@indigoai-us/hq-cli 5.345.168 → 5.345.170

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [5.345.170] — 2026-10-25
+- `hq access --fix` now labels its suggested recipient as an access contact and explicitly distinguishes an ACL creator from a fallback company owner or admin. The label no longer implies that the contact wrote the file; access checks and sharing permissions are unchanged.
+
+- `hq doctor --fix` no longer counts a manifest upload as done when `hq sync manifest` exits 0 without uploading. It now runs `hq sync manifest --json` and reports `soft_skipped`, `throttled`, `disabled`, `locked` and `resend_full_scheduled` as not uploaded, with the reason in the unresolved-check next step. When the server asks for a full resend, `--fix` retries once with `--full`, so that scope can clear in the same run; if the server asks again, the reason says a full resend is queued. An `hq` on PATH that predates `--json` falls back to exit-code handling. `hq sync manifest --json` prints the pass outcome as one JSON line (status, mode, error kind and HTTP status; no paths or error text). On hq-cloud releases that store the last failed pass, a stale `sync.manifest.*` row names that failure instead of saying the daily pass is not running, and a failure `--fix` cannot clear (404 route, 403, rejected identity; a 401 keeps its `--fix` target) is reported as `manifest-upload-rejected` with no `--fix` target (feedback_84d7a862).
+- `hq feedback` adds a `stalled` status for work that started and then stopped. A feedback row is in progress only while it has a linked open PR or a live lane; after 48 hours with no activity it moves to `stalled` (the hq-pro sweep, guard and `prUrl`/`laneId` fields ship separately), which is listed apart from `new` (not started). `hq feedback list --status stalled` filters on it, the list table now has a STATUS column that marks stalled rows `stalled!`, and `--status` accepts `in-progress` for `in_progress`; the server validates the value. `hq feedback update --state` accepts `stalled`.
+- `hq feedback update --state in-progress` (or `in_progress`) now requires `--pr <url>` or `--lane <id>`. The CLI first stores the link as `prUrl`/`laneId` and reads the ticket back to check that the server saved it, then posts the state. If the server rejects or ignores the link fields (a server without the new fields), the command exits 1 without posting the state, and the message gives the ticket's current state as read back from the server. The new `hq feedback claim <id>` assigns a ticket to you, and it and `hq feedback assign` send only the assignee and never set a status.
+- `hq files share <name> --with <member>` now looks an extension-less name such as `knowledge` up in the vault before granting it. If `knowledge/` has files and no object `knowledge` exists, the grant covers the folder glob `knowledge/*` and a note says so. Before, it granted an exact object named `knowledge`, which covered nothing under the folder. If only the object exists, the exact key is granted as before. If both exist, neither exists, or the lookup fails, the command refuses with exit 1 and points to `--exact` or `'knowledge/*'`. The share-session path (no `--with`) resolves the name the same way. `hq files unshare <name> --with <member>` first removes the exact `<name>` grant (including rows left by older versions), and when none matches it tries `<name>/*` unless the vault shows `<name>` is only a file; it says which row it removed, lists both rows when nothing matched, and is never blocked by the vault lookup. `unshare` without `--with` still uses the prefix exactly as typed. `--exact` keeps the literal key, and now errors without `--with`. Prefixes with a `*` inside a segment (`**`, `know*`) or an empty segment (`/knowledge`) are refused. The access-request prompt sent to an owner now passes `--exact`, so it grants only the requested object.
+- Fix `hq feedback list` hiding most items: `--status <s>` alone now lists every item in that status instead of only untriaged ones, the new `--open` lists every item that is not resolved, wont-fix or accepted, and a list cut short by `--limit`, the page cap or the server prints a notice on stderr and adds `truncated: true` to `--json` output.
+- `hq mesh context organize` now lists project candidates for a session that attached a project existing only on this machine. Before this fix, such a session could be saved with its company slug but no company id (when the membership check was offline or failed during reconcile), and organize answered `candidates_unavailable` even when signed in. Organize now looks the slug up in your active memberships (5-second limit), saves the company id and fetches candidates. Offline sessions and slugs you are not an active member of keep the old answer. Follow-up to hq-pro #5114.
+- `hq sync push` no longer prints a success line when uploads are held after an account sign-in change on this computer. Before, the push skipped every named file without counting it and reported "Pushed 0 file(s) (0 B, 0 skipped)" with exit 0, while the vault kept the old copy. It now prints how many files were not uploaded, names `hq sync held` and `hq sync release-held`, adds `filesHeldByIdentityFence` to the `--json` complete event, and exits 1. Feedback a69e12ba-c8c6-40a9-ba00-01e60d302e18.
