@indigoai-us/hq-cli 5.345.155 → 5.345.159

package/dist/lib/doctor/checks/sync-health.js

@@ -33,6 +33,7 @@ import * as path from "node:path";
 import * as hqCloud from "@indigoai-us/hq-cloud";
 import { loadManifestExports, MANIFEST_UNAVAILABLE_REASON, } from "../../hq-cloud-manifest.js";
 import { readCompaniesManifestMap } from "../../work-context/repo-remote.js";
+import { companyRecordedNotResolved } from "../company-resolution-state.js";
 import { MANIFEST_DISABLED_ENV, manifestUploadsDisabled, } from "../../manifest-disabled.js";
 import { CLI_VERSION } from "../../../cli-version.js";
 import { readSyncVersion } from "../../../utils/feedback-versions.js";
@@ -59,6 +60,8 @@ function withDefaults(deps, hqRoot) {
         unresolvedScopes: deps.unresolvedScopes ?? ((journals) => defaultUnresolvedScopes(hqRoot, journals)),
         localCompanyExists: deps.localCompanyExists ??
             ((slug) => defaultLocalCompanyExists(hqRoot, slug)),
+        companySyncResolvable: deps.companySyncResolvable ??
+            ((slug, lastSync) => !companyRecordedNotResolved(hqRoot, slug, deps.now().getTime(), lastSync)),
         manifestUploadsDisabled: deps.manifestUploadsDisabled ?? (() => manifestUploadsDisabled()),
     };
 }
@@ -555,10 +558,62 @@ function journalResults(deps, journals) {
                 continue;
             }
         }
-        results.push(journalFreshnessResult(entry, entry.slug, nowMs));
+        const freshness = journalFreshnessResult(entry, entry.slug, nowMs);
+        // A stale company journal whose company the sync service could not
+        // resolve on the last pull would send `--fix` into the same failure, and
+        // the health hook would then report it every day (feedback 9b4a5016).
+        // Only a WARN is downgraded: a fresh journal stays PASS and an unreadable
+        // one stays UNKNOWN.
+        if (freshness.status === "WARN" &&
+            isCompanyJournalSlug(entry.slug) &&
+            !companySyncResolvable(deps, entry.slug, entry.journal.lastSync)) {
+            results.push(notOnThisMachineResult(entry, checkId));
+            continue;
+        }
+        results.push(freshness);
     }
     return results;
 }
+function companySyncResolvable(deps, slug, lastSync) {
+    try {
+        return deps.companySyncResolvable(slug, lastSync);
+    }
+    catch {
+        // Probe failed: keep the WARN rather than hiding a possibly-live company.
+        return true;
+    }
+}
+function notOnThisMachineResult(entry, checkId) {
+    return {
+        status: "NA",
+        checkId,
+        reasonCode: "company-not-resolved",
+        target: entry.path,
+        message: `Sync journal '${entry.slug}' is not on this machine — the last hq doctor --fix pull could not find '${entry.slug}' for your HQ identity, so --fix will not pull it again for now.`,
+        remediation: `If you should still have '${entry.slug}', check you are signed in to the right HQ account (/hq-whoami) and ask its owner to re-invite you, then run \`hq sync pull --company ${entry.slug}\`; if not, delete its old sync journal (sync-journal.${entry.slug}.json in ~/.hq).`,
+    };
+}
+function latestTimestamp(...values) {
+    let best = null;
+    let bestMs = Number.NEGATIVE_INFINITY;
+    for (const value of values) {
+        const ms = value ? Date.parse(value) : Number.NaN;
+        if (Number.isFinite(ms) && ms > bestMs) {
+            bestMs = ms;
+            best = value;
+        }
+    }
+    return best;
+}
+function manifestNotOnThisMachineResult(entry, checkId, slug) {
+    return {
+        status: "NA",
+        checkId,
+        reasonCode: "company-not-resolved",
+        message: `Scope '${entry.scopeKey}' (company '${slug}') is not on this machine — the last hq doctor --fix run could not find '${slug}' for your HQ identity, so --fix will not upload its manifest again for now.`,
+        remediation: `If you should still have '${slug}', check you are signed in to the right HQ account (/hq-whoami) and ask its owner to re-invite you, then run \`hq sync pull --company ${slug}\`.`,
+    };
+}
 // ─── Manifest upload freshness (sync-reconciliation-audit US-004) ────────────
 /**
  * A scope whose last manifest upload is older than this is reported stale.
