@indigoai-us/hq-cli 5.187.0 → 5.188.1

package/dist/commands/lanes.js

@@ -13,13 +13,16 @@ import * as path from "node:path";
 import { registerOutpostPrunerCommand } from "./outpost-pruner.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
+import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
 import { resolveProcessFlagGate } from "../lib/flag-registry.js";
+import { createOutpostHireGrantContext, parseOutpostHireGrantContext, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
 import { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity, resolveAdmissionHost, } from "../lib/lanes/admission-host.js";
 export { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity } from "../lib/lanes/admission-host.js";
 export { LANE_HIRE_GRANTS_FLAG };
-import { buildOutpostCapacityCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostMoveTargetCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, parseOutpostPickupPayload, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
+import { buildOutpostCapacityCommand, buildOutpostBalanceMoveCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostMoveTargetCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, buildOutpostLaneListCommand, parseOutpostPickupPayload, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
 import { buildHostCapacitySnapshot, chooseHostForLane, parseHostCapacitySnapshot, } from "../lib/lanes/host-capacity.js";
+import { BALANCE_MOVABLE_STATES, CLAUDE_ACCOUNT_BALANCE_FLAG, accountLoadsForReport, assertBalanceApplyEnabled, planClaudeBalanceMoves, selectClaudeAccount, } from "../lib/lanes/claude-account-balance.js";
 import { parseUserYaml } from "../utils/user-yaml-error.js";
 import { backfillOutpostIdentityMarker as backfillOutpostIdentityMarkerImpl, createOutpostIdentityMarkerIfMissing, validateOutpostIdentityId, } from "../lib/lanes/outpost-identity.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
@@ -53,6 +56,9 @@ export const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
 function defaultLanePlacementEnabled() {
     return resolveProcessFlagGate(LANE_OUTPOST_LOAD_BALANCING_FLAG, { fallback: false }, () => false);
 }
+function defaultLaneClaudeAccountBalanceEnabled() {
+    return resolveProcessFlagGate(CLAUDE_ACCOUNT_BALANCE_FLAG, { fallback: false }, () => false);
+}
 function defaultLaneHireGrantsEnabled(company) {
     return readLanesRegistryFlag(LANE_HIRE_GRANTS_FLAG, { company });
 }
@@ -77,7 +83,7 @@ function failJson(err) {
         if (err.error === "hire_grant_exhausted") {
             process.stderr.write(`hq lanes: ${err.message}\n`);
         }
-        printJson(err.toJSON());
+        printJson({ ...err.toJSON(), message: err.message });
         process.exit(1);
     }
     const message = err instanceof Error ? err.message : String(err);
@@ -251,6 +257,9 @@ function resolveDeps(deps = {}) {
         fetchText: deps.fetchText ?? defaultFetchText,
         lanePlacementEnabled: deps.lanePlacementEnabled ?? defaultLanePlacementEnabled,
         laneHireGrantsEnabled: deps.laneHireGrantsEnabled ?? defaultLaneHireGrantsEnabled,
+        isSsmOwnerDispatch: deps.isSsmOwnerDispatch ?? (() => isSsmRunCommandProcess()),
+        withGrantHireLocks: deps.withGrantHireLocks ?? withLaneHireLocks,
+        laneClaudeAccountBalanceEnabled: deps.laneClaudeAccountBalanceEnabled ?? defaultLaneClaudeAccountBalanceEnabled,
     };
 }
 function livenessDepsFromCtx(ctx) {
@@ -446,6 +455,81 @@ function laneHireFields(lane, lanes) {
         hire_summary: hireSummary,
     };
 }
+function outpostCliOverride(ctx, outpostId) {
+    const envKey = `HQ_LANES_OUTPOST_CLI_${outpostId.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
+    const configured = ctx.env[envKey];
+    const hqBinary = configured === undefined ? undefined : configured.trim();
+    if (configured !== undefined &&
+        (!hqBinary ||
+            !path.posix.isAbsolute(hqBinary) ||
+            hqBinary.includes("\0") ||
+            hqBinary.includes("\r") ||
+            hqBinary.includes("\n"))) {
+        throw new LanesError("outpost_lane_cli_invalid", `${envKey} must be an absolute remote executable path`, { outpost_id: outpostId });
+    }
+    return hqBinary;
+}
+function safeOwnerErrorValue(value, key = "") {
+    if (/(?:env|environment|token|secret|password|credential|authorization|api[_-]?key|access[_-]?key|private[_-]?key)/i.test(key)) {
+        return undefined;
+    }
+    if (typeof value === "string") {
+        return value
+            .replace(/\b(Bearer|Basic)\s+[^\s,;]+/gi, "$1 [redacted]")
+            .replace(/\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[A-Z0-9]{16})\b/g, "[redacted]")
+            .replace(/\b["']?([A-Z][A-Z0-9_]{1,})["']?\s*[:=]\s*["']?([^\s"',;}]+)["']?/g, "$1=[redacted]");
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => safeOwnerErrorValue(item));
+    }
+    if (value === null || typeof value !== "object")
+        return value;
+    const safe = {};
+    for (const [childKey, childValue] of Object.entries(value)) {
+        const nested = safeOwnerErrorValue(childValue, childKey);
+        if (nested !== undefined)
+            safe[childKey] = nested;
+    }
+    return safe;
+}
+function ownerErrorFromOutput(stdout) {
