@indigoai-us/hq-cli 5.345.174 → 5.345.176

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 ## [Unreleased]
 
+## [5.345.176] — 2026-10-28
+- `hq bot list --json` rows carry `runtimeCrash`. It is set when the bot's coding tool crashed before a turn started, the crash came after the bot last started, and no turn has worked since; otherwise it is null. It gives the time, exit code, how long the tool ran, and the first line of what the tool printed. A restart or a working turn clears it. HQ uses it to warn before sending the bot work it would fail, for example the Daily Brief's Create brief.
+- A local bot started by the HQ app on macOS now restarts itself, between turns, when an HQ app update replaces the app's launcher. Before this, macOS stopped letting the bot's coding tool read the Documents folder after the update, and every message failed within milliseconds ("Claude Code stopped with an error") until the bot was restarted by hand.
+- A local bot now checks its own coding tool's sign-in before each turn, at start, and every 15 seconds while it is signed out, in the bot's own environment (`claude auth status --json`, `codex login status`). A bot started by launchd has a bare environment, so Claude Code could be signed in for the terminal and signed out for the bot; the turn then died in milliseconds with a bare "unknown error" that read as a crash. The bot now holds the message, says once that the tool is not signed in on this computer (with the Sign in card), and answers as soon as the sign-in works. `hq bot status --json` and `hq bot list --json` report `runtimeSignedIn` (true, false, or null when the bot cannot say), `runtimeSignInCheck` and `signInCommand`, so the HQ app can check before it sends a Daily Brief job. Turns also carry `USER` (and `LOGNAME`) from the account the bot runs as when the environment lacks them, since Claude Code keys its Keychain login on `$USER`.
+- On any machine where `hq daemon` runs the new sync engine (`sync-core`), it now also runs
+  the `mesh` service, which writes the engine's wake marker. Without it, a machine
+  that turned on `sync-core` with an override (for example an agent kit) had no remote
+  wakes and fell back to polling every 1 to 30 minutes. Disabling `mesh` explicitly still
+  turns it off.
+- Recover durable unfinished loop queues after controller loss through normal admission. Hold uncertain effects for explicit senior, local-host and company-bound `hq lanes recover-loop --lane-version` disposition with an audited fingerprint; never replay uncertain work or reactivate historical done lanes. Preserve operator stops, questions, account eligibility and live ownership, reject linked recovery directories, and serialize controller starts with recovery. Legacy ownerless lease publication and old-client reclaimer races remain separately gated.
+- The new sync engine now installs as release v0.1.19, and company vaults move to full mode only on v0.1.19 or later. On a busy company vault, a remote change now costs one request instead of about four, and an idle engine no longer runs extra follow-up checks.
+- The new sync engine now installs as release v0.1.20, and company vaults move to full mode only on v0.1.20 or later. Remote changes now arrive within seconds instead of after a 30 second hold, and Linux now picks up local changes as they happen instead of waiting for the next poll. A file deleted right after the engine uploaded it is now deleted on the server instead of coming back, editing a file before its upload shows on the server no longer creates a conflict copy, and two-sided board.json edits merge by entry id instead of conflicting. Wakes that change nothing locally no longer send requests.
+- When a company's `sync.rust-engine-rollout` switch is on, the daemon now moves that company's vault and the member's personal vault straight to the new sync engine in full mode on its next reconcile: the legacy sync is turned off for both vaults and the engine starts once the legacy runner has stopped syncing them. The read-only warming phase and the plan-size promotion hold are gone. Company vaults run full from engine 0.1.17 on, the engine the daemon now installs; a machine left with an older engine keeps its company vaults on the current sync and lists them under `held` in `hq sync-core status`. The engine's first full cycle with work (planned, completed, pending, held, not applied, and the uploads, downloads, deletes, conflict copies and deferred paths in its work list) is recorded per vault in `~/.hq/sync-core/rollout.json`. Turning the switch off, or naming a vault in `~/.hq/sync-core/skip.json`, stops the engine for that vault, removes its ownership record and turns the legacy sync back on for it, including a vault that was already off before the switch and when `rollout.json` cannot be read.
+- The daemon decides whether an installed sync engine is new enough from the version the binary itself reports, falling back to the `hq-syncd.release` marker only when the binary cannot be run, and corrects a stale marker, so a marker left at an older release beside a newer binary no longer makes the daemon replace that binary with an older one. A read-only engine left from an earlier release runs without the protocol variable and heartbeat watchdog until the next reconcile moves it to full mode.
+- The daemon's `sync-core` service now uploads a sync-audit manifest once a day for every vault the new sync engine owns on this machine: a vault the daemon runs in full mode whose current sync is switched off here. A `sync-core-manifest` unit runs `hq daemon service sync-core-manifest`, which calls `hq sync manifest --engine-owned --respect-throttle` per scope. A vault whose sync is merely switched off, or whose current sync is still on, gets no engine-owned manifest, so two uploaders never share a scope. Without this the nightly reconciliation audit marks engine-owned scopes `manifest_stale` from the second day, because only the current sync uploaded manifests. `hq sync manifest --engine-owned` builds the manifest from the disk walk alone and marks the legacy journal as not the scope's ledger (`ledgerUnavailable.errorClass` = `SyncCoreOwnsScope`), so the audit compares disk against the vault instead of reading the frozen journal's upload claims as differences.
+- A Mac whose daemon runs the current sync no longer waits ten minutes before starting the new sync engine for a vault just because the HQ desktop app is open. The ten-minute wait now applies only when the desktop app runs the current sync itself; when the daemon runs it, the engine starts as soon as the daemon's sync runner has restarted without that vault.
+- The daemon's push-wake marker `~/.hq/work-mesh/sync-wake.json` now carries a
+  per-vault `vaults` map (`{ "<vault uid>": { "wakeSequence": n } }`) next to the
+  shared `wakeSequence`, read from the IoT envelope's `vault` field, so each
+  hq-sync-core engine wakes only for its own vault. Old markers are read and
+  carried forward.
+
+## [5.345.175] — 2026-10-28
+- A local bot whose coding tool crashed before it could start on a message (seen as "Claude Code stopped with an error" on the first message after a day or more idle) now tries that message once more on its own. If it crashes again, the reply carries a Heal bot card so HQ can restart the bot and send the message again, and the bot's log and `hq bot status` record what the tool printed, how long it ran and which binary it was, so the cause can be found.
+- `hq dm --attach` after a person `hq login` looks up the caller's `prs_` uid
+  when the session token has no `custom:entityUid` (human tokens never carry
+  that claim). Plain `hq dm` already worked; attaching a file no longer fails
+  with "Could not read your person uid from the session token".
+
 ## [5.345.174] — 2026-10-27
 - `hq channels delete <name> --yes` deletes a channel you own, including its
   messages. Group DMs stay undeletable. Without `--yes` the command refuses.

