@indigoai-us/hq-cli 5.132.0 → 5.133.0

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 ## [Unreleased]
 
+## [5.133.0] — 2026-09-22
+
+### Fixed
+
+- Lane follow-ups now probe all enabled, logged-in accounts for an unpinned
+  model, preserve the later quota reset and its source, expire abandoned pickup
+  validation markers with a terminal reason, and parse Codex's ordinal
+  `try again at` reset time.
+
+- `hq sync push` no longer fails every file when the target vault was
+  provisioned on or after 2026-09-19. Those vaults carry an S3 Object Lock
+  default retention rule, and S3 refuses a PutObject into them unless the
+  request carries a content checksum; the CLI's declared `@indigoai-us/hq-cloud`
+  range still allowed a client that sends none, so an affected push reported
+  `400 InvalidRequest: Content-MD5 OR x-amz-checksum- HTTP header is required
+  for Put Object requests with Object Lock parameters` on every file. The
+  dependency floor now starts at the release that attaches the checksum, so no
+  install can resolve a client that cannot write to a locked vault. A CI guard
+  holds the floor.
+
+- Lane creation and re-parenting now allow depth 3. A depth-3 caller and any
+  derived depth 4 lane are refused with `max_lane_depth`.
+
+- Question ageing now derives its two-advance cap from the depth-3 lane cap, so
+  an unanswered worker-lane question reaches the user after two hourly hops.
+
 ## [5.132.0] — 2026-09-22
 
 ### Added
@@ -104,6 +130,16 @@
 
 ## [Unreleased]
 
+- `hq mesh daemon install` and `hq mesh daemon run` unload and remove the
+  legacy `ai.getindigo.hq-work-mesh-listen` unit (LaunchAgent, systemd user
+  unit, or Scheduled Task) so only the daemon subscribes. The daemon writes
+  `~/.hq/work-mesh/live-cache.json` and bumps its cursor once per project-view
+  push. MQTT reconnect logs once per transition into reconnecting instead of
+  on every close. `hq mesh daemon doctor` reports "legacy listener still
+  installed" while that unit remains (US-006).
+
+## [Unreleased]
+
 - Held-event repair no longer treats a later event timestamp as proof that
   metadata belongs to the current session instance. A reused session id stays
   unresolved when the held event's binding episode does not match the current

package/dist/commands/lanes.d.ts

@@ -7,14 +7,14 @@
 import { Command } from "commander";
 import { type OutpostDispatchResult } from "../lib/lanes/outpost-dispatch.js";
 import { emitLaneDecisionEvents, type LaneMesh } from "../lib/lanes/mesh-events.js";
-import { type LaneCompanyRef, type LaneRecord, type QuestionRecord, type ResolvedLaneWorker, type SeniorRef, type LivenessDeps, type MachineIdentity, type RunCommand, type ThrottleDeps } from "../lib/lanes/index.js";
+import { MAX_LANE_DEPTH, type LaneCompanyRef, type LaneRecord, type QuestionRecord, type ResolvedLaneWorker, type SeniorRef, type LivenessDeps, type MachineIdentity, type RunCommand, type ThrottleDeps } from "../lib/lanes/index.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { type RunCompactionFn } from "../lib/lanes/compaction.js";
 import { type KnownModelsDeps, type ProbeCommand } from "../lib/lanes/models.js";
 import { spawnLaneWorker, type KillProcessFn, type ProveDetachedFn, type SpawnProcessFn } from "../lib/lanes/spawn.js";
 export { spawnLaneWorker };
 export { questionBodyAbsPath };
-export declare const MAX_LANE_DEPTH = 2;
+export { MAX_LANE_DEPTH };
 export declare const OUTPOST_ID_PATH = "/etc/outpost/outpost-id";
 export declare const OUTPOST_DIR = "/etc/outpost";
 export declare const LANES_RUNS_REL: string;

