@indigoai-us/hq-cli 5.132.0 → 5.134.0

package/dist/lib/heartbeat-identity.d.ts

@@ -0,0 +1,29 @@
+import type { CaptureContext } from "@sentry/node";
+export declare const HEARTBEAT_IDENTITY_MISMATCH_CODE = "AGENT_IDENTITY_MISMATCH";
+export type HeartbeatRunner = "agent-kit" | "bot";
+export type HeartbeatAgentUidSource = "config_file" | "env" | "flag";
+export type HeartbeatCredsSource = "explicit" | "default";
+export interface HeartbeatFailure {
+    status: number;
+    code?: string;
+    message?: string;
+}
+export interface HeartbeatIdentityMismatchContext {
+    runner: HeartbeatRunner;
+    configuredAgentUid: string;
+    tokenAgentUid?: string;
+    agentUidSource: HeartbeatAgentUidSource;
+    credsSource: HeartbeatCredsSource;
+}
+export type HeartbeatIdentityMismatchReporter = (context: HeartbeatIdentityMismatchContext) => void;
+/** Parse only the bounded fields the heartbeat route uses for classification. */
+export declare function parseHeartbeatFailureBody(bodyText: string | undefined): {
+    code?: string;
+    message?: string;
+};
+/** Match the server's registered code/name, never an arbitrary 403. */
+export declare function isHeartbeatIdentityMismatch(failure: HeartbeatFailure): boolean;
+/** Read the agent uid claim for diagnostics only; this never authorizes a call. */
+export declare function tokenAgentUid(token: string): string | undefined;
+export declare function captureHeartbeatIdentityMismatch(context: HeartbeatIdentityMismatchContext, captureMessage?: (message: string, context: CaptureContext) => string): void;
+//# sourceMappingURL=heartbeat-identity.d.ts.map

package/dist/lib/heartbeat-identity.js

@@ -0,0 +1,71 @@
+import { CLI_VERSION } from "../cli-version.js";
+import { Sentry } from "../sentry.js";
+import { peekIdToken } from "../utils/id-token.js";
+export const HEARTBEAT_IDENTITY_MISMATCH_CODE = "AGENT_IDENTITY_MISMATCH";
+const AGENT_UID_RE = /^agt_[A-Za-z0-9_-]{1,100}$/;
+function normalize(value) {
+    return (value ?? "").replace(/[^A-Za-z0-9]/g, "").toLowerCase();
+}
+function safeAgentUid(value) {
+    return typeof value === "string" && AGENT_UID_RE.test(value) ? value : undefined;
+}
+/** Parse only the bounded fields the heartbeat route uses for classification. */
+export function parseHeartbeatFailureBody(bodyText) {
+    if (!bodyText)
+        return {};
+    try {
+        const body = JSON.parse(bodyText);
+        const code = typeof body.code === "string" ? body.code.slice(0, 120) : undefined;
+        const message = typeof body.error === "string"
+            ? body.error.slice(0, 300)
+            : typeof body.message === "string"
+                ? body.message.slice(0, 300)
+                : undefined;
+        return { ...(code ? { code } : {}), ...(message ? { message } : {}) };
+    }
+    catch {
+        return {};
+    }
+}
+/** Match the server's registered code/name, never an arbitrary 403. */
+export function isHeartbeatIdentityMismatch(failure) {
+    if (failure.status !== 403)
+        return false;
+    const code = normalize(failure.code);
+    if (code === normalize(HEARTBEAT_IDENTITY_MISMATCH_CODE) || code === "agentidentitymismatcherror")
+        return true;
+    const message = normalize(failure.message);
+    return (message.includes("heartbeatmustbereportedbytheagentsownmachineidentity") ||
+        message.includes("agentidentitymismatcherror"));
+}
+/** Read the agent uid claim for diagnostics only; this never authorizes a call. */
+export function tokenAgentUid(token) {
+    const claims = peekIdToken(token);
+    return (safeAgentUid(claims["custom:entityUid"]) ??
+        safeAgentUid(claims.entityUid) ??
+        safeAgentUid(claims.sub));
+}
+function diagnosticUid(value) {
+    return safeAgentUid(value) ?? "unknown";
+}
+function captureHeartbeatIdentityMismatchMessage(message, context) {
+    return Sentry.captureMessage(message, context);
+}
+export function captureHeartbeatIdentityMismatch(context, captureMessage = captureHeartbeatIdentityMismatchMessage) {
+    const options = {
+        level: "warning",
+        fingerprint: ["heartbeat-identity-mismatch"],
+        tags: {
+            agent_uid_source: context.agentUidSource,
+            creds_source: context.credsSource,
+            runner: context.runner,
+            hq_cli_version: CLI_VERSION,
+        },
+        extra: {
+            configured_agent_uid: diagnosticUid(context.configuredAgentUid),
+            ...(context.tokenAgentUid ? { token_agent_uid: diagnosticUid(context.tokenAgentUid) } : {}),
+        },
+    };
+    captureMessage("heartbeat identity mismatch", options);
+}
+//# sourceMappingURL=heartbeat-identity.js.map