package/dist/command-catalog.generated.d.ts

@@ -1180,6 +1180,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--respect-throttle";
             readonly description: "Honour the 24h per-scope upload throttle instead of forcing a pass (for scheduled callers)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--engine-owned";
+            readonly description: "The new sync engine owns this scope here: build the manifest from disk alone and mark the legacy journal as not its ledger";
+            readonly hidden: false;
         }, {
             readonly flags: "--hq-root <path>";
             readonly description: "Local HQ tree root (default: <runtime-path>)";
@@ -15695,6 +15699,47 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "recover-loop";
+        readonly description: "Preview or explicitly fail/abandon uncertain loop effects; never replay work";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <lane-id>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "lane-id";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "Loop lane id";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--disposition <action>";
+            readonly description: "fail or abandon; omit for a read-only preview";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--lane-version <number>";
+            readonly description: "Exact lane version from preview";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--fingerprint <sha256>";
+            readonly description: "Exact preview envelope/lease fingerprint";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--reason <text>";
+            readonly description: "Audited reason; does not certify external effects";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--attest-owner-investigated";
+            readonly description: "Attest unknown lease ownership was investigated and no live owner exists";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "JSON on stdout (always)";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "enqueue";
         readonly description: "Validate and queue one phase envelope for a loop lane";
@@ -18382,6 +18427,26 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly hidden: false;
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "sync-core-manifest";
+            readonly description: "Upload the sync-audit manifest for every vault the new sync engine owns on this machine";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: false;
+            readonly usage: "[options]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--hq-root <path>";
+                readonly description: "HQ folder the engine works against";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--json";
+                readonly description: "Print one JSON array of per-scope outcomes";
+                readonly hidden: false;
+            }];
+            readonly subcommands: readonly [];
         }, {
             readonly name: "remote-control";
             readonly description: "Keep `claude remote-control` running in a tmux session in the HQ folder";

