@indigoai-us/hq-cloud 6.14.41 → 6.14.43

package/dist/lib/net-errors.d.ts

@@ -2,9 +2,10 @@
  * Transient network-failure classification for the sync runner.
  *
  * The auto-sync watcher runs an unattended poll loop. At the top of every pass
- * it calls `GET /membership/me` to resolve which companies to sync. When the
- * machine is briefly offline (wifi drop, waking from sleep, a DNS blip, the
- * vault API momentarily unreachable) that call fails at the transport layer —
+ * it calls `GET /membership/me` to resolve which companies to sync, then it
+ * runs a per-company fanout. When the machine is briefly offline (wifi drop,
+ * waking from sleep, a DNS blip, the vault API or a vault S3 endpoint
+ * momentarily unreachable), either boundary can fail at the transport layer —
  * Node's `fetch` throws `TypeError: fetch failed` with the real cause (an
  * `ECONNREFUSED` / `ENOTFOUND` / `ETIMEDOUT` / … Error) on `.cause`.
  *
@@ -12,9 +13,11 @@
  * back. But the runner used to `return 1` for it, the watch loop propagated
  * that non-zero exit, the process exited, and the menubar supervisor reported
  * "auto-sync watcher exited unexpectedly (code=Some(1))" for every blip — the
- * HQ-SYNC-1W cluster. We classify these so the watch loop can stay alive and
- * retry instead of surfacing a false crash, while a one-shot `hq sync` still
- * exits non-zero so a human running it by hand sees the failure.
+ * HQ-SYNC-1W cluster. A company-leg failure was also previously counted as an
+ * exit-2 partial sync, producing the HQ-SYNC-X symptom even though it was just
+ * retryable DNS/transport loss. We classify both boundaries so the watch loop
+ * can stay alive and retry instead of surfacing a false crash, while a one-shot
+ * `hq sync` still exits non-zero so a human running it by hand sees the failure.
  */
 /**
  * Distinct runner exit code for a transient network failure. The watch loop

package/dist/lib/net-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"net-errors.d.ts","sourceRoot":"","sources":["../../src/lib/net-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AA0BzC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAsBxE"}
+{"version":3,"file":"net-errors.d.ts","sourceRoot":"","sources":["../../src/lib/net-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AA0BzC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAsBxE"}

package/dist/lib/net-errors.js

@@ -2,9 +2,10 @@
  * Transient network-failure classification for the sync runner.
  *
  * The auto-sync watcher runs an unattended poll loop. At the top of every pass
- * it calls `GET /membership/me` to resolve which companies to sync. When the
- * machine is briefly offline (wifi drop, waking from sleep, a DNS blip, the
- * vault API momentarily unreachable) that call fails at the transport layer —
+ * it calls `GET /membership/me` to resolve which companies to sync, then it
+ * runs a per-company fanout. When the machine is briefly offline (wifi drop,
+ * waking from sleep, a DNS blip, the vault API or a vault S3 endpoint
+ * momentarily unreachable), either boundary can fail at the transport layer —
  * Node's `fetch` throws `TypeError: fetch failed` with the real cause (an
  * `ECONNREFUSED` / `ENOTFOUND` / `ETIMEDOUT` / … Error) on `.cause`.
  *
@@ -12,9 +13,11 @@
  * back. But the runner used to `return 1` for it, the watch loop propagated
  * that non-zero exit, the process exited, and the menubar supervisor reported
  * "auto-sync watcher exited unexpectedly (code=Some(1))" for every blip — the
- * HQ-SYNC-1W cluster. We classify these so the watch loop can stay alive and
- * retry instead of surfacing a false crash, while a one-shot `hq sync` still
- * exits non-zero so a human running it by hand sees the failure.
+ * HQ-SYNC-1W cluster. A company-leg failure was also previously counted as an
+ * exit-2 partial sync, producing the HQ-SYNC-X symptom even though it was just
+ * retryable DNS/transport loss. We classify both boundaries so the watch loop
+ * can stay alive and retry instead of surfacing a false crash, while a one-shot
+ * `hq sync` still exits non-zero so a human running it by hand sees the failure.
  */
 /**
  * Distinct runner exit code for a transient network failure. The watch loop