@@ -651,6 +706,16 @@ function manifestResults(deps, journals) {
             // Without it the row stays manual-only. Personal must be explicit: a
             // bare `hq sync manifest` uploads the active company instead.
             const scope = manifestUploadScope(entry);
+            // Same evidence as the journal row: a company a --fix run could not
+            // resolve is not on this machine, so its manifest is NA too. The later
+            // of the journal sync and this upload counts as a later success.
+            if (scope && scope !== "personal") {
+                const journalSync = journals.find((j) => j.slug === scope)?.journal.lastSync ?? null;
+                const latest = latestTimestamp(journalSync, entry.lastUploadAt);
+                if (!companySyncResolvable(deps, scope, latest)) {
+                    return manifestNotOnThisMachineResult(entry, checkId, scope);
+                }
+            }
             const command = `hq sync manifest${scope ? ` --scope ${scope}` : ""}`;
             const message = `Scope '${entry.scopeKey}' last uploaded a sync manifest ${days} day${days === 1 ? "" : "s"} ago (${entry.lastUploadAt}) — the daily audit pass is not running.`;
             // With the kill switch set the upload exits 0 and sends nothing, so the

package/dist/lib/doctor/company-resolution-state.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Companies a `hq doctor --fix` pull found the sync service cannot resolve
+ * for this machine's signed-in identity (feedback 9b4a5016).
+ *
+ * The record is evidence, not a guess: it is written only when a targeted
+ * `hq sync pull --company <slug>` failed because the service has no company
+ * by that slug for the caller, or refused the caller access to it. The sync
+ * health check then reports that company's stale journal as "not on this
+ * machine" instead of an auto-fixable WARN, so `--fix` stops pulling it and
+ * the client-health hook stops reporting it. A successful pull clears the
+ * entry, and an entry expires after {@link COMPANY_NOT_RESOLVED_TTL_MS} so a
+ * re-joined company is tried again.
+ */
+export declare const COMPANY_RESOLUTION_STATE_RELATIVE_PATH: string;
+/** An unresolved-company record is retried after this long. */
+export declare const COMPANY_NOT_RESOLVED_TTL_MS: number;
+/**
+ * True when the output of a failed `hq sync pull --company <slug>` shows the
+ * service could not resolve the company for this caller: no company by that
+ * slug in the caller's namespace, or a 403/404 on the membership-gated
+ * credential vend. A bare 403/404 on the slug lookup is not used: a gateway
+ * or authorizer fault answers the same way. Network, timeout, and server
+ * errors are not evidence.
+ */
+export declare function pullOutputShowsCompanyNotResolved(output: string): boolean;
+/** Record that a pull could not resolve `slug`, or clear it after a good pull. */
+export declare function recordCompanyResolution(hqRoot: string, slug: string, resolved: boolean, nowMs: number): void;
+/** True when a pull within the TTL could not resolve `slug`. Never throws. */
+export declare function companyRecordedNotResolved(hqRoot: string, slug: string, nowMs: number, lastSyncedAt?: string | null): boolean;
+//# sourceMappingURL=company-resolution-state.d.ts.map

package/dist/lib/doctor/company-resolution-state.js

@@ -0,0 +1,89 @@
+/**
+ * Companies a `hq doctor --fix` pull found the sync service cannot resolve
+ * for this machine's signed-in identity (feedback 9b4a5016).