package/dist/lib/lanes/constants.d.ts

@@ -0,0 +1,3 @@
+/** Maximum number of lane levels below the user. */
+export declare const MAX_LANE_DEPTH = 3;
+//# sourceMappingURL=constants.d.ts.map

package/dist/lib/lanes/constants.js

@@ -0,0 +1,3 @@
+/** Maximum number of lane levels below the user. */
+export const MAX_LANE_DEPTH = 3;
+//# sourceMappingURL=constants.js.map

package/dist/lib/lanes/index.d.ts

@@ -2,6 +2,7 @@
  * Library layer for `hq lanes`. The command module should import from here.
  */
 export { AccountResolutionError, LaneNotFoundError, LaneSchemaError, LaneVersionConflict, LanesConfigError, LanesError, WorkerResolutionError, isLaneVersionConflict, isLanesError, } from "./errors.js";
+export { MAX_LANE_DEPTH } from "./constants.js";
 export { CONFIG_SCHEMA_VERSION, ENVELOPE_DECISIONS, ENVELOPE_SCHEMA_VERSION, HISTORY_CAP, HOST_KINDS, LANE_PROVIDERS, LANE_SCHEMA_VERSION, LANE_STATES, LIVENESS_STATES, QUESTION_BODY_STORES, QUESTION_SCHEMA_VERSION, QUESTION_STATUSES, QUEUED_REASONS, RAISED_VIA, ROUTING_REASONS, SENIOR_KINDS, STORY_STATUSES, TERMINAL_LANE_STATES, isEnvelopeDecision, isHostKind, isLaneProvider, isLaneState, isLivenessState, isQuestionStatus, isSeniorKind, isTerminalLaneState, parseLaneEnvelope, parseLaneProvider, parseLaneState, parseLivenessState, parseMajorSchema, parseQuestionStatus, parseSeniorKind, } from "./types.js";
 export type { AccountConfig, AttributionHistoryEntry, EnvelopeDecision, EnvelopeQuestion, HostKind, LaneCompanyRef, LaneEnvelope, LaneHost, LaneProvider, LaneRecord, PendingResume, AccountHistoryEntry, LaneState, LanesConfig, LastEnvelopeRef, LivenessState, LivenessWindows, ProviderConfig, QuestionAnswer, QuestionBodyRef, QuestionRecord, QuestionStatus, QueuedReason, RaisedVia, RoutingHistoryEntry, RoutingReason, SeniorHistoryEntry, SeniorKind, SeniorRef, StoryStatus, TerminalLaneState, ThrottleConfig, } from "./types.js";
 export { DEFAULT_ACCOUNT_HOMES, DEFAULT_COMPACT_AFTER_MS, DEFAULT_CPU_BUSY_PAUSE, DEFAULT_CPU_BUSY_RESUME, DEFAULT_LIVE_WITHIN_MS, DEFAULT_LIVENESS_WINDOWS, DEFAULT_MAX_QUEUED, DEFAULT_MIN_AVAILABLE_MEM_MB, DEFAULT_PROVIDER_MAX_RUNNING, DEFAULT_SILENT_LOST_MS, DEFAULT_TURN_START_LOST_MS, LANES_CONFIG_REL, accountMaxRunning, canonicalizeHome, documentedDefaultConfig, expandHome, lanesConfigPath, loadLanesConfig, parseLanesConfig, providerCompactAfterMs, providerQuotaDefaultHoldMs, DEFAULT_QUOTA_HOLD_MS, writeLanesConfig, } from "./config.js";