package/dist/commands/lanes.js

@@ -17,7 +17,7 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { openMeshTransport } from "../lib/mesh/client.js";
 import { createLaneMesh, emitLaneDecisionEvents, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
-import { AccountResolutionError, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountMaxRunning, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, isLoggedOut, runReconcilePass, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasRecordedSessionId, providerSupportsSessionResume, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountMaxRunning, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, MAX_LANE_DEPTH, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, isLoggedOut, runReconcilePass, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasRecordedSessionId, providerSupportsSessionResume, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
 import { providerCompactAfterMs } from "../lib/lanes/config.js";
@@ -29,7 +29,7 @@ import { defaultProbe, validateLaneModel, } from "../lib/lanes/models.js";
 import { parseCliModel, refuseOutpostSelfTarget, resolveLaneModel, FOREGROUND_ONLY_RULE, STANDING_AUTHORIZATION, spawnLaneWorker, stopLaneProcesses, } from "../lib/lanes/spawn.js";
 export { spawnLaneWorker };
 export { questionBodyAbsPath };
-export const MAX_LANE_DEPTH = 2;
+export { MAX_LANE_DEPTH };
 export const OUTPOST_ID_PATH = "/etc/outpost/outpost-id";
 export const OUTPOST_DIR = "/etc/outpost";
 export const LANES_RUNS_REL = path.join("workspace", "lanes-runs");
@@ -1092,6 +1092,7 @@ export function pickupFailureUpdater(reasonRaw, details) {
             state: "failed",
             queued_reason: undefined,
             pickup_validation_pending: undefined,
+            pickup_validation_pending_since: undefined,
             terminal_reason: reason,
             terminal_details: details,
         };
@@ -1166,7 +1167,12 @@ export function applyOutpostAccountPickup(hqRoot, laneId, modelDeps = {}) {
             if (current.account === resolved.id && current.pickup_validation_pending === undefined) {
                 return current;
             }
-            return { ...current, account: resolved.id, pickup_validation_pending: undefined };
+            return {
+                ...current,
+                account: resolved.id,
+                pickup_validation_pending: undefined,
+                pickup_validation_pending_since: undefined,
+            };
         });
     }
     catch (err) {
@@ -1315,8 +1321,8 @@ async function runCreate(ctx, opts) {
     // creates wait on. A pinned create checks the pinned account's home. An
     // unpinned create is not bound to an account here (persist re-resolves the
     // balanced account under the lock, so overlapping creates still spread),
-    // so it checks the balanced candidate first and then every other enabled
-    // account the locked selection could land on (codex catalogs are per home
+    // so it checks the balanced candidate first and then every other enabled,
+    // logged-in account the locked selection could land on (codex catalogs are per home
     // and can differ). `validatedAccounts` records which accepted the model
     // or had no readable list, and the balanced pick under the lock is
     // restricted to that set (resolveAccount's allowedAccounts): an account
@@ -1344,26 +1350,68 @@ async function runCreate(ctx, opts) {
             : [
                 candidate,
                 ...Object.keys(accounts)
-                    .filter((id) => id !== candidate && accounts[id]?.enabled)
+                    .filter((id) => id !== candidate &&
+                    accounts[id]?.enabled &&
+                    accountStatus(provider, id, config, { existsSync: ctx.existsSync }).logged_in === true)
                     .sort(),
             ];
+        const checkedAccounts = [];
+        const unsupported = [];
+        const quotaBlocked = [];
+        const quota = loadQuotaState(hqRoot);
         for (const id of toValidate) {
             const home = accounts[id]?.home;
             if (home === undefined)
                 continue;
+            checkedAccounts.push(id);
             try {
                 validateLaneModel(provider, cliModel, home, modelDeps);
-                validatedAccounts.add(id);
             }
             catch (err) {
                 if (!(isLanesError(err) && err.error === "model_unsupported"))
                     throw err;
-                // The account that would run the lane refuses it: refuse now, before
-                // the other lists are read. Another account's refusal only drops it
-                // from the locked selection.
-                if (id === candidate)
-                    throw err;
+                unsupported.push({ account: id, error: err });
+                continue;
+            }
+            const block = quotaBlockFor(quota, provider, id, cliModel, now);
+            if (block.blocked) {
+                quotaBlocked.push({ account: id, block });
+                continue;
+            }
+            validatedAccounts.add(id);
+        }
+        if (validatedAccounts.size === 0 && quotaBlocked.length > 0) {
+            const blocked = quotaBlocked[0];
+            const model = blocked.block.model ?? cliModel;
+            const checkedSuffix = ` Checked accounts: ${checkedAccounts.join(", ")}`;
+            if (blocked.block.reason === "account_model_unavailable") {
+                throw new AccountResolutionError("account_model_unavailable", `Account ${JSON.stringify(blocked.account)} cannot run model ${model ?? "(no model)"}: ${blocked.block.marker ?? "needs credits"}${checkedSuffix}`, {
+                    provider,
+                    account: blocked.account,
+                    model: model ?? null,
+                    marker: blocked.block.marker ?? null,
+                    checked_accounts: checkedAccounts,
+                });
             }