package/dist/lib/net-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"net-errors.js","sourceRoot":"","sources":["../../src/lib/net-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;IACtC,cAAc;IACd,YAAY;IACZ,WAAW;IACX,WAAW;IACX,WAAW;IACX,OAAO;IACP,cAAc;IACd,WAAW;IACX,aAAa;IACb,UAAU;IACV,cAAc;IACd,uCAAuC;IACvC,yBAAyB;IACzB,yBAAyB;IACzB,sBAAsB;IACtB,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC;IAC7D,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvD,+DAA+D;IAC/D,IAAI,GAAG,CAAC,OAAO,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,4EAA4E;IAC5E,MAAM,UAAU,GAAI,GAA4B,CAAC,MAAM,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,uBAAuB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAI,GAA2B,CAAC,KAAK,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QACzC,OAAO,uBAAuB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"net-errors.js","sourceRoot":"","sources":["../../src/lib/net-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;IACtC,cAAc;IACd,YAAY;IACZ,WAAW;IACX,WAAW;IACX,WAAW;IACX,OAAO;IACP,cAAc;IACd,WAAW;IACX,aAAa;IACb,UAAU;IACV,cAAc;IACd,uCAAuC;IACvC,yBAAyB;IACzB,yBAAyB;IACzB,sBAAsB;IACtB,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC;IAC7D,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvD,+DAA+D;IAC/D,IAAI,GAAG,CAAC,OAAO,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,4EAA4E;IAC5E,MAAM,UAAU,GAAI,GAA4B,CAAC,MAAM,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,uBAAuB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAI,GAA2B,CAAC,KAAK,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QACzC,OAAO,uBAAuB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/net-errors.test.js

@@ -6,7 +6,7 @@ describe("isTransientNetworkError", () => {
         // (HQ-SYNC-1W): `{"type":"error","message":"fetch failed","path":"(discovery)"}`.
         expect(isTransientNetworkError(new TypeError("fetch failed"))).toBe(true);
     });
-    it("treats known transport `.code`s as transient", () => {
+    it("treats direct transport `.code`s as transient", () => {
         for (const code of ["ECONNREFUSED", "ENOTFOUND", "EAI_AGAIN", "ETIMEDOUT"]) {
             const err = Object.assign(new Error("boom"), { code });
             expect(isTransientNetworkError(err)).toBe(true);
@@ -19,6 +19,14 @@ describe("isTransientNetworkError", () => {
         const err = Object.assign(new TypeError("fetch failed"), { cause });
         expect(isTransientNetworkError(err)).toBe(true);
     });
+    it("walks an AWS SDK UnknownError cause chain to the underlying DNS error", () => {
+        const cause = Object.assign(new Error("getaddrinfo ENOTFOUND hq-vault-prs-test.s3.us-east-1.amazonaws.com"), { code: "ENOTFOUND", syscall: "getaddrinfo" });
+        const err = Object.assign(new Error("UnknownError"), {
+            name: "UnknownError",
+            cause,
+        });
+        expect(isTransientNetworkError(err)).toBe(true);
+    });
     it("walks AggregateError.errors (happy-eyeballs)", () => {
         const agg = Object.assign(new AggregateError([
             Object.assign(new Error("v4"), { code: "ECONNREFUSED" }),

package/dist/lib/net-errors.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"net-errors.test.js","sourceRoot":"","sources":["../../src/lib/net-errors.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAElF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,yEAAyE;QACzE,kFAAkF;QAClF,MAAM,CAAC,uBAAuB,CAAC,IAAI,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,EAAE;YAClE,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;SACzD,EAAE,qBAAqB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,CAAC,uBAAuB,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,uBAAuB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAgC,CAAC;QAC9D,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC;QAChB,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"net-errors.test.js","sourceRoot":"","sources":["../../src/lib/net-errors.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAElF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,yEAAyE;QACzE,kFAAkF;QAClF,MAAM,CAAC,uBAAuB,CAAC,IAAI,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,EAAE;YAClE,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CACzB,IAAI,KAAK,CAAC,oEAAoE,CAAC,EAC/E,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,CAC9C,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE;YACnD,IAAI,EAAE,cAAc;YACpB,KAAK;SACN,CAAC,CAAC;QACH,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;SACzD,EAAE,qBAAqB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,CAAC,uBAAuB,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,uBAAuB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAgC,CAAC;QAC9D,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC;QAChB,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cloud",
-  "version": "6.14.41",
+  "version": "6.14.43",
   "description": "HQ by Indigo cloud sync engine — bidirectional S3 sync for mobile access",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/bin/sync-runner-company.ts

