@indigoai-us/hq-cli 5.149.1 → 5.151.0

package/dist/commands/lanes.js

@@ -18,7 +18,7 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { openMeshTransport } from "../lib/mesh/client.js";
 import { createLaneMesh, emitLaneDecisionEvents, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
-import { AccountResolutionError, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountMaxRunning, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, isLoggedOut, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasRecordedSessionId, providerSupportsSessionResume, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, isLoggedOut, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, withLaneAdmissionLock, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { activeLaneStories, laneStories, laneStory, storyWarning, } from "../lib/lanes/stories.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
@@ -840,36 +840,25 @@ function isOverdue(hqRoot, laneId, now) {
         return false;
     return now.getTime() > at;
 }
-function compareQueueOrder(a, b) {
-    if (b.priority !== a.priority)
-        return b.priority - a.priority;
-    return a.created_at.localeCompare(b.created_at);
-}
 function admitCreate(input) {
-    const { hqRoot, provider, pinnedAccount, profileId, profileMaxConcurrent, priority, createdAt, config, } = input;
+    const { hqRoot, provider, pinnedAccount, profileId, profileMaxConcurrent, host, priority, createdAt, nowMs, config, } = input;
     const providerCfg = config.providers[provider];
     const lanes = loadAllLanes(hqRoot).filter((lane) => lane.lane_id !== input.excludeLaneId);
-    const runningProvider = lanes.filter((lane) => lane.provider === provider && lane.state === "running");
-    const queuedSame = lanes.filter((lane) => {
-        if (lane.provider !== provider || lane.state !== "queued")
-            return false;
-        if (pinnedAccount)
-            return lane.account === pinnedAccount;
-        return !lane.account;
-    });
+    const localLanes = lanes.filter((lane) => laneRunsHere(lane, host));
+    const runningProvider = lanes.filter((lane) => lane.provider === provider &&
+        (lane.state === "running" ||
+            hasActiveAdmissionReservation(lane, nowMs) ||
+            hasActivePendingResume(lane, nowMs)) &&
+        laneRunsHere(lane, host));
+    const queuedProvider = localLanes.filter((lane) => lane.provider === provider &&
+        lane.state === "queued" &&
+        !hasActiveAdmissionReservation(lane, nowMs));
     const runningCount = pinnedAccount
         ? runningProvider.filter((lane) => lane.account === pinnedAccount).length
         : runningProvider.length;
     const providerRunning = runningProvider.length;
-    const queuedCount = queuedSame.length;
+    const queuedCount = queuedProvider.length;
     const maxQueued = providerCfg.max_queued;
-    const profileRunning = profileId === undefined
-        ? 0
-        : lanes.filter((lane) => lane.worker_profile === profileId && lane.state === "running").length;
-    const atCap = providerRunning >= providerCfg.max_running ||
-        (pinnedAccount !== undefined &&
-            runningCount >= accountMaxRunning(providerCfg, pinnedAccount)) ||
-        (profileMaxConcurrent !== undefined && profileRunning >= profileMaxConcurrent);
     const synthetic = {
         schema_version: "hq-lane.v1",
         lane_id: "__incoming__",
@@ -883,19 +872,24 @@ function admitCreate(input) {
         priority,
         provider,
         account: pinnedAccount,
-        host: { kind: "local", id: "local" },
+        host: host.outpostId
+            ? { kind: "outpost", id: host.outpostId }
+            : { kind: "local", id: host.hostname },
+        ...(profileId !== undefined ? { worker_profile: profileId } : {}),
         version: 0,
         created_at: createdAt,
         updated_at: createdAt,
         attribution_history: [],
     };
-    const ranked = [...queuedSame, synthetic].sort(compareQueueOrder);
-    const first = ranked[0];
-    const isHead = first?.lane_id === "__incoming__";
-    const wouldStart = !atCap && isHead;
-    if (wouldStart)
+    const capReason = laneAdmissionCapReason(localLanes, synthetic, config, host, profileMaxConcurrent, nowMs);
+    const earlierEligible = !capReason && hasEarlierEligibleQueuedLane(localLanes, synthetic, config, host, (lane) => lane.worker_profile === undefined
+        ? undefined
+        : loadWorkerProfile(hqRoot, lane.worker_profile).meta.max_concurrent, nowMs);
+    const queuedReason = capReason ??
