@indigoai-us/hq-cli 5.166.0 → 5.168.0

package/dist/commands/lanes.js

@@ -10,6 +10,7 @@ import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { registerOutpostPrunerCommand } from "./outpost-pruner.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { resolveProcessFlagGate } from "../lib/flag-registry.js";
@@ -23,7 +24,7 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { openMeshTransport } from "../lib/mesh/client.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshEventIdentity, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
-import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, withLaneAdmissionLock, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, withLaneAdmissionLock, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { activeLaneStories, laneStories, laneStory, storyWarning, } from "../lib/lanes/stories.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
@@ -1119,7 +1120,7 @@ async function assessLaneAdmission(ctx, lane, options) {
     return admission;
 }
 function assertLaneRunsHereForAdmission(ctx, lane) {
-    if (laneRunsHere(lane, reconcileHostFromCtx(ctx)))
+    if (laneRunsHereForOperatorMutation(ctx, lane))
         return;
     throw new LanesError("lane_remote", `Lane ${lane.lane_id} is hosted remotely; run the admission command on its Outpost`, { lane_id: lane.lane_id, host: lane.host });
 }
@@ -2382,6 +2383,16 @@ function laneIsHostedHere(ctx, lane) {
     }
     return identity.kind === "id" && identity.id === lane.host.id;
 }
+function laneRunsHereForOperatorMutation(ctx, lane) {
+    if (lane.host.kind === "outpost")
+        return laneIsHostedHere(ctx, lane);
+    return laneRunsHere(lane, reconcileHostFromCtx(ctx));
+}
+function assertLaneRunsHereForOperatorMutation(ctx, lane, action) {
+    if (laneRunsHereForOperatorMutation(ctx, lane))
+        return;
+    throw new LanesError("lane_remote", `Cannot ${action} lane ${lane.lane_id} from this host; its state is owned by ${lane.host.kind}:${lane.host.id}`, { lane_id: lane.lane_id, host: lane.host, action });
+}
 async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
     if (lane.host.kind !== "outpost") {
         throw new LanesError("outpost_dispatch_failed", `Lane ${lane.lane_id} has no Outpost host to dispatch to`, { lane_id: lane.lane_id });
@@ -2896,8 +2907,7 @@ async function runMove(ctx, laneId, opts) {
         moved = await dispatchRemoteLaneMove(ctx, source, choice.host, choice.account);
     }
     else {
-        const currentHost = laneHostFromCtx(ctx);
-        throw new LanesError("lane_move_wrong_host", `Move lane ${laneId} from its current host (${source.host.kind}:${source.host.id})`, { lane_id: laneId, lane_host: source.host, current_host: currentHost });
+        throw new LanesError("lane_remote", `Cannot move lane ${laneId} from this host; its state is owned by ${source.host.kind}:${source.host.id}`, { lane_id: laneId, host: source.host, action: "move" });
     }
     printJson({
         ok: true,
@@ -2912,12 +2922,8 @@ async function runMove(ctx, laneId, opts) {
 async function commitLaneMove(ctx, laneId, target, account) {
     assertPlacementEnabled(ctx);
     const hqRoot = ctx.hqRoot();
-    const sourceHost = laneHostFromCtx(ctx);
-    const admissionHost = reconcileHostFromCtx(ctx);
     const before = readLane(hqRoot, laneId);
-    if (!laneRunsHere(before, admissionHost)) {
-        throw new LanesError("lane_move_wrong_host", `Move lane ${laneId} from its current host (${before.host.kind}:${before.host.id})`, { lane_id: laneId, lane_host: before.host, current_host: sourceHost });
-    }
+    assertLaneRunsHereForOperatorMutation(ctx, before, "move-target");
     if (before.host.kind === target.kind && before.host.id === target.id) {
         throw new LanesError("lane_move_same_host", `Lane ${laneId} is already on ${target.kind}:${target.id}`, {
             lane_id: laneId,
@@ -2971,12 +2977,7 @@ async function commitLaneMove(ctx, laneId, target, account) {
     const timeout = target.kind === "outpost" ? readLaneTimeout(hqRoot, laneId) : undefined;
     const moved = await withLaneAdmissionLock(hqRoot, before.provider, async () => {
         const current = readLane(hqRoot, laneId);