+- HQ's existing daemon can now supervise one explicitly configured personal-vault sync-core canary on macOS or Linux. Activation fails closed unless the binary, vault ownership and full-mode configuration match, hands ownership over without overlapping the existing sync runner, and restarts a core process that stops reporting health. The existing realtime connection accepts only the versioned, content-free sync wake envelope. Company vaults and machines without the canary setting keep the existing sync path unchanged.
+- The personal local bot records a decision pick from the owner's HQ DM. When a decision is in conversation in that DM (`hq decide talk`) and the owner's whole reply names one option (`Release`, `ship`, `go with Release`), the bot records it through the decisions API with source `thread` and replies `Recorded: <option>.` Any other reply goes to the model with the decision loaded, and nothing is recorded. Only the owner's messages count, only decisions addressed to the owner in the owner's own companies are used, and the call uses the bot's own sign-in. After 24 hours with no pick the bot restates the full decision once. If the decisions API is not deployed (404), a pick gets a plain reply saying it was not recorded.
+
+
+## [5.345.169] — 2026-10-24
+- Sentry error reports now redact CloudFront signed-URL params (`Policy`, `Key-Pair-Id`) and the `AWSAccessKeyId` and `GoogleAccessId` ids when they appear as structured keys in event data, for example a parsed query under `extra`. The feedback diagnostics scrubber already redacted them (#2177); the Sentry scrubber caught them only inside strings. The shared structured-key cases now run against the Sentry scrubber too.
+- A debounced automatic checkpoint is now queued for the next checkpoint sibling. Before this, `hq core checkpoint` wrote the `-auto-` thread when the per-session debounce skipped the sibling, but it never queued the payload, so no sibling ever filled the thread in. The payload is now added to the pending queue once, and the next sibling run picks it up. The debounce still limits how many siblings start. When the pending queue goes over its cap of 50, a message on stderr now gives the number of oldest payloads dropped. Feedback a2a5c2c3-5ea0-4e1f-8155-1f39ce6ac750.
+
+- `hq feedback` now redacts presigned URL signatures, session tokens, bearer tokens and other credentials from the diagnostics it attaches. Before this fix, recent Sentry breadcrumbs were copied into diagnostics without scrubbing, so an S3 presigned URL's X-Amz-Security-Token could reach the stored feedback row. Diagnostics passed in by callers are scrubbed too, and the inline log tails and the S3 log bundle now also catch bare, URL-encoded, CloudFront, GCS and Azure signed URL parameters.
+- `hq doctor --fix` no longer starts a second background sync pull while a pull it stopped at its time limit is still shutting down. It takes the pull-start lock from another process only when that process has exited or its process id now belongs to a different process.
+- `hq doctor --fix` can now refresh sync journals on drives without hard links (exFAT, FAT, some network drives). `hq doctor` warns, naming the process, when a journal refresh lock has been held for more than 10 minutes.
+- `hq doctor --fix` no longer kills a slow sync journal pull after 90 seconds. A pull that is still running keeps going in the background for up to 10 minutes, one at a time, and `hq doctor` shows that journal as "refresh in progress" until it finishes. It never blocks your own `hq sync`, and it steps aside at once for `hq rescue` and other repairs, keeping what it already downloaded. A large company is no longer reported as stale every day.
+
 ## [5.345.168] — 2026-10-24
 - `hq dm` now picks the default audience from the recipient when no audience flag is passed. A 1:1 DM to a person (email, `prs_` uid, or a bare name that resolves to a person) sends `audience: "human"`. A 1:1 DM to an agent (`agt_` uid), a group DM and a channel post send `audience: "agent"`, so script and lane messages stay out of people's conversations. Scheduled sends (`--at`, `--in`) follow the same rule. Pass `--for-human` (alias for `--audience human`) to tag any message for people; an explicit `--audience human|agent|both` wins over `--for-human`, with a warning on stderr, and is validated on every path. `hq core delegate send` tags the pickup DM `audience: "both"`, `hq dm-bind post` keeps the channel default (`audience: "agent"`) for its automated status posts, and the agent MCP `hq_dm_send` tool, `hq agents message` and the `hq access` grant request apply the recipient rule. Reading commands (inbox, thread, channel) are unchanged, and `hq dm forward` does not set an audience.
 - `hq scan secrets` no longer exits 2 when a repo's `.gitleaks.toml` allowlist is rejected. In staged and file scans it now prints a fixed warning that quotes no part of the file and scans with no repo allowlist, so a real key is still reported (exit 1) and a commit that replaces a bad allowlist is not blocked. An unknown `--allowlist-rev` still exits 2.