+        (earlierEligible ? "queue_position" : undefined);
+    if (!queuedReason)
         return { action: "start" };
-    if (queuedCount >= maxQueued) {
+    if (!input.alreadyQueued && queuedCount >= maxQueued) {
         return {
             action: "refuse",
             error: new LanesError("lane_queue_full", `Lane queue is full for ${pinnedAccount ? `account ${pinnedAccount}` : provider}`, {
@@ -906,27 +900,38 @@ function admitCreate(input) {
             }),
         };
     }
-    if (atCap) {
-        return { action: "queue", reason: isHead ? "cap" : "queue_position" };
-    }
-    return { action: "queue", reason: "queue_position" };
+    return { action: "queue", reason: queuedReason };
 }
-async function applyThrottle(hqRoot, config, ctx, current, provider, pinnedAccount) {
-    if (current.action !== "start")
+async function applyThrottle(hqRoot, config, ctx, current, provider, pinnedAccount, options = {}) {
+    if (current.action !== "start" &&
+        !(current.action === "queue" && current.reason === "queue_position"))
         return current;
     const { decision } = await decideAdmission(hqRoot, config.throttle, ctx.throttleDeps);
     if (decision.admit)
         return current;
+    if (current.action === "queue")
+        return { action: "queue", reason: "throttle" };
     const providerCfg = config.providers[provider];
+    const host = options.host ?? reconcileHostFromCtx(ctx);
+    const nowMs = options.nowMs ?? ctx.now().getTime();
     const queuedCount = loadAllLanes(hqRoot).filter((lane) => {
-        if (lane.provider !== provider || lane.state !== "queued")
+        if (lane.lane_id === options.excludeLaneId ||
+            lane.provider !== provider ||
+            lane.state !== "queued" ||
+            hasActiveAdmissionReservation(lane, nowMs) ||
+            !laneRunsHere(lane, host))
             return false;
         if (pinnedAccount)
             return lane.account === pinnedAccount;
         return !lane.account;
     }).length;
-    if (queuedCount >= providerCfg.max_queued) {
-        const running = loadAllLanes(hqRoot).filter((lane) => lane.provider === provider && lane.state === "running").length;
+    if (!options.alreadyQueued && queuedCount >= providerCfg.max_queued) {
+        const running = loadAllLanes(hqRoot).filter((lane) => lane.lane_id !== options.excludeLaneId &&
+            lane.provider === provider &&
+            (lane.state === "running" ||
+                hasActiveAdmissionReservation(lane, nowMs) ||
+                hasActivePendingResume(lane, nowMs)) &&
+            laneRunsHere(lane, host)).length;
         return {
             action: "refuse",
             error: new LanesError("lane_queue_full", `Lane queue is full for ${pinnedAccount ? `account ${pinnedAccount}` : provider}`, {
@@ -939,6 +944,45 @@ async function applyThrottle(hqRoot, config, ctx, current, provider, pinnedAccou
     }
     return { action: "queue", reason: "throttle" };
 }
+async function assessLaneAdmission(ctx, lane, options) {
+    const hqRoot = ctx.hqRoot();
+    const config = loadLanesConfig(hqRoot);
+    const account = options.account ?? lane.account;
+    const profile = lane.worker_profile
+        ? loadWorkerProfile(hqRoot, lane.worker_profile)
+        : undefined;
+    const nowMs = ctx.now().getTime();
+    let admission = admitCreate({
+        hqRoot,
+        provider: lane.provider,
+        pinnedAccount: account,
+        ...(profile
+            ? { profileId: profile.id, profileMaxConcurrent: profile.meta.max_concurrent }
+            : {}),
+        host: reconcileHostFromCtx(ctx),
+        priority: lane.priority,
+        createdAt: options.queueAt,
+        nowMs,
+        config,
+        excludeLaneId: lane.lane_id,
+        alreadyQueued: options.alreadyQueued,
+    });
+    if (admission.action === "start" ||
+        (admission.action === "queue" && admission.reason === "queue_position")) {
+        admission = await applyThrottle(hqRoot, config, ctx, admission, lane.provider, account, {
+            host: reconcileHostFromCtx(ctx),
+            excludeLaneId: lane.lane_id,
+            alreadyQueued: options.alreadyQueued,
+            nowMs,
+        });
+    }
+    return admission;
+}
+function assertLaneRunsHereForAdmission(ctx, lane) {
+    if (laneRunsHere(lane, reconcileHostFromCtx(ctx)))
+        return;
+    throw new LanesError("lane_remote", `Lane ${lane.lane_id} is hosted remotely; run the admission command on its Outpost`, { lane_id: lane.lane_id, host: lane.host });
+}
 function assertKnownOutpost(requested, known) {
     if (!known.includes(requested)) {
         throw new LanesError("unknown_outpost", `Unknown Outpost ${JSON.stringify(requested)}. Accepted: ${known.join(", ") || "(none)"}`, { accepted: known, value: requested });
@@ -954,8 +998,6 @@ function copyHookRails(fromHome, toHome) {
 function railsPresent(home) {
     return fs.existsSync(path.join(home, "hooks"));
 }
-const ADMISSION_LOCK_STALE_MS = 30_000;
-const ADMISSION_LOCK_TIMEOUT_MS = 5_000;
 /**
  * Spec §5.1: `hq lanes ask` from inside a lane can hit a binary or dist
  * being replaced mid-call (ENOENT / ETXTBSY / a module that no longer
@@ -969,83 +1011,6 @@ function yieldEventLoop() {
         setImmediate(resolve);
     });
 }
-function admissionLockPath(hqRoot, provider, pinnedAccount) {
-    const name = pinnedAccount
-        ? `${provider}-${pinnedAccount}`
-        : `${provider}-unpinned`;
-    return path.join(hqRoot, LANES_RUNS_REL, ".admission-locks", `${name}.lock`);
-}
-async function withAdmissionLock(lockPath, fn, sleep) {
-    ensureDir(path.dirname(lockPath));
-    const started = Date.now();
-    while (true) {
-        let fd;
-        try {
-            fd = fs.openSync(lockPath, "wx");
-            try {
-                fs.writeSync(fd, Buffer.from(`${process.pid}\n${Date.now()}\n`, "utf8"));
-            }
-            catch (err) {
-                fs.closeSync(fd);
-                fd = undefined;
-                throw err;
-            }
-            try {
-                await yieldEventLoop();
-                return await fn();
-            }
-            finally {
-                try {
-                    fs.closeSync(fd);