+    const trimmed = stdout.trim();
+    if (!trimmed)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        process.stderr.write("hq lanes: Outpost lanes dispatch returned malformed JSON\n");
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return undefined;
+    }
+    const owner = parsed;
+    if (typeof owner.error !== "string" || !/^[a-z][a-z0-9_]{0,99}$/.test(owner.error)) {
+        return undefined;
+    }
+    if (safeOwnerErrorValue(owner.error) !== owner.error)
+        return undefined;
+    if (owner.error === "already_terminal" || owner.error === "outpost_self_target") {
+        return undefined;
+    }
+    const rawDetails = {};
+    for (const [key, value] of Object.entries(owner)) {
+        if (key !== "error" && key !== "message" && key !== "details")
+            rawDetails[key] = value;
+    }
+    if (owner.details !== null && typeof owner.details === "object" && !Array.isArray(owner.details)) {
+        Object.assign(rawDetails, owner.details);
+    }
+    const details = safeOwnerErrorValue(rawDetails);
+    const message = typeof owner.message === "string" && owner.message.trim()
+        ? String(safeOwnerErrorValue(owner.message))
+        : `Outpost owner returned ${owner.error}`;
+    return { error: owner.error, message, details };
+}
 async function ownerLaneHireFields(ctx, lane) {
     if (lane.host.kind !== "outpost") {
         throw new LanesError("outpost_lane_hire_summary_invalid", "Owner summary requires an Outpost-hosted lane", {
@@ -453,17 +537,7 @@ async function ownerLaneHireFields(ctx, lane) {
         });
     }
     const outpostId = lane.host.id;
-    const outpostCliEnvKey = `HQ_LANES_OUTPOST_CLI_${outpostId.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
-    const configuredHqBinary = ctx.env[outpostCliEnvKey];
-    const hqBinary = configuredHqBinary === undefined ? undefined : configuredHqBinary.trim();
-    if (configuredHqBinary !== undefined &&
-        (!hqBinary ||
-            !path.posix.isAbsolute(hqBinary) ||
-            hqBinary.includes("\0") ||
-            hqBinary.includes("\r") ||
-            hqBinary.includes("\n"))) {
-        throw new LanesError("outpost_lane_cli_invalid", `${outpostCliEnvKey} must be an absolute remote executable path`, { outpost_id: outpostId });
-    }
+    const hqBinary = outpostCliOverride(ctx, outpostId);
     let dispatched;
     try {
         dispatched = await ctx.dispatchOutpostExec({
@@ -755,6 +829,198 @@ async function loadHostCapacitySnapshots(ctx, hqRoot, config = loadLanesConfig(h
         skippedHosts: unavailable.map(({ outpost_id, error }) => ({ outpost_id, error })),
     };
 }
+async function readOutpostLaneRecords(ctx, outpostId) {
+    let result;
+    try {
+        result = await ctx.dispatchOutpostExec({
+            outpostId,
+            command: buildOutpostLaneListCommand(),
+            timeoutSeconds: CAPACITY_PROBE_TIMEOUT_MS / 1000,
+            waitMs: CAPACITY_PROBE_TIMEOUT_MS,
+        });
+    }
+    catch (err) {
+        throw new LanesError("outpost_lane_list_unavailable", `Could not read lanes from Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, { outpost_id: outpostId });
+    }
+    if (result.done !== true || result.status !== "Success" || result.exitCode !== 0) {
+        throw new LanesError("outpost_lane_list_unavailable", `Outpost ${outpostId} did not return a successful lane list`, { outpost_id: outpostId, status: result.status, done: result.done ?? false, exit_code: result.exitCode });
+    }
+    let body;
+    try {
+        body = JSON.parse(result.stdout);
+    }
+    catch (err) {
+        throw new LanesError("outpost_lane_list_invalid", `Outpost ${outpostId} returned invalid lane-list JSON: ${dispatchErrorMessage(err)}`, { outpost_id: outpostId });
+    }
+    if (body === null || typeof body !== "object" || Array.isArray(body) ||
+        body.ok !== true ||
+        body.action !== "list" ||
+        !Array.isArray(body.lanes)) {
+        throw new LanesError("outpost_lane_list_invalid", `Outpost ${outpostId} returned a malformed lane list`, {
+            outpost_id: outpostId,
+        });
+    }
+    const listed = body.lanes;
+    const lanes = [];
+    for (const [index, value] of listed.entries()) {
+        if (value === null || typeof value !== "object" || Array.isArray(value)) {
+            throw new LanesError("outpost_lane_list_invalid", `Outpost ${outpostId} lane row ${index} is malformed`, {
+                outpost_id: outpostId,
+                index,
+            });
+        }
+        const raw = value;
+        const host = raw.host;
+        if (host === null || typeof host !== "object" || Array.isArray(host)) {
+            throw new LanesError("outpost_lane_list_invalid", `Outpost ${outpostId} lane row ${index} has no host`, {
+                outpost_id: outpostId,
+                index,
+            });
+        }
+        const rowHost = host;
+        const belongsToOutpost = rowHost.kind === "outpost" && rowHost.id === outpostId;
+        // Lanes created before an Outpost received its identity marker retain the
+        // real local hostname in their record. The remote list comes from this
+        // Outpost's own store, so preserve those local identities for accounting.
