@indigoai-us/hq-cli 5.345.156 → 5.345.159

package/dist/commands/cloud.js

@@ -14,6 +14,7 @@
  */
 import { isAccessDeniedError, accessDeniedKeyOf, formatAccessDenied, } from "../utils/access-denied-hint.js";
 import { findReadOnlyLocalOnly, isGrantEnforced, readVaultAccessManifest, } from "../lib/sync/read-only-local-only.js";
+import { SERVER_OWNED_FOLDERS, findServerOwnedLocalOnly, } from "../lib/sync/server-owned-local-only.js";
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
@@ -165,6 +166,37 @@ export function staleUploadRefusalLines(count, paths = []) {
     }
     return lines;
 }
+export function readUploadFailures(result) {
+    const r = result;
+    return { count: r.filesUploadFailed ?? 0, paths: r.uploadFailedPaths ?? [] };
+}
+/**
+ * Files the vault accepted in the plan but refused or failed at upload
+ * (feedback_943456f4). Without these lines a push that uploaded nothing
+ * printed "✓ Pushed 0" and exited 0.
+ */
+export function uploadFailedLines(count, paths = []) {
+    if (count <= 0)
+        return [];
+    const lines = [
+        `⚠ ${count} file(s) were NOT uploaded because the upload failed. ` +
+            `They are still on this machine. Push again to retry them.`,
+    ];
+    if (paths.length > 0) {
+        lines.push("  Not uploaded:", ...paths.map((filePath) => `  - ${filePath}`));
+    }
+    return lines;
+}
+/**
+ * share() option that turns a user-named path an ignore rule drops into an
+ * "unreachable path" error instead of a silent 0-file success
+ * (feedback_63bfc302, feedback_8c294805). Spread as a plain record so this
+ * builds against an hq-cloud release whose ShareOptions predates the field;
+ * older releases ignore it.
+ */
+export function namedPathShareOptions(userNamedPaths) {
+    return userNamedPaths ? { failOnIgnoredNamedPaths: true } : {};
+}
 /**
  * Optional detail line listing the effective write prefixes when a push
  * dropped files — helps debug ACL vs scope-excluded mismatches (feedback_7e9c535e).
@@ -561,6 +593,12 @@ export async function pushAll(options, deps) {
                 result.filesRefusedStalePaths ??= [];
                 result.filesRefusedStalePaths.push(...(r.filesRefusedStalePaths ?? []));
             }
+            if ((r.filesUploadFailed ?? 0) > 0) {
+                result.filesUploadFailed =
+                    (result.filesUploadFailed ?? 0) + (r.filesUploadFailed ?? 0);
+                result.uploadFailedPaths ??= [];
+                result.uploadFailedPaths.push(...(r.uploadFailedPaths ?? []));
+            }
             result.perCompany.push({
                 slug: entry.slug,
                 result: r,
@@ -947,6 +985,9 @@ export function registerCloudCommands(program) {
             // Otherwise preserve the historical "default to cwd" semantics so
             // `hq sync push <file>` and bare `hq sync push` from inside the
             // company tree both work as before.
+            // Paths the user typed fail loudly when an ignore rule drops them
+            // (feedback_63bfc302); enumerated defaults keep the quiet skip.
+            const userNamedPaths = explicitPersonalPaths !== undefined || (paths?.length ?? 0) > 0;
             const targetPaths = explicitPersonalPaths
                 ? explicitPersonalPaths
                 : paths && paths.length > 0
@@ -1019,9 +1060,11 @@ export function registerCloudCommands(program) {
                 ...(journalSlug !== undefined ? { journalSlug } : {}),
                 ...(author ? { author } : {}),
                 ...(pushPrefixSet !== undefined ? { prefixSet: pushPrefixSet } : {}),
+                ...namedPathShareOptions(userNamedPaths),
             });
             const planLimitRefused = planLimitTracker.summary();
             const staleRefusalCount = result.filesRefusedStale ?? 0;
+            const uploadFailed = readUploadFailures(result);
             const refusalRecovery = [
                 result.filesExcludedByScope > 0
                     ? "Check write access for the refused path; ask its creator or a company admin to grant access."