package/dist/command-catalog.generated.js

@@ -1419,6 +1419,11 @@ export const COMMAND_CATALOG = [
                         "description": "Honour the 24h per-scope upload throttle instead of forcing a pass (for scheduled callers)",
                         "hidden": false
                     },
+                    {
+                        "flags": "--engine-owned",
+                        "description": "The new sync engine owns this scope here: build the manifest from disk alone and mark the legacy journal as not its ledger",
+                        "hidden": false
+                    },
                     {
                         "flags": "--hq-root <path>",
                         "description": "Local HQ tree root (default: <runtime-path>)",
@@ -19117,6 +19122,57 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "recover-loop",
+                "description": "Preview or explicitly fail/abandon uncertain loop effects; never replay work",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <lane-id>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "lane-id",
+                        "required": true,
+                        "variadic": false,
+                        "description": "Loop lane id"
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--disposition <action>",
+                        "description": "fail or abandon; omit for a read-only preview",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--lane-version <number>",
+                        "description": "Exact lane version from preview",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--fingerprint <sha256>",
+                        "description": "Exact preview envelope/lease fingerprint",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--reason <text>",
+                        "description": "Audited reason; does not certify external effects",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--attest-owner-investigated",
+                        "description": "Attest unknown lease ownership was investigated and no live owner exists",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "JSON on stdout (always)",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "enqueue",
                 "description": "Validate and queue one phase envelope for a loop lane",
@@ -22399,6 +22455,30 @@ export const COMMAND_CATALOG = [
                         ],
                         "subcommands": []
                     },
+                    {
+                        "name": "sync-core-manifest",
+                        "description": "Upload the sync-audit manifest for every vault the new sync engine owns on this machine",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options]",
+                        "helpText": [],
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--hq-root <path>",
+                                "description": "HQ folder the engine works against",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Print one JSON array of per-scope outcomes",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
+                    },
                     {
                         "name": "remote-control",
                         "description": "Keep `claude remote-control` running in a tmux session in the HQ folder",

package/dist/commands/bot.d.ts

@@ -1,7 +1,8 @@
 import { Command } from "commander";
-import { type RuntimeSignInIssue } from "../lib/bot/runtime-sign-in.js";
+import { type RuntimeSignInCheck, type RuntimeSignInIssue } from "../lib/bot/runtime-sign-in.js";
+import type { BotStatusFile } from "../lib/bot/status.js";
 import { probeBotRuntime, type RuntimeProbeResult } from "../lib/bot/probe.js";
-import { type BotLocalConfig, type MyLocalBot, type BotKind, type BotMemoryMode, type BotNotRunnableReason, type BotConfig, type BotRuntimeId, type LaunchctlExec, type BotRole } from "../lib/bot/index.js";
+import { type BotLocalConfig, type MyLocalBot, type BotKind, type BotMemoryMode, type BotNotRunnableReason, type RuntimeCrash, type BotConfig, type BotRuntimeId, type LaunchctlExec, type BotRole } from "../lib/bot/index.js";
 /** Real launchctl; every failure is a non-ok result, never a throw. */
 export declare const defaultLaunchctl: LaunchctlExec;
 /** The desktop app creates HQ's setup bot under this name, always from the `setup` worker. */
@@ -40,6 +41,25 @@ export interface BotRow {
     busySince: string | null;
     /** Present while the coding tool needs a new sign-in before the bot can work. */
     runtimeSignIn: RuntimeSignInIssue | null;
+    /**
+     * The bot's own last check of its coding tool's sign-in, in the bot's
+     * environment (at start, before a turn, on a timer while signed out). Null
+     * when the bot has not reported one (stopped, or an older hq-cli).
+     */
+    runtimeSignInCheck: RuntimeSignInCheck | null;
+    /**
+     * The bot's word on whether its coding tool is signed in for it: false
+     * while it holds a sign-in issue or its last check said no; true when its
+     * last check said yes and no issue is held; null when it cannot say.
+     */
+    runtimeSignedIn: boolean | null;
+    /** The terminal command that signs the bot's coding tool in on this computer. */
+    signInCommand: string;
+    /**
+     * The coding tool crashed before its turn started since the bot last
+     * started, and no turn has worked since; null otherwise. A restart clears it.
+     */
+    runtimeCrash: RuntimeCrash | null;
     daemonInstalled: boolean;
     daemonLoaded: boolean;
     /**
@@ -74,6 +94,12 @@ export interface BotRow {
 export declare function listBotNames(root: string): string[];
 /** Bot-identity token supplier: per-bot creds + per-bot token cache dir. */
 export declare function botTokenSupplier(dir: string): () => Promise<string>;
+/**
+ * The bot's word on its coding tool's sign-in. Only a running bot's report
+ * counts: a stopped bot's last check may be from before a sign-in or a
+ * sign-out, and the next start checks afresh.
+ */
+export declare function runtimeSignedIn(status: Pick<BotStatusFile, "runtimeSignIn" | "runtimeSignInCheck"> | null | undefined, processAlive: boolean): boolean | null;
 /** Spawn `hq bot run <name>` detached (no launchd). */
 export declare function spawnDetachedRun(name: string, dir: string): number;
 /**