package/dist/command-catalog.generated.d.ts

@@ -1164,6 +1164,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--print";
             readonly description: "Build and print the chunks as JSON; upload nothing";
             readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print the pass outcome as one JSON line instead of a summary";
+            readonly hidden: false;
         }, {
             readonly flags: "--respect-throttle";
             readonly description: "Honour the 24h per-scope upload throttle instead of forcing a pass (for scheduled callers)";
@@ -3067,6 +3071,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--permission <level>";
             readonly description: "Permission level (only with --with): read | write";
             readonly hidden: false;
+        }, {
+            readonly flags: "--exact";
+            readonly description: "With --with: grant exactly the object named by <prefix>, even when it looks like a folder (by default a bare folder name such as 'knowledge' is granted as the folder glob 'knowledge/*').";
+            readonly hidden: false;
         }, {
             readonly flags: "--full";
             readonly description: "Grant access to the ENTIRE vault (the '*' wildcard prefix) — no need to quote a glob. Requires --with; defaults to write permission.";
@@ -3092,7 +3100,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "unshare";
-        readonly description: "Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with.";
+        readonly description: "Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with. With --with, a bare name such as 'knowledge' first removes the exact 'knowledge' grant (rows from older `hq files share` versions) and, when none matches, the folder-glob 'knowledge/*' grant. Without --with, the prefix is used exactly as typed: pass 'knowledge/*' (quoted) to clean up the folder-glob row.";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -3109,6 +3117,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--with <principal>";
             readonly description: "Person uid, agent uid, company Outpost id (out_...), email address, group id, or '@all' to remove the grant";
             readonly hidden: false;
+        }, {
+            readonly flags: "--exact";
+            readonly description: "With --with: remove the grant on exactly the object named by <prefix>. By default a bare folder name such as 'knowledge' resolves to the folder glob 'knowledge/*', the same way `hq files share` resolves it.";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {
@@ -4565,12 +4577,20 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [{
             readonly flags: "--state <state>";
-            readonly description: "One of: triaged, in-progress, shipped, verified, resolved";
+            readonly description: "One of: triaged, in-progress, stalled, shipped, verified, resolved";
             readonly hidden: false;
         }, {
             readonly flags: "--note <text>";
             readonly description: "What the customer should read (plain text, up to 2000 characters)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--pr <url>";
+            readonly description: "Open pull request for this ticket (required with --state in-progress unless --lane is given)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--lane <id>";
+            readonly description: "Live lane working this ticket (required with --state in-progress unless --pr is given)";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {
@@ -4632,6 +4652,27 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "claim";
+        readonly description: "Assign a ticket to yourself (sets the assignee only, never the status)";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <id>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "id";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "Feedback id (feedback_<uuid>)";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "Print { id, assignee } as JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "list";
         readonly description: "List feedback: untriaged (default), yours, or one person's";
@@ -4646,6 +4687,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--untriaged";
             readonly description: "Items nobody has triaged yet (the default)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--open";
+            readonly description: "Every item not resolved, won't-fix or accepted, triaged or not";
+            readonly hidden: false;
         }, {
             readonly flags: "--mine";
             readonly description: "Items assigned to you";
@@ -4656,7 +4701,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--status <status>";
-            readonly description: "Only items with this status";
+            readonly description: "Only items with this status (new, triaging, accepted, wont_fix, in_progress, resolved, waiting_on_customer, reopened, stalled, needs_info). Without --untriaged, --mine or --assignee it lists every item in that status";
             readonly hidden: false;
         }, {
             readonly flags: "--limit <n>";
@@ -4668,7 +4713,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--json";
-            readonly description: "Print { items, count } as JSON";
+            readonly description: "Print { items, count } as JSON, plus truncated: true when more items match";
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];