+        const hasLocalHostIdentity = rowHost.kind === "local" &&
+            typeof rowHost.id === "string" && rowHost.id.trim() !== "";
+        if (!belongsToOutpost && !hasLocalHostIdentity)
+            continue;
+        const normalized = raw.state === "remote" && raw.remote_state !== undefined
+            ? { ...raw, state: raw.remote_state }
+            : raw;
+        try {
+            lanes.push(parseLaneRecord(normalized));
+        }
+        catch (err) {
+            throw new LanesError("outpost_lane_list_invalid", `Outpost ${outpostId} returned an invalid owned lane record: ${dispatchErrorMessage(err)}`, { outpost_id: outpostId, index });
+        }
+    }
+    return lanes;
+}
+async function loadClaudeBalanceHostSnapshots(ctx, hqRoot, config) {
+    const localHost = laneHostFromCtx(ctx);
+    const localLanes = loadAllLanes(hqRoot);
+    const local = buildHostCapacitySnapshot({
+        host: localHost,
+        lanes: localLanes,
+        config,
+        existsSync: ctx.existsSync,
+        probe: ctx.probeProvider,
+        env: ctx.env,
+        now: ctx.now(),
+    });
+    const snapshots = [{
+            capacity: local,
+            lanes: localLanes.filter((lane) => lane.host.kind === localHost.kind && lane.host.id === localHost.id),
+            laneListAvailable: true,
+        }];
+    if (localHost.kind === "outpost") {
+        const hostname = ctx.hostname().trim();
+        const actualLocalHost = { kind: "local", id: hostname };
+        const actualLocalLanes = hostname
+            ? localLanes.filter((lane) => lane.host.kind === "local" && lane.host.id === hostname)
+            : [];
+        if (actualLocalLanes.length > 0) {
+            snapshots.push({
+                capacity: buildHostCapacitySnapshot({
+                    host: actualLocalHost,
+                    lanes: actualLocalLanes,
+                    config,
+                    existsSync: ctx.existsSync,
+                    probe: ctx.probeProvider,
+                    env: ctx.env,
+                    now: ctx.now(),
+                }),
+                lanes: actualLocalLanes,
+                laneListAvailable: true,
+            });
+        }
+    }
+    const unavailableHosts = [];
+    let outpostIds;
+    try {
+        outpostIds = await ctx.listOutpostIds();
+    }
+    catch (err) {
+        unavailableHosts.push({
+            host: { kind: "unknown", id: "unknown" },
+            reason: `outpost_list_unavailable: ${dispatchErrorMessage(err)}`,
+        });
+        return { snapshots, unavailableHosts };
+    }
+    if (outpostIds.length > MAX_PLACEMENT_OUTPOSTS ||
+        outpostIds.some((id) => typeof id !== "string" || id.trim() === "") ||
+        new Set(outpostIds).size !== outpostIds.length ||
+        new Set(outpostIds.map((id) => id.trim())).size !== outpostIds.length) {
+        throw new LanesError("outpost_list_invalid", "Outpost list is malformed or exceeds the placement limit", {
+            count: outpostIds.length,
+            maximum: MAX_PLACEMENT_OUTPOSTS,
+        });
+    }
+    const remoteIds = outpostIds.map((id) => id.trim())
+        .filter((id) => id !== "primary" || (localHost.kind === "outpost" && localHost.id !== "primary"))
+        .filter((id) => localHost.kind !== "outpost" || id !== localHost.id)
+        .sort();
+    const remoteResults = await mapWithConcurrency(remoteIds, OUTPOST_HIRE_SUMMARY_CONCURRENCY, async (id) => {
+        let capacity;
+        try {
+            capacity = await readOutpostCapacity(ctx, id);
+        }
+        catch (err) {
+            if (isLanesError(err) && err.error !== "outpost_capacity_unavailable") {
+                throw new LanesError("claude_account_balance_host_invalid", `Outpost ${id} returned an invalid account-capacity snapshot: ${err.message}`, { outpost_id: id, source_error: err.error });
+            }
+            return { gap: { host: { kind: "outpost", id }, reason: isLanesError(err) ? err.error : "outpost_capacity_unavailable" } };
+        }
+        let lanes = [];
+        let laneListAvailable = false;
+        try {
+            lanes = await readOutpostLaneRecords(ctx, id);
+            laneListAvailable = true;
+        }
+        catch (err) {
+            if (isLanesError(err) && err.error === "outpost_lane_list_invalid")
+                throw err;
+            unavailableHosts.push({
+                host: { kind: "outpost", id },
+                reason: isLanesError(err) ? err.error : "outpost_lane_list_unavailable",
+            });
+        }
+        const hostSnapshots = [{
+                capacity,
+                lanes: laneListAvailable
+                    ? lanes.filter((lane) => lane.host.kind === "outpost" && lane.host.id === id)
+                    : lanes,
+                laneListAvailable,
+            }];
+        if (laneListAvailable) {
+            const localGroups = new Map();
+            for (const lane of lanes) {
+                if (lane.host.kind !== "local")
+                    continue;
+                const group = localGroups.get(lane.host.id) ?? [];
+                group.push(lane);
+                localGroups.set(lane.host.id, group);
+            }
+            for (const [hostname, localHostLanes] of localGroups) {
+                hostSnapshots.push({
+                    capacity: { ...capacity, host: { kind: "local", id: hostname } },
+                    lanes: localHostLanes,
+                    laneListAvailable: true,
+                });
+            }
+        }
+        return { snapshots: hostSnapshots };
+    });
+    for (const result of remoteResults) {
+        if ("snapshots" in result)
+            snapshots.push(...result.snapshots);
+        else
+            unavailableHosts.push(result.gap);
+    }
+    return { snapshots, unavailableHosts };