-        if (!laneRunsHere(current, admissionHost)) {
-            throw new LanesError("lane_move_conflict", `Lane ${laneId} changed hosts before the move`, {
-                lane_id: laneId,
-                host: current.host,
-            });
-        }
+        assertLaneRunsHereForOperatorMutation(ctx, current, "move-target");
         if (!laneCanMoveBeforeStart(current)) {
             throw new LanesError(current.state === "queued" ? "lane_move_started" : "lane_not_queued", `Lane ${laneId} started before the move could commit`, { lane_id: laneId, state: current.state });
         }
@@ -3216,17 +3217,15 @@ async function runAdmit(ctx, laneId, opts) {
             state: lane.state,
         });
     }
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "admit");
     const host = reconcileHostFromCtx(ctx);
-    if (!laneRunsHere(lane, host)) {
-        printJson({ ok: true, action: "admit", lane_id: laneId, admitted: false, blocked_by: "remote", lane });
-        return;
-    }
     if (lane.pickup_validation_pending === true) {
         printJson({ ok: true, action: "admit", lane_id: laneId, admitted: false, blocked_by: "pickup_validation", lane });
         return;
     }
     await withLaneAdmissionLock(hqRoot, lane.provider, async () => {
         lane = readLane(hqRoot, laneId);
+        assertLaneRunsHereForOperatorMutation(ctx, lane, "admit");
         if (lane.state !== "queued") {
             throw new LanesError("lane_not_queued", `Lane ${laneId} changed to ${lane.state} before admission`, {
                 lane_id: laneId,
@@ -3572,6 +3571,7 @@ async function runMessage(ctx, laneId, opts) {
         await dispatchOutpostLaneCommand(ctx, lane, "message", opts);
         return;
     }
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "message");
     lane = laneWithRecoveredProviderSession(hqRoot, lane);
     // An account move is refused on its own terms first: a running lane and a
     // provider without session resume get the move's named errors, not the
@@ -3847,6 +3847,7 @@ async function runResume(ctx, laneId, opts) {
         await dispatchOutpostLaneCommand(ctx, lane, "resume", opts);
         return;
     }
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "resume");
     lane = laneWithRecoveredProviderSession(hqRoot, lane);
     if (opts.model !== undefined && opts.account === undefined) {
         throw new LanesError("model_requires_account", "--model on hq lanes resume is only accepted together with --account", {});
@@ -4223,6 +4224,7 @@ async function runStoryList(ctx, laneId) {
 async function runStoryAdd(ctx, laneId, storyId, opts) {
     const hqRoot = ctx.hqRoot();
     let lane = readLane(hqRoot, laneId);
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "update story status for");
     const projectId = opts.project?.trim() || lane.project_id;
     if (!projectId)
         throw new LanesError("missing_project", "--project is required", {});
@@ -4232,7 +4234,10 @@ async function runStoryAdd(ctx, laneId, storyId, opts) {
     const at = ctx.now().toISOString();
     lane = await ensureStoryThread(ctx, lane, projectId);
     const before = lane;
-    const next = casUpdateLane(hqRoot, laneId, (current) => addCarriedStory(current, projectId, normalizedStoryId, at));
+    const next = casUpdateLane(hqRoot, laneId, (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "update story status for");
+        return addCarriedStory(current, projectId, normalizedStoryId, at);
+    });
     await commitStoryTransition(ctx, before, next, projectId, normalizedStoryId, "lane_started", "in_progress");
     const finalLane = readLane(hqRoot, laneId);
     printJson({
@@ -4249,6 +4254,7 @@ async function runStoryAdd(ctx, laneId, storyId, opts) {
 async function runStoryStart(ctx, laneId, storyId, opts) {
     const hqRoot = ctx.hqRoot();
     let lane = readLane(hqRoot, laneId);
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "update story status for");
     const target = storyCommandTarget(lane, storyId, opts.project);
     if (target.story.status === "done") {
         throw new LanesError("story_already_done", `Story ${target.projectId}/${target.storyId} is done and cannot be started again`, {
@@ -4260,7 +4266,10 @@ async function runStoryStart(ctx, laneId, storyId, opts) {