@@ -1029,6 +1072,9 @@ export function registerCloudCommands(program) {
                 staleRefusalCount > 0
                     ? "Pull the current vault copy, merge your edit, and push again."
                     : null,
+                uploadFailed.count > 0
+                    ? "Push again; the files that failed are still on this machine."
+                    : null,
             ]
                 .filter((message) => message !== null)
                 .join(" ");
@@ -1049,6 +1095,8 @@ export function registerCloudCommands(program) {
                     filesExcludedByScope: result.filesExcludedByScope,
                     filesRefusedStale: staleRefusalCount,
                     filesRefusedStalePaths: result.filesRefusedStalePaths ?? [],
+                    filesUploadFailed: uploadFailed.count,
+                    uploadFailedPaths: uploadFailed.paths,
                     ...(refusalRecovery ? { refusalRecovery } : {}),
                     ...(planLimitRefused ? { planLimitRefused } : {}),
                 });
@@ -1081,26 +1129,33 @@ export function registerCloudCommands(program) {
                 for (const line of staleUploadRefusalLines(result.filesRefusedStale ?? 0, result.filesRefusedStalePaths)) {
                     log(chalk.yellow(line));
                 }
+                for (const line of uploadFailedLines(uploadFailed.count, uploadFailed.paths)) {
+                    log(chalk.yellow(line));
+                }
                 await syncHealth.succeeded();
                 process.exit(1);
                 return;
             }
-            if (result.filesExcludedByScope > 0 || staleRefusalCount > 0) {
+            const notUploadedCount = result.filesExcludedByScope + staleRefusalCount + uploadFailed.count;
+            if (notUploadedCount > 0) {
                 log(chalk.yellow(`\n⚠ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ` +
-                    `${result.filesSkipped} skipped, ${result.filesExcludedByScope + staleRefusalCount} files not uploaded)`));
+                    `${result.filesSkipped} skipped, ${notUploadedCount} files not uploaded)`));
                 for (const line of scopeExcludedLines(result.filesExcludedByScope, pushPrefixSet)) {
                     log(chalk.yellow(line));
                 }
                 for (const line of staleUploadRefusalLines(staleRefusalCount, result.filesRefusedStalePaths)) {
                     log(chalk.yellow(line));
                 }
+                for (const line of uploadFailedLines(uploadFailed.count, uploadFailed.paths)) {
+                    log(chalk.yellow(line));
+                }
             }
             else {
                 const skipSummary = formatPushSkipSummary(result);
                 log(chalk.green(`\n✓ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ${skipSummary})`));
             }
             await syncHealth.succeeded();
-            const exitCode = scopeExcludedExitCode(result.filesExcludedByScope + staleRefusalCount);
+            const exitCode = scopeExcludedExitCode(notUploadedCount);
             if (exitCode !== 0) {
                 process.exit(exitCode);
                 return;
@@ -1278,6 +1333,7 @@ export function registerCloudCommands(program) {
         .command("status")
         .description("Show local sync journal summary")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .option("--company <slug>", "Show only this company's journal (company slug)")
         .action((options, command) => {
         const explicitHqRoot = command.getOptionValueSource("hqRoot") === "cli";
         try {
@@ -1312,7 +1368,17 @@ export function registerCloudCommands(program) {
             // Journals live in the machine-wide state directory, independently
             // of the HQ content root selected for this status display.
             const stateDir = getStateDir();
-            const journals = listJournals();
+            const companyFilter = options.company?.trim();
+            if (options.company !== undefined && !companyFilter) {
+                throw new Error("--company needs a company slug");
+            }
+            // Journals are keyed by slug; a company UID would silently match none.