+ *
+ * The record is evidence, not a guess: it is written only when a targeted
+ * `hq sync pull --company <slug>` failed because the service has no company
+ * by that slug for the caller, or refused the caller access to it. The sync
+ * health check then reports that company's stale journal as "not on this
+ * machine" instead of an auto-fixable WARN, so `--fix` stops pulling it and
+ * the client-health hook stops reporting it. A successful pull clears the
+ * entry, and an entry expires after {@link COMPANY_NOT_RESOLVED_TTL_MS} so a
+ * re-joined company is tried again.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const COMPANY_RESOLUTION_STATE_RELATIVE_PATH = path.join("workspace", "doctor", "unresolved-companies.json");
+/** An unresolved-company record is retried after this long. */
+export const COMPANY_NOT_RESOLVED_TTL_MS = 14 * 24 * 60 * 60 * 1000;
+/**
+ * True when the output of a failed `hq sync pull --company <slug>` shows the
+ * service could not resolve the company for this caller: no company by that
+ * slug in the caller's namespace, or a 403/404 on the membership-gated
+ * credential vend. A bare 403/404 on the slug lookup is not used: a gateway
+ * or authorizer fault answers the same way. Network, timeout, and server
+ * errors are not evidence.
+ */
+export function pullOutputShowsCompanyNotResolved(output) {
+    return (/No entity in caller's namespace matches company\//.test(output) ||
+        /STS \/sts\/vend failed: 40[34]\b/.test(output));
+}
+function statePath(hqRoot) {
+    return path.join(hqRoot, COMPANY_RESOLUTION_STATE_RELATIVE_PATH);
+}
+function readState(hqRoot) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(statePath(hqRoot), "utf8"));
+        if (parsed &&
+            typeof parsed === "object" &&
+            parsed.version === 1 &&
+            typeof parsed.notResolved === "object" &&
+            parsed.notResolved !== null) {
+            const notResolved = Object.create(null);
+            for (const [slug, atMs] of Object.entries(parsed.notResolved)) {
+                if (typeof atMs === "number" && Number.isFinite(atMs))
+                    notResolved[slug] = atMs;
+            }
+            return { version: 1, notResolved };
+        }
+    }
+    catch {
+        // Missing or unreadable state is "nothing recorded".
+    }
+    return { version: 1, notResolved: Object.create(null) };
+}
+function writeState(hqRoot, state) {
+    const target = statePath(hqRoot);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    const temporaryPath = `${target}.${process.pid}.tmp`;
+    fs.writeFileSync(temporaryPath, `${JSON.stringify(state)}\n`, { mode: 0o600 });
+    fs.renameSync(temporaryPath, target);
+}
+/** Record that a pull could not resolve `slug`, or clear it after a good pull. */
+export function recordCompanyResolution(hqRoot, slug, resolved, nowMs) {
+    const state = readState(hqRoot);
+    if (resolved) {
+        if (!Object.hasOwn(state.notResolved, slug))
+            return;
+        delete state.notResolved[slug];
+    }
+    else {
+        state.notResolved[slug] = nowMs;
+    }
+    writeState(hqRoot, state);
+}
+/** True when a pull within the TTL could not resolve `slug`. Never throws. */
+export function companyRecordedNotResolved(hqRoot, slug, nowMs, lastSyncedAt) {
+    const notResolved = readState(hqRoot).notResolved;
+    if (!Object.hasOwn(notResolved, slug))
+        return false;
+    const atMs = notResolved[slug];
+    // A daemon/manual pull after this failure is stronger evidence than the
+    // cached failure, even if that successful sync has since become stale.
+    const lastSyncMs = lastSyncedAt ? Date.parse(lastSyncedAt) : Number.NaN;
+    if (Number.isFinite(lastSyncMs) && lastSyncMs > atMs)
+        return false;
+    const ageMs = nowMs - atMs;
+    return ageMs >= 0 && ageMs <= COMPANY_NOT_RESOLVED_TTL_MS;
+}
+//# sourceMappingURL=company-resolution-state.js.map

package/dist/lib/doctor/fix/apply.d.ts

@@ -61,6 +61,12 @@ export interface ApplyFixesOptions {
     confirm?: () => boolean | Promise<boolean>;
     /** Clock for the backup directory name. Default: `new Date()`. */
     now?: () => Date;
+    /**
+     * Monotonic milliseconds for the network-repair time budget. Default:
+     * `performance.now()`. Tests inject a fake clock so a slow-pull budget run
+     * does not take minutes of real time.