-                }
-                catch (err) {
-                    process.stderr.write(`hq lanes: admission lock close failed for ${lockPath}: ${err instanceof Error ? err.message : String(err)}\n`);
-                }
-                try {
-                    fs.unlinkSync(lockPath);
-                }
-                catch (err) {
-                    const code = err.code;
-                    if (code !== "ENOENT") {
-                        process.stderr.write(`hq lanes: admission lock unlink failed for ${lockPath}: ${err instanceof Error ? err.message : String(err)}\n`);
-                    }
-                }
-            }
-        }
-        catch (err) {
-            const code = err.code;
-            if (code !== "EEXIST")
-                throw err;
-            if (Date.now() - started > ADMISSION_LOCK_TIMEOUT_MS) {
-                throw new LanesError("store_lock_timeout", `Timed out waiting for admission lock ${lockPath}`, { path: lockPath });
-            }
-            try {
-                const raw = fs.readFileSync(lockPath, "utf8");
-                const tsLine = raw.split("\n")[1];
-                const ts = tsLine ? Number(tsLine) : NaN;
-                if (Number.isFinite(ts) && Date.now() - ts > ADMISSION_LOCK_STALE_MS) {
-                    try {
-                        fs.unlinkSync(lockPath);
-                    }
-                    catch (unlinkErr) {
-                        const unlinkCode = unlinkErr.code;
-                        if (unlinkCode !== "ENOENT")
-                            throw unlinkErr;
-                    }
-                    continue;
-                }
-            }
-            catch (statErr) {
-                const statCode = statErr.code;
-                if (statCode !== "ENOENT") {
-                    process.stderr.write(`hq lanes: stale admission-lock probe failed for ${lockPath}: ${statErr instanceof Error ? statErr.message : String(statErr)}\n`);
-                }
-            }
-            await sleep(10);
-            await yieldEventLoop();
-        }
-    }
-}
 function withCasRetry(fn, attempts = 5) {
     let last;
     for (let i = 0; i < attempts; i += 1) {
@@ -1666,6 +1631,13 @@ async function runCreate(ctx, opts) {
         }
     }
     const allowedAccounts = validatedAccounts.size > 0 ? [...validatedAccounts] : profileAccounts;
+    const balancedAdmissionAccounts = !outpostId && pinnedAccount === undefined
+        ? [...new Set(allowedAccounts ??
+                Object.entries(config.providers[provider].accounts)
+                    .filter(([id, account]) => account.enabled &&
+                    (profileAccounts === undefined || profileAccounts.includes(id)))
+                    .map(([id]) => id))]
+        : undefined;
     const threadId = meshCompany
         ? await ctx.mesh.ensureProjectThread(meshCompany, project)
         : undefined;
@@ -1704,6 +1676,7 @@ async function runCreate(ctx, opts) {
             validation = "pending";
         }
         else {
+            const admissionNowMs = ctx.now().getTime();
             admission = admitCreate({
                 hqRoot,
                 provider,
@@ -1712,14 +1685,16 @@ async function runCreate(ctx, opts) {
                 ...(profile?.meta.max_concurrent !== undefined
                     ? { profileMaxConcurrent: profile.meta.max_concurrent }
                     : {}),
+                host: reconcileHostFromCtx(ctx),
                 priority,
                 createdAt,
+                nowMs: admissionNowMs,
                 config,
             });
             if (admission.action === "refuse" && admission.error) {
                 throw admission.error;
             }
-            admission = await applyThrottle(hqRoot, config, ctx, admission, provider, pinnedAccount);
+            admission = await applyThrottle(hqRoot, config, ctx, admission, provider, pinnedAccount, { nowMs: admissionNowMs });
             if (admission.action === "refuse" && admission.error) {
                 throw admission.error;
             }
@@ -1728,6 +1703,7 @@ async function runCreate(ctx, opts) {
             ? { kind: "outpost", id: outpostId }
             : { kind: "local", id: ctx.hostname() };
         const queuedReason = admission.action === "queue" ? admission.reason : undefined;
+        const admissionReservedAt = admission.action === "start" ? ctx.now().toISOString() : undefined;
         const lane = createLane(hqRoot, {
             company,
             ...(company === null && meshCompany
@@ -1748,6 +1724,9 @@ async function runCreate(ctx, opts) {
             senior_history: [],
             state: "queued",
             queued_reason: queuedReason,
+            ...(admissionReservedAt !== undefined
+                ? { admission_reserved_at: admissionReservedAt }
+                : {}),
             priority,
             worker: resolvedWorker?.id ?? opts.worker,
             ...(resolvedWorker ? { worker_path: resolvedWorker.path } : {}),
@@ -1761,6 +1740,9 @@ async function runCreate(ctx, opts) {
                 : {}),
             provider,
             account: pinnedAccount,
+            ...(balancedAdmissionAccounts !== undefined
+                ? { admission_accounts: balancedAdmissionAccounts }
+                : {}),
             ...(model !== undefined ? { model } : {}),
             model_source: cliModel !== undefined
                 ? "cli"
@@ -1787,7 +1769,7 @@ async function runCreate(ctx, opts) {
         persisted = await persist();
     }
     else {
-        persisted = await withAdmissionLock(admissionLockPath(hqRoot, provider, accountWasExplicit ? pinnedAccount : undefined), persist, ctx.sleep);
+        persisted = await withLaneAdmissionLock(hqRoot, provider, persist, ctx.sleep);
     }
     const { lane, admission, validation } = persisted;
     const dest = runDir(hqRoot, lane.lane_id);
@@ -2160,38 +2142,54 @@ async function runPickup(ctx, opts) {
         });
         return;
     }
-    const config = loadLanesConfig(hqRoot);
-    let admission = admitCreate({
-        hqRoot,
-        provider: afterAccount.provider,
-        pinnedAccount: afterAccount.account,
-        priority: afterAccount.priority,