+            if (companyFilter?.startsWith("cmp_")) {
+                throw new Error(`--company takes the company slug, not its UID (${companyFilter})`);
+            }
+            const journals = companyFilter
+                ? listJournals().filter((j) => j.slug === companyFilter)
+                : listJournals();
             let grandFiles = 0;
             let grandBytes = 0;
             let grandLastSync = "";
@@ -1320,7 +1386,13 @@ export function registerCloudCommands(program) {
             console.log(`  HQ root:        ${hqRoot}`);
             console.log(`  Active company: ${activeCompany ?? chalk.dim("(none)")}`);
             console.log(`  State dir:      ${stateDir}`);
+            if (companyFilter)
+                console.log(`  Company:        ${companyFilter}`);
             console.log(`  Journals:       ${journals.length}`);
+            if (journals.length === 0 && companyFilter) {
+                console.log(chalk.dim(`No sync journal for company "${companyFilter}" yet — run \`hq sync now --company ${companyFilter}\` to create one.`));
+                return;
+            }
             if (journals.length === 0) {
                 console.log(chalk.dim("No sync journal yet — run `hq sync now`, `hq sync push`, or `hq sync pull` to create one."));
                 return;
@@ -1355,6 +1427,7 @@ export function registerCloudCommands(program) {
                 console.log(`      Last sync:     ${grandLastSync || "never"}`);
             }
             printReadOnlyLocalOnly(hqRoot, journals);
+            printServerOwnedLocalOnly(hqRoot, journals);
         }
         catch (err) {
             console.error(chalk.red("✗ Status failed:"), err instanceof Error ? err.message : String(err));
@@ -1724,13 +1797,18 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal, skipCompani
         else if (row.result) {
             const r = row.result;
             const legRefused = r.planLimit ?? null;
-            const status = r.aborted || r.filesExcludedByScope > 0 || (r.filesRefusedStale ?? 0) > 0 || legRefused
+            const status = r.aborted ||
+                r.filesExcludedByScope > 0 ||
+                (r.filesRefusedStale ?? 0) > 0 ||
+                (r.filesUploadFailed ?? 0) > 0 ||
+                legRefused
                 ? chalk.yellow("⚠")
                 : chalk.green("✓");
             console.log(`  ${status} ${row.slug}: ${r.filesUploaded} file(s), ` +
                 `${formatBytes(r.bytesUploaded)}, ${r.filesSkipped} skipped, ` +
                 `${r.filesDeleted} deleted, ${r.filesExcludedByScope} scope-excluded, ` +
-                `${r.filesRefusedStale ?? 0} stale-refused, ${r.conflictPaths.length} conflict(s)` +
+                `${r.filesRefusedStale ?? 0} stale-refused, ${r.filesUploadFailed ?? 0} failed, ` +
+                `${r.conflictPaths.length} conflict(s)` +
                 (r.aborted ? " — aborted" : "") +
                 (legRefused
                     ? ` — ${describeRefusedCount(legRefused)} refused by plan limit`
@@ -1747,11 +1825,16 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal, skipCompani
         `(${formatBytes(result.bytesUploaded)}) across ${result.attempted} ` +
         `target(s); ${result.filesDeleted} deleted; ${errored} error(s); ` +
         `${result.filesExcludedByScope} scope-excluded; ` +
-        `${result.filesRefusedStale ?? 0} stale-refused` +
+        `${result.filesRefusedStale ?? 0} stale-refused; ` +
+        `${result.filesUploadFailed ?? 0} failed` +
         (refusedTargets > 0
             ? `; new files refused by a plan limit on ${refusedTargets} target(s)`
             : "");
-    console.log(errored > 0 || result.filesExcludedByScope > 0 || refusedTargets > 0
+    console.log(errored > 0 ||
+        result.filesExcludedByScope > 0 ||
+        (result.filesRefusedStale ?? 0) > 0 ||
+        (result.filesUploadFailed ?? 0) > 0 ||
+        refusedTargets > 0
         ? chalk.yellow(summary)
         : chalk.green(summary));
     for (const row of result.perCompany) {
@@ -1772,6 +1855,9 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal, skipCompani
         for (const line of staleUploadRefusalLines(staleCount, row.result?.filesRefusedStalePaths)) {
             console.log(chalk.yellow(`${row.slug}: ${line}`));
         }
+        for (const line of uploadFailedLines(row.result?.filesUploadFailed ?? 0, row.result?.uploadFailedPaths)) {
+            console.log(chalk.yellow(`${row.slug}: ${line}`));
+        }
     }
     if (errored > 0)
         throw new SyncExitError(1);
@@ -1780,10 +1866,12 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal, skipCompani
         filesExcludedByScope: result.filesExcludedByScope,
         filesRefusedStale: result.filesRefusedStale ?? 0,