+            throw new AccountResolutionError("account_quota_exhausted", `Account ${JSON.stringify(blocked.account)} is out of quota${blocked.block.quota_reset_at ? ` until ${blocked.block.quota_reset_at}` : ""} for model ${model ?? "(no model)"}${checkedSuffix}`, {
+                provider,
+                account: blocked.account,
+                model: model ?? null,
+                quota_reset_at: blocked.block.quota_reset_at ?? null,
+                checked_accounts: checkedAccounts,
+            });
+        }
+        if (validatedAccounts.size === 0 && unsupported.length > 0) {
+            const first = unsupported[0].error;
+            throw new LanesError(first.error, `${first.message} Checked accounts: ${checkedAccounts.join(", ")}`, {
+                ...first.details,
+                checked_accounts: checkedAccounts,
+                account_errors: unsupported.map(({ account, error }) => ({
+                    account,
+                    accepted: error.details.accepted,
+                    source: error.details.source,
+                })),
+            });
         }
     }
     const threadId = company
@@ -1637,7 +1685,7 @@ function parseRemotePickupJson(stdout) {
     }
     return null;
 }
-function ingestPickupPayload(hqRoot, payload) {
+function ingestPickupPayload(hqRoot, payload, now) {
     const laneId = payload.lane.lane_id;
     if (!laneId) {
         throw new LanesError("outpost_payload_invalid", "Pickup payload lane.lane_id is required", {});
@@ -1646,9 +1694,20 @@ function ingestPickupPayload(hqRoot, payload) {
     // The lane is stored ineligible for admission until the account bind
     // clears the marker (see LaneRecord.pickup_validation_pending).
     const lane = existing === null
-        ? createLane(hqRoot, { ...payload.lane, pickup_validation_pending: true })
-        : existing.state === "queued" && existing.pickup_validation_pending === undefined
-            ? retryUpdateLane(hqRoot, laneId, "command", (current) => current.state === "queued" ? { ...current, pickup_validation_pending: true } : current)
+        ? createLane(hqRoot, {
+            ...payload.lane,
+            updated_at: now.toISOString(),
+            pickup_validation_pending: true,
+            pickup_validation_pending_since: now.toISOString(),
+        })
+        : existing.state === "queued"
+            ? retryUpdateLane(hqRoot, laneId, "command", (current) => current.state === "queued"
+                ? {
+                    ...current,
+                    pickup_validation_pending: true,
+                    pickup_validation_pending_since: now.toISOString(),
+                }
+                : current)
             : existing;
     const dest = runDir(hqRoot, lane.lane_id);
     ensureDir(path.join(dest, "logs"));
@@ -1692,7 +1751,7 @@ async function runPickup(ctx, opts) {
         throw new LanesError("outpost_payload_invalid", `Pickup payload is not JSON: ${err instanceof Error ? err.message : String(err)}`, {});
     }
     const payload = parseOutpostPickupPayload(parsedJson);
-    const ingested = ingestPickupPayload(hqRoot, payload);
+    const ingested = ingestPickupPayload(hqRoot, payload, ctx.now());
     if (ingested.host.kind === "outpost") {
         try {
             refuseOutpostSelfTarget(hqRoot, ingested, {
@@ -2373,15 +2432,26 @@ async function runReparent(ctx, laneId, opts) {
         throw new LanesError("demotion_with_pending_questions", "Cannot increase a lane's depth while it has pending questions", { lane_id: laneId, from_depth: oldDepth, to_depth: newDepth });
     }
     const override = { laneId, senior: nextSenior, depth: newDepth };
+    const descendants = [];
     for (const other of loadAllLanes(hqRoot)) {
         if (other.lane_id === laneId)
             continue;
         if (!walkHitsLane(hqRoot, other.senior, laneId, ctx))
             continue;
-        const d = derivedLaneDepth(hqRoot, other.senior, ctx, override);
-        if (d > MAX_LANE_DEPTH) {
-            throw new LanesError("max_lane_depth", `Re-parent would put descendant ${other.lane_id} at depth ${d}`, { lane_id: other.lane_id, depth: d, max: MAX_LANE_DEPTH });
+        const oldDescendantDepth = derivedLaneDepth(hqRoot, other.senior, ctx);
+        const descendantDepth = derivedLaneDepth(hqRoot, other.senior, ctx, override);
+        if (descendantDepth > MAX_LANE_DEPTH) {
+            throw new LanesError("max_lane_depth", `Re-parent would put descendant ${other.lane_id} at depth ${descendantDepth}`, { lane_id: other.lane_id, depth: descendantDepth, max: MAX_LANE_DEPTH });
         }
+        if (descendantDepth > oldDescendantDepth &&
+            pendingQuestionsForLane(hqRoot, other.lane_id).length > 0) {
+            throw new LanesError("demotion_with_pending_questions", "Cannot increase a lane's depth while it has pending questions", {
+                lane_id: other.lane_id,
+                from_depth: oldDescendantDepth,
+                to_depth: descendantDepth,
+            });
+        }
+        descendants.push({ laneId: other.lane_id, depth: descendantDepth });
     }
     const at = ctx.now().toISOString();
     const updated = casUpdateLane(hqRoot, laneId, (current) => {
@@ -2401,6 +2471,13 @@ async function runReparent(ctx, laneId, opts) {
             }),
         };
     });
+    for (const descendant of descendants) {
+        casUpdateLane(hqRoot, descendant.laneId, (current) => {
+            if (current.depth === descendant.depth)
+                return current;
+            return { ...current, depth: descendant.depth };
+        });
+    }
     for (const question of pending) {
         casUpdateQuestion(hqRoot, question.question_id, (current) => {
             const already = current.routing_history.some((entry) => entry.reason === "reparented" && entry.at === at);
@@ -3019,6 +3096,7 @@ async function runReconcile(ctx, opts) {
         throttleDeps: ctx.throttleDeps,
         livenessDeps: livenessDepsFromCtx(ctx),
         presenceConnected: ctx.presenceConnected,
+        mesh: ctx.mesh,
         env: ctx.env,
     });
     printJson(summary);