package/dist/commands/bot.js

@@ -30,7 +30,7 @@ import { DecisionsClient } from "../lib/decisions/client.js";
 import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
 import { preloadResidentPackageModules, reportResidentPackagePreloadFailure, runResidentCommandWithPackageLease, } from "../utils/resident-package-preload.js";
 import { followLogFile } from "../lib/log-follow.js";
-import { CLI_UPDATE_DISABLE_ENV, createCliUpdateWatcher, handOffToUpdatedCli } from "../lib/bot/cli-update.js";
+import { CLI_UPDATE_DISABLE_ENV, createCliUpdateWatcher, detectHqAppLauncher, handOffToUpdatedCli } from "../lib/bot/cli-update.js";
 import { createVaultObjectDownloader } from "../lib/agent-kit/attachment-download.js";
 import { addBotToCompanies, describeCompanyFailures, removeBotFromCompanies } from "./bot-companies.js";
 import { registerBotContinuityCommand } from "./bot-continuity.js";
@@ -49,10 +49,10 @@ import { askDaemonToStart, askDaemonToStop, daemonOwnsProcess, daemonHoldReason,
 import { daemonPaths } from "../lib/daemon/paths.js";
 import { launchdLabel } from "../lib/bot/paths.js";
 import { isAncestorProcess } from "../lib/bot/self-process.js";
-import { runtimeDisplayName } from "../lib/bot/runtime-sign-in.js";
+import { runtimeDisplayName, signInCommand } from "../lib/bot/runtime-sign-in.js";
 import { classifyRuntimeFailure, runtimeFailureReason } from "../lib/bot/runtime-failure.js";
 import { PROBE_DEFAULT_TIMEOUT_MS, probeBotRuntime } from "../lib/bot/probe.js";
-import { BotApi, BotApiError, BOT_RESTORE_DEFAULTS, buildBotLocalConfig, describeBotLocalConfig, orphanBotRunMessage, parseBotLocalConfig, removeOrphanBotDaemon, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, repairBotDaemonIfStale, healBotDaemonNodeFromJob, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotDisplayName, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, localNameForRemoteBot, remoteBotRunnability, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_DISPLAY_NAME_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, detectBotPlatform, withBotLock, localBotRole, remoteBotRole, remoteBotDisplayName, personFacingName, writeCloudDisplayName, setupSlugFor, ASSISTANT_ROLE, HQ_FLEET_RUNTIME_ENGINE_ID, authenticateFleetLocalBot, bootstrapFleetLocalBot, buildSystemPrompt, controlFleetLocalBot, ensureFleetPython, fleetLocalGatewayPid, refreshFleetLocalInstructions, fleetLocalPromotionRuntime, installPinnedFleetLocalDistribution, readPromptSources, removeFleetLocalBot, } from "../lib/bot/index.js";
+import { BotApi, BotApiError, BOT_RESTORE_DEFAULTS, buildBotLocalConfig, describeBotLocalConfig, orphanBotRunMessage, parseBotLocalConfig, removeOrphanBotDaemon, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, repairBotDaemonIfStale, healBotDaemonNodeFromJob, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotDisplayName, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, localNameForRemoteBot, remoteBotRunnability, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, runtimeCrashSinceStart, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_DISPLAY_NAME_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, detectBotPlatform, withBotLock, localBotRole, remoteBotRole, remoteBotDisplayName, personFacingName, writeCloudDisplayName, setupSlugFor, ASSISTANT_ROLE, HQ_FLEET_RUNTIME_ENGINE_ID, authenticateFleetLocalBot, bootstrapFleetLocalBot, buildSystemPrompt, controlFleetLocalBot, ensureFleetPython, fleetLocalGatewayPid, refreshFleetLocalInstructions, fleetLocalPromotionRuntime, installPinnedFleetLocalDistribution, readPromptSources, removeFleetLocalBot, } from "../lib/bot/index.js";
 function collectRepeated(value, previous) {
     return [...previous, value];
 }
@@ -176,6 +176,18 @@ async function ownerToken(interactive = process.stdin.isTTY === true) {
     // sign-in and shares the same cached session file.
     return ensureCognitoToken({ tokenSource: "person", interactive });
 }
+/**
+ * The bot's word on its coding tool's sign-in. Only a running bot's report
+ * counts: a stopped bot's last check may be from before a sign-in or a
