run one group of checks
+  instead of all of them: `hq doctor --only hooks`. A name it does not
+  recognise is refused rather than quietly checking nothing, and `--json`
+  records which groups ran, so a partial result cannot be read as a verdict on
+  the whole tree.
+
+### Fixed
+
+- When Claude Code's saved login has stopped working, a local bot now says it needs a sign-in and keeps your message for when it works again. Before, the bot relayed Claude Code's own "Failed to authenticate" notice as if it were the model's answer, so HQ never showed the "Sign in again" button.
+
+### Added
+
+- You can now switch off the background helper that tidies HQ after a
+  checkpoint, without giving up checkpoints themselves. Add
+  `"env": { "HQ_CHECKPOINT_AGENT": "0" }` to `.claude/settings.json` in your HQ
+  folder and the helper stops running; your checkpoint notes are still saved.
+  Set it back to `"1"` to turn it on again. It works the same whether you use
+  Claude Code, Codex or Grok, and `settings.local.json` overrides it if you
+  keep one. If the value is something the setting does not understand, hq says
+  so rather than quietly leaving the helper on.
+
+## [5.115.3] — 2026-09-15
+
+### Changed
+
+- The background helper that tidies HQ after a checkpoint now runs on cheaper
+  settings: Claude Sonnet 5 instead of Opus 5, Grok 4.6 instead of 4.5, and a
+  medium thinking effort on every engine (Codex and Grok were on high). It does
+  the same work; it just costs less while doing it.
+
+## [5.115.2] — 2026-09-15
+
+### Fixed
+
+- Search indexing no longer starts a second embedding rebuild when one is
+  already running. Two rebuilds could use much of a machine while writing to
+  the same local index, so hq now skips the duplicate and lets a later pass
+  finish any remaining work.
+- Creating a company from the command line (`hq onboard create-company`), and from a bot's conversation, works again; it had been refused with "ownerUid must match the authenticated caller". A company you already created but never finished setting up is now picked up and completed instead of being refused as "already taken".
+
+## [5.115.1] — 2026-09-15
+
+### Fixed
+
+- `hq bot create --kind company` now sends the bot's companies with the create, as the cloud requires, so a company bot can actually be created; the cloud makes it a member of each company, and a company you are not an owner or admin of is refused before anything is created.
+
+## [5.115.0] — 2026-09-15
+
+### Added
+
+- Local bots now come in two kinds. A **personal bot** acts as you: everything
+  it does — in your direct messages, in rooms, and on its first task — runs
+  under your own account, so it reaches every company and file you can and
+  can create companies, bots, invites and shares for you. A **company bot**
+  acts as itself, like a cloud agent: it is a member of one or more companies
+  and reaches only those companies' files, memory and secrets; it never acts
+  as you and says so if asked to create something for you, suggesting you ask
+  a personal bot instead. `hq bot create <name> --kind personal|company
+  --company <slug>` (repeat `--company` for several) picks the kind; a
+  company bot is invited into each company as you create it, and the command
+  tells you exactly which invite did not go through. `hq bot companies
+  <name> --add/--remove <slug>` changes a company bot's memberships later.
+  `hq bot list --json` and `hq bot status` show each bot's kind and
+  companies, and every bot's instructions say which kind it is. Bots created
+  before this release keep working, as personal bots (including one created
+  from a company worker, and the setup bot). Removing a company bot with
+  `hq bot rm` also takes it out of its companies.
+- A personal bot now runs `hq` commands as you in rooms too, not only in your
+  direct messages (before, its room turns used the bot's own identity).
+
+### Fixed
+
+- When a local bot's coding tool (Claude Code, Codex or Grok) has lost its
+  sign-in, the bot no longer answers every message with "Failed to
+  authenticate". It says once that the tool needs you to sign in again, keeps
+  your message, and answers it on its own as soon as the sign-in works (right
+  away after `hq bot restart`). A setup bot's first step waits the same way.
+  `hq bot list --json` reports `runtimeSignIn` while this is the case.