package/dist/command-catalog.generated.js

@@ -1399,6 +1399,11 @@ export const COMMAND_CATALOG = [
                         "description": "Build and print the chunks as JSON; upload nothing",
                         "hidden": false
                     },
+                    {
+                        "flags": "--json",
+                        "description": "Print the pass outcome as one JSON line instead of a summary",
+                        "hidden": false
+                    },
                     {
                         "flags": "--respect-throttle",
                         "description": "Honour the 24h per-scope upload throttle instead of forcing a pass (for scheduled callers)",
@@ -3693,6 +3698,11 @@ export const COMMAND_CATALOG = [
                         "description": "Permission level (only with --with): read | write",
                         "hidden": false
                     },
+                    {
+                        "flags": "--exact",
+                        "description": "With --with: grant exactly the object named by <prefix>, even when it looks like a folder (by default a bare folder name such as 'knowledge' is granted as the folder glob 'knowledge/*').",
+                        "hidden": false
+                    },
                     {
                         "flags": "--full",
                         "description": "Grant access to the ENTIRE vault (the '*' wildcard prefix) — no need to quote a glob. Requires --with; defaults to write permission.",
@@ -3724,7 +3734,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "unshare",
-                "description": "Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with.",
+                "description": "Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with. With --with, a bare name such as 'knowledge' first removes the exact 'knowledge' grant (rows from older `hq files share` versions) and, when none matches, the folder-glob 'knowledge/*' grant. Without --with, the prefix is used exactly as typed: pass 'knowledge/*' (quoted) to clean up the folder-glob row.",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -3744,6 +3754,11 @@ export const COMMAND_CATALOG = [
                         "flags": "--with <principal>",
                         "description": "Person uid, agent uid, company Outpost id (out_...), email address, group id, or '@all' to remove the grant",
                         "hidden": false
+                    },
+                    {
+                        "flags": "--exact",
+                        "description": "With --with: remove the grant on exactly the object named by <prefix>. By default a bare folder name such as 'knowledge' resolves to the folder glob 'knowledge/*', the same way `hq files share` resolves it.",
+                        "hidden": false
                     }
                 ],
                 "subcommands": []
@@ -5529,13 +5544,23 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--state <state>",
-                        "description": "One of: triaged, in-progress, shipped, verified, resolved",
+                        "description": "One of: triaged, in-progress, stalled, shipped, verified, resolved",
                         "hidden": false
                     },
                     {
                         "flags": "--note <text>",
                         "description": "What the customer should read (plain text, up to 2000 characters)",
                         "hidden": false
+                    },
+                    {
+                        "flags": "--pr <url>",
+                        "description": "Open pull request for this ticket (required with --state in-progress unless --lane is given)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--lane <id>",
+                        "description": "Live lane working this ticket (required with --state in-progress unless --pr is given)",
+                        "hidden": false
                     }
                 ],
                 "subcommands": []
@@ -5613,6 +5638,32 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "claim",
+                "description": "Assign a ticket to yourself (sets the assignee only, never the status)",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <id>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "id",
+                        "required": true,
+                        "variadic": false,
+                        "description": "Feedback id (feedback_<uuid>)"
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "Print { id, assignee } as JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "list",
                 "description": "List feedback: untriaged (default), yours, or one person's",
@@ -5629,6 +5680,11 @@ export const COMMAND_CATALOG = [
                         "description": "Items nobody has triaged yet (the default)",
                         "hidden": false
                     },
+                    {
+                        "flags": "--open",
+                        "description": "Every item not resolved, won't-fix or accepted, triaged or not",
+                        "hidden": false
+                    },
                     {
                         "flags": "--mine",
                         "description": "Items assigned to you",
@@ -5641,7 +5697,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--status <status>",
-                        "description": "Only items with this status",
+                        "description": "Only items with this status (new, triaging, accepted, wont_fix, in_progress, resolved, waiting_on_customer, reopened, stalled, needs_info). Without --untriaged, --mine or --assignee it lists every item in that status",
                         "hidden": false
                     },
                     {
@@ -5656,7 +5712,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--json",
-                        "description": "Print { items, count } as JSON",
+                        "description": "Print { items, count } as JSON, plus truncated: true when more items match",
                         "hidden": false
                     }
                 ],