     const at = ctx.now().toISOString();
     lane = await ensureStoryThread(ctx, lane, target.projectId);
     const before = lane;
-    const next = casUpdateLane(hqRoot, laneId, (current) => updateCarriedStory(current, target.projectId, target.storyId, "in_progress", at));
+    const next = casUpdateLane(hqRoot, laneId, (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "update story status for");
+        return updateCarriedStory(current, target.projectId, target.storyId, "in_progress", at);
+    });
     await commitStoryTransition(ctx, before, next, target.projectId, target.storyId, "lane_started", "in_progress");
     const finalLane = readLane(hqRoot, laneId);
     printJson({ ok: true, action: "story.start", lane_id: laneId, project_id: target.projectId, story_id: target.storyId, status: "in_progress", story_warning: storyWarning(finalLane) ?? null, lane: finalLane });
@@ -4268,6 +4277,7 @@ async function runStoryStart(ctx, laneId, storyId, opts) {
 async function runStoryBlock(ctx, laneId, storyId, opts) {
     const hqRoot = ctx.hqRoot();
     let lane = readLane(hqRoot, laneId);
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "update story status for");
     const target = storyCommandTarget(lane, storyId, opts.project);
     if (target.story.status === "done") {
         throw new LanesError("story_already_done", `Story ${target.projectId}/${target.storyId} is done and cannot be blocked again`, {
@@ -4282,7 +4292,10 @@ async function runStoryBlock(ctx, laneId, storyId, opts) {
     const at = ctx.now().toISOString();
     lane = await ensureStoryThread(ctx, lane, target.projectId);
     const before = lane;
-    const next = casUpdateLane(hqRoot, laneId, (current) => updateCarriedStory(current, target.projectId, target.storyId, "blocked", at, { blocked_reason: reason }));
+    const next = casUpdateLane(hqRoot, laneId, (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "update story status for");
+        return updateCarriedStory(current, target.projectId, target.storyId, "blocked", at, { blocked_reason: reason });
+    });
     await commitStoryTransition(ctx, before, next, target.projectId, target.storyId, "lane_blocked", "blocked", { blocked_reason: reason });
     const finalLane = readLane(hqRoot, laneId);
     printJson({ ok: true, action: "story.block", lane_id: laneId, project_id: target.projectId, story_id: target.storyId, status: "blocked", blocked_reason: reason, story_warning: storyWarning(finalLane) ?? null, lane: finalLane });
@@ -4290,6 +4303,7 @@ async function runStoryBlock(ctx, laneId, storyId, opts) {
 async function runStoryDone(ctx, laneId, storyId, opts) {
     const hqRoot = ctx.hqRoot();
     let lane = readLane(hqRoot, laneId);
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "update story status for");
     if (!opts.verified) {
         throw new LanesError("senior_verification_required", "Only a senior may mark a story done; pass --verified after reviewing or merging it", { lane_id: laneId });
     }
@@ -4311,10 +4325,13 @@ async function runStoryDone(ctx, laneId, storyId, opts) {
     const at = ctx.now().toISOString();
     lane = await ensureStoryThread(ctx, lane, target.projectId);
     const before = lane;
-    const next = casUpdateLane(hqRoot, laneId, (current) => updateCarriedStory(current, target.projectId, target.storyId, "done", at, {
-        verified_at: at,
-        verified_by: current.senior,
-    }));
+    const next = casUpdateLane(hqRoot, laneId, (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "update story status for");
+        return updateCarriedStory(current, target.projectId, target.storyId, "done", at, {
+            verified_at: at,
+            verified_by: current.senior,
+        });
+    });
     await commitStoryTransition(ctx, before, next, target.projectId, target.storyId, "lane_done", "done", { summary: "Senior verification complete" });
     const finalLane = readLane(hqRoot, laneId);
     printJson({ ok: true, action: "story.done", lane_id: laneId, project_id: target.projectId, story_id: target.storyId, status: "done", verified: true, story_warning: storyWarning(finalLane) ?? null, lane: finalLane });