-        createdAt: afterAccount.created_at,
-        config,
-        excludeLaneId: afterAccount.lane_id,
-    });
-    if (admission.action === "refuse" && admission.error) {
-        throw admission.error;
-    }
-    admission = await applyThrottle(hqRoot, config, ctx, admission, afterAccount.provider, afterAccount.account);
-    if (admission.action === "refuse" && admission.error) {
-        throw admission.error;
-    }
-    let started;
-    if (admission.action === "queue") {
-        started = casUpdateLane(hqRoot, afterAccount.lane_id, (current) => {
-            if (isTerminalLaneState(current.state))
-                return current;
-            return {
-                ...current,
-                state: "queued",
-                queued_reason: admission.reason,
-            };
+    let selfTargetCancelled = false;
+    const started = await withLaneAdmissionLock(hqRoot, afterAccount.provider, async () => {
+        const current = readLane(hqRoot, afterAccount.lane_id);
+        const config = loadLanesConfig(hqRoot);
+        const nowMs = ctx.now().getTime();
+        let admission = admitCreate({
+            hqRoot,
+            provider: current.provider,
+            pinnedAccount: current.account,
+            ...(current.worker_profile !== undefined
+                ? {
+                    profileId: current.worker_profile,
+                    profileMaxConcurrent: loadWorkerProfile(hqRoot, current.worker_profile).meta.max_concurrent,
+                }
+                : {}),
+            host: reconcileHostFromCtx(ctx),
+            priority: current.priority,
+            createdAt: current.queued_at ?? current.created_at,
+            nowMs,
+            config,
+            excludeLaneId: current.lane_id,
+            alreadyQueued: true,
         });
-    }
-    else {
+        if (admission.action === "refuse" && admission.error)
+            throw admission.error;
+        admission = await applyThrottle(hqRoot, config, ctx, admission, current.provider, current.account, { host: reconcileHostFromCtx(ctx), excludeLaneId: current.lane_id, alreadyQueued: true, nowMs });
+        if (admission.action === "refuse" && admission.error)
+            throw admission.error;
+        if (admission.action === "queue") {
+            return casUpdateLane(hqRoot, current.lane_id, (live) => {
+                if (live.version !== current.version || isTerminalLaneState(live.state)) {
+                    throw new LanesError("lane_admission_conflict", `Lane ${current.lane_id} changed while pickup admission was checked`, {
+                        lane_id: current.lane_id,
+                        prepared_version: current.version,
+                        version: live.version,
+                        state: live.state,
+                    });
+                }
+                return {
+                    ...live,
+                    state: "queued",
+                    queued_reason: admission.reason ?? "throttle",
+                    queued_at: live.queued_at ?? ctx.now().toISOString(),
+                };
+            });
+        }
         try {
-            started = spawnLaneWorker(hqRoot, afterAccount, {
+            return spawnLaneWorker(hqRoot, current, {
                 env: ctx.env,
                 modelDeps: {
                     readFileSync: ctx.readFileSync,
@@ -2210,19 +2208,22 @@ async function runPickup(ctx, opts) {
         }
         catch (err) {
             if (isLanesError(err) && err.error === "outpost_self_target") {
-                const cancelled = readLane(hqRoot, afterAccount.lane_id);
-                printJson({
-                    ok: true,
-                    action: "pickup",
-                    lane_id: cancelled.lane_id,
-                    state: cancelled.state,
-                    error: "outpost_self_target",
-                    lane: cancelled,
-                });
-                return;
+                selfTargetCancelled = true;
+                return readLane(hqRoot, afterAccount.lane_id);
             }
             throw err;
         }
+    }, ctx.sleep);
+    if (selfTargetCancelled) {
+        printJson({
+            ok: true,
+            action: "pickup",
+            lane_id: started.lane_id,
+            state: started.state,
+            error: "outpost_self_target",
+            lane: started,
+        });
+        return;
     }
     printJson({
         ok: true,
@@ -2242,6 +2243,7 @@ async function runList(ctx, opts) {
         company = await ctx.resolveCompany(opts.company);
     }
     const now = ctx.now();
+    const host = reconcileHostFromCtx(ctx);
     const lanes = loadAllLanes(hqRoot)
         .filter((lane) => {
         if (state && lane.state !== state)
@@ -2258,28 +2260,42 @@ async function runList(ctx, opts) {
             return false;
         return true;
     })
-        .sort(compareQueueOrder)
-        .map((lane) => ({
-        ...lane,
-        overdue: Boolean(lane.overdue) || isOverdue(hqRoot, lane.lane_id, now),
-        stalled: Boolean(lane.stalled),
-        // Listing is observational. Reconcile owns durable liveness transitions.
-        senior_lost: lane.state === "running" && lane.senior.kind === "session" && lane.senior.id
-            ? (() => {
-                const state = sessionLiveness(hqRoot, lane.senior.id, {
-                    nowMs: now.getTime(),
-                    deps: livenessDepsFromCtx(ctx),
-                    presenceConnected: ctx.presenceConnected,
-                });
-                return state === null || state === "ended" || state === "lost";
-            })()
-            : false,
-    }));
+        .sort(compareLaneQueueOrder)
+        .map((lane) => {
+        const remoteQueued = lane.state === "queued" &&
+            lane.host.kind === "outpost" &&
+            !laneRunsHere(lane, host);
+        return {
+            ...lane,
+            ...(remoteQueued
+                ? { state: "remote", remote_state: lane.state, queued_reason: undefined }
+                : {}),
+            overdue: Boolean(lane.overdue) || isOverdue(hqRoot, lane.lane_id, now),
+            stalled: Boolean(lane.stalled),
+            // Listing is observational. Reconcile owns durable liveness transitions.