package/dist/commands/mesh.js

@@ -1545,7 +1545,10 @@ export function registerMeshCommand(program) {
 }
 async function runDaemonRun(opts = {}) {
     const hqRoot = opts.hqRoot?.trim() || undefined;
-    const handle = await runMeshDaemon(hqRoot ? { hqRoot } : {});
+    const handle = await runMeshDaemon({
+        ...(hqRoot ? { hqRoot } : {}),
+        enableWorkCache: true,
+    });
     // Stay alive until signal handlers call stop + exit.
     await new Promise(() => {
         void handle;

package/dist/lib/lanes/constants.d.ts

@@ -0,0 +1,3 @@
+/** Maximum number of lane levels below the user. */
+export declare const MAX_LANE_DEPTH = 3;
+//# sourceMappingURL=constants.d.ts.map

package/dist/lib/lanes/constants.js

@@ -0,0 +1,3 @@
+/** Maximum number of lane levels below the user. */
+export const MAX_LANE_DEPTH = 3;
+//# sourceMappingURL=constants.js.map

package/dist/lib/lanes/index.d.ts

@@ -2,6 +2,7 @@
  * Library layer for `hq lanes`. The command module should import from here.
  */
 export { AccountResolutionError, LaneNotFoundError, LaneSchemaError, LaneVersionConflict, LanesConfigError, LanesError, WorkerResolutionError, isLaneVersionConflict, isLanesError, } from "./errors.js";
+export { MAX_LANE_DEPTH } from "./constants.js";
 export { CONFIG_SCHEMA_VERSION, ENVELOPE_DECISIONS, ENVELOPE_SCHEMA_VERSION, HISTORY_CAP, HOST_KINDS, LANE_PROVIDERS, LANE_SCHEMA_VERSION, LANE_STATES, LIVENESS_STATES, QUESTION_BODY_STORES, QUESTION_SCHEMA_VERSION, QUESTION_STATUSES, QUEUED_REASONS, RAISED_VIA, ROUTING_REASONS, SENIOR_KINDS, STORY_STATUSES, TERMINAL_LANE_STATES, isEnvelopeDecision, isHostKind, isLaneProvider, isLaneState, isLivenessState, isQuestionStatus, isSeniorKind, isTerminalLaneState, parseLaneEnvelope, parseLaneProvider, parseLaneState, parseLivenessState, parseMajorSchema, parseQuestionStatus, parseSeniorKind, } from "./types.js";
 export type { AccountConfig, AttributionHistoryEntry, EnvelopeDecision, EnvelopeQuestion, HostKind, LaneCompanyRef, LaneEnvelope, LaneHost, LaneProvider, LaneRecord, PendingResume, AccountHistoryEntry, LaneState, LanesConfig, LastEnvelopeRef, LivenessState, LivenessWindows, ProviderConfig, QuestionAnswer, QuestionBodyRef, QuestionRecord, QuestionStatus, QueuedReason, RaisedVia, RoutingHistoryEntry, RoutingReason, SeniorHistoryEntry, SeniorKind, SeniorRef, StoryStatus, TerminalLaneState, ThrottleConfig, } from "./types.js";
 export { DEFAULT_ACCOUNT_HOMES, DEFAULT_COMPACT_AFTER_MS, DEFAULT_CPU_BUSY_PAUSE, DEFAULT_CPU_BUSY_RESUME, DEFAULT_LIVE_WITHIN_MS, DEFAULT_LIVENESS_WINDOWS, DEFAULT_MAX_QUEUED, DEFAULT_MIN_AVAILABLE_MEM_MB, DEFAULT_PROVIDER_MAX_RUNNING, DEFAULT_SILENT_LOST_MS, DEFAULT_TURN_START_LOST_MS, LANES_CONFIG_REL, accountMaxRunning, canonicalizeHome, documentedDefaultConfig, expandHome, lanesConfigPath, loadLanesConfig, parseLanesConfig, providerCompactAfterMs, providerQuotaDefaultHoldMs, DEFAULT_QUOTA_HOLD_MS, writeLanesConfig, } from "./config.js";