package/dist/lib/lanes/index.js

@@ -2,6 +2,7 @@
  * Library layer for `hq lanes`. The command module should import from here.
  */
 export { AccountResolutionError, LaneNotFoundError, LaneSchemaError, LaneVersionConflict, LanesConfigError, LanesError, WorkerResolutionError, isLaneVersionConflict, isLanesError, } from "./errors.js";
+export { MAX_LANE_DEPTH } from "./constants.js";
 export { CONFIG_SCHEMA_VERSION, ENVELOPE_DECISIONS, ENVELOPE_SCHEMA_VERSION, HISTORY_CAP, HOST_KINDS, LANE_PROVIDERS, LANE_SCHEMA_VERSION, LANE_STATES, LIVENESS_STATES, QUESTION_BODY_STORES, QUESTION_SCHEMA_VERSION, QUESTION_STATUSES, QUEUED_REASONS, RAISED_VIA, ROUTING_REASONS, SENIOR_KINDS, STORY_STATUSES, TERMINAL_LANE_STATES, isEnvelopeDecision, isHostKind, isLaneProvider, isLaneState, isLivenessState, isQuestionStatus, isSeniorKind, isTerminalLaneState, parseLaneEnvelope, parseLaneProvider, parseLaneState, parseLivenessState, parseMajorSchema, parseQuestionStatus, parseSeniorKind, } from "./types.js";
 export { DEFAULT_ACCOUNT_HOMES, DEFAULT_COMPACT_AFTER_MS, DEFAULT_CPU_BUSY_PAUSE, DEFAULT_CPU_BUSY_RESUME, DEFAULT_LIVE_WITHIN_MS, DEFAULT_LIVENESS_WINDOWS, DEFAULT_MAX_QUEUED, DEFAULT_MIN_AVAILABLE_MEM_MB, DEFAULT_PROVIDER_MAX_RUNNING, DEFAULT_SILENT_LOST_MS, DEFAULT_TURN_START_LOST_MS, LANES_CONFIG_REL, accountMaxRunning, canonicalizeHome, documentedDefaultConfig, expandHome, lanesConfigPath, loadLanesConfig, parseLanesConfig, providerCompactAfterMs, providerQuotaDefaultHoldMs, DEFAULT_QUOTA_HOLD_MS, writeLanesConfig, } from "./config.js";
 export { resolveLanesHqRoot } from "./hq-root.js";

package/dist/lib/lanes/quota.d.ts

@@ -64,9 +64,12 @@ export declare function applyDefaultQuotaHold(signal: QuotaSignal, defaultHoldMs
 export declare function quotaStatePath(hqRoot: string): string;
 export declare function loadQuotaState(hqRoot: string): QuotaState;
 /**
- * Parse "resets Sep 24, 2am (UTC)" into an ISO timestamp. The year is the
- * current UTC year, rolled forward when that instant is already past.
- * Returns null when the text names no reset.
+ * Parse provider reset times such as "resets Sep 24, 2am (UTC)" and Codex's
+ * "try again at Sep 14th, 2026 9:24 PM" into an ISO timestamp. Codex's
+ * unzoned form is displayed in the provider CLI's local timezone, while the
+ * provider `resets` form is UTC when it names `(UTC)`. The year is the current
+ * UTC year for an unyear-tagged reset, rolled forward when it is already past.
+ * An explicit provider year is kept as stated.
  */
 export declare function parseProviderResetTime(text: string, now: Date): string | null;
 /**