package/dist/commands/access.js

@@ -611,7 +611,12 @@ async function completeTarget(input, deps, located) {
             }
             else {
                 grantor = resolved;
-                const grantorLine = `Grantor: ${grantorLabel(resolved)} (${resolved.source})`;
+                const contactRole = resolved.source === "acl-creator"
+                    ? "ACL creator"
+                    : resolved.source === "owner"
+                        ? "company owner fallback"
+                        : "company admin fallback";
+                const grantorLine = `Access contact: ${grantorLabel(resolved)} (${contactRole}; file authorship not verified)`;
                 // The recipient is always shown BEFORE any send. Under --json stdout is
                 // reserved for the single JSON object, so the line goes to stderr.
                 if (json)
@@ -659,7 +664,7 @@ async function completeTarget(input, deps, located) {
                     }
                     if (approved && outcome === "no-access") {
                         const message = `${requester.email} is asking for read access to ${resolvedKey} in ${slug}.`;
-                        const prompt = `hq files share ${resolvedKey} --with ${requester.email} --permission read --company ${slug}`;
+                        const prompt = `hq files share ${resolvedKey} --exact --with ${requester.email} --permission read --company ${slug}`;
                         const sent = await deps.dm.send({
                             recipient: resolved.email,
                             message,

package/dist/commands/bot.js

@@ -26,6 +26,7 @@ import { hasPromotionHold, promotionHoldSummary } from "../lib/bot/promotion-hol
  * list (online flag), and rm. Secrets are never printed.
  */
 import { promoteLocalBot } from "../lib/bot/promote.js";
+import { DecisionsClient } from "../lib/decisions/client.js";
 import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
 import { preloadResidentPackageModules, reportResidentPackagePreloadFailure, runResidentCommandWithPackageLease, } from "../utils/resident-package-preload.js";
 import { followLogFile } from "../lib/log-follow.js";
@@ -1063,6 +1064,9 @@ async function runBotResident(nameArg) {
         api,
         runtime: runtimeFor(config.runtime),
         ownerContext: () => owner.get(),
+        // US-005: decision picks in the owner DM, with the bot's own machine token
+        // (never the owner's login).
+        decisions: new DecisionsClient(token),
         // Chat attachments are fetched with the bot's own machine identity against
         // the same API its inbox and posts use (BotApi has no baseUrl override either).
         downloadAttachment: createVaultObjectDownloader({ getToken: token }),

package/dist/commands/cloud.d.ts

@@ -67,6 +67,26 @@ export declare function withSyncHealthReport<T>(run: () => Promise<T>): Promise<
  */
 export declare function scopeExcludedExitCode(count: number): 0 | 1;
 export declare function scopeExcludedWarning(count: number): string | null;
+/**
+ * Counts the files share() held back because this sync scope is fenced after an account
+ * switch on this computer (feedback_a69e12ba). share() reports the hold only as
+ * an `identity-switch-push-held` event and leaves the files out of every
+ * result counter, so without this the push printed "Pushed 0 file(s) (0 B,
+ * 0 skipped)" as a success while the vault kept the old copy.
+ *
+ * Each event carries the size of one fenced hold, so the tracker keeps the
+ * largest count it sees instead of a sum: a repeated emit for the same hold
+ * cannot inflate the total. A missing, non-numeric or negative count reads as 0.
+ */
+export declare function createIdentityHeldTracker(): {
+    observe: (event: {
+        type: string;
+        count?: unknown;
+    }) => void;
+    count: () => number;
+};
+/** Recovery lines for files held by the account-switch push fence. */
+export declare function identityHeldLines(count: number): string[];
 /** Actionable recovery for files refused because the vault baseline is stale. */
 export declare function staleUploadRefusalLines(count: number, paths?: readonly string[]): string[];
 /**