+}
 function parsePlacementPolicy(raw) {
     const value = raw.trim();
     if (value === "local")
@@ -1955,6 +2221,8 @@ async function runCreate(ctx, opts) {
     let placementHostOverride;
     let autoPlacementChoice;
     let autoPlacementSkippedHosts = [];
+    let balanceHostLoad;
+    let balanceTargetHost;
     let inheritedPlacement;
     const callerLaneId = ctx.env.HQ_LANE_ID?.trim() || undefined;
     if (requestedPlacement === undefined &&
@@ -2059,6 +2327,11 @@ async function runCreate(ctx, opts) {
     }
     let pinnedAccount;
     const accountWasExplicit = Boolean(opts.account && opts.account.trim() !== "");
+    const explicitBalanceAccount = accountWasExplicit
+        ? opts.account.trim()
+        : profileAccounts === undefined
+            ? profileAccount
+            : undefined;
     if (autoPlacementChoice !== undefined) {
         pinnedAccount = autoPlacementChoice.account;
     }
@@ -2227,6 +2500,24 @@ async function runCreate(ctx, opts) {
         }
     }
     const allowedAccounts = validatedAccounts.size > 0 ? [...validatedAccounts] : profileAccounts;
+    let accountSelection;
+    if (provider === "claude" && ctx.laneClaudeAccountBalanceEnabled()) {
+        const targetHost = placementHostOverride ?? (outpostId !== undefined
+            ? { kind: "outpost", id: outpostId }
+            : laneHostFromCtx(ctx));
+        balanceTargetHost = targetHost;
+        balanceHostLoad = await loadClaudeBalanceHostSnapshots(ctx, hqRoot, config);
+        const selected = selectClaudeAccount({
+            hosts: balanceHostLoad.snapshots,
+            targetHost,
+            config,
+            ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
+            ...(explicitBalanceAccount !== undefined ? { explicitAccount: explicitBalanceAccount } : {}),
+            unavailableHosts: balanceHostLoad.unavailableHosts,
+        });
+        pinnedAccount = selected.account;
+        accountSelection = { ...selected, selected_at: ctx.now().toISOString() };
+    }
     const balancedAdmissionAccounts = !outpostId && pinnedAccount === undefined
         ? [...new Set(allowedAccounts ??
                 Object.entries(config.providers[provider].accounts)
@@ -2239,6 +2530,38 @@ async function runCreate(ctx, opts) {
     const persist = async () => {
         let admission;
         let validation;
+        if (!outpostId && provider === "claude" && explicitBalanceAccount === undefined &&
+            balanceHostLoad !== undefined && balanceTargetHost !== undefined) {
+            const localHost = laneHostFromCtx(ctx);
+            if (localHost.kind === balanceTargetHost.kind && localHost.id === balanceTargetHost.id) {
+                const localLanes = loadAllLanes(hqRoot).filter((lane) => lane.host.kind === localHost.kind && lane.host.id === localHost.id);
+                const refreshedLocal = {
+                    capacity: buildHostCapacitySnapshot({
+                        host: localHost,
+                        lanes: localLanes,
+                        config,
+                        existsSync: ctx.existsSync,
+                        probe: ctx.probeProvider,
+                        env: ctx.env,
+                        now: ctx.now(),
+                    }),
+                    lanes: localLanes,
+                    laneListAvailable: true,
+                };
+                const hosts = balanceHostLoad.snapshots.map((host) => host.capacity.host.kind === localHost.kind && host.capacity.host.id === localHost.id
+                    ? refreshedLocal
+                    : host);
+                const selected = selectClaudeAccount({
+                    hosts,
+                    targetHost: balanceTargetHost,
+                    config,
+                    ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
+                    unavailableHosts: balanceHostLoad.unavailableHosts,
+                });
+                pinnedAccount = selected.account;
+                accountSelection = { ...selected, selected_at: ctx.now().toISOString() };
+            }
+        }
         if (!outpostId && pinnedAccount === undefined) {
             pinnedAccount = resolveAccount(provider, undefined, config, {
                 hqRoot,
@@ -2337,6 +2660,7 @@ async function runCreate(ctx, opts) {
                 : {}),
             provider,
             account: pinnedAccount,
+            ...(accountSelection !== undefined ? { account_selection: accountSelection } : {}),
             ...(defaultPlacement !== undefined
                 ? { placement_default: defaultPlacement }
                 : {}),
@@ -2528,7 +2852,8 @@ async function dispatchCreatedOutpostLane(ctx, input) {
         const staged = await ctx.stageOutpostPayload(outpostId, bytes);
         const command = buildOutpostPickupCommand(staged.getUrl);
         const dispatched = await ctx.dispatchOutpostExec({ outpostId, command });
-        if (preserveQueuedOnFailure && dispatched.done !== true) {
+        const dispatchedOwnerError = ownerErrorFromOutput(dispatched.stdout);
+        if (preserveQueuedOnFailure && dispatched.done !== true && !dispatchedOwnerError) {
             throw new LanesError("outpost_dispatch_failed", "Outpost pickup exec has not finished; its outcome is unknown", {
                 outpost_id: outpostId,
                 lane_id: lane.lane_id,
@@ -2558,6 +2883,40 @@ async function dispatchCreatedOutpostLane(ctx, input) {
             await emitLaneTerminalStateSoft(ctx, cancelled);
             return cancelled;
         }
+        const ownerError = dispatchedOwnerError;
+        if (ownerError) {
+            if (preserveQueuedOnFailure) {
+                throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected lane pickup: ${ownerError.message}`, {
+                    outpost_id: outpostId,