+     */
+    elapsedMs?: () => number;
     /**
      * The dirty-tree probe: the changed paths under {@link HOOK_CONFIG_DIRS}, or
      * [] when clean or not a git repo. Default shells out to `git status`.
@@ -121,6 +127,12 @@ export interface RefreshSyncResult {
     outcome: RefreshSyncOutcome;
     /** One-line summary for the post-fix report. */
     message: string;
+    /**
+     * True when the pull failed because the sync service could not resolve
+     * the company for this caller (no such company, or access refused).
+     * Recorded so the next check reports the journal "not on this machine".
+     */
+    companyNotResolved?: boolean;
 }
 /** Per-company bound for the default `hq sync pull` repair. */
 export declare const REFRESH_SYNC_TIMEOUT_MS = 90000;
@@ -142,6 +154,12 @@ export interface RefreshManifestResult {
      * unresolved-check next step. Absent when the upload exited 0.
      */
     reason?: string;
+    /**
+     * The upload failed because the company is not visible to this identity
+     * ("No membership found"). Recorded as unresolved-company evidence only
+     * after another company succeeds in the same run.
+     */
+    companyNotResolved?: boolean;
 }
 /**
  * Why a sync check is still FAIL or WARN after `--fix`:
@@ -189,12 +207,22 @@ export interface AppliedFixBackup {
 /** A newly unlocked safe repair can be picked up for at most this many passes. */
 export declare const MAX_FIX_PASSES = 3;
 /**
- * Two 90s network repairs leave 120s for startup and check overhead under the
- * hook's 300s ceiling. Journal pulls and manifest uploads share this budget.
- * When both kinds are pending and no upload has run yet, one slot is held for
- * a manifest upload so stale journals cannot starve every manifest.
+ * Ceiling on network repairs per run. A run refreshes every resolvable stale
+ * journal up to this many; above it, `--fix` says so and the rotating cursor
+ * picks up the rest next run. Journal pulls and manifest uploads share this
+ * budget. When both kinds are pending and no upload has run yet, one slot is
+ * held for a manifest upload so stale journals cannot starve every manifest.
+ * Each repair is bounded at 90s, and unattended runs also stop starting new
+ * repairs after REFRESH_SYNC_START_BUDGET_MS (feedback 9b4a5016).
+ */
+export declare const MAX_REFRESH_SYNC_PLANS_PER_RUN = 10;
+/**
+ * No new network repair starts once this much of the run has passed. Health
+ * hooks bound `--fix` at 300s (older hooks are still in the field), so the
+ * last 90s repair started here still ends by 210s, leaving room for the
+ * check passes. Fast pulls reach the count ceiling well before this.
  */
-export declare const MAX_REFRESH_SYNC_PLANS_PER_RUN = 2;
+export declare const REFRESH_SYNC_START_BUDGET_MS = 120000;
 /** The outcome of an {@link applyFixes} run. */
 export interface ApplyFixesResult {
     /** 0 on success, decline, or a clean no-op; 1 when a dirty tree is refused. */
@@ -268,7 +296,9 @@ export declare function defaultRefreshManifest(target: RefreshManifestTarget): P
  * A spawn killed by the timeout has a null status, so it is reported as a
  * timeout rather than as an exit code.