         filesRefusedStalePaths: [...new Set(result.filesRefusedStalePaths ?? [])],
+        filesUploadFailed: result.filesUploadFailed ?? 0,
     };
     return (refusalSummary.planLimitRefused ||
         refusalSummary.filesExcludedByScope > 0 ||
-        refusalSummary.filesRefusedStale > 0
+        refusalSummary.filesRefusedStale > 0 ||
+        refusalSummary.filesUploadFailed > 0
         ? refusalSummary
         : null);
 }
@@ -1872,9 +1960,11 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
             ...(nowPushPrefixSet !== undefined ? { prefixSet: nowPushPrefixSet } : {}),
         });
         const pushRefused = planLimitTracker.summary();
+        const pushUploadFailed = readUploadFailures(pushResult);
         const pushStatus = pushResult.aborted ||
             pushResult.filesExcludedByScope > 0 ||
             (pushResult.filesRefusedStale ?? 0) > 0 ||
+            pushUploadFailed.count > 0 ||
             pushRefused
             ? chalk.yellow("⚠")
             : chalk.green("✓");
@@ -1895,6 +1985,9 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         for (const line of staleUploadRefusalLines(pushResult.filesRefusedStale ?? 0, pushResult.filesRefusedStalePaths)) {
             console.log(chalk.yellow(line));
         }
+        for (const line of uploadFailedLines(pushUploadFailed.count, pushUploadFailed.paths)) {
+            console.log(chalk.yellow(line));
+        }
         if (pushResult.aborted) {
             console.log(chalk.yellow("\n⚠ Sync now aborted on push leg; pull skipped."));
             throw new SyncExitError(1);
@@ -2016,7 +2109,8 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
             throw new SyncExitError(1, { health: "succeeded" });
         }
         if (pushResult.filesExcludedByScope > 0 ||
-            (pushResult.filesRefusedStale ?? 0) > 0) {
+            (pushResult.filesRefusedStale ?? 0) > 0 ||
+            pushUploadFailed.count > 0) {
             console.log(chalk.yellow("\n⚠ Sync now finished, but one or more requested uploads were refused."));
             throw new SyncExitError(1, { health: "succeeded" });
         }
@@ -2141,6 +2235,52 @@ export function printReadOnlyLocalOnly(hqRoot, journals, log = (line) => console
     }
     return grand;
 }
+/**
+ * `hq sync status`: list local files under server-owned folders (sources/,
+ * signals/, ontology/ outside entities/) that are not in the sync journal.
+ * The server pipeline writes these folders; a client push refuses them and
+ * the recurring runner skips them quietly, so a file written locally there
+ * never reaches the vault and `pendingFiles: 0` still reports a clean tree
+ * (feedback_0414d71c). Uses only the journals already loaded, with no
+ * network calls. Prints nothing when nothing applies.
+ */
+export function printServerOwnedLocalOnly(hqRoot, journals, log = (line) => console.log(line)) {
+    let shouldSync;
+    let grand = 0;
+    for (const { slug, journal } of journals) {
+        if (slug === PERSONAL_VAULT_JOURNAL_SLUG)
+            continue;
+        if (!fs.existsSync(path.join(hqRoot, "companies", slug)))
+            continue;
+        if (!shouldSync) {
+            try {
+                shouldSync = createIgnoreFilter(hqRoot);
+            }
+            catch {
+                shouldSync = () => true;
+            }
+        }
+        const journalKeys = new Set(Object.keys(journal.files ?? {}));
+        const found = findServerOwnedLocalOnly({ hqRoot, slug, journalKeys, shouldSync });
+        if (found.total === 0)
+            continue;
+        grand += found.total;
+        log(chalk.yellow(`\n  ! ${slug}: ${found.total} local-only file(s) under server-owned folders ` +
+            `(${SERVER_OWNED_FOLDERS.map((f) => `${f}/`).join(", ")}) never upload`));
+        for (const rel of found.files) {
+            log(`      ${rel}`);
+        }
+        if (found.total > found.files.length) {
+            log(chalk.dim(`      ... and ${found.total - found.files.length} more`));
+        }
+    }
+    if (grand > 0) {
+        log(chalk.dim("      The cloud pipeline writes these folders; push skips them and does not count them as pending. " +
+            "Keep notes you write yourself under knowledge/ (which syncs), or add sources through an " +
+            "integration or ingestion flow and run hq sync pull."));
+    }
+    return grand;
+}
 function scopeLabel(slug) {
     if (slug === PERSONAL_VAULT_JOURNAL_SLUG)
         return "personal vault";

package/dist/commands/company.js

@@ -13,7 +13,8 @@ function workTrackingFromBody(body) {
 }
 /**
  * Read both switches from GET /company-settings (owner or admin only). The
- * server returns effective values, so an absent field means the default (off).