+            senior_lost: lane.state === "running" && lane.senior.kind === "session" && lane.senior.id
+                ? (() => {
+                    const state = sessionLiveness(hqRoot, lane.senior.id, {
+                        nowMs: now.getTime(),
+                        deps: livenessDepsFromCtx(ctx),
+                        presenceConnected: ctx.presenceConnected,
+                    });
+                    return state === null || state === "ended" || state === "lost";
+                })()
+                : false,
+        };
+    });
     printJson({ ok: true, action: "list", lanes });
 }
 async function runShow(ctx, laneId) {
     const hqRoot = ctx.hqRoot();
-    const lane = readLane(hqRoot, laneId);
+    const storedLane = readLane(hqRoot, laneId);
+    const remoteQueued = storedLane.state === "queued" &&
+        storedLane.host.kind === "outpost" &&
+        !laneRunsHere(storedLane, reconcileHostFromCtx(ctx));
+    const lane = remoteQueued
+        ? { ...storedLane, state: "remote", remote_state: storedLane.state, queued_reason: undefined }
+        : storedLane;
     const askDeliveryFailed = readJsonFile(askDeliveryFailedPath(hqRoot, laneId));
     printJson({
         ok: true,
@@ -2290,7 +2306,7 @@ async function runShow(ctx, laneId) {
         stalled_at: lane.stalled_at ?? null,
         stalled_reason: lane.stalled_reason ?? null,
         ask_delivery_failed: askDeliveryFailed,
-        delivery: laneDeliveryMechanism(lane),
+        delivery: laneDeliveryMechanism(storedLane),
         provider_session_id: lane.provider_session_id ?? null,
         provider_session_id_absent: lane.provider_session_id_absent ?? null,
         envelope_repair_mode: lane.envelope_repair?.mode ?? null,
@@ -2306,10 +2322,136 @@ async function runShow(ctx, laneId) {
         terminal_details: lane.terminal_details ?? null,
         last_message_at: lane.last_message_at ?? null,
         last_compaction: lane.last_compaction
-            ? { ...lane.last_compaction, after: compactionAfterUsage(lane) }
+            ? { ...lane.last_compaction, after: compactionAfterUsage(storedLane) }
             : null,
     });
 }
+function forceAdmissionAuthorized(ctx, lane) {
+    const sessionId = sessionIdFromEnv(ctx.env);
+    const callerLaneId = ctx.env.HQ_LANE_ID?.trim() || undefined;
+    if (lane.senior.kind === "lane") {
+        return callerLaneId !== undefined && callerLaneId === lane.senior.id;
+    }
+    if (!sessionId || callerLaneId !== undefined)
+        return false;
+    if (lane.senior.kind === "session")
+        return sessionId === lane.senior.id;
+    if (lane.senior.kind !== "user")
+        return false;
+    const loaded = loadSessionMeta(ctx.hqRoot(), sessionId, ctx);
+    if (loaded.status !== "ok")
+        return false;
+    const senior = loaded.doc.senior;
+    return senior === "user" ||
+        (senior !== null && typeof senior === "object" && !Array.isArray(senior) &&
+            senior.kind === "user");
+}
+async function runAdmit(ctx, laneId, opts) {
+    const hqRoot = ctx.hqRoot();
+    let lane = readLane(hqRoot, laneId);
+    if (lane.state !== "queued") {
+        throw new LanesError("lane_not_queued", `Lane ${laneId} is ${lane.state}; only a queued lane can be admitted`, {
+            lane_id: laneId,
+            state: lane.state,
+        });
+    }
+    const host = reconcileHostFromCtx(ctx);
+    if (!laneRunsHere(lane, host)) {
+        printJson({ ok: true, action: "admit", lane_id: laneId, admitted: false, blocked_by: "remote", lane });
+        return;
+    }
+    if (lane.pickup_validation_pending === true) {
+        printJson({ ok: true, action: "admit", lane_id: laneId, admitted: false, blocked_by: "pickup_validation", lane });
+        return;
+    }
+    await withLaneAdmissionLock(hqRoot, lane.provider, async () => {
+        lane = readLane(hqRoot, laneId);
+        if (lane.state !== "queued") {
+            throw new LanesError("lane_not_queued", `Lane ${laneId} changed to ${lane.state} before admission`, {
+                lane_id: laneId,
+                state: lane.state,
+            });
+        }
+        let blockedBy;
+        if (opts.force) {
+            if (!forceAdmissionAuthorized(ctx, lane)) {
+                throw new LanesError("force_not_authorized", `Only lane ${lane.senior.kind === "lane" ? lane.senior.id : lane.senior.kind === "session" ? lane.senior.id : "senior/operator"} may force admission of ${laneId}`, { lane_id: laneId, senior: lane.senior });
+            }
+            const config = loadLanesConfig(hqRoot);
+            const lanes = loadAllLanes(hqRoot).filter((row) => row.lane_id !== laneId && laneRunsHere(row, host));
+            const { decision } = await decideAdmission(hqRoot, config.throttle, ctx.throttleDeps);
+            if (!decision.admit) {
+                blockedBy = "throttle";
+            }
+            else if (hasEarlierEligibleQueuedLane(lanes, lane, config, host, (row) => row.worker_profile === undefined
+                ? undefined
+                : loadWorkerProfile(hqRoot, row.worker_profile).meta.max_concurrent)) {
+                blockedBy = "queue_position";
+            }
+        }
+        else {
+            const admission = await assessLaneAdmission(ctx, lane, {
+                queueAt: lane.queued_at ?? lane.created_at,
+                alreadyQueued: true,
+            });
+            if (admission.action === "refuse" && admission.error) {
+                throw admission.error;
+            }
+            if (admission.action === "queue")
+                blockedBy = admission.reason ?? "throttle";
+        }
+        if (blockedBy !== undefined) {
+            const updated = casUpdateLane(hqRoot, laneId, (current) => {