  */
-export declare function manifestUploadResult(scope: string, result: Pick<SpawnSyncReturns<string>, "error" | "status" | "signal">): RefreshManifestResult;
+export declare function manifestUploadResult(scope: string, result: Pick<SpawnSyncReturns<string>, "error" | "status" | "signal"> & Partial<Pick<SpawnSyncReturns<string>, "stdout" | "stderr">>): RefreshManifestResult;
+/** `hq sync manifest` output for a company this identity is not a member of. */
+export declare function manifestOutputShowsNoMembership(output: string): boolean;
 /**
  * The uncommitted changes under {@link HOOK_CONFIG_DIRS}, one porcelain line
  * each. Returns [] when the tree is clean OR when `hqRoot` is not a git repo

package/dist/lib/doctor/fix/apply.js

@@ -48,6 +48,7 @@ import { botDir } from "../../bot/paths.js";
 import { readBotConfig } from "../../bot/config.js";
 import { buildBotDaemonPaths, installedDaemonHqBinary, repairBotDaemonIfStale, rewriteBotDaemonNodePath, } from "../../bot/daemon.js";
 import { classifyRefreshSyncOutcome, } from "./refresh-sync-outcome.js";
+import { pullOutputShowsCompanyNotResolved, recordCompanyResolution, } from "../company-resolution-state.js";
 import { readRefreshManifestCursor, readRefreshSyncProgress, writeRefreshManifestCursor, writeRefreshSyncCursor, writeRefreshSyncLastRun, } from "./refresh-sync-progress.js";
 import { clientHealthShowManualOnlyEnabled } from "../client-health-reason-codes-flag.js";
 /** The tree subtrees whose uncommitted changes block a `--fix` run. */
@@ -57,12 +58,22 @@ export const REFRESH_SYNC_TIMEOUT_MS = 90_000;
 /** A newly unlocked safe repair can be picked up for at most this many passes. */
 export const MAX_FIX_PASSES = 3;
 /**
- * Two 90s network repairs leave 120s for startup and check overhead under the
- * hook's 300s ceiling. Journal pulls and manifest uploads share this budget.
- * When both kinds are pending and no upload has run yet, one slot is held for
- * a manifest upload so stale journals cannot starve every manifest.
+ * Ceiling on network repairs per run. A run refreshes every resolvable stale
+ * journal up to this many; above it, `--fix` says so and the rotating cursor
+ * picks up the rest next run. Journal pulls and manifest uploads share this
+ * budget. When both kinds are pending and no upload has run yet, one slot is
+ * held for a manifest upload so stale journals cannot starve every manifest.
+ * Each repair is bounded at 90s, and unattended runs also stop starting new
+ * repairs after REFRESH_SYNC_START_BUDGET_MS (feedback 9b4a5016).
  */
-export const MAX_REFRESH_SYNC_PLANS_PER_RUN = 2;
+export const MAX_REFRESH_SYNC_PLANS_PER_RUN = 10;
+/**
+ * No new network repair starts once this much of the run has passed. Health
+ * hooks bound `--fix` at 300s (older hooks are still in the field), so the
+ * last 90s repair started here still ends by 210s, leaving room for the
+ * check passes. Fast pulls reach the count ceiling well before this.
+ */
+export const REFRESH_SYNC_START_BUDGET_MS = 120_000;
 function rotateRefreshSyncPlans(plans, afterSlug) {
     const ordered = [...plans].sort((a, b) => a.target < b.target ? -1 : a.target > b.target ? 1 : 0);
     if (!afterSlug || ordered.length < 2)
@@ -138,8 +149,52 @@ export async function applyFixes(options) {
         writeErr("HQ client-health manual-only flag lookup failed; keeping manual-only instructions hidden.\n");
     }
     const collect = options.runChecks ?? defaultRunChecks;
-    const refreshSync = options.refreshSync ?? defaultRefreshSync;
-    const refreshManifest = options.refreshManifest ?? defaultRefreshManifest;
+    const performRefreshSync = options.refreshSync ?? defaultRefreshSync;
+    // A namespace error can also be a server response regression. Only mark a
+    // missing company when a different company succeeds in this same run; an
+    // all-company outage must stay WARN and visible to client health.
+    const successfulCompanies = new Set();
+    const unresolvedCompanyPulls = new Map();
+    const noteCompanyOutcome = (slug, ok, notResolved) => {
+        try {
+            if (ok) {
+                successfulCompanies.add(slug);
+                unresolvedCompanyPulls.delete(slug);
+                recordCompanyResolution(hqRoot, slug, true, Date.now());
+            }
+            else if (notResolved) {
+                unresolvedCompanyPulls.set(slug, Date.now());
+            }
+            for (const [pending, atMs] of unresolvedCompanyPulls) {
+                // A success for this same company cannot establish peer health:
+                // its manifest may be exposing a real membership-path failure.
+                if (![...successfulCompanies].some((successful) => successful !== pending))
+                    continue;
+                recordCompanyResolution(hqRoot, pending, false, atMs);
+                unresolvedCompanyPulls.delete(pending);
+            }
+        }
+        catch {
+            // Best effort: failure to persist evidence keeps the stale WARN visible.