package/dist/lib/lanes/quota.js

@@ -136,26 +136,36 @@ function writeQuotaState(hqRoot, state) {
     fs.renameSync(tmp, filePath);
 }
 /**
- * Parse "resets Sep 24, 2am (UTC)" into an ISO timestamp. The year is the
- * current UTC year, rolled forward when that instant is already past.
- * Returns null when the text names no reset.
+ * Parse provider reset times such as "resets Sep 24, 2am (UTC)" and Codex's
+ * "try again at Sep 14th, 2026 9:24 PM" into an ISO timestamp. Codex's
+ * unzoned form is displayed in the provider CLI's local timezone, while the
+ * provider `resets` form is UTC when it names `(UTC)`. The year is the current
+ * UTC year for an unyear-tagged reset, rolled forward when it is already past.
+ * An explicit provider year is kept as stated.
  */
 export function parseProviderResetTime(text, now) {
-    const match = /resets\s+([A-Za-z]+)\s+(\d{1,2})(?:,\s*(\d{1,2})(?::(\d{2}))?\s*(am|pm))?(?:\s*\(UTC\))?/i.exec(text);
+    const resetMatch = /\bresets\s+([A-Za-z]+)\s+(\d{1,2})(?:st|nd|rd|th)?(?:,\s*(?:(\d{4})\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm))?(?:\s*\((UTC)\))?/i.exec(text);
+    const codexMatch = /\btry\s+again\s+at\s+([A-Za-z]+)\s+(\d{1,2})(?:st|nd|rd|th)?,\s*(\d{4})\s+(\d{1,2})(?::(\d{2}))?\s*(am|pm)(?:\s*\((UTC)\))?/i.exec(text);
+    const match = resetMatch ?? codexMatch;
     if (!match)
         return null;
+    const codexLocalTime = codexMatch !== null && (match[7] ?? "").toLowerCase() !== "utc";
     const month = MONTHS[(match[1] ?? "").slice(0, 3).toLowerCase()];
     if (month === undefined)
         return null;
     const day = Number(match[2]);
     if (!Number.isInteger(day) || day < 1 || day > 31)
         return null;
+    const explicitYear = match[3] !== undefined;
+    const parsedYear = explicitYear ? Number(match[3]) : now.getUTCFullYear();
+    if (!Number.isInteger(parsedYear) || parsedYear < 1970)
+        return null;
     let hour = 0;
     let minute = 0;
-    if (match[3] !== undefined) {
-        hour = Number(match[3]);
-        minute = match[4] !== undefined ? Number(match[4]) : 0;
-        const ap = (match[5] ?? "").toLowerCase();
+    if (match[4] !== undefined) {
+        hour = Number(match[4]);
+        minute = match[5] !== undefined ? Number(match[5]) : 0;
+        const ap = (match[6] ?? "").toLowerCase();
         if (ap === "pm" && hour < 12)
             hour += 12;
         if (ap === "am" && hour === 12)
@@ -163,11 +173,32 @@ export function parseProviderResetTime(text, now) {
         if (hour > 23 || minute > 59)
             return null;
     }
-    let year = now.getUTCFullYear();
-    let ts = Date.UTC(year, month, day, hour, minute, 0, 0);
-    if (ts < now.getTime() - 36 * 60 * 60 * 1000) {
+    const timestampForYear = (targetYear) => {
+        const candidate = codexLocalTime
+            ? new Date(targetYear, month, day, hour, minute, 0, 0)
+            : new Date(Date.UTC(targetYear, month, day, hour, minute, 0, 0));
+        const valid = codexLocalTime
+            ? candidate.getFullYear() === targetYear &&
+                candidate.getMonth() === month &&
+                candidate.getDate() === day &&
+                candidate.getHours() === hour &&
+                candidate.getMinutes() === minute
+            : candidate.getUTCFullYear() === targetYear &&
+                candidate.getUTCMonth() === month &&
+                candidate.getUTCDate() === day &&
+                candidate.getUTCHours() === hour &&
+                candidate.getUTCMinutes() === minute;
+        return valid ? candidate.getTime() : null;
+    };
+    let year = parsedYear;
+    let ts = timestampForYear(year);
+    if (ts === null)
+        return null;
+    if (!explicitYear && ts < now.getTime() - 36 * 60 * 60 * 1000) {
         year += 1;
-        ts = Date.UTC(year, month, day, hour, minute, 0, 0);
+        ts = timestampForYear(year);
+        if (ts === null)
+            return null;
     }
     return new Date(ts).toISOString();
 }
@@ -259,21 +290,40 @@ export function recordAccountQuota(hqRoot, provider, accountId, signal) {
             next.marker = signal.marker ?? `needs credits for ${signal.model}`;
             delete next.quota_reset_at;
         }
-        if (signal.quota_reset_at && !signal.needs_credits) {
+        if (signal.quota_reset_at &&
+            !signal.needs_credits &&
+            shouldReplaceReset(next.quota_reset_at, signal.quota_reset_at)) {
             next.quota_reset_at = signal.quota_reset_at;
         }
         models[signal.model] = next;
     }
     const account = { ...current, models };
     if (signal.account_wide && signal.quota_reset_at) {
-        account.all_models_quota_reset_at = signal.quota_reset_at;
-        account.reset_source = signal.reset_source ?? "provider";
+        if (shouldReplaceReset(current.all_models_quota_reset_at, signal.quota_reset_at)) {
+            account.all_models_quota_reset_at = signal.quota_reset_at;
+            account.reset_source = signal.reset_source ?? "provider";
+        }
+        else if (current.all_models_quota_reset_at) {
+            account.all_models_quota_reset_at = current.all_models_quota_reset_at;
+            account.reset_source = current.reset_source ?? "provider";
+        }
     }
     accounts[accountId] = account;
     state.providers[provider] = accounts;
     writeQuotaState(hqRoot, state);
     return state;
 }
+function shouldReplaceReset(current, incoming) {
+    if (!current)
+        return true;
+    const currentMs = Date.parse(current);
+    const incomingMs = Date.parse(incoming);
+    if (!Number.isFinite(currentMs))
+        return Number.isFinite(incomingMs);
+    if (!Number.isFinite(incomingMs))
+        return false;
+    return incomingMs > currentMs;
+}
 function resetStillAhead(iso, now) {
     if (!iso)
         return false;

package/dist/lib/lanes/reconcile.d.ts

@@ -12,12 +12,15 @@ import type { LaneRecord, LivenessState, QuestionRecord, SeniorRef } from "./typ
 import { type LaneMesh } from "./mesh-events.js";
 /** Spec §9: unanswered at the current hop for 60 minutes → one hop. */
 export declare const QUESTION_AGE_MS: number;
-/** Spec §6.6 + §9: v1 permits exactly one aged advance. */
-export declare const MAX_AGED_ADVANCES = 1;
+/** Spec §6.6 + §9: a depth-3 worker has two hops to age toward the user. */
+export declare const MAX_AGED_ADVANCES: number;
 /** Aligns with watcher silence: a host that has not reported for this long is dead. */
 export declare const DEAD_HOST_MS: number;
 export declare const RECONCILE_LOCK_STALE_MS = 30000;
 export declare const RECONCILE_LOCK_TIMEOUT_MS = 5000;
+/** A pickup probe that has not cleared its marker within this window is abandoned. */
+export declare const PICKUP_VALIDATION_MAX_AGE_MS: number;
+export declare const PICKUP_VALIDATION_TIMEOUT_REASON: "pickup_validation_timeout";
 export declare const RECONCILE_UNIT_NAME = "hq-lanes-reconcile.service";
 export declare const RECONCILE_TIMER_NAME = "hq-lanes-reconcile.timer";
 export interface ReconcileSkip {