@@ -4354,6 +4371,7 @@ async function runReparent(ctx, laneId, opts) {
     const nextSenior = parseSeniorRef(opts.senior);
     assertSeniorExists(hqRoot, nextSenior, ctx);
     const lane = readLane(hqRoot, laneId);
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "reparent");
     if (isTerminalLaneState(lane.state)) {
         throw new LanesError("lane_terminal", `Cannot re-parent a lane in terminal state ${lane.state}`, { lane_id: laneId, state: lane.state });
     }
@@ -4378,6 +4396,7 @@ async function runReparent(ctx, laneId, opts) {
             continue;
         if (!walkHitsLane(hqRoot, other.senior, laneId, ctx))
             continue;
+        assertLaneRunsHereForOperatorMutation(ctx, other, "reparent descendant of");
         const oldDescendantDepth = derivedLaneDepth(hqRoot, other.senior, ctx);
         const descendantDepth = derivedLaneDepth(hqRoot, other.senior, ctx, override);
         if (descendantDepth > MAX_LANE_DEPTH) {
@@ -4395,6 +4414,7 @@ async function runReparent(ctx, laneId, opts) {
     }
     const at = ctx.now().toISOString();
     const updated = casUpdateLane(hqRoot, laneId, (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "reparent");
         const already = current.senior_history.some((entry) => entry.at === at && entry.reason === (opts.reason ?? "reparent"));
         if (already && current.depth === newDepth)
             return current;
@@ -4413,6 +4433,7 @@ async function runReparent(ctx, laneId, opts) {
     });
     for (const descendant of descendants) {
         casUpdateLane(hqRoot, descendant.laneId, (current) => {
+            assertLaneRunsHereForOperatorMutation(ctx, current, "reparent descendant of");
             if (current.depth === descendant.depth)
                 return current;
             return { ...current, depth: descendant.depth };
@@ -4487,14 +4508,226 @@ async function runLogs(ctx, laneId, opts) {
 export function stopCommittedState(state) {
     return state === "queued" ? "cancelled" : "killed";
 }
+function parseConfirmedOutpostStopLane(raw, laneId, outpostId, commandId) {
+    let remoteLane;
+    try {
+        remoteLane = parseLaneRecord(raw);
+    }
+    catch (err) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} returned an invalid lane snapshot for stop ${laneId}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: commandId,
+            cause: err instanceof Error ? err.message : String(err),
+        });
+    }
+    if (remoteLane.lane_id !== laneId ||
+        remoteLane.host.kind !== "outpost" ||
+        remoteLane.host.id !== outpostId ||
+        !isTerminalLaneState(remoteLane.state)) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not return its terminal lane ${laneId}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: commandId,
+            owner_lane_id: remoteLane.lane_id,
+            owner_host: remoteLane.host,
+            owner_state: remoteLane.state,
+        });
+    }
+    return remoteLane;
+}
+function parseRemoteCancelledQuestionIds(value, laneId, outpostId, commandId) {
+    if (!Array.isArray(value) ||
+        value.some((id) => typeof id !== "string" || id.trim() === "") ||
+        new Set(value).size !== value.length) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} returned invalid cancelled question ids for lane ${laneId}`, { lane_id: laneId, outpost_id: outpostId, command_id: commandId });
+    }
+    return value;
+}
+async function readOutpostTerminalLane(ctx, laneId, outpostId, stopCommandId) {
+    let dispatched;
+    try {
+        dispatched = await ctx.dispatchOutpostExec({
+            outpostId,
+            command: buildOutpostLaneCommand({ action: "show", laneId }),
+            timeoutSeconds: 120,
+            waitMs: 120_000,
+        });
+    }
+    catch (err) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Could not read terminal lane ${laneId} from Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: stopCommandId,
+            sync_command_id: null,
+        });
+    }
+    const commandId = dispatched.commandId?.trim();
+    if (dispatched.done !== true ||
+        !commandId ||
+        dispatched.status !== "Success" ||
+        dispatched.exitCode !== 0) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not confirm a lane read after stop ${laneId}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: stopCommandId,