package/dist/lib/lanes/index.js

@@ -2,6 +2,7 @@
  * Library layer for `hq lanes`. The command module should import from here.
  */
 export { AccountResolutionError, LaneNotFoundError, LaneSchemaError, LaneVersionConflict, LanesConfigError, LanesError, WorkerResolutionError, isLaneVersionConflict, isLanesError, } from "./errors.js";
+export { MAX_LANE_DEPTH } from "./constants.js";
 export { CONFIG_SCHEMA_VERSION, ENVELOPE_DECISIONS, ENVELOPE_SCHEMA_VERSION, HISTORY_CAP, HOST_KINDS, LANE_PROVIDERS, LANE_SCHEMA_VERSION, LANE_STATES, LIVENESS_STATES, QUESTION_BODY_STORES, QUESTION_SCHEMA_VERSION, QUESTION_STATUSES, QUEUED_REASONS, RAISED_VIA, ROUTING_REASONS, SENIOR_KINDS, STORY_STATUSES, TERMINAL_LANE_STATES, isEnvelopeDecision, isHostKind, isLaneProvider, isLaneState, isLivenessState, isQuestionStatus, isSeniorKind, isTerminalLaneState, parseLaneEnvelope, parseLaneProvider, parseLaneState, parseLivenessState, parseMajorSchema, parseQuestionStatus, parseSeniorKind, } from "./types.js";
 export { DEFAULT_ACCOUNT_HOMES, DEFAULT_COMPACT_AFTER_MS, DEFAULT_CPU_BUSY_PAUSE, DEFAULT_CPU_BUSY_RESUME, DEFAULT_LIVE_WITHIN_MS, DEFAULT_LIVENESS_WINDOWS, DEFAULT_MAX_QUEUED, DEFAULT_MIN_AVAILABLE_MEM_MB, DEFAULT_PROVIDER_MAX_RUNNING, DEFAULT_SILENT_LOST_MS, DEFAULT_TURN_START_LOST_MS, LANES_CONFIG_REL, accountMaxRunning, canonicalizeHome, documentedDefaultConfig, expandHome, lanesConfigPath, loadLanesConfig, parseLanesConfig, providerCompactAfterMs, providerQuotaDefaultHoldMs, DEFAULT_QUOTA_HOLD_MS, writeLanesConfig, } from "./config.js";
 export { resolveLanesHqRoot } from "./hq-root.js";

package/dist/lib/lanes/quota.d.ts

@@ -64,9 +64,12 @@ export declare function applyDefaultQuotaHold(signal: QuotaSignal, defaultHoldMs
 export declare function quotaStatePath(hqRoot: string): string;
 export declare function loadQuotaState(hqRoot: string): QuotaState;
 /**
- * Parse "resets Sep 24, 2am (UTC)" into an ISO timestamp. The year is the
- * current UTC year, rolled forward when that instant is already past.
- * Returns null when the text names no reset.
+ * Parse provider reset times such as "resets Sep 24, 2am (UTC)" and Codex's
+ * "try again at Sep 14th, 2026 9:24 PM" into an ISO timestamp. Codex's
+ * unzoned form is displayed in the provider CLI's local timezone, while the
+ * provider `resets` form is UTC when it names `(UTC)`. The year is the current
+ * UTC year for an unyear-tagged reset, rolled forward when it is already past.
+ * An explicit provider year is kept as stated.
  */
 export declare function parseProviderResetTime(text: string, now: Date): string | null;
 /**