+- In your direct messages, a local bot now does what you ask under your own
+  account: creating a company, a bot, an invite or a share works directly,
+  instead of the bot explaining that the cloud refuses to let it act in your
+  name and asking you to run a command in a terminal. In rooms, bots still act
+  as themselves. A company you create this way now also adds that bot as a
+  member, so it can keep helping inside the new company.
+
+## [5.114.0] — 2026-09-15
+
+### Changed
+
+- Local bots now work on two conversations at once. A question in one
+  channel no longer waits for the bot to finish answering in another; messages
+  in the same conversation (your DMs with the bot, or one channel) are still
+  answered in order. A restart or stop during two turns reports each one that
+  did not finish.
+
+### Fixed
+
+- The log bundle attached to `hq feedback` reports is now a zip instead of a
+  gzip. Slack refuses a gzip file from the HQ app at any size, so for several
+  weeks every report's logs were uploaded and then silently dropped before
+  anyone could read them. Nothing about what the bundle contains or how it is
+  redacted has changed.
+
+## [5.113.1] — 2026-09-15
+
+### Fixed
+
+- A bot can create a bot for its owner. `hq bot` commands (create, list, rm,
+  promote) always act as the signed-in person, even when a bot runs them; they
+  used the bot's own identity, which can own no bot, so the setup bot told
+  people to open a terminal to create their first bot.
+
+## [5.113.0] — 2026-09-15
+
+### Added
+
+- Search indexing now skips any file larger than 100 KB. HQ indexes every `.md`
+  and `.json` file under your project folders, which pulled in things nobody
+  searches as prose: browser trace dumps, perf captures, scraped datasets,
+  lockfiles. A few of those were large enough that indexing ran out of time
+  before it finished, so the search index never caught up. Set a different limit
+  with `HQ_INDEX_MAX_DOC_BYTES`, or `indexMaxDocBytes` in your HQ root's
+  `.hq/config.json`. Set it to `0` to index everything again.
+
+## [5.112.0] — 2026-09-15
+
+### Added
+
+- `hq core sentry report`: lets HQ hooks send one bounded diagnostic event to
+  Sentry through stdin. It is for hooks rather than everyday interactive use,
+  accepts only approved simple fields, and has a `--dry-run` mode that shows
+  the event it would send instead of sending it.
+
+### Fixed
+
+- `hq` starts faster by loading only the command you run instead of every
+  command, and by avoiding an observability hook that delayed startup. Help
+  output and command behaviour are unchanged.
+- Commands no longer wait as long for a network endpoint that accepts a
+  connection but does not answer. After a long-running command, hq still makes
+  time for error reporting and its version-cache refresh.
+- CLI diagnostics now finish one release-health session with the correct final
+  state when a CLI run finishes or fails normally, including `hq-auth-refresh`,
+  instead of leaving a session open or competing sessions reporting the same
+  run.
+
+## [5.111.2] — 2026-09-15
+
+## [5.111.1] — 2026-09-14
+
+### Fixed
+
+- A new bot's first message no longer tells its signed-in owner they are not
+  signed in. While the bot fetched its own sign-in, a check of the owner's
+  sign-in in the same process could read the bot's credentials instead and find
+  no account. Sign-in reads now wait for that to finish.
+- When a bot cannot read its owner's account right away, it tries again before
+  answering, and never asks a signed-in owner to sign in or run a command. The
+  bot's log now records why an owner check failed.
+
+## [5.111.0] — 2026-09-14
+
+### Added
+
+- `hq skill delete <target>`: delete a company skill and all of its files for
+  everyone. Accepts a `skl_…` id, a SKILL.md path, or a skill slug; names the
+  skill and asks for confirmation (`--yes` skips it, and it refuses to run
+  unattended without `--yes`). Synced copies are removed on the next sync.
+  Requires access-admin rights on the skill.
+
+## [5.110.0] — 2026-09-14
+
+### Added
+
+- `hq bot`: personal local bots that run on your own computer under your Claude
+  Code, Codex, or Grok sign-in, with their own HQ identity and your permissions.
+  `hq bot create|list|status|start|stop|restart|rm|workers|set|logs` manage them;
+  each bot runs as a launchd agent, answers your DMs, can join group chats and
+  company channels, and can start from a company worker (`--worker`).
