@indigoai-us/hq-cli 5.345.53 → 5.345.55

package/CHANGELOG.md

@@ -2,7 +2,31 @@
 
 ## [Unreleased]
 
+## [5.345.55] — 2026-10-08
+- Added `hq daemon sync conflicts acknowledge <id>` so the desktop can clear a parked-conflict notice without writing runner-owned sync state.
+- Add `hq import scan`, which runs the HQ import-context scanner on this
+  machine (local only) and reports conversation history, repositories,
+  companies and projects. `--json --stream` prints the scan as v1 JSON Lines
+  events (`start`, `source`, `count`, `company`, `project`, `error`, `done`)
+  for the HQ desktop first-run setup; `--json` prints only the final `done`
+  object. Each scanner line is validated against a schema and rebuilt from its
+  v1 fields; invalid lines are dropped with a warning. Scanner diagnostics are
+  shown with paths and token-like strings redacted. The HQ folder comes from
+  `--hq-root` or the HQ installer's record only. When the scan cannot run,
+  fails or is cancelled, the command emits an `error` event and a `done` and
+  exits non-zero; cancelling stops the whole scanner process group. Event
+  types are exported from `dist/lib/import-scan/events.js`. Needs an hq-core
+  release whose import-context scanner supports `--progress-json`.
+- Exit with actionable recovery steps when a vault upload is refused.
+
+## [5.345.54] — 2026-10-08
+- Add `hq lanes session-start` for conduct-mode SessionStart bootstrapping. `HQ_LANE_ENGINE` is the preferred engine environment variable; `HQ_CONDUCT_ENGINE` remains a deprecated fallback alias. Show `hq lanes` in root help.
+
+- Prevents `hq` commands run outside an HQ tree on Windows from hanging while searching parent directories for an HQ root.
+
 ## [5.345.53] — 2026-10-08
+- Starter plan-limit notices quote 3 integrations when the server sends no integration limit, up from 1. The setup guide, pricing skill, and agents-and-team skill now say Starter includes 3 integrations (connected apps).
+
 - `hq meetings live` now also lists live meetings you were invited to but did not record, such as a standup a teammate's notetaker is recording, so you can read their live transcript.
 
 ## [5.345.52] — 2026-10-08

package/assets/bot-workers/setup/context/USER-GUIDE.md

@@ -323,7 +323,7 @@ HQ/
 HQ has three plans: **Starter**, **HQ Workforce** ($500/month per workspace), and
 **Enterprise**.
 
-Starter is free. It holds up to 5 members and includes 1 integration. MCP,
+Starter is free. It holds up to 5 members and includes 3 integrations. MCP,
 Atlas, and telemetry are not included. Everything else — knowledge, projects,
 policies, workers, secrets, vault storage, `hq deploy`, and `hq share` — works
 the same as on the paid plans.

package/assets/bot-workers/setup/skills/agents-and-team.md

@@ -29,7 +29,7 @@ Run `hq whoami` and `hq companies list`, and read the "Owner context" block.
 3. **Their plan, when the flow depends on it.** Check it as
    `skills/pricing.md` says; never guess it. Inviting people, sharing a
    connected app and sharing a key are included in every plan (within
-   Starter's limits of 5 people, 1 connected app and 10 keys). Hosted agents,
+   Starter's limits of 5 people, 3 connected apps and 10 keys). Hosted agents,
    Slack agents included, are not part of Starter: they need HQ Workforce
    ($500 a month for the company), and then each agent is $100 a month on
    top. If HQ refuses something or quotes a price, pass that answer on.

package/assets/bot-workers/setup/skills/pricing.md

@@ -36,7 +36,7 @@ often empty; when it is empty it tells you nothing about the plan.
 **Starter, free.** For a company getting started:
 