@@ -22,6 +22,7 @@ import {
   type ScopePrefixInput,
 } from "../prefix-coalesce.js";
 import { describeError } from "../lib/describe-error.js";
+import { isTransientNetworkError } from "../lib/net-errors.js";
 import { VaultAuthError } from "../vault-client.js";
 import type {
   DeletePropagationPolicy,
@@ -39,6 +40,7 @@ export interface CompanyFanoutResult {
   stateByCompany: Map<string, CompanyState>;
   errors: Array<{ company: string; message: string }>;
   companyFailures: Array<{ company: string; message: string }>;
+  transientCompanies: Array<{ company: string; message: string }>;
   meaningfulOutcomeCount: number;
   allConflicts: Array<{
     company: string;
@@ -78,6 +80,7 @@ export async function executeCompanyFanout(options: {
     options.direction === "pull" || options.direction === "both";
   const errors: Array<{ company: string; message: string }> = [];
   const companyFailures: Array<{ company: string; message: string }> = [];
+  const transientCompanies: Array<{ company: string; message: string }> = [];
   const allConflicts: Array<{
     company: string;
     path: string;
@@ -489,8 +492,18 @@ export async function executeCompanyFanout(options: {
       // session and emit one auth-error event for manual and watch consumers.
       if (err instanceof VaultAuthError) throw err;
       const message = describeError(err);
-      errors.push({ company: companyLabel, message });
-      companyFailures.push({ company: companyLabel, message });
+      const transientNetwork = isTransientNetworkError(err);
+      // A prior path-level error is deterministic and must continue to win in
+      // the all-complete status and telemetry even if the leg later encounters
+      // a retryable transport failure.
+      const transientOnly = transientNetwork && !companyHadTransferError;
+      if (transientNetwork) {
+        transientCompanies.push({ company: companyLabel, message });
+        if (transientOnly) state.status = "transient-network";
+      } else {
+        errors.push({ company: companyLabel, message });
+        companyFailures.push({ company: companyLabel, message });
+      }
       meaningfulOutcomeCount += 1;
       options.emit({
         type: "complete",
@@ -514,12 +527,25 @@ export async function executeCompanyFanout(options: {
         scopeOrphansBlocked: 0,
         changedPaths: [],
       });
-      options.emit({
-        type: "error",
-        company: companyLabel,
-        path: "(company)",
-        message,
-      });
+      if (transientNetwork) {
+        // This is deliberately not an error event: a retryable transport blip
+        // must remain visible without being miscounted as a deterministic
+        // company failure (and therefore an exit-2/Sentry error). The complete
+        // event above still reports aborted:true and the pass exits 75.
+        options.emit({
+          type: "transient-network",
+          company: companyLabel,
+          path: "(company)",
+          message,
+        });
+      } else {
+        options.emit({
+          type: "error",
+          company: companyLabel,
+          path: "(company)",
+          message,
+        });
+      }
       void emitCloudTelemetry(
         options.telemetryClient,
         {
@@ -531,7 +557,7 @@ export async function executeCompanyFanout(options: {
             : {}),
           properties: {
             direction: options.direction,
-            status: "errored",
+            status: transientOnly ? "transient-network" : "errored",
             filesDownloaded: state.filesDownloaded,
             bytesDownloaded: state.bytesDownloaded,
             filesUploaded: state.filesUploaded,
@@ -554,6 +580,7 @@ export async function executeCompanyFanout(options: {
     stateByCompany,
     errors,
     companyFailures,
+    transientCompanies,
     meaningfulOutcomeCount,
     allConflicts,
     pushPathResults,

package/src/bin/sync-runner-rollup.ts

@@ -1,7 +1,7 @@
 import type { RunnerEvent } from "./sync-runner.js";
 import type { RunnerTarget } from "./sync-runner-planning.js";
 
-export type CompanyStatus = "complete" | "aborted" | "errored";
+export type CompanyStatus = "complete" | "aborted" | "errored" | "transient-network";
 
 export interface CompanyState {
   company: string;

package/src/bin/sync-runner.test.ts

@@ -1875,17 +1875,12 @@ describe("per-company fanout", () => {
   });
 