+                if (current.version !== lane.version || current.state !== "queued") {
+                    throw new LanesError("lane_admission_conflict", `Lane ${laneId} changed while admission was checked`, {
+                        lane_id: laneId,
+                        prepared_version: lane.version,
+                        version: current.version,
+                        state: current.state,
+                    });
+                }
+                return { ...current, queued_reason: blockedBy };
+            });
+            printJson({
+                ok: true,
+                action: "admit",
+                lane_id: laneId,
+                admitted: false,
+                blocked_by: blockedBy,
+                lane: updated,
+            });
+            return;
+        }
+        const started = spawnLaneWorker(hqRoot, lane, {
+            env: ctx.env,
+            modelDeps: {
+                readFileSync: ctx.readFileSync,
+                probe: ctx.probeProvider,
+                env: ctx.env,
+            },
+            existsSync: ctx.existsSync,
+            spawnProcess: ctx.spawnProcess,
+            proveDetached: ctx.proveDetached,
+            killProcess: ctx.killProcess,
+            now: ctx.now,
+            resolveMachineIdentity: ctx.resolveMachineIdentity,
+            runCompaction: ctx.runCompaction,
+            locateTranscript: ctx.locateTranscript,
+        });
+        const admitted = opts.force && started.state === "running"
+            ? casUpdateLane(hqRoot, laneId, (current) => ({ ...current, admitted_reason: "operator_force" }))
+            : started;
+        printJson({
+            ok: true,
+            action: "admit",
+            lane_id: laneId,
+            admitted: admitted.state === "running",
+            forced: Boolean(opts.force),
+            blocked_by: admitted.state === "running" ? null : admitted.queued_reason ?? null,
+            lane: admitted,
+        });
+    }, ctx.sleep);
+}
 /**
  * US-023: move the lane's provider session to `--account` (same provider)
  * before a resume or a message resume. Every check runs before anything is
@@ -2322,6 +2464,7 @@ async function prepareAccountMove(ctx, lane, input) {
     const hqRoot = ctx.hqRoot();
     const now = ctx.now();
     const laneId = lane.lane_id;
+    assertLaneRunsHereForAdmission(ctx, lane);
     if (lane.state === "running") {
         throw new LanesError("lane_running", `Lane ${laneId} is running; stop it or wait for it to exit before moving its session`, {
             lane_id: laneId,
@@ -2432,16 +2575,14 @@ async function prepareAccountMove(ctx, lane, input) {
     // pointed at the account whose spawn has not claimed it yet
     // (`pending_resume` set by this write, cleared by the claim), so two moves
     // into one free slot cannot both start.
-    return withAdmissionLock(admissionLockPath(hqRoot, lane.provider, target), async () => {
-        const lanes = loadAllLanes(hqRoot);
-        // A queued lane with a pending resume waits for admission and holds
-        // no slot; one in any other state with a pending resume is a move
-        // whose spawn is about to claim, and holds the slot it was granted.
-        const occupies = (row) => row.lane_id !== laneId &&
-            (row.state === "running" || (row.pending_resume !== undefined && row.state !== "queued"));
-        const onProvider = lanes.filter((row) => row.provider === lane.provider && occupies(row));
-        const atCap = onProvider.length >= providerCfg.max_running ||
-            onProvider.filter((row) => row.account === target).length >= accountMaxRunning(providerCfg, target);
+    return withLaneAdmissionLock(hqRoot, lane.provider, async () => {
+        const admission = await assessLaneAdmission(ctx, lane, {
+            account: target,
+            queueAt: at,
+        });
+        if (admission.action === "refuse" && admission.error)
+            throw admission.error;
+        const queued = admission.action === "queue";
         const moved = casUpdateLane(hqRoot, laneId, (current) => {
             // The copy and every check above were made from `lane`; a record
             // that moved on since (another move, a spawn, a cancel) invalidates
@@ -2453,6 +2594,7 @@ async function prepareAccountMove(ctx, lane, input) {
             const next = {
                 ...current,
                 account: target,
+                admission_accounts: undefined,
                 provider_session_id: sessionId,
                 provider_session_id_absent: undefined,
                 ...(input.cliModel !== undefined
@@ -2466,13 +2608,17 @@ async function prepareAccountMove(ctx, lane, input) {
                 }),
                 pending_resume: { session_id: sessionId, at, ...input.pending },
             };
-            if (atCap) {
+            if (queued) {
                 next.state = "queued";
-                next.queued_reason = "cap";
+                next.queued_reason = admission.reason ?? "throttle";
+                next.queued_at = at;
+            }
+            else {
+                next.queued_at = undefined;
             }
             return next;
         });
-        return { lane: moved, from, to: target, copy, queued: atCap };
+        return { lane: moved, from, to: target, copy, queued };
     }, ctx.sleep);
 }
 async function runMessage(ctx, laneId, opts) {
@@ -2527,6 +2673,7 @@ async function runMessage(ctx, laneId, opts) {
     };
     let resumed = null;
     let move = null;
+    let queuedOnAdmission = false;
     if (opts.account !== undefined) {
         // A moved message is always a resume on the target account: a running
         // lane (the dropbox mechanism) is refused inside prepareAccountMove.