package/dist/lib/lanes/reconcile.js

@@ -9,6 +9,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { parseUserYaml } from "../../utils/user-yaml-error.js";
 import { accountMaxRunning, loadLanesConfig, providerQuotaDefaultHoldMs } from "./config.js";
+import { MAX_LANE_DEPTH } from "./constants.js";
 import { LanesError, isLaneVersionConflict } from "./errors.js";
 import { classifySessionLiveness, defaultLivenessDeps, loadLivenessIndex, readDaemonPresenceConnected, } from "./liveness.js";
 import { ANSWERED_QUESTIONS_FILE, armLaneWatcher, isPidRecordAlive, laneRunDir, readPidRecord, readSpawnManifest, spawnEnvelopeRepair, spawnLaneWorker, } from "./spawn.js";
@@ -22,12 +23,15 @@ import { decideEnvelopeRepair, envelopeQuestionIds, routeProviderFailure } from
 import { providerRejectionDetails, readProviderRejection, } from "./provider-rejection.js";
 /** Spec §9: unanswered at the current hop for 60 minutes → one hop. */
 export const QUESTION_AGE_MS = 60 * 60 * 1000;
-/** Spec §6.6 + §9: v1 permits exactly one aged advance. */
-export const MAX_AGED_ADVANCES = 1;
+/** Spec §6.6 + §9: a depth-3 worker has two hops to age toward the user. */
+export const MAX_AGED_ADVANCES = MAX_LANE_DEPTH - 1;
 /** Aligns with watcher silence: a host that has not reported for this long is dead. */
 export const DEAD_HOST_MS = SILENCE_MS;
 export const RECONCILE_LOCK_STALE_MS = 30_000;
 export const RECONCILE_LOCK_TIMEOUT_MS = 5_000;
+/** A pickup probe that has not cleared its marker within this window is abandoned. */
+export const PICKUP_VALIDATION_MAX_AGE_MS = 15 * 60 * 1000;
+export const PICKUP_VALIDATION_TIMEOUT_REASON = "pickup_validation_timeout";
 export const RECONCILE_UNIT_NAME = "hq-lanes-reconcile.service";
 export const RECONCILE_TIMER_NAME = "hq-lanes-reconcile.timer";
 function logSkip(skip) {
@@ -309,6 +313,89 @@ function casQuestionIf(hqRoot, questionId, shouldWrite, updater, dryRun) {
     }
     throw new LanesError("version_conflict", `Exhausted CAS retries for question ${questionId}`, { question_id: questionId });
 }
+async function emitAgedQuestionAtUser(summary, deps, lane, question) {
+    if (deps.dryRun)
+        return;
+    const mesh = deps.mesh === undefined ? createLaneMesh({ interactive: false }) : deps.mesh;
+    if (!mesh || !lane.company || !lane.thread_id)
+        return;
+    const timeoutMs = deps.meshEmitTimeoutMs ?? 10_000;
+    let timer;
+    try {
+        await Promise.race([
+            mesh.appendThreadEvent(lane.company, lane.thread_id, "lane_question_at_user", { lane_id: lane.lane_id, question_id: question.question_id }),
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => reject(new Error(`question-at-user mesh emit timed out after ${timeoutMs}ms`)), timeoutMs);
+            }),
+        ]);
+    }
+    catch (err) {
+        markDirty(summary, {
+            kind: "question",
+            id: question.question_id,
+            why: `question-at-user mesh emit failed: ${err instanceof Error ? err.message : String(err)}`,
+        });
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+function pickupValidationPendingAtMs(lane) {
+    const raw = lane.pickup_validation_pending_since ?? lane.updated_at;
+    const at = Date.parse(raw);
+    return Number.isFinite(at) ? at : null;
+}
+function pickupValidationExpired(lane, nowMs) {
+    const pendingAtMs = pickupValidationPendingAtMs(lane);
+    return pendingAtMs === null || nowMs - pendingAtMs > PICKUP_VALIDATION_MAX_AGE_MS;
+}
+function expireAbandonedPickupValidation(hqRoot, lanes, summary, deps, now) {
+    const nowMs = now.getTime();
+    for (const lane of lanes) {
+        if (lane.state !== "queued" ||
+            lane.pickup_validation_pending !== true ||
+            !laneRunsHere(lane, deps.host) ||
+            !pickupValidationExpired(lane, nowMs)) {
+            continue;
+        }
+        try {
+            const result = casLaneIf(hqRoot, lane.lane_id, (current) => current.state === "queued" &&
+                current.pickup_validation_pending === true &&
+                pickupValidationExpired(current, nowMs), (current) => {
+                const pendingAtMs = pickupValidationPendingAtMs(current);
+                return {
+                    ...current,
+                    state: "failed",
+                    queued_reason: undefined,
+                    pickup_validation_pending: undefined,
+                    pickup_validation_pending_since: undefined,
+                    terminal_reason: PICKUP_VALIDATION_TIMEOUT_REASON,
+                    terminal_details: {
+                        pickup_validation_pending_since: current.pickup_validation_pending_since ?? current.updated_at,
+                        age_ms: pendingAtMs === null ? null : Math.max(0, nowMs - pendingAtMs),
+                        max_age_ms: PICKUP_VALIDATION_MAX_AGE_MS,
+                    },
+                };
+            }, deps.dryRun);
+            if (result.changed) {
+                summary.aged.push({
+                    id: lane.lane_id,
+                    from: "queued",
+                    to: "failed",
+                    reason: PICKUP_VALIDATION_TIMEOUT_REASON,
+                });
+            }
+        }
+        catch (err) {
+            markDirty(summary, {
+                kind: "lane",
+                id: lane.lane_id,
+                why: `pickup validation expiry failed: ${err instanceof Error ? err.message : String(err)}`,
+            });
+        }
+    }
+}
 function fileNonEmpty(filePath) {
     try {
         return fs.statSync(filePath).size > 0;
@@ -589,6 +676,10 @@ export async function runPassBody(hqRoot, deps) {
                         to: String(nextHop),
                         reason: "unanswered_timeout",
                     });
+                    if (nextAudience.kind === "user") {
+                        const originLane = laneById.get(question.lane_id) ?? readLane(hqRoot, question.lane_id);
+                        await emitAgedQuestionAtUser(summary, deps, originLane, result.record);
+                    }
                 }
             }
         }
@@ -862,6 +953,7 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
     }
 }
 async function admitQueued(hqRoot, lanes, summary, deps, now) {
+    expireAbandonedPickupValidation(hqRoot, lanes, summary, deps, now);
     // A lane whose pickup probe is still out is not admitted: its record is
     // about to be bound or failed by the pickup, and a worker spawned now
     // would keep running behind that write.