package/dist/lib/lanes/quota.js

@@ -136,26 +136,36 @@ function writeQuotaState(hqRoot, state) {
     fs.renameSync(tmp, filePath);
 }
 /**
- * Parse "resets Sep 24, 2am (UTC)" into an ISO timestamp. The year is the
- * current UTC year, rolled forward when that instant is already past.
- * Returns null when the text names no reset.
+ * Parse provider reset times such as "resets Sep 24, 2am (UTC)" and Codex's
+ * "try again at Sep 14th, 2026 9:24 PM" into an ISO timestamp. Codex's
+ * unzoned form is displayed in the provider CLI's local timezone, while the
+ * provider `resets` form is UTC when it names `(UTC)`. The year is the current
+ * UTC year for an unyear-tagged reset, rolled forward when it is already past.
+ * An explicit provider year is kept as stated.
  */
 export function parseProviderResetTime(text, now) {
-    const match = /resets\s+([A-Za-z]+)\s+(\d{1,2})(?:,\s*(\d{1,2})(?::(\d{2}))?\s*(am|pm))?(?:\s*\(UTC\))?/i.exec(text);
+    const resetMatch = /\bresets\s+([A-Za-z]+)\s+(\d{1,2})(?:st|nd|rd|th)?(?:,\s*(?:(\d{4})\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm))?(?:\s*\((UTC)\))?/i.exec(text);
+    const codexMatch = /\btry\s+again\s+at\s+([A-Za-z]+)\s+(\d{1,2})(?:st|nd|rd|th)?,\s*(\d{4})\s+(\d{1,2})(?::(\d{2}))?\s*(am|pm)(?:\s*\((UTC)\))?/i.exec(text);
+    const match = resetMatch ?? codexMatch;
     if (!match)
         return null;
+    const codexLocalTime = codexMatch !== null && (match[7] ?? "").toLowerCase() !== "utc";
     const month = MONTHS[(match[1] ?? "").slice(0, 3).toLowerCase()];
     if (month === undefined)
         return null;
     const day = Number(match[2]);
     if (!Number.isInteger(day) || day < 1 || day > 31)
         return null;
+    const explicitYear = match[3] !== undefined;
+    const parsedYear = explicitYear ? Number(match[3]) : now.getUTCFullYear();
+    if (!Number.isInteger(parsedYear) || parsedYear < 1970)
+        return null;
     let hour = 0;
     let minute = 0;
-    if (match[3] !== undefined) {
-        hour = Number(match[3]);
-        minute = match[4] !== undefined ? Number(match[4]) : 0;
-        const ap = (match[5] ?? "").toLowerCase();
+    if (match[4] !== undefined) {
+        hour = Number(match[4]);
+        minute = match[5] !== undefined ? Number(match[5]) : 0;
+        const ap = (match[6] ?? "").toLowerCase();
         if (ap === "pm" && hour < 12)
             hour += 12;
         if (ap === "am" && hour === 12)
@@ -163,11 +173,32 @@ export function parseProviderResetTime(text, now) {
         if (hour > 23 || minute > 59)
             return null;
     }
-    let year = now.getUTCFullYear();
-    let ts = Date.UTC(year, month, day, hour, minute, 0, 0);
-    if (ts < now.getTime() - 36 * 60 * 60 * 1000) {
+    const timestampForYear = (targetYear) => {
+        const candidate = codexLocalTime
+            ? new Date(targetYear, month, day, hour, minute, 0, 0)
+            : new Date(Date.UTC(targetYear, month, day, hour, minute, 0, 0));
+        const valid = codexLocalTime
+            ? candidate.getFullYear() === targetYear &&
+                candidate.getMonth() === month &&
+                candidate.getDate() === day &&
+                candidate.getHours() === hour &&
+                candidate.getMinutes() === minute
+            : candidate.getUTCFullYear() === targetYear &&
+                candidate.getUTCMonth() === month &&
+                candidate.getUTCDate() === day &&
+                candidate.getUTCHours() === hour &&
+                candidate.getUTCMinutes() === minute;
+        return valid ? candidate.getTime() : null;
+    };
+    let year = parsedYear;
+    let ts = timestampForYear(year);
+    if (ts === null)
+        return null;
+    if (!explicitYear && ts < now.getTime() - 36 * 60 * 60 * 1000) {
         year += 1;
-        ts = Date.UTC(year, month, day, hour, minute, 0, 0);
+        ts = timestampForYear(year);
+        if (ts === null)
+            return null;
     }
     return new Date(ts).toISOString();
 }
@@ -259,21 +290,40 @@ export function recordAccountQuota(hqRoot, provider, accountId, signal) {
             next.marker = signal.marker ?? `needs credits for ${signal.model}`;
             delete next.quota_reset_at;
         }
-        if (signal.quota_reset_at && !signal.needs_credits) {
+        if (signal.quota_reset_at &&
+            !signal.needs_credits &&
+            shouldReplaceReset(next.quota_reset_at, signal.quota_reset_at)) {
             next.quota_reset_at = signal.quota_reset_at;
         }
         models[signal.model] = next;
     }
     const account = { ...current, models };
     if (signal.account_wide && signal.quota_reset_at) {
-        account.all_models_quota_reset_at = signal.quota_reset_at;
-        account.reset_source = signal.reset_source ?? "provider";
+        if (shouldReplaceReset(current.all_models_quota_reset_at, signal.quota_reset_at)) {
+            account.all_models_quota_reset_at = signal.quota_reset_at;
+            account.reset_source = signal.reset_source ?? "provider";
+        }
+        else if (current.all_models_quota_reset_at) {
+            account.all_models_quota_reset_at = current.all_models_quota_reset_at;
+            account.reset_source = current.reset_source ?? "provider";
+        }
     }
     accounts[accountId] = account;
     state.providers[provider] = accounts;
     writeQuotaState(hqRoot, state);
     return state;
 }
+function shouldReplaceReset(current, incoming) {
+    if (!current)
+        return true;
+    const currentMs = Date.parse(current);
+    const incomingMs = Date.parse(incoming);
+    if (!Number.isFinite(currentMs))
+        return Number.isFinite(incomingMs);
+    if (!Number.isFinite(incomingMs))
+        return false;
+    return incomingMs > currentMs;
+}
 function resetStillAhead(iso, now) {
     if (!iso)
         return false;