@@ -2551,31 +2698,70 @@ async function runMessage(ctx, laneId, opts) {
         appendDropboxMessage(hqRoot, laneId, dropboxMessage);
     }
     else {
-        // Exited Claude worker with a recorded session: the message becomes the
-        // next turn of that session. It is archived under delivered/ (never the
-        // inbox, which would hand it to the drain hook a second time) and the
-        // spawn happens before any attribution write so a failed spawn leaves
-        // the record untouched.
-        resumed = spawnLaneWorker(hqRoot, lane, {
-            env: ctx.env,
-            modelDeps: {
-                readFileSync: ctx.readFileSync,
-                probe: ctx.probeProvider,
+        // Exited worker with a recorded session: queue the message when capacity
+        // is occupied, otherwise start its next turn under the shared admission lock.
+        assertLaneRunsHereForAdmission(ctx, lane);
+        resumed = await withLaneAdmissionLock(hqRoot, lane.provider, async () => {
+            const admission = await assessLaneAdmission(ctx, lane, { queueAt: at });
+            if (admission.action === "refuse" && admission.error)
+                throw admission.error;
+            if (admission.action === "queue") {
+                const sessionId = lane.provider_session_id;
+                if (!sessionId) {
+                    throw new LanesError("no_provider_session", `Lane ${laneId} has no provider session id to queue this message resume`, {
+                        lane_id: laneId,
+                        provider: lane.provider,
+                    });
+                }
+                archiveResumeMessage(hqRoot, laneId, dropboxMessage);
+                queuedOnAdmission = true;
+                return casUpdateLane(hqRoot, laneId, (current) => {
+                    if (current.version !== lane.version || current.state !== lane.state) {
+                        throw new LanesError("lane_admission_conflict", `Lane ${laneId} changed while message admission was checked`, {
+                            lane_id: laneId,
+                            prepared_version: lane.version,
+                            version: current.version,
+                            state: current.state,
+                        });
+                    }
+                    return {
+                        ...current,
+                        state: "queued",
+                        queued_reason: admission.reason ?? "throttle",
+                        queued_at: at,
+                        pending_resume: {
+                            session_id: sessionId,
+                            trigger: "message",
+                            text,
+                            message_id: messageId,
+                            compact: opts.compact !== false,
+                            at,
+                        },
+                    };
+                });
+            }
+            const started = spawnLaneWorker(hqRoot, lane, {
                 env: ctx.env,
-            },
-            existsSync: ctx.existsSync,
-            spawnProcess: ctx.spawnProcess,
-            proveDetached: ctx.proveDetached,
-            killProcess: ctx.killProcess,
-            now: ctx.now,
-            resolveMachineIdentity: ctx.resolveMachineIdentity,
-            runCompaction: ctx.runCompaction,
-            locateTranscript: ctx.locateTranscript,
-        }, {
-            trigger: { kind: "message", text, message_id: messageId },
-            compact: opts.compact !== false,
-        });
-        archiveResumeMessage(hqRoot, laneId, dropboxMessage);
+                modelDeps: {
+                    readFileSync: ctx.readFileSync,
+                    probe: ctx.probeProvider,
+                    env: ctx.env,
+                },
+                existsSync: ctx.existsSync,
+                spawnProcess: ctx.spawnProcess,
+                proveDetached: ctx.proveDetached,
+                killProcess: ctx.killProcess,
+                now: ctx.now,
+                resolveMachineIdentity: ctx.resolveMachineIdentity,
+                runCompaction: ctx.runCompaction,
+                locateTranscript: ctx.locateTranscript,
+            }, {
+                trigger: { kind: "message", text, message_id: messageId },
+                compact: opts.compact !== false,
+            });
+            archiveResumeMessage(hqRoot, laneId, dropboxMessage);
+            return started;
+        }, ctx.sleep);
     }
     // Every accepted message moves the compaction reference forward.