+ * sign-out, and the next start checks afresh.
+ */
+export function runtimeSignedIn(status, processAlive) {
+    if (!processAlive || !status)
+        return null;
+    if (status.runtimeSignIn)
+        return false;
+    return status.runtimeSignInCheck?.signedIn ?? null;
+}
 function rowFor(name, opts = {}) {
     const dir = botDir(name);
     const config = readBotConfig(dir);
@@ -221,6 +233,10 @@ function rowFor(name, opts = {}) {
         busy: processAlive && inflightTurns.length > 0,
         busySince: processAlive ? (inflightTurns[0]?.startedAt ?? null) : null,
         runtimeSignIn: status?.runtimeSignIn ?? null,
+        runtimeSignInCheck: status?.runtimeSignInCheck ?? null,
+        runtimeSignedIn: runtimeSignedIn(status, processAlive),
+        signInCommand: signInCommand(config.runtime),
+        runtimeCrash: processAlive ? runtimeCrashSinceStart(status) : null,
         daemonInstalled,
         daemonLoaded,
         daemonNodeMissing,
@@ -1158,9 +1174,11 @@ async function runBotResident(nameArg) {
         downloadAttachment: createVaultObjectDownloader({ getToken: token }),
         // Reload onto an updated hq-cli: the watched path is the script this
         // process was launched with, which is what its supervisor launches next.
+        // Also restart when the HQ.app launcher is replaced: macOS ties the bot's
+        // Documents access to that binary, and coding-tool turns fail until restart.
         ...(process.env[CLI_UPDATE_DISABLE_ENV] === "1"
             ? {}
-            : { cliUpdate: createCliUpdateWatcher({ dir, entry: process.argv[1] ?? null }) }),
+            : { cliUpdate: createCliUpdateWatcher({ dir, entry: process.argv[1] ?? null, launcher: detectHqAppLauncher() }) }),
         onCliUpdateRestart: (_update, log) => {
             handOffToUpdatedCli(name, log, { spawnReplacement: () => spawnDetachedRun(name, dir) });
         },
@@ -1250,13 +1268,21 @@ async function runBotStatus(nameArg, opts) {
         console.log(`  started:    ${status.startedAt}   restarts: ${status.restarts}   replies: ${status.repliesSent}`);
         if (status.cliVersion)
             console.log(`  hq-cli:     ${status.cliVersion}`);
-        if (status.runtimeSignIn?.state === "expired") {
+        if (status.runtimeSignIn) {
             const tool = runtimeDisplayName(status.runtimeSignIn.runtime);
-            console.log(`  ${chalk.yellow(`${tool} needs to sign in again`)} — sign in from HQ, or run \`${status.runtimeSignIn.runtime} ${status.runtimeSignIn.runtime === "claude" ? "auth login" : "login"}\`, then \`hq bot restart ${name}\``);
+            const what = status.runtimeSignIn.state === "signed-out" ? `${tool} is not signed in for ${name}` : `${tool} needs to sign in again`;
+            console.log(`  ${chalk.yellow(what)} — sign in from HQ, or run \`${signInCommand(status.runtimeSignIn.runtime)}\`; ${name} checks again on its own`);
+        }
+        else if (status.runtimeSignInCheck) {
+            const c = status.runtimeSignInCheck;
+            console.log(`  sign-in:    ${c.signedIn === true ? chalk.green("signed in") : c.signedIn === false ? chalk.yellow("signed out") : chalk.gray("unknown")}${chalk.dim(`  checked ${c.checkedAt}`)}${c.signedIn === null && c.detail ? chalk.dim(`  (${c.detail})`) : ""}`);
         }
         if (status.modelHold && new Date(status.modelHold.until).getTime() > Date.now()) {
             console.log(`  ${chalk.yellow(`holding until ${status.modelHold.until}`)} after repeated model failures; the next message after that runs again`);
         }
+        if (status.lastCrash) {
+            console.log(`  last crash: ${chalk.yellow(`${status.lastCrash.at}, exit ${status.lastCrash.code ?? "?"}${status.lastCrash.durationMs !== undefined ? ` after ${status.lastCrash.durationMs} ms` : ""}`)}`);
+        }
         if (status.runtimeModelFallback) {
             console.log(`  model:      ${chalk.yellow(`running on ${status.runtimeModelFallback.to}`)} because ${row.runtime} here is too old for ${status.runtimeModelFallback.from || "its configured model"}; update ${row.runtime} to use it`);
         }