package/dist/lib/lanes/reconcile.d.ts

@@ -12,12 +12,15 @@ import type { LaneRecord, LivenessState, QuestionRecord, SeniorRef } from "./typ
 import { type LaneMesh } from "./mesh-events.js";
 /** Spec §9: unanswered at the current hop for 60 minutes → one hop. */
 export declare const QUESTION_AGE_MS: number;
-/** Spec §6.6 + §9: v1 permits exactly one aged advance. */
-export declare const MAX_AGED_ADVANCES = 1;
+/** Spec §6.6 + §9: a depth-3 worker has two hops to age toward the user. */
+export declare const MAX_AGED_ADVANCES: number;
 /** Aligns with watcher silence: a host that has not reported for this long is dead. */
 export declare const DEAD_HOST_MS: number;
 export declare const RECONCILE_LOCK_STALE_MS = 30000;
 export declare const RECONCILE_LOCK_TIMEOUT_MS = 5000;
+/** A pickup probe that has not cleared its marker within this window is abandoned. */
+export declare const PICKUP_VALIDATION_MAX_AGE_MS: number;
+export declare const PICKUP_VALIDATION_TIMEOUT_REASON: "pickup_validation_timeout";
 export declare const RECONCILE_UNIT_NAME = "hq-lanes-reconcile.service";
 export declare const RECONCILE_TIMER_NAME = "hq-lanes-reconcile.timer";
 export interface ReconcileSkip {