+            sync_command_id: commandId || null,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+        });
+    }
+    let remote;
+    try {
+        remote = parseRemoteJson(dispatched.stdout, "Outpost lane show");
+    }
+    catch (err) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} returned an invalid lane read after stop ${laneId}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: stopCommandId,
+            sync_command_id: commandId,
+            cause: err instanceof Error ? err.message : String(err),
+        });
+    }
+    if (remote?.ok !== true || remote.action !== "show") {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not return lane ${laneId} after stop`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: stopCommandId,
+            sync_command_id: commandId,
+        });
+    }
+    return {
+        lane: parseConfirmedOutpostStopLane(remote.lane, laneId, outpostId, commandId),
+        commandId,
+    };
+}
+async function dispatchOutpostLaneStop(ctx, lane) {
+    if (lane.host.kind !== "outpost") {
+        throw new LanesError("outpost_dispatch_failed", `Lane ${lane.lane_id} has no Outpost host to dispatch stop to`, { lane_id: lane.lane_id });
+    }
+    const outpostId = lane.host.id;
+    let dispatched;
+    try {
+        dispatched = await ctx.dispatchOutpostExec({
+            outpostId,
+            command: buildOutpostLaneCommand({ action: "stop", laneId: lane.lane_id }),
+            timeoutSeconds: 120,
+            waitMs: 120_000,
+        });
+    }
+    catch (err) {
+        throw new LanesError("outpost_dispatch_failed", `Could not dispatch stop for lane ${lane.lane_id} to Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, { lane_id: lane.lane_id, outpost_id: outpostId });
+    }
+    const commandId = dispatched.commandId?.trim();
+    if (dispatched.done !== true || !commandId) {
+        throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not return a completed stop command for lane ${lane.lane_id}`, {
+            lane_id: lane.lane_id,
+            outpost_id: outpostId,
+            command_id: commandId || null,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+        });
+    }
+    const remote = parseRemoteJson(dispatched.stdout, "Outpost lane stop");
+    let state;
+    let alreadyTerminal = false;
+    let ownerLane;
+    let cancelledQuestions;
+    let syncCommandId;
+    if (remote?.error === "already_terminal") {
+        if (remote.lane_id !== lane.lane_id ||
+            !isTerminalLaneState(remote.state) ||
+            (dispatched.status !== "Success" && dispatched.status !== "Failed") ||
+            dispatched.exitCode === null ||
+            dispatched.exitCode === 0) {
+            throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} returned an invalid already-terminal result for lane ${lane.lane_id}`, { lane_id: lane.lane_id, outpost_id: outpostId, command_id: commandId });
+        }
+        state = remote.state;
+        alreadyTerminal = true;
+        const owner = await readOutpostTerminalLane(ctx, lane.lane_id, outpostId, commandId);
+        if (owner.lane.state !== state) {
+            throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} returned a different terminal state for lane ${lane.lane_id}`, {
+                lane_id: lane.lane_id,
+                outpost_id: outpostId,
+                command_id: commandId,
+                sync_command_id: owner.commandId,
+                stop_state: state,
+                owner_state: owner.lane.state,
+            });
+        }
+        ownerLane = owner.lane;
+        cancelledQuestions = [];
+        syncCommandId = owner.commandId;
+    }
+    else if (remote?.error !== undefined) {
+        throw new LanesError("outpost_remote_command_failed", typeof remote.message === "string"
+            ? remote.message
+            : `Outpost ${outpostId} rejected the stop command for lane ${lane.lane_id}`, {
+            lane_id: lane.lane_id,
+            outpost_id: outpostId,
+            command_id: commandId,
+            remote_error: remote.error,
+        });
+    }
+    else {