package/dist/commands/cloud.js

@@ -153,6 +153,41 @@ export function scopeExcludedWarning(count) {
         `They were skipped, not synced. Re-run with --json to list them, or ` +
         `ask an admin to grant you write on those paths.`);
 }
+/**
+ * Counts the files share() held back because this sync scope is fenced after an account
+ * switch on this computer (feedback_a69e12ba). share() reports the hold only as
+ * an `identity-switch-push-held` event and leaves the files out of every
+ * result counter, so without this the push printed "Pushed 0 file(s) (0 B,
+ * 0 skipped)" as a success while the vault kept the old copy.
+ *
+ * Each event carries the size of one fenced hold, so the tracker keeps the
+ * largest count it sees instead of a sum: a repeated emit for the same hold
+ * cannot inflate the total. A missing, non-numeric or negative count reads as 0.
+ */
+export function createIdentityHeldTracker() {
+    let held = 0;
+    return {
+        observe(event) {
+            if (event.type !== "identity-switch-push-held")
+                return;
+            const n = typeof event.count === "number" && Number.isFinite(event.count)
+                ? Math.max(0, Math.trunc(event.count))
+                : 0;
+            held = Math.max(held, n);
+        },
+        count: () => held,
+    };
+}
+/** Recovery lines for files held by the account-switch push fence. */
+export function identityHeldLines(count) {
+    if (count <= 0)
+        return [];
+    return [
+        `⚠ ${count} file(s) were NOT uploaded: uploads for this company are held on this computer ` +
+            `after an account sign-in change. Run \`hq sync held\` to see what is held, then ` +
+            `\`hq sync release-held\` to upload it.`,
+    ];
+}
 /** Actionable recovery for files refused because the vault baseline is stale. */
 export function staleUploadRefusalLines(count, paths = []) {
     if (count <= 0)
@@ -1028,6 +1063,7 @@ export function registerCloudCommands(program) {
                 companyRef: targetCompany ?? readActiveCompany(options.hqRoot),
             });
             const planLimitTracker = createPlanLimitRefusalTracker(companySlugForBilling(progressCompany));
+            const identityHeld = createIdentityHeldTracker();
             syncHealth = beginSyncHealthReport();
             if (!personalMode) {
                 const companyUid = entityContext?.uid ??
@@ -1055,7 +1091,10 @@ export function registerCloudCommands(program) {
                 }),
                 hqRoot: options.hqRoot,
                 onEvent,
-                progressRecorder: trackingProgressRecorder(planLimitTracker, progressCompany),
+                progressRecorder: ((record) => (event) => {
+                    identityHeld.observe(event);
+                    record(event);
+                })(trackingProgressRecorder(planLimitTracker, progressCompany)),
                 ...(personalMode ? { personalMode: true } : {}),
                 ...(journalSlug !== undefined ? { journalSlug } : {}),
                 ...(author ? { author } : {}),
@@ -1063,6 +1102,7 @@ export function registerCloudCommands(program) {
                 ...namedPathShareOptions(userNamedPaths),
             });
             const planLimitRefused = planLimitTracker.summary();
+            const identityHeldCount = identityHeld.count();
             const staleRefusalCount = result.filesRefusedStale ?? 0;
             const uploadFailed = readUploadFailures(result);
             const refusalRecovery = [
@@ -1075,6 +1115,9 @@ export function registerCloudCommands(program) {
                 uploadFailed.count > 0
                     ? "Push again; the files that failed are still on this machine."
                     : null,
+                identityHeldCount > 0
+                    ? "Run `hq sync held`, then `hq sync release-held` to upload the held files."
+                    : null,
             ]
                 .filter((message) => message !== null)
                 .join(" ");
@@ -1095,6 +1138,7 @@ export function registerCloudCommands(program) {
                     filesExcludedByScope: result.filesExcludedByScope,
                     filesRefusedStale: staleRefusalCount,
                     filesRefusedStalePaths: result.filesRefusedStalePaths ?? [],
+                    filesHeldByIdentityFence: identityHeldCount,
                     filesUploadFailed: uploadFailed.count,
                     uploadFailedPaths: uploadFailed.paths,
                     ...(refusalRecovery ? { refusalRecovery } : {}),
@@ -1115,8 +1159,8 @@ export function registerCloudCommands(program) {
                 // Never a success line over a refusal: say what was pushed, what
                 // was refused and how to fix it, then exit non-zero. The sync
                 // itself worked, so client health records a success. `--json`
-                // callers read `planLimitRefused` on the complete event instead
-                // and keep their exit status.
+                // callers also read `planLimitRefused` on the complete event; the
+                // exit status is non-zero in both modes.
                 log(chalk.yellow(`\n⚠ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ` +
                     `${result.filesSkipped} skipped), but ${describeRefusedFiles(planLimitRefused)} ` +
                     "refused: new files are paused for this account."));
@@ -1132,11 +1176,15 @@ export function registerCloudCommands(program) {
                 for (const line of uploadFailedLines(uploadFailed.count, uploadFailed.paths)) {
                     log(chalk.yellow(line));
                 }
+                for (const line of identityHeldLines(identityHeldCount)) {
+                    log(chalk.yellow(line));
+                }
                 await syncHealth.succeeded();
                 process.exit(1);
                 return;
             }
-            const notUploadedCount = result.filesExcludedByScope + staleRefusalCount + uploadFailed.count;
+            const notUploadedCount = result.filesExcludedByScope + staleRefusalCount + uploadFailed.count +
+                identityHeldCount;
             if (notUploadedCount > 0) {
                 log(chalk.yellow(`\n⚠ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ` +
                     `${result.filesSkipped} skipped, ${notUploadedCount} files not uploaded)`));
@@ -1149,6 +1197,9 @@ export function registerCloudCommands(program) {
                 for (const line of uploadFailedLines(uploadFailed.count, uploadFailed.paths)) {
                     log(chalk.yellow(line));
                 }
+                for (const line of identityHeldLines(identityHeldCount)) {
+                    log(chalk.yellow(line));
+                }
             }
             else {
                 const skipSummary = formatPushSkipSummary(result);