 - up to 5 people (invitations not yet accepted count toward the 5)
-- 1 connected app
+- 3 connected apps
 - 10 keys
 - 10 GB of files and 500 site deploys
 - no hosted agents (see "Agents" below)

package/dist/command-catalog.generated.d.ts

@@ -5144,6 +5144,62 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly subcommands: readonly [];
     }];
+}, {
+    readonly name: "import";
+    readonly description: "Import existing AI context (Claude Code, Codex, repos) into HQ";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly helpOption: true;
+    readonly helpCommand: true;
+    readonly usage: "[options] [command]";
+    readonly helpText: readonly [];
+    readonly arguments: readonly [];
+    readonly options: readonly [];
+    readonly subcommands: readonly [{
+        readonly name: "scan";
+        readonly description: "Scan this machine for AI context (sessions, repos, companies, projects); local only";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [{
+            readonly position: "after";
+            readonly text: "\nThe desktop app runs: hq import scan --json --stream\nEvents (v1): start, source, count, company, project, error, done. See docs/import-scan-stream.md.";
+        }];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "Print only the final done event as JSON";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--stream";
+            readonly description: "With --json, print every scan event as JSON Lines while scanning";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--hq-root <path>";
+            readonly description: "HQ folder (default: the folder the HQ installer recorded)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--output <path>";
+            readonly description: "Where to write report.json (default: <hq>/workspace/imports/<scan id>/report.json)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--scope <dir>";
+            readonly description: "Also scan this folder (repeatable)";
+            readonly hidden: false;
+            readonly defaultValue: readonly [];
+        }, {
+            readonly flags: "--claude-export <path>";
+            readonly description: "Include a claude.ai data export (unzipped folder or conversations.json)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--no-default-scopes";
+            readonly description: "Scan only --scope folders, not the default code folders";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }];
 }, {
     readonly name: "reindex";
     readonly description: "Surface namespaced skills, materialize legacy knowledge repos, regenerate the workers registry, and trust HQ hooks for Codex, Grok, and Claude Code";
@@ -10929,7 +10985,7 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly name: "lanes";
     readonly description: "Create, supervise, and steer worker lanes; routed decision queue";
     readonly aliases: readonly [];
-    readonly hidden: true;
+    readonly hidden: false;
     readonly helpOption: true;
     readonly helpCommand: true;
     readonly usage: "[options] [command]";
@@ -10937,6 +10993,22 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly arguments: readonly [];
     readonly options: readonly [];
     readonly subcommands: readonly [{
+        readonly name: "session-start";
+        readonly description: "Internal SessionStart bootstrap";
+        readonly aliases: readonly [];
+        readonly hidden: true;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "JSON on stdout (always)";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }, {
         readonly name: "checks";
         readonly description: "Evaluate tracker and lane health checks";
         readonly aliases: readonly [];
@@ -12184,7 +12256,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--engine <engine>";
-            readonly description: "claude | codex | grok; defaults to HQ_CONDUCT_ENGINE or claude";
+            readonly description: "claude | codex | grok; defaults to HQ_LANE_ENGINE (HQ_CONDUCT_ENGINE is deprecated) or claude";
             readonly hidden: false;
         }, {
             readonly flags: "--reminder";
@@ -13756,6 +13828,35 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly arguments: readonly [];
         readonly options: readonly [];
         readonly subcommands: readonly [{
+            readonly name: "conflicts";
+            readonly description: "Manage parked conflict copy notices";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: true;
+            readonly usage: "[options] [command]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [];
+            readonly subcommands: readonly [{
+                readonly name: "acknowledge";
+                readonly description: "Acknowledge a parked conflict copy notice";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly helpOption: true;
+                readonly helpCommand: false;
+                readonly usage: "[options] <noticeId>";
+                readonly helpText: readonly [];
+                readonly arguments: readonly [{
+                    readonly name: "noticeId";
+                    readonly required: true;
+                    readonly variadic: false;
+                    readonly description: "";
+                }];
+                readonly options: readonly [];
+                readonly subcommands: readonly [];
+            }];
+        }, {
             readonly name: "status";
             readonly description: "Show sync ownership, heartbeat, last pass and log path";
             readonly aliases: readonly [];