+- The HQ setup bot: `hq bot create setup --worker setup` uses the setup worker
+  bundled with the CLI, so a fresh install can be walked through setup before
+  core workers have synced.
+- Bots post their in-between messages while they work, have no turn time limit
+  (`HQ_BOT_TURN_TIMEOUT_MS` is opt-in), always reply, and never re-run a message
+  that already started.
+- Per-bot model and thinking level (`hq bot set <name> --model --effort`),
+  read fresh on every turn.
+- `hq bot promote`: move a local bot to the cloud as the same identity
+  (requires the matching backend release).
+
+### Fixed
+
+- Bots no longer tell their owner they belong to no company: owner DM turns
+  carry the owner's companies, looked up with the owner's own sign-in, because
+  `hq` lookups a bot runs describe the bot itself.
+- Stopping a bot's turn stops everything the model started, instead of waiting
+  for a child process that still holds the output open.
+
+## [5.109.16] — 2026-09-14
+
+### Changed
+
+- hq-cloud now uses 6.16.41, which reverts the phase-two resident journal change
+  that caused sync runners to spin.
+
+## [5.109.15] — 2026-09-13
+
+### Changed
+
+- hq-cli now bundles hq-cloud 6.16.39, reducing resident sync-journal memory
+  through the packed row store.
+
+## [5.109.14] — 2026-09-13
+
+### Fixed
+
+- Repeated "install tree was being rewritten" reports from a background reinstall
+  now collapse into one stable issue per outcome instead of spawning a fresh crash
+  report on every occurrence (Sentry HQ-CLI-21, HQ-CLI-22, HQ-CLI-23). hq already
+  groups these by their recovery outcome, but the grouping key led with a
+  placeholder that also told Sentry to fold in its own default grouping — and for
+  this error that default is the underlying loader failure, whose details differ
+  every time (which dependency file the reinstall happened to be rewriting, under
+  each machine's install path). So each occurrence minted a new issue and the
+  family never settled down. The key is now fully explicit and no longer inherits
+  that default, so future occurrences with the same outcome share one group. The
+  existing issues HQ-CLI-21/22/23 stay open as they are: a grouping change only
+  affects events reported after it ships.
+
+## [5.109.13] — 2026-09-13
+
+### Fixed
+
+- A background reinstall no longer turns into a crash report in the CommonJS twin
+  of the shape 5.109.12 fixed for ES modules (HQ-CLI-20). When another program
+  reinstalls hq globally while a command is starting, it rewrites hq's files one
+  by one over a few seconds. If a bundled CommonJS dependency (here `ajv`, reached
+  while `hq core timeout-guard` registers its commands) had just resolved one of
+  its own files and that file vanished before Node read it, the low-level `ENOENT …
+  open` came from inside Node's CommonJS module loader — a shape the recovery only
+  recognized for ES modules, so it was still filed as a crash. It is now recognized
+  as "your install was mid-update, not an hq bug": the command waits for the
+  reinstall to settle and re-runs once on the healed tree, and the same noise is
+  dropped on the routes that bypass the top-level handler. The gate is deliberately
+  narrow — it fires only when Node's own loader was reading a module's source (the
+  frame directly beneath the file read is a `cjs/loader` frame, never the
+  dependency's own code) — so a third-party package whose own startup code reads a
+  missing file, or a fault in hq's own shipped files, still reports exactly once
+  (Sentry HQ-CLI-20).
+
+## [5.109.12] — 2026-09-12
+
+### Fixed
+
+- A background reinstall no longer turns into a crash report in two more shapes
+  it was still slipping through (HQ-CLI-1S, HQ-CLI-1T). When another program
+  reinstalls hq globally while a command is starting, it renames hq's files aside
+  and rewrites them file by file over a few seconds. Two failure shapes from that
+  window were still filed as crashes instead of being recovered: (1) a file that
+  Node checked a moment earlier vanished between its two resolve steps, surfacing
+  as a low-level `ENOENT … lstat` from inside the module resolver (HQ-CLI-1S);
+  and (2) a dependency file that was found but only half-written, so loading it
+  returned an empty module and its own code threw `TypeError: … is not a
+  function` (HQ-CLI-1T). Both are now recognized as "your install was mid-update,
+  not an hq bug": the command waits for the reinstall to settle and re-runs once
+  on the healed tree instead of reporting an error. The half-written-file case
+  only ever waits when a reinstall is actually in progress — a genuine, lasting
+  defect in a third-party dependency still reports exactly once and never pays a
+  wait, and a fault in hq's own shipped files is still reported. (The two related
+  shapes HQ-CLI-1V and HQ-CLI-1W are already covered by 5.109.8 and #561.)