   /**
-   * Regression test: AWS SDK v3 raises an opaque `UnknownError` (name and
-   * message both literally "UnknownError") when it cannot match a Node-side
-   * networking failure to a modeled exception. The actual root cause —
-   * ENOTFOUND from a stale DNS cache, ECONNRESET on a flapping link, etc. —
-   * is parked on `err.cause`. Pre-fix the per-company catch extracted only
-   * `err.message`, so an unactionable bare "UnknownError" reached operators
-   * and the underlying syscall/hostname were lost. The catch now runs the
-   * thrown value through `describeError`, which walks the cause chain and
-   * stitches a one-line diagnostic the operator can act on.
+   * AWS SDK v3 can wrap a Node-side DNS error in an opaque `UnknownError`.
+   * The cause-chain classifier must treat this exactly like the direct
+   * ENOTFOUND shape from HQ-SYNC-X: visible and retryable, never an exit-2
+   * company error.
    */
-  it("per-company error event surfaces cause-chain (ENOTFOUND from SDK UnknownError)", async () => {
+  it("classifies an SDK UnknownError whose cause is ENOTFOUND as transient (HQ-SYNC-X)", async () => {
     const deps = makeDeps({
       createVaultClient: () =>
         makeVaultStub({
@@ -1914,22 +1909,173 @@ describe("per-company fanout", () => {
     });
 
     const code = await runRunner(["--companies"], deps);
-    expect(code).toBe(2);
+    expect(code).toBe(TRANSIENT_NETWORK_EXIT);
 