package/dist/command-catalog.generated.js

@@ -6253,6 +6253,75 @@ export const COMMAND_CATALOG = [
             }
         ]
     },
+    {
+        "name": "import",
+        "description": "Import existing AI context (Claude Code, Codex, repos) into HQ",
+        "aliases": [],
+        "hidden": false,
+        "helpOption": true,
+        "helpCommand": true,
+        "usage": "[options] [command]",
+        "helpText": [],
+        "arguments": [],
+        "options": [],
+        "subcommands": [
+            {
+                "name": "scan",
+                "description": "Scan this machine for AI context (sessions, repos, companies, projects); local only",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [
+                    {
+                        "position": "after",
+                        "text": "\nThe desktop app runs: hq import scan --json --stream\nEvents (v1): start, source, count, company, project, error, done. See docs/import-scan-stream.md."
+                    }
+                ],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "Print only the final done event as JSON",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--stream",
+                        "description": "With --json, print every scan event as JSON Lines while scanning",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--hq-root <path>",
+                        "description": "HQ folder (default: the folder the HQ installer recorded)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--output <path>",
+                        "description": "Where to write report.json (default: <hq>/workspace/imports/<scan id>/report.json)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--scope <dir>",
+                        "description": "Also scan this folder (repeatable)",
+                        "hidden": false,
+                        "defaultValue": []
+                    },
+                    {
+                        "flags": "--claude-export <path>",
+                        "description": "Include a claude.ai data export (unzipped folder or conversations.json)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--no-default-scopes",
+                        "description": "Scan only --scope folders, not the default code folders",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            }
+        ]
+    },
     {
         "name": "reindex",
         "description": "Surface namespaced skills, materialize legacy knowledge repos, regenerate the workers registry, and trust HQ hooks for Codex, Grok, and Claude Code",
@@ -13278,7 +13347,7 @@ export const COMMAND_CATALOG = [
         "name": "lanes",
         "description": "Create, supervise, and steer worker lanes; routed decision queue",
         "aliases": [],
-        "hidden": true,
+        "hidden": false,
         "helpOption": true,
         "helpCommand": true,
         "usage": "[options] [command]",
@@ -13286,6 +13355,25 @@ export const COMMAND_CATALOG = [
         "arguments": [],
         "options": [],
         "subcommands": [
+            {
+                "name": "session-start",
+                "description": "Internal SessionStart bootstrap",
+                "aliases": [],
+                "hidden": true,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "JSON on stdout (always)",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "checks",
                 "description": "Evaluate tracker and lane health checks",
@@ -14811,7 +14899,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--engine <engine>",
-                        "description": "claude | codex | grok; defaults to HQ_CONDUCT_ENGINE or claude",
+                        "description": "claude | codex | grok; defaults to HQ_LANE_ENGINE (HQ_CONDUCT_ENGINE is deprecated) or claude",
                         "hidden": false
                     },
                     {
@@ -16736,6 +16824,40 @@ export const COMMAND_CATALOG = [
                 "arguments": [],
                 "options": [],
                 "subcommands": [
+                    {
+                        "name": "conflicts",
+                        "description": "Manage parked conflict copy notices",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": true,
+                        "usage": "[options] [command]",
+                        "helpText": [],
+                        "arguments": [],
+                        "options": [],
+                        "subcommands": [
+                            {
+                                "name": "acknowledge",
+                                "description": "Acknowledge a parked conflict copy notice",
+                                "aliases": [],
+                                "hidden": false,
+                                "helpOption": true,
+                                "helpCommand": false,
+                                "usage": "[options] <noticeId>",
+                                "helpText": [],
+                                "arguments": [
+                                    {
+                                        "name": "noticeId",
+                                        "required": true,
+                                        "variadic": false,
+                                        "description": ""
+                                    }
+                                ],
+                                "options": [],
+                                "subcommands": []
+                            }
+                        ]
+                    },
                     {
                         "name": "status",
                         "description": "Show sync ownership, heartbeat, last pass and log path",