+                    lane_id: lane.lane_id,
+                    command_id: dispatched.commandId,
+                    status: dispatched.status,
+                    done: dispatched.done ?? false,
+                    exit_code: dispatched.exitCode,
+                    ...(remote?.pickup_persisted === false ||
+                        ownerError.details.pickup_persisted === false
+                        ? { pickup_persisted: false }
+                        : {}),
+                    owner_error: ownerError,
+                });
+            }
+            const failed = markDispatchFailure(hqRoot, lane.lane_id, {
+                outpost_id: outpostId,
+                command_id: dispatched.commandId,
+                exit_code: dispatched.exitCode,
+                status: dispatched.status,
+                owner_error: ownerError,
+            });
+            await emitLaneTerminalStateSoft(ctx, failed);
+            throw new LanesError(DISPATCH_TERMINAL_REASON, `Outpost ${outpostId} rejected lane pickup: ${ownerError.message}`, {
+                outpost_id: outpostId,
+                lane_id: failed.lane_id,
+                state: failed.state,
+                terminal_reason: DISPATCH_TERMINAL_REASON,
+                command_id: dispatched.commandId,
+                owner_error: ownerError,
+            });
+        }
         if (preserveQueuedOnFailure && remote?.pickup_persisted === false) {
             throw new LanesError("outpost_dispatch_failed", "Outpost pickup finished and reported that it did not persist the lane", {
                 outpost_id: outpostId,
@@ -2725,19 +3084,24 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         throw new LanesError("outpost_dispatch_failed", `Lane ${lane.lane_id} has no Outpost host to dispatch to`, { lane_id: lane.lane_id });
     }
     const outpostId = lane.host.id;
+    const grantContext = action === "grant"
+        ? createOutpostHireGrantContext(lane, loadAllLanes(ctx.hqRoot()), await ctx.laneHireGrantsEnabled(lane.company))
+        : undefined;
     let dispatched;
     try {
         dispatched = await ctx.dispatchOutpostExec({
             outpostId,
             command: buildOutpostLaneCommand({
-                action,
+                action: action === "grant" ? "grant-target" : action,
                 laneId: lane.lane_id,
+                hqBinary: action === "grant" ? outpostCliOverride(ctx, outpostId) : undefined,
                 text: options.text,
                 project: options.project,
                 story: options.story,
                 account: options.account,
                 model: options.model,
                 hire: options.hire,
+                grantContext,
                 compact: options.compact,
             }),
         });
@@ -2745,6 +3109,18 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
     catch (err) {
         throw new LanesError("outpost_dispatch_failed", `Could not dispatch ${action} for lane ${lane.lane_id} to Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, { lane_id: lane.lane_id, outpost_id: outpostId });
     }
+    const ownerError = ownerErrorFromOutput(dispatched.stdout);
+    if (ownerError) {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the ${action} command: ${ownerError.message}`, {
+            lane_id: lane.lane_id,
+            outpost_id: outpostId,
+            command_id: dispatched.commandId,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+            owner_error: ownerError,
+        });
+    }
     if (dispatched.done !== true ||
         dispatched.status !== "Success" ||
         dispatched.exitCode !== 0) {
@@ -2759,13 +3135,11 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
     }
     const remote = parseRemoteJson(dispatched.stdout, "Outpost lane command");
     if (remote?.error !== undefined) {
-        throw new LanesError("outpost_remote_command_failed", typeof remote.message === "string"
-            ? remote.message
-            : `Outpost ${outpostId} rejected the ${action} command`, {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the ${action} command`, {
             lane_id: lane.lane_id,
             outpost_id: outpostId,
             command_id: dispatched.commandId,
-            remote_error: remote.error,
+            owner_error: ownerErrorFromOutput(dispatched.stdout),
         });
     }
     const resultConfirmed = remote !== null &&
@@ -3113,6 +3487,8 @@ async function runCapacity(ctx) {
         lanes: loadAllLanes(hqRoot),
         config: loadLanesConfig(hqRoot),
         existsSync: ctx.existsSync,
+        probe: ctx.probeProvider,
+        env: ctx.env,
         now: ctx.now(),
     });
     printJson(snapshot);
@@ -3385,6 +3761,9 @@ async function commitLaneMove(ctx, laneId, target, account) {
                 outcome: "unknown",
                 ...(commandId !== undefined ? { command_id: commandId } : {}),
                 check_command: checkCommand,
+                ...(dispatchDetails.owner_error !== undefined
+                    ? { owner_error: dispatchDetails.owner_error }
+                    : {}),
             });
         }
         let restored = false;
@@ -3425,6 +3804,9 @@ async function commitLaneMove(ctx, laneId, target, account) {
             source_host: before.host,
             target_host: target,
             source_restored: restored,
+            ...(dispatchDetails.owner_error !== undefined
+                ? { owner_error: dispatchDetails.owner_error }
+                : {}),
             ...(rollbackError !== undefined
                 ? { rollback_error: dispatchErrorMessage(rollbackError) }
                 : {}),
@@ -3454,6 +3836,18 @@ async function dispatchRemoteLaneMove(ctx, source, target, account) {
     catch (err) {