-    const companyErr = deps.stderr
+    expect(
+      deps.stderr
+        .events()
+        .some((e) => e.type === "error" && e.company === "privy"),
+    ).toBe(false);
+    const transient = deps.stdout
       .events()
-      .find(
+      .find((e) => (e as { type: string }).type === "transient-network") as
+      | { company: string; path: string; message: string }
+      | undefined;
+    expect(transient).toMatchObject({
+      company: "privy",
+      path: "(company)",
+    });
+    expect(transient?.message).toContain("UnknownError");
+    expect(transient?.message).toContain("ENOTFOUND");
+    expect(transient?.message).toContain("getaddrinfo");
+    expect(transient?.message).toContain("privy.s3.us-east-1.amazonaws.com");
+  });
+
+  it("returns 75, preserves the aborted complete event, and reports a direct ENOTFOUND leg as transient", async () => {
+    const transportError = Object.assign(
+      new Error("getaddrinfo ENOTFOUND hq-vault-prs-test.s3.us-east-1.amazonaws.com"),
+      { code: "ENOTFOUND" },
+    );
+    const deps = makeDeps({
+      createVaultClient: () =>
+        makeVaultStub({
+          memberships: [{ companyUid: "cmp_acme" }],
+          entityGet: (uid: string) =>
+            Promise.resolve({ uid, slug: "acme" } as unknown as EntityInfo),
+        }),
+      sync: vi.fn().mockRejectedValue(transportError),
+    });
+
+    const code = await runRunner(["--companies"], deps);
+
+    expect(code).toBe(TRANSIENT_NETWORK_EXIT);
+    expect(
+      deps.stderr
+        .events()
+        .some((e) => e.type === "error" && e.path === "(company)"),
+    ).toBe(false);
+    expect(
+      deps.stdout.events().find(
+        (e) => (e as { type: string }).type === "transient-network",
+      ),
+    ).toMatchObject({
+      company: "acme",
+      path: "(company)",
+      message: expect.stringContaining("code=ENOTFOUND"),
+    });
+    expect(
+      deps.stdout.events().find(
+        (e): e is Extract<RunnerEvent, { type: "complete" }> =>
+          e.type === "complete" && e.company === "acme",
+      ),
+    ).toMatchObject({ aborted: true });
+    const all = deps.stdout
+      .events()
+      .find((e) => e.type === "all-complete") as {
+      errors: Array<{ company: string; message: string }>;
+      transient?: Array<{ company: string; message: string }>;
+      companies: Array<{ company: string; status: string }>;
+    };
+    expect(all.errors).toEqual([]);
+    expect(all.transient).toEqual([
+      {
+        company: "acme",
+        message: expect.stringContaining("code=ENOTFOUND"),
+      },
+    ]);
+    expect(all.companies).toEqual([
+      expect.objectContaining({ company: "acme", status: "transient-network" }),
+    ]);
+  });
+
+  it("keeps deterministic company failures as exit 2 errors", async () => {
+    const deps = makeDeps({
+      createVaultClient: () =>
+        makeVaultStub({
+          memberships: [{ companyUid: "cmp_acme" }],
+          entityGet: (uid: string) =>
+            Promise.resolve({ uid, slug: "acme" } as unknown as EntityInfo),
+        }),
+      sync: vi.fn().mockRejectedValue(new Error("AccessDenied: forbidden")),
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(PARTIAL_SYNC_EXIT);
+    expect(
+      deps.stderr.events().find(
         (e): e is Extract<RunnerEvent, { type: "error" }> =>
-          e.type === "error" && e.company === "privy",
-      );
-    expect(companyErr).toBeDefined();
-    expect(companyErr?.path).toBe("(company)");
-    // The diagnostic must carry the original networking signal — without
-    // this the operator only sees "UnknownError" and the run is unactionable.
-    expect(companyErr?.message).toContain("UnknownError");
-    expect(companyErr?.message).toContain("ENOTFOUND");
-    expect(companyErr?.message).toContain("getaddrinfo");
-    expect(companyErr?.message).toContain("privy.s3.us-east-1.amazonaws.com");
+          e.type === "error" && e.company === "acme" && e.path === "(company)",
+      ),
+    ).toBeDefined();
+    expect(
+      deps.stdout
+        .events()
+        .some((e) => (e as { type: string }).type === "transient-network"),
+    ).toBe(false);
+  });
+
+  it("lets a real company error win over a transient company leg", async () => {
+    const dnsError = Object.assign(new Error("getaddrinfo ENOTFOUND vault"), {
+      code: "ENOTFOUND",
+    });
+    const slugs: Record<string, string> = { cmp_acme: "acme", cmp_beta: "beta" };
+    const deps = makeDeps({
+      createVaultClient: () =>
+        makeVaultStub({
+          memberships: [{ companyUid: "cmp_acme" }, { companyUid: "cmp_beta" }],
+          entityGet: (uid: string) =>
+            Promise.resolve({ uid, slug: slugs[uid] ?? uid } as unknown as EntityInfo),
+        }),
+      sync: vi
+        .fn<(opts: SyncOptions) => Promise<SyncResult>>()
+        .mockRejectedValueOnce(dnsError)
+        .mockRejectedValueOnce(new Error("AccessDenied: forbidden")),
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(PARTIAL_SYNC_EXIT);
+    expect(
+      deps.stdout
+        .events()
+        .filter((e) => (e as { type: string }).type === "transient-network"),
+    ).toHaveLength(1);
+    expect(
+      deps.stderr
+        .events()
+        .filter((e) => e.type === "error" && e.path === "(company)"),
+    ).toHaveLength(1);
+  });
+
+  it("keeps a leg errored when a path error precedes a transient throw", async () => {
+    const dnsError = Object.assign(new Error("getaddrinfo ENOTFOUND vault"), {
+      code: "ENOTFOUND",
+    });
+    const deps = makeDeps({
+      createVaultClient: () =>
+        makeVaultStub({
+          memberships: [{ companyUid: "cmp_acme" }],
+          entityGet: (uid: string) =>
+            Promise.resolve({ uid, slug: "acme" } as unknown as EntityInfo),
+        }),
+      sync: vi.fn().mockImplementation(async (opts: SyncOptions) => {
+        opts.onEvent?.({
+          type: "error",
+          path: "locked.md",
+          message: "AccessDenied: forbidden",
+        });
+        throw dnsError;
+      }),
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(PARTIAL_SYNC_EXIT);
+    const all = deps.stdout
+      .events()
+      .find((event) => event.type === "all-complete") as {
+      transient: Array<{ company: string }>;
+      companies: Array<{ company: string; status: string }>;
+    };
+    expect(all.transient).toEqual([expect.objectContaining({ company: "acme" })]);
+    expect(all.companies).toEqual([
+      expect.objectContaining({ company: "acme", status: "errored" }),
+    ]);
   });
 
   /**
@@ -2270,6 +2416,37 @@ describe("all-complete aggregate", () => {
       .toMatchObject({ properties: { status: "partial" } });
   });
 