package/dist/commands/core-checkpoint-native.js

@@ -1206,8 +1206,30 @@ function appendPending(pendingPath, payload) {
     // runs once the queue is already over cap, where newest-wins is the point.
     const kept = lines.slice(-MAX_PENDING_PAYLOADS);
     fs.writeFileSync(pendingPath, `${kept.join("\n")}\n`);
+    // Say so instead of dropping silently: a wedged sibling shows up here.
+    const dropped = lines.length - kept.length;
+    printError(`checkpoint: pending queue over cap (${MAX_PENDING_PAYLOADS}); dropped ${dropped} oldest payload(s)`);
     return kept.length;
 }
+/**
+ * Queue a payload for the next sibling run and record its ontology touches.
+ * Shared by the busy-sibling path and the debounced automatic path, so both
+ * hand their thread to the next run instead of leaving it unfilled.
+ */
+async function queuePayload(liveRoot, payload) {
+    const siblingRoot = path.join(liveRoot, "workspace", "checkpoints", "sibling");
+    fs.mkdirSync(siblingRoot, { recursive: true });
+    const depth = appendPending(path.join(siblingRoot, "pending.jsonl"), payload);
+    try {
+        const { recordQueuedTouches } = await import("../lib/checkpoint-ontology/queued-touches.js");
+        recordQueuedTouches(liveRoot, payload.company, payload.files, new Date());
+    }
+    catch {
+        // Queued touches only help a later ontology plan; they must never fail
+        // the checkpoint itself.
+    }
+    return depth;
+}
 /**
  * Take ownership of the queued payloads by renaming the queue aside.
  *
@@ -1369,15 +1391,7 @@ async function startSibling(liveRoot, input, threadPath, backend) {
     const activePid = existingSiblingPid(lockPath, Date.now());
     fs.mkdirSync(siblingRoot, { recursive: true });
     if (activePid !== null) {
-        const depth = appendPending(pendingPath, payload);
-        try {
-            const { recordQueuedTouches } = await import("../lib/checkpoint-ontology/queued-touches.js");
-            recordQueuedTouches(liveRoot, payload.company, payload.files, new Date());
-        }
-        catch {
-            // Queued touches only help a later ontology plan; they must never fail
-            // the checkpoint itself.
-        }
+        const depth = await queuePayload(liveRoot, payload);
         printResult(`checkpoint: sibling busy — payload queued (${depth} pending)`);
         return;
     }
@@ -1579,7 +1593,13 @@ async function runCheckpoint(options, command, group, preResolvedHqRoot) {
                 printResult(`checkpoint: sibling disabled (${SIBLING_SETTING})`);
             }
             else if (autoDebounced) {
-                printResult("checkpoint: sibling skipped (automatic checkpoint; one ran for this session recently)");
+                // feedback_a2a5c2c3: the debounce limits how many siblings start, but
+                // the thread still needs filling. Queue it once; the next sibling run
+                // claims it. The debounce stamp is not refreshed, so the window still
+                // closes on schedule and the next automatic checkpoint starts a run.
+                const depth = await queuePayload(liveRoot, siblingPayload(input, threadPath, "none"));
+                printResult("checkpoint: sibling skipped (automatic checkpoint; one ran for this session recently)" +
+                    ` — payload queued (${depth} pending)`);
             }
             else if (backend === "none") {
                 printResult("checkpoint: sibling disabled (backend none)");