+        const remoteLane = remote?.lane;
+        const remoteLaneRecord = remoteLane !== null &&
+            typeof remoteLane === "object" &&
+            !Array.isArray(remoteLane)
+            ? remoteLane
+            : null;
+        if (dispatched.status !== "Success" ||
+            dispatched.exitCode !== 0 ||
+            remote?.ok !== true ||
+            remote.action !== "stop" ||
+            remoteLaneRecord?.lane_id !== lane.lane_id ||
+            (remoteLaneRecord.state !== "cancelled" && remoteLaneRecord.state !== "killed")) {
+            throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} completed exec without confirming the stop for lane ${lane.lane_id}`, {
+                lane_id: lane.lane_id,
+                outpost_id: outpostId,
+                command_id: commandId,
+                status: dispatched.status,
+                exit_code: dispatched.exitCode,
+            });
+        }
+        ownerLane = parseConfirmedOutpostStopLane(remoteLaneRecord, lane.lane_id, outpostId, commandId);
+        state = ownerLane.state;
+        cancelledQuestions = parseRemoteCancelledQuestionIds(remote.cancelled_questions, lane.lane_id, outpostId, commandId);
+    }
+    const updated = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, ownerLane);
+    printJson({
+        ok: true,
+        action: "stop",
+        lane: updated,
+        cancelled_questions: cancelledQuestions,
+        outpost_id: outpostId,
+        outpost_command_id: commandId,
+        ...(syncCommandId ? { outpost_sync_command_id: syncCommandId } : {}),
+        outpost_result: {
+            state,
+            already_terminal: alreadyTerminal,
+            status: dispatched.status,
+            exit_code: dispatched.exitCode,
+        },
+    });
+}
 async function runStop(ctx, laneId) {
     const hqRoot = ctx.hqRoot();
     const lane = readLane(hqRoot, laneId);
+    if (lane.host.kind === "outpost" && !laneRunsHereForOperatorMutation(ctx, lane)) {
+        await dispatchOutpostLaneStop(ctx, lane);
+        return;
+    }
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "stop");
     if (isTerminalLaneState(lane.state)) {
         throw new LanesError("already_terminal", `Lane ${laneId} is already ${lane.state}`, { lane_id: laneId, state: lane.state });
     }
     const at = ctx.now().toISOString();
     const updated = casUpdateLane(hqRoot, laneId, (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "stop");
         if (isTerminalLaneState(current.state)) {
             throw new LanesError("already_terminal", `Lane ${laneId} is already ${current.state}`, { lane_id: laneId, state: current.state });
         }
@@ -4531,6 +4764,7 @@ async function runAsk(ctx, opts) {
         throw new LanesError("missing_question", "--question is required", {});
     }
     const lane = readLane(hqRoot, laneId);
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "ask");
     const optionList = Array.isArray(opts.option)
         ? opts.option
         : opts.option
@@ -4659,6 +4893,10 @@ async function runQuestionsAnswer(ctx, questionId, opts) {
     const question = readQuestion(hqRoot, questionId);
     throwIfQuestionNotPending(question);
     await yieldEventLoop();
+    const askingLane = readLane(hqRoot, laneIdForAnswerDelivery(question));
+    if (laneAcceptsDropboxDelivery(askingLane)) {
+        assertLaneRunsHereForOperatorMutation(ctx, askingLane, "deliver an answer to");
+    }
     const body = requireQuestionBody(hqRoot, question);
     // A trimmed-empty --freeform is absent: it must not win over --choice and
     // must not become a freeform answer of "".
@@ -4700,7 +4938,7 @@ async function runQuestionsAnswer(ctx, questionId, opts) {
             },
         };
     });
-    const delivery = deliverAnswerToAskingLane(hqRoot, updated, choice, at);
+    const delivery = deliverAnswerToAskingLane(ctx, updated, choice, at);
     printJson({
         ok: true,
         action: "questions.answer",
@@ -4729,13 +4967,15 @@ function writeAnswerDeliveryFailed(hqRoot, laneId, questionId, err, at) {
  * Record is already durable. Delivery is best-effort onto the asking lane's
  * drop box (spec §6.5). Target is question.lane_id, never a project/story lookup.