+ * server returns effective values, so an absent field means the default
+ * (registry off, live on).
  * A refused or failed read returns null rather than a guess.
  */
 async function readWorkTrackingSettings(token, companyUid) {
@@ -28,7 +29,7 @@ async function readWorkTrackingSettings(token, companyUid) {
         const body = (await res.json().catch(() => ({})));
         return {
             workRegistryEnabled: body.workRegistryEnabled === true,
-            workMeshLiveEnabled: body.workMeshLiveEnabled === true,
+            workMeshLiveEnabled: body.workMeshLiveEnabled !== false,
         };
     }
     catch {
@@ -97,7 +98,7 @@ export function registerCompanyCommand(program) {
         .option("--accounting-enabled <true|false>", "Enable/disable the accounting pack for this company")
         .option("--checkpoint-gate-enabled <true|false>", "Require (true) or stop requiring (false) a checkpoint before HQ sessions in this company end a turn")
         .option("--work-registry-enabled <true|false>", "Turn work-session registration on or off for this company (default off). Work tracking needs this and --work-mesh-live-enabled")
-        .option("--work-mesh-live-enabled <true|false>", "Turn live work tracking on or off for this company (default off). Work tracking needs this and --work-registry-enabled")
+        .option("--work-mesh-live-enabled <true|false>", "Turn live work tracking on or off for this company (default on; set false to opt out). Work tracking needs this and --work-registry-enabled")
         .action(async (opts) => {
         try {
             const companySlug = company.opts().company;

package/dist/commands/core-checkpoint-native.d.ts

@@ -27,6 +27,16 @@ export declare const NO_BACKEND_RETRY_MS: number;
  * always releases the queue before the lock would be presumed abandoned.
  */
 export declare const SIBLING_MAX_RUNTIME_MS: number;
+/**
+ * Minimum gap between two maintenance siblings started by the Stop gate's
+ * automatic checkpoint (`--trigger stop-gate-auto`) for the same session. That
+ * trigger fires at the end of every turn that did not checkpoint, with no files,
+ * learnings, or decisions, so a fast-moving session started a full agent run
+ * per turn and most runs found nothing new (feedback_90c33997). Inside the
+ * window the thread file and stamps are still written; only the sibling is
+ * skipped. Explicit checkpoints are never debounced.
+ */
+export declare const AUTO_SIBLING_MIN_INTERVAL_MS: number;
 /**
  * Queued payloads one sibling run may process, across its launch claim and its
  * own queue drain. Each one runs the full upgrade flow, so a 50-deep queue in
@@ -80,6 +90,14 @@ export type WriteStampsOptions = {
     waitForRetry?: (delayMs: number) => void;
 };
 export declare function writeStamps(liveRoot: string, sessionId: string | undefined, options?: WriteStampsOptions): string[];
+/**
+ * True when an automatic checkpoint for this session already started (or
+ * queued) a sibling within AUTO_SIBLING_MIN_INTERVAL_MS. Without a session ID
+ * there is no per-session key, so the run is never debounced. A missing or
+ * unreadable stamp also counts as "not recent": a wrong answer costs one extra
+ * sibling, never a lost checkpoint.
+ */
+export declare function autoSiblingRecent(liveRoot: string, trigger: string | undefined, sessionId: string | undefined, nowMs: number): boolean;
 /**
  * Backends whose most recent run died without producing a report.