         throw new LanesError("lane_move_dispatch_failed", `Could not ask Outpost ${source.host.id} to move lane ${source.lane_id}: ${dispatchErrorMessage(err)}`, { lane_id: source.lane_id, source_outpost: source.host.id });
     }
+    const ownerError = ownerErrorFromOutput(dispatched.stdout);
+    if (ownerError) {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${source.host.id} rejected the lane move: ${ownerError.message}`, {
+            lane_id: source.lane_id,
+            source_outpost: source.host.id,
+            command_id: dispatched.commandId,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+            owner_error: ownerError,
+        });
+    }
     if (dispatched.done !== true || dispatched.status !== "Success" || dispatched.exitCode !== 0) {
         throw new LanesError("lane_move_dispatch_failed", `Outpost ${source.host.id} did not confirm the lane move`, {
             lane_id: source.lane_id,
@@ -3573,40 +3967,54 @@ function callerMatchesSenior(ctx, seniorRef) {
 function forceAdmissionAuthorized(ctx, lane) {
     return callerMatchesSenior(ctx, lane.senior);
 }
-async function runGrant(ctx, laneId, opts) {
-    if (opts.hire === undefined) {
-        throw new LanesError("missing_hire_grant", "--hire is required", {});
-    }
-    const hireGrant = parseHireGrant(opts.hire);
+async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContext) {
     const hqRoot = ctx.hqRoot();
     const initial = readLane(hqRoot, laneId);
-    if (!callerMatchesSenior(ctx, initial.senior)) {
+    if (authorization === "senior" && !callerMatchesSenior(ctx, initial.senior)) {
         throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: initial.senior });
     }
-    if (initial.host.kind === "outpost" && !laneRunsHere(initial, reconcileHostFromCtx(ctx))) {
-        await dispatchOutpostLaneCommand(ctx, initial, "grant", { hire: String(hireGrant) });
-        return;
+    if (authorization === "ssm-owner-dispatch" &&
+        (initial.host.kind !== "outpost" || !laneIsHostedHere(ctx, initial))) {
+        throw new LanesError("lane_remote", `Outpost grant dispatch cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: initial.host });
+    }
+    if (authorization === "ssm-owner-dispatch" &&
+        (!grantContext || !sameHireGrantSenior(initial.senior, grantContext.expected_senior))) {
+        throw new LanesError("hire_grant_senior_changed", `Lane ${laneId}'s senior changed after the primary authorized its grant update`, { lane_id: laneId, current_senior: initial.senior });
     }
-    const enforce = await ctx.laneHireGrantsEnabled(initial.company);
+    const enforce = grantContext?.enforcement_enabled ??
+        await ctx.laneHireGrantsEnabled(initial.company);
     const lockedLaneIds = [
         laneId,
         ...(initial.senior.kind === "lane" && initial.senior.id
             ? [initial.senior.id]
             : []),
     ];
-    const updated = withLaneHireLocks(hqRoot, lockedLaneIds, () => {
+    const updated = ctx.withGrantHireLocks(hqRoot, lockedLaneIds, () => {
         const current = readLane(hqRoot, laneId);
-        if (!callerMatchesSenior(ctx, current.senior)) {
+        if (authorization === "senior" && !callerMatchesSenior(ctx, current.senior)) {
             throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(current.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: current.senior });
         }
-        const hierarchy = loadAllLanes(hqRoot);
+        if (authorization === "ssm-owner-dispatch" &&
+            (current.host.kind !== "outpost" || !laneIsHostedHere(ctx, current))) {
+            throw new LanesError("lane_remote", `Outpost grant dispatch cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: current.host });
+        }
+        if (authorization === "ssm-owner-dispatch" &&
+            (!grantContext || !sameHireGrantSenior(current.senior, grantContext.expected_senior))) {
+            throw new LanesError("hire_grant_senior_changed", `Lane ${laneId}'s senior changed before the Outpost applied the grant update`, { lane_id: laneId, current_senior: current.senior });
+        }
+        const hierarchy = grantContext?.hierarchy ?? loadAllLanes(hqRoot);
         if (enforce && current.senior.kind === "lane") {
             if (!current.senior.id) {
                 throw new LanesError("hire_grant_senior_invalid", `Lane ${laneId} has a lane senior without an id`, {
                     lane_id: laneId,
                 });
             }
-            const parent = readLane(hqRoot, current.senior.id);
+            const parent = hierarchy.find((lane) => lane.lane_id === current.senior.id);
+            if (!parent) {
+                throw new LanesError(authorization === "ssm-owner-dispatch"
+                    ? "hire_grant_context_invalid"
+                    : "hire_grant_senior_invalid", `Lane ${laneId}'s senior lane is missing from the grant hierarchy`, { lane_id: laneId, senior_lane_id: current.senior.id });
+            }
             if (isTerminalLaneState(parent.state)) {
                 throw new LanesError("hire_grant_senior_inactive", `Senior lane ${parent.lane_id} is ${parent.state} and cannot change grants`, { senior_lane_id: parent.lane_id, state: parent.state });
             }
@@ -3644,9 +4052,44 @@ async function runGrant(ctx, laneId, opts) {
             hire_grant: hireGrant,
         }));
     });
-    const fields = laneHireFields(updated, loadAllLanes(hqRoot));
+    return updated;
+}
+function printGrantResult(hqRoot, updated, hierarchy) {
+    const fields = laneHireFields(updated, hierarchy ?? loadAllLanes(hqRoot));
     printJson({ ok: true, action: "grant", lane_id: updated.lane_id, lane: updated, ...fields });
 }
+async function runGrant(ctx, laneId, opts) {
+    if (opts.hire === undefined) {
+        throw new LanesError("missing_hire_grant", "--hire is required", {});
+    }
+    const hireGrant = parseHireGrant(opts.hire);