+        }
+    };
+    const refreshSync = async (target) => {
+        const result = await performRefreshSync(target);
+        if (target.personal)
+            return result;
+        noteCompanyOutcome(target.slug, result.ok, result.companyNotResolved === true);
+        return result;
+    };
+    const performRefreshManifest = options.refreshManifest ?? defaultRefreshManifest;
+    // Manifest uploads feed the same evidence: "No membership found" waits for
+    // a peer company to succeed, so an all-company outage stays WARN.
+    const refreshManifest = async (target) => {
+        const result = await performRefreshManifest(target);
+        if (target.scope === "personal")
+            return result;
+        noteCompanyOutcome(target.scope, result.ok, result.companyNotResolved === true);
+        return result;
+    };
     const rewriteBotNodePath = options.rewriteBotNodePath ?? defaultRewriteBotNodePath;
     const repairBotHqBinary = options.repairBotHqBinary ?? defaultRepairBotHqBinary;
     // 2. Collect findings, then plan each newly unlocked allowlisted repair.
@@ -149,6 +204,21 @@ export async function applyFixes(options) {
     let lastAttemptedRefreshSyncSlug = readRefreshSyncProgress(hqRoot)?.lastAttemptedSlug ?? null;
     let refreshSyncAppliedThisRun = 0;
     let refreshManifestAppliedThisRun = 0;
+    let refreshCeilingSkipped = 0;
+    const elapsedMs = options.elapsedMs ?? (() => performance.now());
+    const runStartedMs = elapsedMs();
+    let networkBudgetSpent = false;
+    // Only unattended (--yes) runs have a caller with a deadline. An
+    // interactive run waits on the confirmation prompt, which must not use up
+    // the budget.
+    const networkBudgetLeft = () => {
+        if (!options.yes)
+            return true;
+        if (!networkBudgetSpent && elapsedMs() - runStartedMs >= REFRESH_SYNC_START_BUDGET_MS) {
+            networkBudgetSpent = true;
+        }
+        return !networkBudgetSpent;
+    };
     let lastAttemptedRefreshManifestScope = readRefreshManifestCursor(hqRoot);
     const appliedKeys = new Set();
     const planned = [];
@@ -177,20 +247,24 @@ export async function applyFixes(options) {
             keysThisPass.add(key);
             plans.push(plan);
         }
-        const networkSlotsLeft = Math.max(0, MAX_REFRESH_SYNC_PLANS_PER_RUN - refreshSyncAppliedThisRun - refreshManifestAppliedThisRun);
+        const networkSlotsLeft = networkBudgetLeft()
+            ? Math.max(0, MAX_REFRESH_SYNC_PLANS_PER_RUN - refreshSyncAppliedThisRun - refreshManifestAppliedThisRun)
+            : 0;
         // Both kinds start after the company attempted last, so a scope that
         // never clears cannot hold the front of the line on every run.
         const manifestCandidates = rotateRefreshSyncPlans(plans.filter((plan) => plan.fixClass === "refresh-manifest"), lastAttemptedRefreshManifestScope);
         // Hold one slot for an upload until one has run this invocation.