package/dist/command-registration-plan.d.ts

@@ -346,6 +346,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "program";
     readonly module: "./commands/integrations.js";
     readonly exportName: "registerIntegrationsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "import";
+    readonly parent: "program";
+    readonly module: "./commands/import-scan.js";
+    readonly exportName: "registerImportCommand";
 }, {
     readonly type: "registrar";
     readonly root: "reindex";
@@ -442,7 +448,6 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "program";
     readonly module: "./commands/lanes.js";
     readonly exportName: "registerLanesCommand";
-    readonly hidden: true;
 }, {
     readonly type: "registrar";
     readonly root: "monitor";

package/dist/command-registration-plan.js

@@ -60,6 +60,7 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "sources", parent: "program", module: "./commands/sources.js", exportName: "registerSourcesCommand" },
     { type: "registrar", root: "signals", parent: "program", module: "./commands/signals.js", exportName: "registerSignalsCommand" },
     { type: "registrar", root: "integrations", parent: "program", module: "./commands/integrations.js", exportName: "registerIntegrationsCommand" },
+    { type: "registrar", root: "import", parent: "program", module: "./commands/import-scan.js", exportName: "registerImportCommand" },
     { type: "registrar", root: "reindex", parent: "program", module: "./commands/reindex.js", exportName: "registerReindexCommand" },
     { type: "registrar", root: "rescue", parent: "program", module: "./commands/rescue.js", exportName: "registerRescueCommand" },
     { type: "registrar", root: "mcp", parent: "program", module: "./commands/mcp-status.js", exportName: "registerMcpCommand" },
@@ -75,7 +76,7 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "index", parent: "program", module: "./commands/index-cmd.js", exportName: "registerIndexCommand" },
     { type: "registrar", root: "doctor", parent: "program", module: "./commands/doctor.js", exportName: "registerDoctorCommand" },
     { type: "registrar", root: "mesh", parent: "program", module: "./commands/mesh.js", exportName: "registerMeshCommand" },
-    { type: "registrar", root: "lanes", parent: "program", module: "./commands/lanes.js", exportName: "registerLanesCommand", hidden: true },
+    { type: "registrar", root: "lanes", parent: "program", module: "./commands/lanes.js", exportName: "registerLanesCommand" },
     { type: "registrar", root: "monitor", parent: "program", module: "./commands/monitor.js", exportName: "registerMonitorCommand" },
     { type: "registrar", root: "daemon", parent: "program", module: "./commands/daemon.js", exportName: "registerDaemonCommand", hidden: true },
     { type: "registrar", root: "bot", parent: "program", module: "./commands/bot.js", exportName: "registerBotCommand" },

package/dist/commands/cloud.d.ts

@@ -65,7 +65,10 @@ export declare function withSyncHealthReport<T>(run: () => Promise<T>): Promise<
  * nothing was scope-excluded. Keeping this pure makes the "never silently
  * succeed when files were dropped" guarantee unit-testable.
  */
+export declare function scopeExcludedExitCode(count: number): 0 | 1;
 export declare function scopeExcludedWarning(count: number): string | null;
+/** Actionable recovery for files refused because the vault baseline is stale. */
+export declare function staleUploadRefusalLines(count: number, paths?: readonly string[]): string[];
 /**
  * Optional detail line listing the effective write prefixes when a push
  * dropped files — helps debug ACL vs scope-excluded mismatches (feedback_7e9c535e).
@@ -231,6 +234,8 @@ export interface ShareCallResult {
     filesSkipped: number;
     filesDeleted: number;
     filesExcludedByScope: number;
+    filesRefusedStale?: number;
+    filesRefusedStalePaths?: string[];
     conflictPaths: string[];
     aborted: boolean;
     /** Files this leg's plan limit refused; absent or null when none were. */
@@ -272,6 +277,8 @@ export interface PushAllResult {
     bytesUploaded: number;
     filesDeleted: number;
     filesExcludedByScope: number;
+    filesRefusedStale?: number;
+    filesRefusedStalePaths?: string[];
     errors: Array<{
         company: string;
         message: string;