+  it("records a transient company leg without adding an errored-leg telemetry count", async () => {
+    const posts: TelemetryEventsBatch[] = [];
+    const client: VaultClientSurface = {
+      ...makeVaultStub({
+        memberships: [{ companyUid: "cmp_a" }],
+        entityGet: (uid: string) =>
+          Promise.resolve({ uid, slug: "acme" } as unknown as EntityInfo),
+      }),
+      postTelemetryEvents: vi.fn(async (batch) => {
+        posts.push(batch);
+        return { ok: true, written: batch.events.length, skipped: [] };
+      }),
+    };
+    const dnsError = Object.assign(new Error("getaddrinfo ENOTFOUND vault"), {
+      code: "ENOTFOUND",
+    });
+    const deps = makeDeps({
+      createVaultClient: () => client,
+      sync: vi.fn().mockRejectedValue(dnsError),
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(TRANSIENT_NETWORK_EXIT);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    const events = posts.flatMap((post) => post.events);
+    expect(events.find((event) => event.eventName === "company_sync_leg_completed"))
+      .toMatchObject({ properties: { status: "transient-network" } });
+    expect(events.find((event) => event.eventName === "sync_runner_completed"))
+      .toMatchObject({ properties: { status: "partial", errorCount: 0 } });
+  });
+
   it("retains terminal failure telemetry when post-client discovery fails", async () => {
     const posts: TelemetryEventsBatch[] = [];
     const client: VaultClientSurface = {
@@ -2329,6 +2506,7 @@ describe("all-complete aggregate", () => {
       bytesUploaded: 0,
       conflictPaths: [],
       errors: [],
+      transient: [],
       partial: false,
       companies: [
         {
@@ -3007,6 +3185,7 @@ describe("--direction", () => {
       bytesUploaded: 125,
       conflictPaths: [],
       errors: [],
+      transient: [],
       partial: false,
       companies: [
         {
@@ -4491,6 +4670,50 @@ describe("runRunnerWithLoop — event-push wiring", () => {
     expect(watcher.disposed).toBe(true);
   });
 
+  it("keeps the watch loop alive when a company leg returns transient exit 75 (HQ-SYNC-X)", async () => {
+    const watcher = makeWatcherStub();
+    const dnsError = Object.assign(new Error("getaddrinfo ENOTFOUND vault"), {
+      code: "ENOTFOUND",
+    });
+    const transientPass = makeDeps({
+      createVaultClient: () =>
+        makeVaultStub({
+          memberships: [{ companyUid: "cmp_acme" }],
+          entityGet: (uid: string) =>
+            Promise.resolve({ uid, slug: "acme" } as unknown as EntityInfo),
+        }),
+      sync: vi.fn().mockRejectedValue(dnsError),
+    });
+    let passes = 0;
+    const runPass = vi.fn().mockImplementation(async () => {
+      passes += 1;
+      // End the otherwise-open watch loop with a later hard failure. The first
+      // pass uses the real company-leg fanout path, not a synthetic exit code.
+      return passes === 1 ? runRunner(["--companies"], transientPass) : 1;
+    });
+
+    const code = await runRunnerWithLoop(
+      ["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"],
+      {
+        runPass,
+        clock: new FakeClock(),
+        createWatcher: () => watcher,
+        sleep: () => Promise.resolve(),
+        onShutdownSignal: () => () => {},
+      },
+    );
+
+    expect(runPass).toHaveBeenCalledTimes(2);
+    expect(code).toBe(1);
+    expect(code).not.toBe(TRANSIENT_NETWORK_EXIT);
+    expect(
+      transientPass.stderr
+        .events()
+        .some((event) => event.type === "error" && event.path === "(company)"),
+    ).toBe(false);
+    expect(watcher.disposed).toBe(true);
+  });
+
   it("a PARTIAL_SYNC_EXIT poll pass does NOT surface as a crash — the loop retries", async () => {
     // A partial pass (some per-file transfers threw: oversized object on an
     // old runner, presign denial, corrupt vault key) must keep