package/dist/lib/lanes/types.d.ts

@@ -257,6 +257,8 @@ export interface LaneRecord {
      * leave a running worker behind a record the probe result then rewrites.
      */
     pickup_validation_pending?: true;
+    /** When the pickup validation marker was written. */
+    pickup_validation_pending_since?: string;
     priority: number;
     worker?: string;
     /** Registry-relative directory of the resolved worker, when --worker was set. */

package/dist/lib/lanes/types.js

@@ -198,7 +198,8 @@ export const LANE_FIELD_WRITERS = {
     project_id: ["command"], story_id: ["command"], thread_id: ["creator", "command"],
     depth: ["command"], senior: ["command"], senior_history: ["command"],
     state: ["creator", "command", "watcher", "reconcile", "spawn"], queued_reason: ["creator", "command", "spawn", "reconcile"],
-    pickup_validation_pending: ["creator", "command", "spawn"],
+    pickup_validation_pending: ["creator", "command", "spawn", "reconcile"],
+    pickup_validation_pending_since: ["creator", "command", "spawn", "reconcile"],
     priority: ["command"], worker: ["creator"], worker_path: ["creator"], worker_pack: ["creator"],
     provider: ["creator"], account: ["creator", "spawn", "command"], account_history: ["command"], pending_resume: ["command", "spawn"], host: ["creator"], origin_host: ["creator"], origin_host_source: ["creator"],
     version: ["creator"], created_at: ["creator"], updated_at: ["creator"], attribution_history: ["command"],

package/dist/lib/mesh/live/daemon/doctor.d.ts

@@ -5,6 +5,7 @@
 import { type CognitoActorKind, type CognitoTokenSource } from "../../../../utils/cognito-session.js";
 import { type UnattributedEventCounts } from "../spool.js";
 import { type DaemonStateFile } from "./state.js";
+import { type LegacyListenPlatform } from "./legacy-listen.js";
 export declare const UNHEALTHY_SPOOL_AGE_MS = 60000;
 export interface DaemonDoctorReport {
     running: boolean;
@@ -54,6 +55,8 @@ export interface DaemonDoctorReport {
     };
     /** Work held or quarantined after default-derived membership was denied. */
     deviceDefaultAuthorizationDenials: number;
+    /** True when the pack-era listen unit is still on disk. */
+    legacyListenerInstalled: boolean;
 }
 export interface DaemonDoctorDeps {
     home?: string;
@@ -64,6 +67,9 @@ export interface DaemonDoctorDeps {
     env?: NodeJS.ProcessEnv;
     isProcessAlive?: (pid: number) => boolean;
     now?: () => number;
+    /** Override the legacy-listen probe (tests). */
+    legacyListenerInstalled?: boolean;
+    platform?: LegacyListenPlatform;
 }
 export declare function collectDaemonDoctor(deps?: DaemonDoctorDeps): DaemonDoctorReport;
 export declare function formatDaemonDoctor(report: DaemonDoctorReport): string[];