package/dist/commands/daemon.js

@@ -1553,6 +1553,22 @@ export function registerDaemonCommand(program, over = {}) {
             err: d.err,
         });
     }));
+    service
+        .command("sync-core-manifest")
+        .description("Upload the sync-audit manifest for every vault the new sync engine owns on this machine")
+        .option("--hq-root <path>", "HQ folder the engine works against")
+        .option("--json", "Print one JSON array of per-scope outcomes")
+        .action(wrap(async (d, opts) => {
+        const { runSyncCoreManifest } = await import("./sync-core.js");
+        await runSyncCoreManifest(opts, {
+            home: d.home,
+            env: d.env,
+            platform: d.platform,
+            arch: process.arch,
+            out: d.out,
+            err: d.err,
+        });
+    }));
     service
         .command("remote-control")
         .description("Keep `claude remote-control` running in a tmux session in the HQ folder")

package/dist/commands/dm.d.ts

@@ -392,6 +392,13 @@ export interface CallerIdentity {
  * Pure → unit-testable.
  */
 export declare function callerFromToken(token: string): CallerIdentity;
+/**
+ * Vault scope uid for `--attach`. Human Cognito sessions do not carry
+ * `custom:entityUid` (hq-pro sets that only on agent and outpost tokens), so
+ * JWT peek is not enough after a normal `hq login`. Fall back to the
+ * canonical person lookup used by `--personal` files and secrets.
+ */
+export declare function callerUidForAttach(token: string): Promise<string>;
 /**
  * Newest-first channel history → the caller's most recent top-level eventId.
  * Replies (those with rootEventId) are skipped. Pure → unit-testable.