package/src/bin/sync-runner.ts

@@ -46,8 +46,9 @@
  *       runs where every company completed OR cleanly returned `aborted: true`
  *       (a `--on-conflict abort` policy decision is not an error).
  *   1 — argv parse error or unrecoverable pre-sync failure.
- *   2 — at least one company threw mid-stream (e.g. mid-fanout 401, network
- *       reset, S3 5xx after retries). The all-complete event carries
+ *   2 — at least one company threw a deterministic, non-transport failure
+ *       mid-stream (e.g. mid-fanout 401, denied access, S3 5xx after retries).
+ *       The all-complete event carries
  *       `partial: true` and per-company partial counts captured from
  *       `progress` events before the throw, so consumers parsing ndjson see
  *       what actually transferred. This is distinct from exit 0 with
@@ -386,6 +387,19 @@ export type RunnerEvent =
     } & Omit<Extract<SyncProgressEvent, { type: "plan" }>, "type">)
   | ({ type: "progress"; company: string } & Omit<Extract<SyncProgressEvent, { type: "progress" }>, "type">)
   | ({ type: "error"; company?: string } & Omit<Extract<SyncProgressEvent, { type: "error" }>, "type">)
+  | {
+      /**
+       * A per-company transport failure that is retryable, not a deterministic
+       * sync error. This deliberately stays off the `error` channel: exit 2
+       * means a real partial sync failure, while this pass returns EX_TEMPFAIL
+       * (75) and is retried by the watch loop. Mirrors the non-error treatment
+       * of deliberate skip events.
+       */
+      type: "transient-network";
+      company: string;
+      path: "(company)";
+      message: string;
+    }
   | ({ type: "conflict"; company: string } & Omit<Extract<SyncProgressEvent, { type: "conflict" }>, "type">)
   | { type: "new-files"; company: string; files: Array<{ path: string; bytes: number; addedBy: string | null }> }
   | { type: "scope-excluded"; company: string; count: number; samplePaths: string[] }
@@ -448,9 +462,16 @@ export type RunnerEvent =
        * Always emitted; empty array when no conflicts were detected. Lets
        * the menubar UI render a flat list without re-walking per-company
        * `complete` events.
-       */
+      */
       conflictPaths: Array<{ company: string; path: string; direction: "pull" | "push" }>;
       errors: Array<{ company: string; message: string }>;
+      /**
+       * Retryable company-leg transport failures. Kept separate from `errors`
+       * so consumers can surface an incomplete pass without calling it a
+       * deterministic sync error. Always present for backward-compatible,
+       * additive protocol evolution.
+       */
+      transient: Array<{ company: string; message: string }>;
       /**
        * True when at least one company in the fanout did not complete cleanly
        * — either it returned `aborted: true` (e.g. conflict-abort) or its sync
@@ -472,10 +493,12 @@ export type RunnerEvent =
        * - "aborted"  — sync returned cleanly with `aborted: true` (conflict-abort)
        * - "errored"  — sync threw mid-stream; counts are sourced from progress
        *                events seen before the throw
+       * - "transient-network" — a retryable transport failure interrupted the
+       *                           leg; see `transient` for its diagnostic
        */
       companies: Array<{
         company: string;
-        status: "complete" | "aborted" | "errored";
+        status: "complete" | "aborted" | "errored" | "transient-network";
         filesDownloaded: number;
         bytesDownloaded: number;
         filesUploaded: number;
@@ -1245,8 +1268,8 @@ export async function runRunner(
   // full context (per-file errors → company error → exit) in a single
   // Sentry issue alerted to #hq-alerts.
   //
-  // Non-error events (progress, complete, fanout-plan, all-complete,
-  // setup-needed) stay on stdout. They're the protocol stream the menubar
+  // Non-error events (progress, complete, transient-network, fanout-plan,
+  // all-complete, setup-needed) stay on stdout. They're the protocol stream the menubar
   // parses for UI updates; mixing them with error events on the same
   // channel was the original design (single ndjson stream, simpler to
   // tee), but error context belongs in the diagnostic channel.
@@ -1559,7 +1582,7 @@ export async function runRunner(
     }
     throw err;
   }
-  const { errors, allConflicts, meaningfulOutcomeCount } = fanout;
+  const { errors, transientCompanies, allConflicts, meaningfulOutcomeCount } = fanout;
   deps.onPassResult?.({
     pushPathResults: fanout.pushPathResults,
     companyFailures: fanout.companyFailures,
@@ -1757,6 +1780,7 @@ export async function runRunner(
     bytesUploaded: rollup.totalUploadedBytes,
     conflictPaths: allConflicts,
     errors,
+    transient: transientCompanies,
     partial: rollup.partial,
     companies: rollup.companies,
   });
@@ -1954,7 +1978,9 @@ export async function runRunner(
   // the plan (they were omitted) and return TRANSIENT so watch scoped drain
   // does not publish without a successful upload pass.
   if (errors.length > 0) return PARTIAL_SYNC_EXIT;
-  if (deferredUnresolved > 0) return TRANSIENT_NETWORK_EXIT;
+  if (transientCompanies.length > 0 || deferredUnresolved > 0) {
+    return TRANSIENT_NETWORK_EXIT;
+  }
   return 0;
 }