  */
-function deliverAnswerToAskingLane(hqRoot, question, choice, at) {
+function deliverAnswerToAskingLane(ctx, question, choice, at) {
+    const hqRoot = ctx.hqRoot();
     const laneId = laneIdForAnswerDelivery(question);
     try {
         const lane = readLane(hqRoot, laneId);
         if (!laneAcceptsDropboxDelivery(lane)) {
             return { status: "recorded_only" };
         }
+        assertLaneRunsHereForOperatorMutation(ctx, lane, "deliver an answer to");
         appendDropboxMessage(hqRoot, laneId, answerDropboxMessage(question, choice, at, mintMessageId()));
         return { status: "dropped" };
     }
@@ -5146,6 +5386,7 @@ export function registerLanesCommand(parent, deps = {}) {
     const lanes = parent
         .command("lanes", { hidden: true })
         .description("Create, supervise, and steer worker lanes; routed decision queue");
+    registerOutpostPrunerCommand(lanes);
     lanes
         .command("create")
         .description("Register a lane, run admission, and return immediately")

package/dist/commands/mesh.js

@@ -14,7 +14,7 @@ import chalk from "chalk";
 import { loadCachedTokens, isMachineIdentity } from "../utils/cognito-session.js";
 import * as readline from "node:readline/promises";
 import { STORY_STATUSES, appendThreadEvent, ensureProjectThread, eventPayload, getProjectView, listActiveMembershipCompanies, listActiveThreads, patchStory, putProjectView, registerMeshProject, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
-import { closeSupersededProjectThread, ensureMissingBoardStories, ensureProjectBoard } from "../lib/mesh/project-board.js";
+import { closeSupersededProjectThread, ensureMissingBoardStories, ensureProjectBoard, formatStoryStatusChanges, mergeProjectStories, } from "../lib/mesh/project-board.js";
 import { buildPreflightFixtures } from "../lib/work-context/preflight-contract.js";
 import { createCandidatesFetcher, createMigratePoster, createOrganizePoster, createWorkSessionDeliverer, fetchCompanyLive, formatCompanyLiveTable, openMeshTransport, probeMigrationCapabilityForMemberships, requireToken, } from "../lib/mesh/client.js";
 import { clearDefaultCompany, isDefaultCompanyDisabled, readDeviceConfig, recordMigrationCapabilitySnapshot, setRepairHeldWithDefault, setDefaultCompany, } from "../lib/work-context/config.js";
@@ -307,23 +307,6 @@ function httpStatus(err) {
     }
     return undefined;
 }
-function mergeProjectStories(current, planned) {
-    const currentById = new Map(current.map((story) => [story.id, story]));
-    const plannedIds = new Set(planned.map((story) => story.id));
-    const merged = planned.map((story) => {
-        const live = currentById.get(story.id);
-        if (!live)
-            return story;
-        const status = live.status || story.status;
-        return {
-            ...story,
-            ...(status ? { status } : {}),
-            passes: status === "done" ? true : typeof live.passes === "boolean" ? live.passes : story.passes,
-            ...(live.assigneeUid ? { assigneeUid: live.assigneeUid } : {}),
-        };
-    });
-    return [...merged, ...current.filter((story) => !plannedIds.has(story.id))];
-}
 function mergeProjectRepos(current, planned) {
     const plannedPaths = new Set(planned.map((repo) => repo.path));
     return [...planned, ...current.filter((repo) => !plannedPaths.has(repo.path))];
@@ -386,6 +369,10 @@ async function runProjectSet(projectId, opts) {
         registration = ensured.registration;
     }
     else if (opts.name !== undefined || opts.description !== undefined || source !== undefined || explicitRepos !== undefined) {
+        const stories = source
+            ? mergeProjectStories(current.stories, source.stories, { resetStatus: Boolean(opts.resetStatus) })
+            : current.stories;
+        const statusChangeLine = source ? formatStoryStatusChanges(current.stories, stories) : undefined;
         try {
             view = await putProjectView(token, company.companyUid, projectId, {
                 name: opts.name?.trim() || source?.name || current.name,
@@ -394,7 +381,7 @@ async function runProjectSet(projectId, opts) {
                     : source?.description !== undefined
                         ? { description: source.description }
                         : { description: current.description }),
-                stories: source?.stories ?? current.stories,
+                stories,
                 repos: explicitRepos ?? source?.repos ?? current.repos,
                 ...(current.version !== undefined ? { expectedVersion: current.version } : {}),
             });
@@ -409,6 +396,12 @@ async function runProjectSet(projectId, opts) {
             }
             throw err;
         }
+        if (statusChangeLine) {
+            if (opts.json)
+                console.error(statusChangeLine);
+            else
+                console.log(statusChangeLine);
+        }
     }
     else {
         view = current;
@@ -1816,6 +1809,7 @@ export function registerMeshCommand(program) {
         .option("--repo <path[@branch]>", "Repository binding (repeatable)", collectRepeatable)
         .option("--channel <channelId>", "Bind the project to an existing company or project channel")
         .option("--create", "Create the Board view when the GET is a 404")
+        .option("--reset-status", "Overwrite live story status from the PRD (prints a one-line summary of changes)")
         .option("--json", "Print machine-readable JSON")
         .action((projectId, opts) => wrap(() => runProjectSet(projectId, opts))());
     project

package/dist/commands/outpost-pruner.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function registerOutpostPrunerCommand(lanes: Command): void;
+//# sourceMappingURL=outpost-pruner.d.ts.map