package/dist/commands/dm.js

@@ -1,7 +1,7 @@
 import chalk from "chalk";
 import { readFileSync } from "node:fs";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { resolveDestinationCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+import { resolveCallerPersonUid, resolveDestinationCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { isMachineIdentity } from "@indigoai-us/hq-cloud";
 import { peekIdToken } from "../utils/id-token.js";
 import { redactAgentInboxItem as redactInboxCredentials } from "../lib/agent-kit/inbox-redact.js";
@@ -792,9 +792,9 @@ async function runChannelSend(channelName, message, opts) {
         // personal channels in the caller's personal vault.
         let uploaded = [];
         if (localFiles.length > 0) {
-            const callerUid = callerFromToken(token).personUid;
+            const callerUid = await callerUidForAttach(token);
             const scopeUid = channel.companyUid?.trim()
-                ? attachmentScopeForChannel(channel, callerUid ?? "")
+                ? attachmentScopeForChannel(channel, callerUid)
                 : personalScopeForCaller(callerUid);
             uploaded = await uploadDmAttachments({
                 token,
@@ -989,7 +989,7 @@ async function runDmSend(recipient, message, rawOpts) {
         if (localFiles.length > 0) {
             // A 1:1 attachment is stored in the SENDER's personal vault under the
             // sorted participant pair; the server lets either member read it.
-            const callerUid = callerFromToken(token).personUid;
+            const callerUid = await callerUidForAttach(token);
             const scopeUid = personalScopeForCaller(callerUid);
             const peerUid = await resolveDmPeerUid(token, recipient);
             uploaded = await uploadDmAttachments({
@@ -1363,6 +1363,18 @@ export function callerFromToken(token) {
         ...(emailNorm ? { email: emailNorm } : {}),
     };
 }
+/**
+ * Vault scope uid for `--attach`. Human Cognito sessions do not carry
+ * `custom:entityUid` (hq-pro sets that only on agent and outpost tokens), so
+ * JWT peek is not enough after a normal `hq login`. Fall back to the
+ * canonical person lookup used by `--personal` files and secrets.
+ */
+export async function callerUidForAttach(token) {
+    const fromJwt = callerFromToken(token).personUid;
+    if (fromJwt)
+        return fromJwt;
+    return resolveCallerPersonUid(token, undefined, { command: "hq dm --attach" });
+}
 function isCallerMessage(m, me) {
     if (me.personUid && m.fromPersonUid === me.personUid)
         return true;

package/dist/commands/lanes-loop.d.ts

@@ -50,6 +50,9 @@ export interface LoopControllerDeps {
 export declare const LOOP_CONTROLLER_RECOVERY_REASON = "loop_controller_recovery";
 export declare const LOOP_STALL_RESTART_REASON = "loop_stall_restart";
 export declare const LOOP_PHASE_DEADLINE_REASON = "loop_phase_deadline";
-export declare function startLaneLoopController(ctx: Ctx, laneId: string, initialAdmission?: boolean): number;
+/** Direct command starts serialize with explicit effects disposition. */
+export declare function startLaneLoopController(ctx: Ctx, laneId: string, initialAdmission?: boolean): Promise<number>;
+/** Internal admission dispatcher only: its caller already holds the provider lock. */
+export declare function startLaneLoopControllerWithAdmissionLockHeld(ctx: Ctx, laneId: string, initialAdmission?: boolean): number;
 export declare function runLaneLoopController(ctx: Ctx, laneId: string, deps: LoopControllerDeps): Promise<void>;
 //# sourceMappingURL=lanes-loop.d.ts.map