+    const hqRoot = ctx.hqRoot();
+    const initial = readLane(hqRoot, laneId);
+    if (!callerMatchesSenior(ctx, initial.senior)) {
+        throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: initial.senior });
+    }
+    if (initial.host.kind === "outpost" && !laneRunsHere(initial, reconcileHostFromCtx(ctx))) {
+        await dispatchOutpostLaneCommand(ctx, initial, "grant", { hire: String(hireGrant) });
+        return;
+    }
+    const updated = await applyHireGrant(ctx, laneId, hireGrant, "senior");
+    printGrantResult(hqRoot, updated);
+}
+async function runGrantOwnerTarget(ctx, laneId, opts) {
+    if (!ctx.isSsmOwnerDispatch()) {
+        throw new LanesError("hire_grant_dispatch_unauthorized", "The Outpost grant target is available only to an SSM Run Command dispatch", { lane_id: laneId });
+    }
+    if (opts.hire === undefined) {
+        throw new LanesError("missing_hire_grant", "--hire is required", {});
+    }
+    if (opts.grantContext === undefined) {
+        throw new LanesError("hire_grant_context_invalid", "--grant-context is required", { lane_id: laneId });
+    }
+    const hireGrant = parseHireGrant(opts.hire);
+    const grantContext = parseOutpostHireGrantContext(opts.grantContext, laneId);
+    const hqRoot = ctx.hqRoot();
+    printGrantResult(hqRoot, await applyHireGrant(ctx, laneId, hireGrant, "ssm-owner-dispatch", grantContext), grantContext.hierarchy);
+}
 async function runBackfillGrants(ctx, opts) {
     if (opts.apply && opts.dryRun) {
         throw new LanesError("hire_grant_backfill_mode_conflict", "Pass either --dry-run or --apply, not both", {});
@@ -4062,13 +4505,15 @@ async function prepareAccountMove(ctx, lane, input) {
     // (`pending_resume` set by this write, cleared by the claim), so two moves
     // into one free slot cannot both start.
     return withLaneAdmissionLock(hqRoot, lane.provider, async () => {
-        const admission = await assessLaneAdmission(ctx, lane, {
-            account: target,
-            queueAt: at,
-        });
-        if (admission.action === "refuse" && admission.error)
+        const admission = input.deferTurnStart
+            ? undefined
+            : await assessLaneAdmission(ctx, lane, {
+                account: target,
+                queueAt: at,
+            });
+        if (admission?.action === "refuse" && admission.error)
             throw admission.error;
-        const queued = admission.action === "queue";
+        const queued = admission?.action === "queue";
         const moved = await withResumeHireAdmission(ctx, lane, () => casUpdateLane(hqRoot, laneId, (current) => {
             // The copy and every check above were made from `lane`; a record
             // that moved on since (another move, a spawn, a cancel) invalidates
@@ -4080,6 +4525,7 @@ async function prepareAccountMove(ctx, lane, input) {
             const next = {
                 ...current,
                 account: target,
+                ...(input.accountSelection !== undefined ? { account_selection: input.accountSelection } : {}),
                 admission_accounts: undefined,
                 provider_session_id: sessionId,
                 provider_session_id_absent: undefined,
@@ -4092,11 +4538,16 @@ async function prepareAccountMove(ctx, lane, input) {
                     at,
                     reason: SESSION_MOVE_REASON,
                 }),
-                pending_resume: { session_id: sessionId, at, ...input.pending },
+                pending_resume: input.deferTurnStart
+                    ? undefined
+                    : { session_id: sessionId, at, ...input.pending },
             };
-            if (queued) {
+            if (input.deferTurnStart) {
+                next.state = current.state;
+            }
+            else if (queued) {
                 next.state = "queued";
-                next.queued_reason = admission.reason ?? "throttle";
+                next.queued_reason = admission?.reason ?? "throttle";
                 next.queued_at = at;
             }
             else {
@@ -4107,6 +4558,54 @@ async function prepareAccountMove(ctx, lane, input) {
         return { lane: moved, from, to: target, copy, queued };
     }, ctx.sleep);
 }
+async function selectAutomaticClaudeResumeAccount(ctx, lane) {
+    if (lane.provider !== "claude")
+        return undefined;
+    if (!ctx.laneClaudeAccountBalanceEnabled()) {
+        if (lane.account === undefined)
+            return undefined;
+        const config = loadLanesConfig(ctx.hqRoot());
+        const currentConfig = config.providers.claude.accounts[lane.account];
+        if (currentConfig === undefined || !currentConfig.enabled) {
+            throw new AccountResolutionError(currentConfig === undefined ? "unknown_account" : "account_disabled", currentConfig === undefined
+                ? `Lane ${lane.lane_id} records account ${JSON.stringify(lane.account)} which is not configured for claude`
+                : `Account ${JSON.stringify(lane.account)} is unavailable for claude`, { provider: "claude", account: lane.account });
+        }
+        if (accountStatus("claude", lane.account, config, {
+            existsSync: ctx.existsSync,
+            probe: ctx.probeProvider,
+            env: ctx.env,
+        }).logged_in === false) {
+            throw new LanesError("account_not_logged_in", `Account ${lane.account} for claude is not logged in`, { provider: "claude", account: lane.account, lane_id: lane.lane_id });
+        }
+        return undefined;
+    }
+    const hqRoot = ctx.hqRoot();
+    const config = loadLanesConfig(hqRoot);
+    const currentConfig = lane.account === undefined
+        ? undefined
+        : config.providers.claude.accounts[lane.account];
+    const currentLogin = lane.account === undefined || currentConfig === undefined
+        ? false