package/dist/commands/feedback-triage.d.ts

@@ -9,6 +9,18 @@ import { Command } from "commander";
  */
 export declare const TRIAGE_KINDS: readonly ["bug", "feature", "question"];
 export type TriageKind = (typeof TRIAGE_KINDS)[number];
+/**
+ * Internal feedback row statuses `hq feedback list --status` accepts.
+ * `stalled` is open work that started and then stopped: a row is in_progress
+ * only while it has a linked open PR or a live lane, and moves to stalled after
+ * 48h with no activity. It is listed apart from `new` (not started).
+ */
+/**
+ * Statuses shown in `list --status` help. Help text only: the CLI does not
+ * validate against this list, because hq-pro owns the set and returns a 400
+ * for an unknown value.
+ */
+export declare const FEEDBACK_LIST_STATUSES: readonly ["new", "triaging", "accepted", "wont_fix", "in_progress", "resolved", "waiting_on_customer", "reopened", "stalled", "needs_info"];
 export declare const MAX_TRIAGE_SUMMARY = 2000;
 export declare const DEFAULT_LIST_LIMIT = 50;
 export interface FeedbackListRow {
@@ -24,6 +36,14 @@ export type FeedbackListSelector = {
 } | {
     kind: "assignee";
     assignee: string;
+}
+/** Every visible row, untriaged or not. Used for `--status` with no other selector. */
+ | {
+    kind: "any";
+}
+/** Every row not in a terminal status, untriaged or not (`--open`). */
+ | {
+    kind: "open";
 };
 /** Email claim of the caller's staff token, used by `list --mine`. */
 export declare function emailFromToken(token: string): string | null;
@@ -36,14 +56,36 @@ export declare function formatFeedbackAge(iso: string | undefined, now?: number)
  * back as `?cursor=`.
  */
 export declare function cursorFrom(data: unknown): string | null;
+/**
+ * Lifecycle states hq-pro treats as closed (`TERMINAL_STATUSES` in
+ * feedback-status.ts). `--open` lists every row outside this set; a row with
+ * no status counts as open.
+ */
+export declare const TERMINAL_FEEDBACK_STATUSES: readonly string[];
+/** Why a list stopped before the server ran out of rows, if it did. */
+export type FeedbackListTruncation = "limit" | "page-cap" | "server";
+export interface FeedbackListResult {
+    items: FeedbackListRow[];
+    /** Set when matching rows may exist beyond `items`. */
+    truncated?: FeedbackListTruncation;
+}
 /** Page through `GET /v1/feedback` until `limit` rows (or every row with `limit: null`). */
 export declare function listFeedback(opts: {
     token: string;
     selector: FeedbackListSelector;
     status?: string;
     limit: number | null;
-}): Promise<FeedbackListRow[]>;
+}): Promise<FeedbackListResult>;
+/** One-line stderr notice for a list that stopped before the end. */
+export declare function feedbackTruncationNotice(reason: FeedbackListTruncation, shown: number): string;
 export declare function formatFeedbackTable(rows: FeedbackListRow[], now?: number): string;
+/** Status cell for the list table. A stalled row is flagged so it does not read as not started. */
+export declare function formatFeedbackStatus(status: unknown): string;
+/**
+ * Normalize `list --status`; accepts `in-progress` as an alias of `in_progress`.
+ * Any non-empty value goes to the server, which validates it.
+ */
+export declare function parseListStatus(raw: string): string;
 export declare function parseListLimit(raw: string): number;
 export declare function buildTriagePatch(opts: {
     id: string;