         const manifestReserve = manifestCandidates.length > 0 && refreshManifestAppliedThisRun === 0 ? 1 : 0;
         const seenRefreshTargets = new Set();
-        const refreshPlans = rotateRefreshSyncPlans(plans.filter((plan) => plan.fixClass === "refresh-sync"), lastAttemptedRefreshSyncSlug).filter((plan) => {
+        const refreshCandidates = rotateRefreshSyncPlans(plans.filter((plan) => plan.fixClass === "refresh-sync"), lastAttemptedRefreshSyncSlug).filter((plan) => {
             if (seenRefreshTargets.has(plan.target))
                 return false;
             seenRefreshTargets.add(plan.target);
             return true;
-        }).slice(0, Math.max(0, networkSlotsLeft - manifestReserve));
-        const manifestPlans = manifestCandidates.slice(0, networkSlotsLeft - refreshPlans.length);
+        });
+        const refreshPlans = refreshCandidates.slice(0, Math.max(0, networkSlotsLeft - manifestReserve));
+        refreshCeilingSkipped = refreshCandidates.length - refreshPlans.length;
+        const manifestPlans = manifestCandidates.slice(0, Math.max(0, networkSlotsLeft - refreshPlans.length));
         return [
             ...plans.filter((plan) => plan.fixClass !== "refresh-sync" && plan.fixClass !== "refresh-manifest"),
             ...refreshPlans,
@@ -223,6 +297,7 @@ export async function applyFixes(options) {
                     write("Aborted — no changes written.\n");
                     if (showManualOnlyRemediations)
                         writeManualOnlyRemediations(findings, write);
+                    writeNotOnThisMachine(findings, write);
                     const unresolved = unresolvedSyncChecks(findings, []);
                     writeUnresolvedSyncChecks(unresolved, write);
                     return empty({ refused, fixableCount, unresolved });
@@ -248,6 +323,11 @@ export async function applyFixes(options) {
         // 5. Apply each plan once. Later findings with this check id + target are
         //    excluded even if this repair did not make its check pass.
         for (const plan of plans) {
+            const network = plan.fixClass === "refresh-sync" || plan.fixClass === "refresh-manifest";
+            // Leave the plan unapplied (not in appliedKeys) so it is counted as
+            // left over and reported "not attempted" rather than as a failed repair.
+            if (network && !networkBudgetLeft())
+                continue;
             if (plan.fixClass === "refresh-sync") {
                 // Persist before starting the bounded pull. If this process is killed,
                 // the next invocation resumes after this company instead of starving
@@ -272,6 +352,7 @@ export async function applyFixes(options) {
         write("hq doctor --fix: nothing to repair — no auto-fixable findings.\n");
         if (showManualOnlyRemediations)
             writeManualOnlyRemediations(findings, write);
+        writeNotOnThisMachine(findings, write);
         const unresolved = unresolvedSyncChecks(findings, []);
         writeUnresolvedSyncChecks(unresolved, write);
         return empty({ refused, fixableCount, unresolved });
@@ -308,9 +389,20 @@ export async function applyFixes(options) {
         : null;
     if (restoreCommand)
         write(`To restore all changes: ${restoreCommand}\n`);
-    if (planned.at(-1)?.pass === MAX_FIX_PASSES && buildPlans(findings).length > 0) {
+    // Planning against the final findings also recounts the journals left over
+    // the refresh ceiling, so the note below reports what is actually left.
+    const remainingPlans = buildPlans(findings);
+    if (planned.at(-1)?.pass === MAX_FIX_PASSES && remainingPlans.length > 0) {
         write(`Stopped after ${MAX_FIX_PASSES} repair passes; new auto-fixable findings remain.\n`);
     }
+    if (refreshCeilingSkipped > 0) {
+        const limit = refreshSyncAppliedThisRun >= MAX_REFRESH_SYNC_PLANS_PER_RUN
+            ? `--fix refreshes at most ${MAX_REFRESH_SYNC_PLANS_PER_RUN} in one run`
+            : `--fix stops starting pulls after ${REFRESH_SYNC_START_BUDGET_MS / 1000}s`;
+        write(`\nRefreshed ${refreshSyncAppliedThisRun} stale sync journal${refreshSyncAppliedThisRun === 1 ? "" : "s"}; ${limit}. ` +
+            `${refreshCeilingSkipped} more ${refreshCeilingSkipped === 1 ? "is" : "are"} left. Run \`hq doctor --fix\` again to refresh ${refreshCeilingSkipped === 1 ? "it" : "them"}.\n`);
+    }
+    writeNotOnThisMachine(findings, write);
     if (showManualOnlyRemediations)
         writeManualOnlyRemediations(findings, write);
     const unresolved = unresolvedSyncChecks(findings, planned.map(({ plan }) => plan));
@@ -393,6 +485,19 @@ function writeUnresolvedSyncChecks(unresolved, write) {
         write(`  ${entry.status}  ${entry.checkId}\n    Next step: ${entry.nextStep}\n`);
     }
 }
+/**
+ * Print the stale company journals `--fix` skipped because the company is not
+ * set up for sync on this machine, each with its one next step.