  *

package/dist/commands/core-checkpoint-native.js

@@ -90,6 +90,17 @@ const SIBLING_LOCK_TTL_MS = 60 * 60 * 1000;
  * always releases the queue before the lock would be presumed abandoned.
  */
 export const SIBLING_MAX_RUNTIME_MS = 30 * 60 * 1000;
+/**
+ * Minimum gap between two maintenance siblings started by the Stop gate's
+ * automatic checkpoint (`--trigger stop-gate-auto`) for the same session. That
+ * trigger fires at the end of every turn that did not checkpoint, with no files,
+ * learnings, or decisions, so a fast-moving session started a full agent run
+ * per turn and most runs found nothing new (feedback_90c33997). Inside the
+ * window the thread file and stamps are still written; only the sibling is
+ * skipped. Explicit checkpoints are never debounced.
+ */
+export const AUTO_SIBLING_MIN_INTERVAL_MS = 30 * 60 * 1000;
+const AUTO_TRIGGER = "stop-gate-auto";
 /** Newest-wins cap so a wedged sibling cannot grow an unbounded queue. */
 const MAX_PENDING_PAYLOADS = 50;
 /**
@@ -243,6 +254,8 @@ report instead of guessing.
    never overwrite) so the next sibling takes it, and record that in the report.
    NEVER read the queue and truncate it in place: a payload appended between
    your read and the truncate is lost, and its checkpoint is never enriched.
+   A missing or empty file means the queue is empty; skip this step. Do not
+   treat it as an error.
 `;
 /**
  * Rendered into the sibling prompt only when the payload names a company. The
@@ -573,6 +586,42 @@ export function writeStamps(liveRoot, sessionId, options = {}) {
     }
     return stampPaths;
 }
+function autoSiblingStampPath(liveRoot, sessionId) {
+    const sessionKey = sessionId.replace(/[^A-Za-z0-9._-]/g, "_") || "unknown";
+    return path.join(liveRoot, "workspace", "orchestrator", "hook-state", `checkpoint-auto-sibling-${sessionKey}`);
+}
+/**
+ * True when an automatic checkpoint for this session already started (or
+ * queued) a sibling within AUTO_SIBLING_MIN_INTERVAL_MS. Without a session ID
+ * there is no per-session key, so the run is never debounced. A missing or
+ * unreadable stamp also counts as "not recent": a wrong answer costs one extra
+ * sibling, never a lost checkpoint.
+ */
+export function autoSiblingRecent(liveRoot, trigger, sessionId, nowMs) {
+    if (trigger !== AUTO_TRIGGER || !sessionId?.trim())
+        return false;
+    try {
+        const last = Number(fs.readFileSync(autoSiblingStampPath(liveRoot, sessionId), "utf8").trim());
+        if (!Number.isFinite(last))
+            return false;
+        const age = nowMs - last;
+        return age >= 0 && age < AUTO_SIBLING_MIN_INTERVAL_MS;
+    }
+    catch {
+        return false;
+    }
+}
+function stampAutoSibling(liveRoot, trigger, sessionId, nowMs) {
+    if (trigger !== AUTO_TRIGGER || !sessionId?.trim())
+        return;
+    try {
+        fs.writeFileSync(autoSiblingStampPath(liveRoot, sessionId), String(nowMs));
+    }
+    catch {
+        // The debounce stamp only saves cost; failing to write it must not fail
+        // the checkpoint.
+    }
+}
 /**
  * Codex Stop-gate rollout scope: every HQ user on the operator domain, rather
  * than the single account that dogfooded it first. Eligibility is decided on
@@ -1343,6 +1392,15 @@ async function startSibling(liveRoot, input, threadPath, backend) {
     fs.mkdirSync(runDir, { recursive: true });
     const claimPath = path.join(runDir, "pending-claimed.jsonl");
     payload.pending_payloads = limitClaimedPayloads(claimPending(pendingPath, claimPath), claimPath, pendingPath);
+    // The sibling prompt reads and renames this file. Leave an empty queue behind
+    // when the claim moved it away (or none existed), so the sibling never trips
+    // on a missing file. Append mode: a payload queued in the meantime is kept.