package/dist/commands/lanes-loop.js

@@ -1,3 +1,4 @@
+import { withLaneAdmissionLock } from "../lib/lanes/admission.js";
 import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -5,10 +6,10 @@ import { readLane, retryUpdateLane, updateLane } from "../lib/lanes/store.js";
 import { LanesError, isLaneVersionConflict } from "../lib/lanes/errors.js";
 import { liveNodeBinary } from "../lib/lanes/node-binary.js";
 import { readLatestEnvelopeRecord } from "../lib/lanes/watcher.js";
-import { spawnLaneWorker } from "../lib/lanes/spawn.js";
+import { readProcStarttime, spawnLaneWorker } from "../lib/lanes/spawn.js";
 import { raiseLaneQuestion } from "../lib/lanes/questions.js";
 import { isTerminalLaneState } from "../lib/lanes/types.js";
-import { HANDOFF_HOLD_CHOICES, clearLoopControllerPid, loopAdmissionPath, runLoopLane, setLoopControllerPid } from "../lib/lanes/loop.js";
+import { HANDOFF_HOLD_CHOICES, clearLoopControllerPid, loopAdmissionPath, loopControllerIsAlive, runLoopLane, setLoopControllerPid } from "../lib/lanes/loop.js";
 import { laneStories } from "../lib/lanes/stories.js";
 import { readLanesRegistryFlagFailOpen } from "../lib/lanes/registry-flag.js";
 import { LANE_LOOP_HANDOFF_REPAIR_FLAG } from "../lib/lanes/flag-keys.js";
@@ -99,7 +100,25 @@ function casLoopLaneState(hqRoot, laneId, from, to) {
 export const LOOP_CONTROLLER_RECOVERY_REASON = "loop_controller_recovery";
 export const LOOP_STALL_RESTART_REASON = "loop_stall_restart";
 export const LOOP_PHASE_DEADLINE_REASON = "loop_phase_deadline";
-export function startLaneLoopController(ctx, laneId, initialAdmission = false) {
+/** Direct command starts serialize with explicit effects disposition. */
+export async function startLaneLoopController(ctx, laneId, initialAdmission = false) {
+    const root = ctx.hqRoot();
+    const expected = readLane(root, laneId);
+    return withLaneAdmissionLock(root, expected.provider, async () => {
+        const current = readLane(root, laneId);
+        if (current.version !== expected.version || current.provider !== expected.provider) {
+            throw new LanesError("loop_controller_start_changed", "Lane changed while controller start waited for admission; inspect again", { lane_id: laneId });
+        }
+        return startLaneLoopControllerWithAdmissionLockHeld(ctx, laneId, initialAdmission);
+    }, ctx.sleep);
+}
+/** Internal admission dispatcher only: its caller already holds the provider lock. */
+export function startLaneLoopControllerWithAdmissionLockHeld(ctx, laneId, initialAdmission = false) {
+    const runDir = loopRunDir(ctx.hqRoot(), laneId);
+    const identity = ctx.controllerProcessIdentity;
+    if (loopControllerIsAlive(runDir, identity?.isAlive, identity?.readStarttime)) {
+        throw new LanesError("loop_controller_already_alive", "A loop controller or lease owner is already alive; no second controller was started", { lane_id: laneId });
+    }
     const entry = process.argv[1];
     if (!entry)
         throw new LanesError("loop_controller_entry_missing", "Cannot resolve the hq CLI entry point for the loop controller", { lane_id: laneId });
@@ -111,7 +130,7 @@ export function startLaneLoopController(ctx, laneId, initialAdmission = false) {
     child.unref();
     if (child.pid === undefined)
         throw new LanesError("loop_controller_spawn_failed", "Loop controller did not start", { lane_id: laneId });
-    setLoopControllerPid(loopRunDir(ctx.hqRoot(), laneId), laneId, child.pid);
+    setLoopControllerPid(loopRunDir(ctx.hqRoot(), laneId), laneId, child.pid, (identity?.readStarttime ?? readProcStarttime)(child.pid) ?? undefined);
     return child.pid;
 }
 export async function runLaneLoopController(ctx, laneId, deps) {

package/dist/commands/lanes-shared.d.ts

@@ -291,6 +291,11 @@ export interface Ctx {
     killProcess?: KillProcessFn;
     isAlive?: (pid: number) => boolean;
     readStarttime?: (pid: number) => number | null;
+    /** Controller identity is separate from worker liveness test seams. */
+    controllerProcessIdentity?: {
+        isAlive(pid: number): boolean;
+        readStarttime(pid: number): number | null;
+    };
     watcherLoopDeps?: Pick<WatcherLoopDeps, "sleep" | "spawnRepair">;
     stopSleepMs?: (ms: number) => void;
     livenessDeps?: LivenessDeps;

package/dist/commands/lanes.d.ts

@@ -1,10 +1,3 @@
-/**
- * `hq lanes` — worker lane management and decision queue (spec §5–§7, §10–§11).
- *
- * Existing commands print JSON on stdout by default and take no interactive input, except
- * `accounts login`, which hands the terminal to the vendor's own sign-in.
- * `watch` and the monitor reminder are the line-oriented text surfaces.
- */
 import { Command } from "commander";
 import type { MonitorLaneMessagePayload, MonitorLaneMessageResult } from "./lanes-message.js";
 import { type Ctx, type LanesMesh, type OutpostRouteIdentity, type ResolvedResumeProfile, type ResumeProfileRepinAuthorization, type SpawnLoginResult } from "./lanes-shared.js";
@@ -77,6 +70,11 @@ export interface LanesCommandDeps {
     isAlive?: (pid: number) => boolean;
     /** Test seam for worker PID identity checks. */
     readStarttime?: (pid: number) => number | null;
+    /** Controller identity is separate from worker liveness test seams. */
+    controllerProcessIdentity?: {
+        isAlive(pid: number): boolean;
+        readStarttime(pid: number): number | null;
+    };
     /** Test seams for synchronous dead-worker classification and repair. */
     watcherLoopDeps?: Pick<WatcherLoopDeps, "sleep" | "spawnRepair">;
     stopSleepMs?: (ms: number) => void;