package/dist/lib/mesh/live/daemon/doctor.js

@@ -18,6 +18,7 @@ import { hasCurrentAcknowledgedRegistration, readHeldSessions, refWithLocalCompa
 import { readDaemonConfig } from "./config.js";
 import { pidLockStatus, readPidLock } from "./pid-lock.js";
 import { readDaemonState } from "./state.js";
+import { LEGACY_LISTENER_DOCTOR_LINE, legacyListenInstalled, } from "./legacy-listen.js";
 export const UNHEALTHY_SPOOL_AGE_MS = 60_000;
 function oldestJsonlAgeMs(filePath, nowMs) {
     if (!fs.existsSync(filePath))
@@ -144,6 +145,14 @@ export function collectDaemonDoctor(deps = {}) {
     if (presenceRefusal) {
         unhealthyReasons.push(`presence credential refused (${presenceRefusal.code}); next retry ${presenceRefusal.nextRetryAt}`);
     }
+    const platform = deps.platform ?? process.platform;
+    const legacyListener = deps.legacyListenerInstalled ??
+        (platform === "darwin" || platform === "linux"
+            ? legacyListenInstalled({ home, platform })
+            : false);
+    if (legacyListener) {
+        unhealthyReasons.push(LEGACY_LISTENER_DOCTOR_LINE);
+    }
     const auth = describeCognitoTokenSource({ home, env });
     const whoamiTokens = readPersonTokenFile(home, env);
     const daemonTokens = auth.tokenSource === "machine"
@@ -192,6 +201,7 @@ export function collectDaemonDoctor(deps = {}) {
             }
             : undefined,
         deviceDefaultAuthorizationDenials,
+        legacyListenerInstalled: legacyListener,
     };
 }
 export function formatDaemonDoctor(report) {
@@ -200,6 +210,7 @@ export function formatDaemonDoctor(report) {
         `mode: ${report.emitMode}`,
         `mqtt: ${report.mqttState}`,
         `subscription: ${report.subscribed ? "connected" : "disconnected"}`,
+        ...(report.legacyListenerInstalled ? [LEGACY_LISTENER_DOCTOR_LINE] : []),
         `companies online: ${report.companiesOnline.length ? report.companiesOnline.join(", ") : "(none)"}`,
     ];
     if (report.emitMode === "legacy") {

package/dist/lib/mesh/live/daemon/install.d.ts

@@ -235,6 +235,13 @@ export declare function installDaemonService(opts: {
     schtasks?: SchtasksRunner;
     /** Windows: terminate the recorded daemon pid when replacing a task (tests inject). */
     kill?: (pid: number) => void;
+    /** Service-manager runner for retiring the legacy listen unit (tests inject). */
+    runCommand?: (cmd: string, args: string[]) => {
+        status: number | null;
+        stdout: string;
+        stderr: string;
+    };
+    windowsLegacyTaskPresent?: boolean;
 }): InstallResult;
 export declare function uninstallDaemonService(opts: {
     platform?: DaemonInstallPlatform;