+
+## [5.109.11] — 2026-09-12
+
+### Fixed
+
+- A torn-install recovery no longer gives up after 90 seconds while another hq
+  updater is still legitimately installing hq-cli. When a command starts just as
+  the desktop app (or the box's `hq-cli-update` timer, or another `hq`) is
+  rewriting the install, the recovery waits for that writer to finish — bounded by
+  the shared install lock's own 10-minute staleness window rather than the 90-second
+  settle deadline — and then re-runs once on the healed tree, so the common case
+  (an install that finishes within the window) no longer fails at all. A short
+  second line explains the pause while it waits. If a writer holds the lock past
+  that ceiling, the command still fails once, but with a "let the update finish,
+  then re-run — do not reinstall while it is running" remedy and a distinct
+  `lock-held` outcome, instead of advice to reinstall over a live installer
+  (Sentry HQ-CLI-1Y, HQ-CLI-23). The ceiling is overridable with
+  `HQ_INSTALL_SETTLE_LOCK_TIMEOUT_MS`.
+
+## [5.109.10] — 2026-09-12
+
+### Fixed
+
+- A global reinstall that tears the install tree out mid-startup now recovers
+  even when the module that vanished is a RELATIVE sibling (for example
+  `@babel/runtime`'s `./typeof.js`, reached through the mqtt → worker-timers
+  chain). The torn-install classifier reduced a relative CJS specifier to the
+  package name `.`, producing a readiness probe that could never turn true — so
+  an affected command burned the entire 90-second settle budget, never re-ran on
+  the settled tree, and reported an error instead of recovering. Relative
+  specifiers are now re-resolved the way Node's CJS resolver does — from the
+  importer's directory, trying the file, its `.js`/`.json`/`.node` forms, and the
+  directory forms — so the command waits only as long as the reinstall actually
+  takes and then re-execs once on the healed tree. A genuinely missing sibling
+  still surfaces exactly one error naming the resolved path (Sentry HQ-CLI-1R).
+
+## [5.109.8] — 2026-09-11
+
+### Fixed
+
+- A background reinstall no longer turns into a crash report (HQ-CLI-1M,
+  HQ-CLI-1N). When another program reinstalls hq globally while a command is
+  running — the box's own update timer, the desktop app, or a second `hq` — it
+  renames hq's files aside and rewrites them file by file over a few seconds, and
+  a command already running can try to load a file that vanished in that window.
+  hq already knew to treat that as "your install was mid-update, not an hq bug"
+  and print a re-run/reinstall note instead of a crash, but it could only do so
+  while it could still find its own install directory on disk — which, in this
+  exact situation, it usually could not, because that directory is what just got
+  renamed away. That one blind spot silenced the recovery for two different crash
+  shapes: the ESM-loader `ENOENT` seen in production (HQ-CLI-1M) and a lazy
+  CommonJS `require('./sibling')` from a bundled dependency that resolves after
+  the tear (HQ-CLI-1N). hq now locates its own directory without reading the
+  disk, so the mid-update case is recognized for both: a registration-time tear
+  waits for the install to settle and re-runs once, and a tear anywhere else
+  prints the reinstall note. A genuine packaging fault in hq's own shipped files
+  (a miss under the install's own `dist/` or `assets/`) is still reported.
+
+## [5.109.7] — 2026-09-10
+
+### Fixed
+
+- Add `whoami --json`, structured `files acl --json` with explicit absence,
+  and `people resolve --membership-only` with canonical company/person IDs.
+  Delegation helpers can now verify exact grants without parsing display tables
+  or treating a missing ACL as a transport failure. Existing human output stays available.
 
 ## [5.109.6] — 2026-09-10