package/dist/lib/lanes/reconcile.js

@@ -9,6 +9,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { parseUserYaml } from "../../utils/user-yaml-error.js";
 import { accountMaxRunning, loadLanesConfig, providerQuotaDefaultHoldMs } from "./config.js";
+import { MAX_LANE_DEPTH } from "./constants.js";
 import { LanesError, isLaneVersionConflict } from "./errors.js";
 import { classifySessionLiveness, defaultLivenessDeps, loadLivenessIndex, readDaemonPresenceConnected, } from "./liveness.js";
 import { ANSWERED_QUESTIONS_FILE, armLaneWatcher, isPidRecordAlive, laneRunDir, readPidRecord, readSpawnManifest, spawnEnvelopeRepair, spawnLaneWorker, } from "./spawn.js";
@@ -22,12 +23,15 @@ import { decideEnvelopeRepair, envelopeQuestionIds, routeProviderFailure } from
 import { providerRejectionDetails, readProviderRejection, } from "./provider-rejection.js";
 /** Spec §9: unanswered at the current hop for 60 minutes → one hop. */
 export const QUESTION_AGE_MS = 60 * 60 * 1000;
-/** Spec §6.6 + §9: v1 permits exactly one aged advance. */
-export const MAX_AGED_ADVANCES = 1;
+/** Spec §6.6 + §9: a depth-3 worker has two hops to age toward the user. */
+export const MAX_AGED_ADVANCES = MAX_LANE_DEPTH - 1;
 /** Aligns with watcher silence: a host that has not reported for this long is dead. */
 export const DEAD_HOST_MS = SILENCE_MS;
 export const RECONCILE_LOCK_STALE_MS = 30_000;
 export const RECONCILE_LOCK_TIMEOUT_MS = 5_000;
+/** A pickup probe that has not cleared its marker within this window is abandoned. */
+export const PICKUP_VALIDATION_MAX_AGE_MS = 15 * 60 * 1000;
+export const PICKUP_VALIDATION_TIMEOUT_REASON = "pickup_validation_timeout";
 export const RECONCILE_UNIT_NAME = "hq-lanes-reconcile.service";
 export const RECONCILE_TIMER_NAME = "hq-lanes-reconcile.timer";
 function logSkip(skip) {
@@ -309,6 +313,89 @@ function casQuestionIf(hqRoot, questionId, shouldWrite, updater, dryRun) {
     }
     throw new LanesError("version_conflict", `Exhausted CAS retries for question ${questionId}`, { question_id: questionId });
 }
+async function emitAgedQuestionAtUser(summary, deps, lane, question) {
+    if (deps.dryRun)
+        return;
+    const mesh = deps.mesh === undefined ? createLaneMesh({ interactive: false }) : deps.mesh;
+    if (!mesh || !lane.company || !lane.thread_id)
+        return;
+    const timeoutMs = deps.meshEmitTimeoutMs ?? 10_000;
+    let timer;
+    try {
+        await Promise.race([
+            mesh.appendThreadEvent(lane.company, lane.thread_id, "lane_question_at_user", { lane_id: lane.lane_id, question_id: question.question_id }),
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => reject(new Error(`question-at-user mesh emit timed out after ${timeoutMs}ms`)), timeoutMs);
+            }),
+        ]);
+    }
+    catch (err) {
+        markDirty(summary, {
+            kind: "question",
+            id: question.question_id,
+            why: `question-at-user mesh emit failed: ${err instanceof Error ? err.message : String(err)}`,
+        });
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+function pickupValidationPendingAtMs(lane) {
+    const raw = lane.pickup_validation_pending_since ?? lane.updated_at;
+    const at = Date.parse(raw);
+    return Number.isFinite(at) ? at : null;
+}
+function pickupValidationExpired(lane, nowMs) {
+    const pendingAtMs = pickupValidationPendingAtMs(lane);
+    return pendingAtMs === null || nowMs - pendingAtMs > PICKUP_VALIDATION_MAX_AGE_MS;
+}
+function expireAbandonedPickupValidation(hqRoot, lanes, summary, deps, now) {
+    const nowMs = now.getTime();
+    for (const lane of lanes) {
+        if (lane.state !== "queued" ||
+            lane.pickup_validation_pending !== true ||
+            !laneRunsHere(lane, deps.host) ||
+            !pickupValidationExpired(lane, nowMs)) {
+            continue;
+        }
+        try {
+            const result = casLaneIf(hqRoot, lane.lane_id, (current) => current.state === "queued" &&
+                current.pickup_validation_pending === true &&
+                pickupValidationExpired(current, nowMs), (current) => {
+                const pendingAtMs = pickupValidationPendingAtMs(current);
+                return {
+                    ...current,
+                    state: "failed",
+                    queued_reason: undefined,
+                    pickup_validation_pending: undefined,
+                    pickup_validation_pending_since: undefined,
+                    terminal_reason: PICKUP_VALIDATION_TIMEOUT_REASON,
+                    terminal_details: {
+                        pickup_validation_pending_since: current.pickup_validation_pending_since ?? current.updated_at,
+                        age_ms: pendingAtMs === null ? null : Math.max(0, nowMs - pendingAtMs),
+                        max_age_ms: PICKUP_VALIDATION_MAX_AGE_MS,
+                    },
+                };
+            }, deps.dryRun);
+            if (result.changed) {
+                summary.aged.push({
+                    id: lane.lane_id,
+                    from: "queued",
+                    to: "failed",
+                    reason: PICKUP_VALIDATION_TIMEOUT_REASON,
+                });
+            }
+        }
+        catch (err) {
+            markDirty(summary, {
+                kind: "lane",
+                id: lane.lane_id,
+                why: `pickup validation expiry failed: ${err instanceof Error ? err.message : String(err)}`,
+            });
+        }
+    }
+}
 function fileNonEmpty(filePath) {
     try {
         return fs.statSync(filePath).size > 0;
@@ -589,6 +676,10 @@ export async function runPassBody(hqRoot, deps) {
                         to: String(nextHop),
                         reason: "unanswered_timeout",
                     });
+                    if (nextAudience.kind === "user") {
+                        const originLane = laneById.get(question.lane_id) ?? readLane(hqRoot, question.lane_id);
+                        await emitAgedQuestionAtUser(summary, deps, originLane, result.record);
+                    }
                 }
             }
         }
@@ -862,6 +953,7 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
     }
 }
 async function admitQueued(hqRoot, lanes, summary, deps, now) {
+    expireAbandonedPickupValidation(hqRoot, lanes, summary, deps, now);
     // A lane whose pickup probe is still out is not admitted: its record is
     // about to be bound or failed by the pickup, and a worker spawned now
     // would keep running behind that write.

package/dist/lib/lanes/types.d.ts

@@ -257,6 +257,8 @@ export interface LaneRecord {
      * leave a running worker behind a record the probe result then rewrites.
      */
     pickup_validation_pending?: true;
+    /** When the pickup validation marker was written. */
+    pickup_validation_pending_since?: string;
     priority: number;
     worker?: string;
     /** Registry-relative directory of the resolved worker, when --worker was set. */