package/dist/lib/mesh/live/daemon/install.js

@@ -19,6 +19,7 @@ import { resolveDaemonAssetDir } from "./log.js";
 import { LAUNCHD_LABEL, SYSTEMD_UNIT_NAME, WINDOWS_TASK_NAME, daemonDir, daemonLogPath, daemonPidPath, } from "./paths.js";
 import { isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot, verifyHqRoot } from "./config.js";
 import { defaultPidLockDeps, pidLockStatus, readPidLock } from "./pid-lock.js";
+import { retireLegacyListen } from "./legacy-listen.js";
 /**
  * `schtasks /End` terminates the task's root process only. The daemon is
  * launched through `conhost.exe --headless`, so ending the task kills conhost
@@ -651,6 +652,15 @@ export function installDaemonService(opts) {
     const mkdirSync = opts.mkdirSync ?? fs.mkdirSync;
     mkdirSync(paths.daemonDir, { recursive: true, mode: 0o700 });
     registerTrustedHqRoot(paths.daemonDir, paths.hqRoot);
+    const retired = retireLegacyListen({
+        home: paths.home,
+        platform,
+        run: opts.runCommand,
+        windowsTaskPresent: opts.windowsLegacyTaskPresent,
+    });
+    const legacyNote = retired.removed
+        ? " Retired legacy listener ai.getindigo.hq-work-mesh-listen."
+        : "";
     if (platform === "darwin") {
         const rendered = renderLaunchdPlist(paths);
         mkdirSync(paths.launchAgentsDir, { recursive: true });
@@ -662,7 +672,7 @@ export function installDaemonService(opts) {
             paths,
             rendered,
             dest: paths.plistPath,
-            message: `Installed LaunchAgent ${LAUNCHD_LABEL} → ${paths.plistPath}`,
+            message: `Installed LaunchAgent ${LAUNCHD_LABEL} → ${paths.plistPath}${legacyNote}`,
         };
     }
     if (platform === "linux") {
@@ -682,7 +692,7 @@ export function installDaemonService(opts) {
                 dest,
                 message: `Wrote system unit template for user ${opts.systemUser ?? paths.systemUser} at ${dest}. ` +
                     `Install with: sudo cp ${dest} /etc/systemd/system/${SYSTEMD_UNIT_NAME} && ` +
-                    `sudo systemctl daemon-reload && sudo systemctl enable --now ${SYSTEMD_UNIT_NAME}`,
+                    `sudo systemctl daemon-reload && sudo systemctl enable --now ${SYSTEMD_UNIT_NAME}${legacyNote}`,
             };
         }
         const rendered = renderSystemdUserUnit(paths);
@@ -696,7 +706,7 @@ export function installDaemonService(opts) {
             paths,
             rendered,
             dest: paths.systemdUnitPath,
-            message: `Installed systemd user unit ${SYSTEMD_UNIT_NAME} → ${paths.systemdUnitPath}`,
+            message: `Installed systemd user unit ${SYSTEMD_UNIT_NAME} → ${paths.systemdUnitPath}${legacyNote}`,
         };
     }
     if (platform === "win32") {
@@ -728,9 +738,9 @@ export function installDaemonService(opts) {
             dest: paths.windowsTaskXmlPath,
             running,
             message: running
-                ? `${rootLine}Installed Scheduled Task ${WINDOWS_TASK_NAME} → ${paths.windowsTaskXmlPath} (started; ${mode})`
+                ? `${rootLine}Installed Scheduled Task ${WINDOWS_TASK_NAME} → ${paths.windowsTaskXmlPath} (started; ${mode})${legacyNote}`
                 : `${rootLine}Installed Scheduled Task ${WINDOWS_TASK_NAME} → ${paths.windowsTaskXmlPath} (${mode}); ` +
-                    `start failed: ${(started.stderr || started.stdout).trim()}. It starts at next logon.`,
+                    `start failed: ${(started.stderr || started.stdout).trim()}. It starts at next logon.${legacyNote}`,
             notice: windowsLogonNotice(paths),
         };
     }
@@ -738,7 +748,7 @@ export function installDaemonService(opts) {
         platform,
         action: "install",
         paths,
-        message: `Unsupported platform for service install; run: ${paths.nodeBinary} ${paths.hqBinary} mesh daemon run`,
+        message: `Unsupported platform for service install; run: ${paths.nodeBinary} ${paths.hqBinary} mesh daemon run${legacyNote}`,
     };
 }
 export function uninstallDaemonService(opts) {

package/dist/lib/mesh/live/daemon/legacy-listen.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Retire the pack-era work-mesh listen unit so only `hq mesh daemon` subscribes.
+ *
+ * macOS: ~/Library/LaunchAgents/ai.getindigo.hq-work-mesh-listen.plist
+ * Linux: ~/.config/systemd/user/hq-work-mesh-listen.service
+ * Windows: Scheduled Task ai.getindigo.hq-work-mesh-listen
+ */
+export type LegacyListenPlatform = "darwin" | "linux" | "win32" | "other";
+export declare const LEGACY_LISTEN_LABEL = "ai.getindigo.hq-work-mesh-listen";
+export declare const LEGACY_LISTEN_SYSTEMD_UNIT = "hq-work-mesh-listen.service";
+export declare const LEGACY_LISTEN_TASK = "ai.getindigo.hq-work-mesh-listen";
+export declare const LEGACY_LISTENER_DOCTOR_LINE = "legacy listener still installed";
+export interface CommandResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
+export type CommandRunner = (cmd: string, args: string[]) => CommandResult;
+export declare function legacyListenPlistPath(home: string): string;
+export declare function legacyListenSystemdPath(home: string): string;
+export declare function legacyListenInstalled(opts: {
+    home: string;
+    platform: LegacyListenPlatform;
+    existsSync?: (p: string) => boolean;
+}): boolean;
+/**
+ * Unload and delete the legacy listen unit when it is present.
+ * On-disk unit files are removed on every host. launchctl, systemctl, and
+ * schtasks run only for the matching platform, and only through `run` when
+ * the caller injected one (tests never hit a real service manager).
+ * Missing unit is a no-op.
+ */
+export declare function retireLegacyListen(opts: {
+    home: string;
+    platform: LegacyListenPlatform;
+    run?: CommandRunner;
+    uid?: number;
+    /** Windows task probe: true when the scheduled task is registered. */
+    windowsTaskPresent?: boolean;
+}): {
+    removed: boolean;
+};
+//# sourceMappingURL=legacy-listen.d.ts.map