+    try {
+        fs.closeSync(fs.openSync(pendingPath, "a"));
+    }
+    catch {
+        // Best effort: the prompt also treats a missing queue as empty.
+    }
     if (!payload.company) {
         let queued;
         try {
@@ -1455,9 +1513,12 @@ async function runCheckpoint(options, command, group, preResolvedHqRoot) {
     // Resolved before resolveBackend so an opted-out run pays for no backend
     // probe: `--backend auto` shells out to every installed CLI for a version.
     const siblingOptOut = options.agent === false || !siblingEnabledBySetting(liveRoot);
+    const autoDebounced = !siblingOptOut && autoSiblingRecent(liveRoot, input.trigger, input.sessionId, Date.now());
     // Validated even when nothing will spawn, so `--backend bogus` is still an error.
     const requestedBackend = assertKnownBackend(options.backend);
-    const backend = siblingOptOut ? "none" : await resolveBackend(requestedBackend, liveRoot, input.company, { dryRun: options.dryRun });
+    const backend = siblingOptOut || autoDebounced
+        ? "none"
+        : await resolveBackend(requestedBackend, liveRoot, input.company, { dryRun: options.dryRun });
     const now = new Date();
     const threadId = `T-${formatTimestamp(now)}-auto-${summarySlug(input.summary)}`;
     const threadPath = path.join(liveRoot, "workspace", "threads", `${threadId}.json`);
@@ -1478,7 +1539,7 @@ async function runCheckpoint(options, command, group, preResolvedHqRoot) {
                 worker: input.worker,
             },
             stamps: stampPaths.map((stampPath) => path.relative(liveRoot, stampPath)),
-            sibling: siblingOptOut ? null : { backend },
+            sibling: siblingOptOut || autoDebounced ? null : { backend },
         });
         return;
     }
@@ -1517,11 +1578,15 @@ async function runCheckpoint(options, command, group, preResolvedHqRoot) {
             if (siblingOptOut) {
                 printResult(`checkpoint: sibling disabled (${SIBLING_SETTING})`);
             }
+            else if (autoDebounced) {
+                printResult("checkpoint: sibling skipped (automatic checkpoint; one ran for this session recently)");
+            }
             else if (backend === "none") {
                 printResult("checkpoint: sibling disabled (backend none)");
             }
             else {
                 await startSibling(liveRoot, input, threadPath, backend);
+                stampAutoSibling(liveRoot, input.trigger, input.sessionId, Date.now());
             }
         }
     }

package/dist/commands/core-pipeline-driver-native.d.ts

@@ -1,5 +1,6 @@
 import { spawnSync } from "node:child_process";
-export declare function scanDriverState(stateDir: string, maxFails: number, hqBin: string, run?: typeof spawnSync): string;
+export declare function queueMaxSeconds(env?: NodeJS.ProcessEnv): number;
+export declare function scanDriverState(stateDir: string, maxFails: number, hqBin: string, run?: typeof spawnSync, queueMax?: number): string;
 export declare function checkDriverStall(stateDir: string, stallWindow: number, hqBin: string, run?: typeof spawnSync): string;
 export declare function acquirePipelineDriverLock(driverDir: string, pid: number): {
     acquired: boolean;
@@ -14,6 +15,16 @@ export declare function stalledLaneContext(state: string, worker: string): {
 };
 export declare function pendingLaneQuestion(text: string, lane: string): string;
 export declare function sleep(ms: number, signal?: AbortSignal): Promise<void>;
+/**
+ * Move a handoff that failed validation to a numbered sibling
+ * (handoffs/<story>-<phase>.invalid.<n>.json) so the worker's evidence is never
+ * lost, and write a failed handoff in its place that names the validation
+ * error and the kept file. Returns both paths.
+ */
+export declare function quarantineInvalidHandoff(state: string, storyId: string, phase: string, handoffPath: string, reason: string): {
+    keptPath: string;
+    handoffPath: string;
+};
 export declare function stopDriverLanes(state: string, hq: string, logFile: string, options?: {
     timeoutMs?: number;
     pollMs?: number;