package/dist/commands/cloud.js

@@ -139,6 +139,9 @@ export async function withSyncHealthReport(run) {
  * nothing was scope-excluded. Keeping this pure makes the "never silently
  * succeed when files were dropped" guarantee unit-testable.
  */
+export function scopeExcludedExitCode(count) {
+    return count > 0 ? 1 : 0;
+}
 export function scopeExcludedWarning(count) {
     if (count <= 0)
         return null;
@@ -147,6 +150,19 @@ export function scopeExcludedWarning(count) {
         `They were skipped, not synced. Re-run with --json to list them, or ` +
         `ask an admin to grant you write on those paths.`);
 }
+/** Actionable recovery for files refused because the vault baseline is stale. */
+export function staleUploadRefusalLines(count, paths = []) {
+    if (count <= 0)
+        return [];
+    const lines = [
+        `⚠ ${count} file(s) were NOT uploaded because the vault copy changed after your edit. ` +
+            `Pull the current vault copy, merge your edit, and push again.`,
+    ];
+    if (paths.length > 0) {
+        lines.push("  Not uploaded:", ...paths.map((filePath) => `  - ${filePath}`));
+    }
+    return lines;
+}
 /**
  * Optional detail line listing the effective write prefixes when a push
  * dropped files — helps debug ACL vs scope-excluded mismatches (feedback_7e9c535e).
@@ -176,7 +192,7 @@ export function scopeExcludedLines(count, prefixSet) {
             `⚠ ${count} file(s) were NOT uploaded — the server refused them. ` +
                 `A common cause is a file someone else created in a private folder ` +
                 `(foo/): only its creator can change it. They were skipped, not ` +
-                `synced. Re-run with --json to list them.`,
+                `synced. Re-run with --json to list them, or ask its creator to grant access.`,
         ];
     }
     const lines = [scopeExcludedWarning(count)];
@@ -527,6 +543,12 @@ export async function pushAll(options, deps) {
             result.bytesUploaded += r.bytesUploaded;
             result.filesDeleted += r.filesDeleted;
             result.filesExcludedByScope += r.filesExcludedByScope;
+            if ((r.filesRefusedStale ?? 0) > 0) {
+                result.filesRefusedStale =
+                    (result.filesRefusedStale ?? 0) + (r.filesRefusedStale ?? 0);
+                result.filesRefusedStalePaths ??= [];
+                result.filesRefusedStalePaths.push(...(r.filesRefusedStalePaths ?? []));
+            }
             result.perCompany.push({
                 slug: entry.slug,
                 result: r,
@@ -977,6 +999,17 @@ export function registerCloudCommands(program) {
                 ...(pushPrefixSet !== undefined ? { prefixSet: pushPrefixSet } : {}),
             });
             const planLimitRefused = planLimitTracker.summary();
+            const staleRefusalCount = result.filesRefusedStale ?? 0;
+            const refusalRecovery = [
+                result.filesExcludedByScope > 0
+                    ? "Check write access for the refused path; ask its creator or a company admin to grant access."
+                    : null,
+                staleRefusalCount > 0
+                    ? "Pull the current vault copy, merge your edit, and push again."
+                    : null,
+            ]
+                .filter((message) => message !== null)
+                .join(" ");
             if (jsonMode) {
                 // Synthetic terminal event so subprocess consumers can read final
                 // counts without summing per-file events. Distinguished from
@@ -991,6 +1024,10 @@ export function registerCloudCommands(program) {
                     filesSkipped: result.filesSkipped,
                     conflictPaths: result.conflictPaths,
                     aborted: result.aborted,
+                    filesExcludedByScope: result.filesExcludedByScope,
+                    filesRefusedStale: staleRefusalCount,
+                    filesRefusedStalePaths: result.filesRefusedStalePaths ?? [],
+                    ...(refusalRecovery ? { refusalRecovery } : {}),