+ */
+function writeNotOnThisMachine(findings, write) {
+    const skipped = findings.filter((result) => result.reasonCode === "company-not-resolved");
+    if (skipped.length === 0)
+        return;
+    write("\nSkipped — not on this machine (--fix cannot pull these):\n");
+    for (const result of skipped) {
+        write(`  ${result.checkId}\n    Next step: ${result.remediation ?? "Run `hq doctor --only sync` for details."}\n`);
+    }
+}
 /** Print the available user action for findings that `--fix` deliberately skips. */
 function writeManualOnlyRemediations(findings, write) {
     const manual = findings.flatMap((result) => {
@@ -497,6 +602,9 @@ export function defaultRefreshSync(target) {
             ok: false,
             outcome,
             message: `pull of '${target.slug}' exited ${result.status}${detail ? `: ${detail}` : ""}`,
+            companyNotResolved: !target.personal &&
+                !isPersonalJournalSlug(target.slug) &&
+                pullOutputShowsCompanyNotResolved(`${result.stdout ?? ""}\n${result.stderr ?? ""}`),
         });
     }
     return Promise.resolve({
@@ -544,10 +652,18 @@ export function manifestUploadResult(scope, result) {
             ok: false,
             reason: `the upload exited with code ${result.status}`,
             message: `manifest upload for '${scope}' exited ${result.status}`,
+            ...(scope !== "personal" &&
+                manifestOutputShowsNoMembership(`${result.stdout ?? ""}\n${result.stderr ?? ""}`)
+                ? { companyNotResolved: true }
+                : {}),
         };
     }
     return { ok: true, message: `uploaded the manifest for '${scope}'` };
 }
+/** `hq sync manifest` output for a company this identity is not a member of. */
+export function manifestOutputShowsNoMembership(output) {
+    return /No membership found/.test(output) || pullOutputShowsCompanyNotResolved(output);
+}
 // --- Dirty-tree probe ----------------------------------------------------------
 /**
  * The uncommitted changes under {@link HOOK_CONFIG_DIRS}, one porcelain line

package/dist/lib/doctor/types.d.ts

@@ -19,7 +19,7 @@ export declare const DOCTOR_STATUSES: readonly ["PASS", "FAIL", "WARN", "UNTESTE
  */
 export type DoctorStatus = (typeof DOCTOR_STATUSES)[number];
 /** Stable, privacy-safe diagnostics emitted by the sync health family. */
-export declare const SYNC_REASON_CODES: readonly ["core-version-unavailable", "core-update-available", "no-local-tree", "legacy-personal-journal", "never-synced", "invalid-last-sync", "stale-threshold", "manifest-unavailable", "manifest-state-unavailable", "no-manifest-scopes", "never-uploaded", "invalid-upload-time", "unresolved-company-uid", "realtime-lag-stuck", "receiver-permission-denied", "runner-restart-loop", "device-limit-backoff", "repeated-conflicts"];
+export declare const SYNC_REASON_CODES: readonly ["core-version-unavailable", "core-update-available", "no-local-tree", "company-not-resolved", "legacy-personal-journal", "never-synced", "invalid-last-sync", "stale-threshold", "manifest-unavailable", "manifest-state-unavailable", "no-manifest-scopes", "never-uploaded", "invalid-upload-time", "unresolved-company-uid", "realtime-lag-stuck", "receiver-permission-denied", "runner-restart-loop", "device-limit-backoff", "repeated-conflicts"];
 export type SyncReasonCode = (typeof SYNC_REASON_CODES)[number];
 /** Runtime type guard: true only for a member of the fixed vocabulary. */
 export declare function isDoctorStatus(value: unknown): value is DoctorStatus;

package/dist/lib/doctor/types.js

@@ -26,6 +26,7 @@ export const SYNC_REASON_CODES = [
     "core-version-unavailable",
     "core-update-available",
     "no-local-tree",
+    "company-not-resolved",
     "legacy-personal-journal",
     "never-synced",
     "invalid-last-sync",