     let next = casUpdateLane(hqRoot, laneId, (current) => ({
@@ -2621,9 +2807,11 @@ async function runMessage(ctx, laneId, opts) {
     const drainHook = drainHookStatusFor(ctx, next);
     const deliveryStatus = move?.queued
         ? "queued_on_target_account"
-        : mechanism === "dropbox"
-            ? "awaiting_next_tool_call"
-            : "worker_spawned";
+        : queuedOnAdmission
+            ? "queued_on_admission"
+            : mechanism === "dropbox"
+                ? "awaiting_next_tool_call"
+                : "worker_spawned";
     const warning = mechanism === "dropbox" && drainHook !== null && !drainHook.registered
         ? `The drain hook is not registered in ${drainHook.path}; the running worker will not receive this message. It stays in the inbox and is delivered on the lane's next start.`
         : mechanism === "dropbox" && next.stalled === true
@@ -2718,6 +2906,9 @@ async function runResume(ctx, laneId, opts) {
     if (opts.account !== undefined && !providerSupportsSessionResume(lane.provider)) {
         throw new LanesError("provider_session_not_portable", `Provider ${lane.provider} has no session resume, so a lane cannot move between its accounts`, { lane_id: laneId, provider: lane.provider });
     }
+    if (lane.state === "queued") {
+        throw new LanesError("lane_not_resumable", `Lane ${laneId} is queued; use hq lanes admit ${laneId} to request admission`, { lane_id: laneId, state: lane.state, admission_command: `hq lanes admit ${laneId}` });
+    }
     const refusal = resumeCommandRefusal(lane);
     if (refusal !== null) {
         throw new LanesError(refusal.error, refusal.message, {
@@ -2727,6 +2918,7 @@ async function runResume(ctx, laneId, opts) {
             message: refusal.message,
         });
     }
+    assertLaneRunsHereForAdmission(ctx, lane);
     const resumedFrom = lane.state;
     const text = opts.text?.trim() ? opts.text : undefined;
     const at = ctx.now().toISOString();
@@ -2749,32 +2941,77 @@ async function runResume(ctx, laneId, opts) {
         });
         lane = move.lane;
     }
-    const resumed = move?.queued
-        ? lane
-        : spawnLaneWorker(hqRoot, lane, {
-            env: ctx.env,
-            modelDeps: {
-                readFileSync: ctx.readFileSync,
-                probe: ctx.probeProvider,
+    let queuedOnAdmission = false;
+    let resumed;
+    if (move?.queued) {
+        resumed = lane;
+    }
+    else {
+        resumed = await withLaneAdmissionLock(hqRoot, lane.provider, async () => {
+            const admission = await assessLaneAdmission(ctx, lane, { queueAt: at });
+            if (admission.action === "refuse" && admission.error)
+                throw admission.error;
+            if (admission.action === "queue") {
+                const sessionId = lane.provider_session_id;
+                if (!sessionId) {
+                    throw new LanesError("no_provider_session", `Lane ${laneId} has no provider session id to queue this resume`, {
+                        lane_id: laneId,
+                        provider: lane.provider,
+                    });
+                }
+                queuedOnAdmission = true;
+                return casUpdateLane(hqRoot, laneId, (current) => {
+                    if (current.version !== lane.version || current.state !== lane.state) {
+                        throw new LanesError("lane_admission_conflict", `Lane ${laneId} changed while resume admission was checked`, {
+                            lane_id: laneId,
+                            prepared_version: lane.version,
+                            version: current.version,
+                            state: current.state,
+                        });
+                    }
+                    return {
+                        ...current,
+                        state: "queued",
+                        queued_reason: admission.reason ?? "throttle",
+                        queued_at: at,
+                        pending_resume: {
+                            session_id: sessionId,
+                            trigger: "resume",
+                            resumed_from: resumedFrom,
+                            ...(text !== undefined ? { text } : {}),
+                            ...(messageId !== undefined ? { message_id: messageId } : {}),
+                            compact: opts.compact !== false,
+                            at,
+                        },
+                    };
+                });
+            }
+            return spawnLaneWorker(hqRoot, lane, {
                 env: ctx.env,
-            },
-            existsSync: ctx.existsSync,
-            spawnProcess: ctx.spawnProcess,
-            proveDetached: ctx.proveDetached,
-            killProcess: ctx.killProcess,
-            now: ctx.now,
-            resolveMachineIdentity: ctx.resolveMachineIdentity,
-            runCompaction: ctx.runCompaction,
-            locateTranscript: ctx.locateTranscript,
-        }, {
-            trigger: {
-                kind: "resume",
-                from: resumedFrom,
-                ...(text !== undefined ? { text } : {}),
-                ...(messageId !== undefined ? { message_id: messageId } : {}),
-            },
-            compact: opts.compact !== false,
-        });
+                modelDeps: {
+                    readFileSync: ctx.readFileSync,
+                    probe: ctx.probeProvider,
+                    env: ctx.env,
+                },
+                existsSync: ctx.existsSync,
+                spawnProcess: ctx.spawnProcess,
+                proveDetached: ctx.proveDetached,
+                killProcess: ctx.killProcess,
+                now: ctx.now,
+                resolveMachineIdentity: ctx.resolveMachineIdentity,
+                runCompaction: ctx.runCompaction,
+                locateTranscript: ctx.locateTranscript,
+            }, {
+                trigger: {
+                    kind: "resume",
+                    from: resumedFrom,
+                    ...(text !== undefined ? { text } : {}),
+                    ...(messageId !== undefined ? { message_id: messageId } : {}),
+                },
+                compact: opts.compact !== false,
+            });
+        }, ctx.sleep);
+    }
     if (text !== undefined && messageId !== undefined) {
         // Same audit copy a message resume leaves; nothing drains it. Archive only
         // after a successful spawn so a concurrent resume cannot leave a phantom.
@@ -2833,7 +3070,11 @@ async function runResume(ctx, laneId, opts) {
         message_id: messageId ?? null,
         text: text ?? null,
         delivery: "resume",
-        delivery_status: move?.queued ? "queued_on_target_account" : "worker_spawned",
+        delivery_status: move?.queued
+            ? "queued_on_target_account"
+            : queuedOnAdmission
+                ? "queued_on_admission"
+                : "worker_spawned",
         account_move: move ? accountMoveSummary(move) : null,
         resumed_session_id: resumed.last_resume?.session_id ?? null,
         last_resume: next.last_resume ?? null,
@@ -3903,6 +4144,14 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (opts) => {
         await runList(ctx, opts);
     }));
+    lanes
+        .command("admit")
+        .description("Try to admit the oldest eligible queued lane")
+        .argument("<lane-id>", "Lane id")
+        .option("--force", "Senior/operator override for provider, account, and profile caps")
+        .action(wrap(async (laneId, opts) => {
+        await runAdmit(ctx, laneId, opts);
+    }));
     lanes
         .command("watch")
         .description("Watch lane state and question changes until all lanes are terminal")