                     ...(planLimitRefused ? { planLimitRefused } : {}),
                 });
             }
@@ -1019,22 +1056,32 @@ export function registerCloudCommands(program) {
                 for (const line of scopeExcludedLines(result.filesExcludedByScope, pushPrefixSet)) {
                     log(chalk.yellow(line));
                 }
+                for (const line of staleUploadRefusalLines(result.filesRefusedStale ?? 0, result.filesRefusedStalePaths)) {
+                    log(chalk.yellow(line));
+                }
                 await syncHealth.succeeded();
-                if (!jsonMode)
-                    process.exit(1);
+                process.exit(1);
                 return;
             }
-            if (result.filesExcludedByScope > 0) {
+            if (result.filesExcludedByScope > 0 || staleRefusalCount > 0) {
                 log(chalk.yellow(`\n⚠ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ` +
-                    `${result.filesSkipped} skipped, ${result.filesExcludedByScope} scope-excluded)`));
+                    `${result.filesSkipped} skipped, ${result.filesExcludedByScope + staleRefusalCount} files not uploaded)`));
                 for (const line of scopeExcludedLines(result.filesExcludedByScope, pushPrefixSet)) {
                     log(chalk.yellow(line));
                 }
+                for (const line of staleUploadRefusalLines(staleRefusalCount, result.filesRefusedStalePaths)) {
+                    log(chalk.yellow(line));
+                }
             }
             else {
                 log(chalk.green(`\n✓ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ${result.filesSkipped} skipped)`));
             }
             await syncHealth.succeeded();
+            const exitCode = scopeExcludedExitCode(result.filesExcludedByScope + staleRefusalCount);
+            if (exitCode !== 0) {
+                process.exit(exitCode);
+                return;
+            }
         }
         catch (err) {
             if (syncHealth)
@@ -1630,13 +1677,13 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal) {
         else if (row.result) {
             const r = row.result;
             const legRefused = r.planLimit ?? null;
-            const status = r.aborted || r.filesExcludedByScope > 0 || legRefused
+            const status = r.aborted || r.filesExcludedByScope > 0 || (r.filesRefusedStale ?? 0) > 0 || legRefused
                 ? chalk.yellow("⚠")
                 : chalk.green("✓");
             console.log(`  ${status} ${row.slug}: ${r.filesUploaded} file(s), ` +
                 `${formatBytes(r.bytesUploaded)}, ${r.filesSkipped} skipped, ` +
                 `${r.filesDeleted} deleted, ${r.filesExcludedByScope} scope-excluded, ` +
-                `${r.conflictPaths.length} conflict(s)` +
+                `${r.filesRefusedStale ?? 0} stale-refused, ${r.conflictPaths.length} conflict(s)` +
                 (r.aborted ? " — aborted" : "") +
                 (legRefused
                     ? ` — ${describeRefusedCount(legRefused)} refused by plan limit`
@@ -1652,7 +1699,8 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal) {
     const summary = `\nPushed ${result.filesUploaded} file(s) ` +
         `(${formatBytes(result.bytesUploaded)}) across ${result.attempted} ` +
         `target(s); ${result.filesDeleted} deleted; ${errored} error(s); ` +
-        `${result.filesExcludedByScope} scope-excluded` +
+        `${result.filesExcludedByScope} scope-excluded; ` +
+        `${result.filesRefusedStale ?? 0} stale-refused` +
         (refusedTargets > 0
             ? `; new files refused by a plan limit on ${refusedTargets} target(s)`
             : "");
@@ -1673,10 +1721,24 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal) {
         for (const line of scopeExcludedLines(excluded, row.prefixSet)) {
             console.log(chalk.yellow(`${row.slug}: ${line}`));
         }
+        const staleCount = row.result?.filesRefusedStale ?? 0;
+        for (const line of staleUploadRefusalLines(staleCount, row.result?.filesRefusedStalePaths)) {
+            console.log(chalk.yellow(`${row.slug}: ${line}`));
+        }
     }
     if (errored > 0)
         throw new SyncExitError(1);
-    return refused;
+    const refusalSummary = {
+        planLimitRefused: refused,
+        filesExcludedByScope: result.filesExcludedByScope,
+        filesRefusedStale: result.filesRefusedStale ?? 0,
+        filesRefusedStalePaths: [...new Set(result.filesRefusedStalePaths ?? [])],
+    };
+    return (refusalSummary.planLimitRefused ||
+        refusalSummary.filesExcludedByScope > 0 ||
+        refusalSummary.filesRefusedStale > 0
+        ? refusalSummary
+        : null);
 }
 async function runNowSingle(hqRoot, company, personal, message, onConflict, modeAllOverride, forceScopeShrink) {
     console.log(chalk.bold("\nHQ Sync — Now"));
@@ -1763,7 +1825,10 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
             ...(nowPushPrefixSet !== undefined ? { prefixSet: nowPushPrefixSet } : {}),
         });
         const pushRefused = planLimitTracker.summary();
-        const pushStatus = pushResult.aborted || pushResult.filesExcludedByScope > 0 || pushRefused
+        const pushStatus = pushResult.aborted ||
+            pushResult.filesExcludedByScope > 0 ||
+            (pushResult.filesRefusedStale ?? 0) > 0 ||
+            pushRefused
             ? chalk.yellow("⚠")
             : chalk.green("✓");
         console.log(`    ${pushStatus} ` +
@@ -1780,6 +1845,9 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
                 console.log(chalk.yellow(line));
             }
         }
+        for (const line of staleUploadRefusalLines(pushResult.filesRefusedStale ?? 0, pushResult.filesRefusedStalePaths)) {
+            console.log(chalk.yellow(line));
+        }
         if (pushResult.aborted) {
             console.log(chalk.yellow("\n⚠ Sync now aborted on push leg; pull skipped."));
             throw new SyncExitError(1);
@@ -1900,6 +1968,11 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
                 "refused by your plan limit (listed above)."));
             throw new SyncExitError(1, { health: "succeeded" });
         }
+        if (pushResult.filesExcludedByScope > 0 ||
+            (pushResult.filesRefusedStale ?? 0) > 0) {
+            console.log(chalk.yellow("\n⚠ Sync now finished, but one or more requested uploads were refused."));
+            throw new SyncExitError(1, { health: "succeeded" });
+        }
         console.log(chalk.green("\n✓ Sync now complete"));
         if (!personalMode &&
             nudgeResolvedCompanyUid &&
@@ -1943,13 +2016,16 @@ async function runNowAll(hqRoot, message, onConflict, modeAllOverride, skipPerso
     // pull-side).
     await runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, forceScopeShrink);
     if (refused) {
-        // A plan-limit refusal does not stop the pull, but the run must not end
-        // looking like a clean sync: say so last and exit non-zero.
-        console.log(chalk.yellow(`\n⚠ Sync finished, but ${describeRefusedFiles(refused)} refused ` +
-            "by your plan limit (listed under push --all above)."));
-        if (refused.upgradeUrl) {
-            console.log(chalk.yellow(`  Upgrade: ${refused.upgradeUrl}`));
+        // A refused push does not stop the pull, but the run must not end looking
+        // like a clean sync. Its per-target details were printed above.
+        if (refused.planLimitRefused) {
+            console.log(chalk.yellow(`\n⚠ Sync finished, but ${describeRefusedFiles(refused.planLimitRefused)} refused ` +
+                "by your plan limit (listed under push --all above)."));
+            if (refused.planLimitRefused.upgradeUrl) {
+                console.log(chalk.yellow(`  Upgrade: ${refused.planLimitRefused.upgradeUrl}`));
+            }
         }
+        console.log(chalk.yellow("\n⚠ Sync finished, but one or more requested uploads were refused."));
         throw new SyncExitError(1, { health: "succeeded" });
     }
 }