+        : accountStatus("claude", lane.account, config, {
+            existsSync: ctx.existsSync,
+            probe: ctx.probeProvider,
+            env: ctx.env,
+        }).logged_in;
+    const accountNeedsRepair = currentConfig?.enabled !== true || currentLogin === false;
+    const mayRebalance = BALANCE_MOVABLE_STATES.includes(lane.state);
+    if (!accountNeedsRepair && !mayRebalance)
+        return undefined;
+    const balanceHosts = await loadClaudeBalanceHostSnapshots(ctx, hqRoot, config);
+    const selected = selectClaudeAccount({
+        hosts: balanceHosts.snapshots,
+        targetHost: lane.host,
+        config,
+        ...(lane.admission_accounts !== undefined ? { allowedAccounts: lane.admission_accounts } : {}),
+        unavailableHosts: balanceHosts.unavailableHosts,
+    });
+    return { ...selected, selected_at: ctx.now().toISOString() };
+}
 async function runMessage(ctx, laneId, opts) {
     const hqRoot = ctx.hqRoot();
     const text = opts.text;
@@ -4184,6 +4683,31 @@ async function runMessage(ctx, laneId, opts) {
             archiveResumeMessage(hqRoot, laneId, dropboxMessage);
         }
     }
+    else if (mechanism === "resume") {
+        const selection = await selectAutomaticClaudeResumeAccount(ctx, lane);
+        if (selection !== undefined) {
+            if (selection.account !== lane.account) {
+                move = await prepareAccountMove(ctx, lane, {
+                    account: selection.account,
+                    cliModel: undefined,
+                    ...(resumeProfile !== undefined ? { workerProfile: resumeProfile.profile } : {}),
+                    pending: {
+                        trigger: "message",
+                        text,
+                        message_id: messageId,
+                        compact: opts.compact !== false,
+                    },
+                    accountSelection: selection,
+                });
+                lane = move.lane;
+                if (move.queued)
+                    archiveResumeMessage(hqRoot, laneId, dropboxMessage);
+            }
+            else {
+                lane = persistClaudeAccountSelection(hqRoot, lane, selection);
+            }
+        }
+    }
     if (resumeProfile !== undefined) {
         if (opts.account === undefined)
             validateResumeProfileModel(ctx, lane, resumeProfile.profile);
@@ -4357,6 +4881,150 @@ function accountMoveSummary(move) {
         target_dir: move.copy.target_dir,
     };
 }
+function persistClaudeAccountSelection(hqRoot, lane, selection) {
+    return casUpdateLane(hqRoot, lane.lane_id, (current) => {
+        if (current.version !== lane.version || current.state !== lane.state || current.account !== lane.account) {
+            throw new LanesError("claude_account_balance_selection_conflict", `Lane ${lane.lane_id} changed while Claude account balance was being selected`, {
+                lane_id: lane.lane_id,
+                prepared_version: lane.version,
+                version: current.version,
+                state: current.state,
+                account: current.account ?? null,
+            });
+        }
+        return { ...current, account_selection: selection };
+    });
+}
+async function applyClaudeBalanceMove(ctx, suggestion) {
+    const currentHost = reconcileHostFromCtx(ctx);
+    const suggestionRunsHere = suggestion.host.kind === "outpost"
+        ? currentHost.outpostId === suggestion.host.id
+        : currentHost.outpostId === null && currentHost.hostname === suggestion.host.id;
+    if (suggestion.host.kind === "outpost" && !suggestionRunsHere) {
+        let result;
+        try {
+            result = await ctx.dispatchOutpostExec({
+                outpostId: suggestion.host.id,
+                command: buildOutpostBalanceMoveCommand({
+                    laneId: suggestion.lane_id,
+                    account: suggestion.to,
+                    fromAccount: suggestion.from,
+                    expectedState: suggestion.state,
+                }),
+                timeoutSeconds: 120,
+                waitMs: 120_000,
+            });
+        }
+        catch (err) {
+            throw new LanesError("claude_account_balance_move_failed", `Could not move lane ${suggestion.lane_id} on Outpost ${suggestion.host.id}: ${dispatchErrorMessage(err)}`, { lane_id: suggestion.lane_id, host: suggestion.host, account: suggestion.to });
+        }
+        if (result.done !== true || result.status !== "Success" || result.exitCode !== 0) {
+            throw new LanesError("claude_account_balance_move_failed", `Outpost ${suggestion.host.id} did not confirm the account move for lane ${suggestion.lane_id}`, { lane_id: suggestion.lane_id, host: suggestion.host, account: suggestion.to, status: result.status, exit_code: result.exitCode });
+        }
+        const remote = parseRemoteJson(result.stdout, "Claude account balance move");
+        if (remote?.ok !== true || remote.action !== "balance-move-target" ||
+            remote.lane_id !== suggestion.lane_id || remote.from !== suggestion.from ||
+            remote.account !== suggestion.to ||
+            remote.state !== suggestion.state) {
+            throw new LanesError("claude_account_balance_move_unconfirmed", `Outpost ${suggestion.host.id} returned an invalid account-move result`, {
+                lane_id: suggestion.lane_id,
+                host: suggestion.host,
+                account: suggestion.to,
+            });
+        }
+        return { lane_id: suggestion.lane_id, host: suggestion.host, from: suggestion.from, to: suggestion.to, state: suggestion.state };
+    }
+    const lane = laneWithRecoveredProviderSession(ctx.hqRoot(), readLane(ctx.hqRoot(), suggestion.lane_id));
+    if (lane.state === "running") {
+        throw new LanesError("lane_running", `Lane ${lane.lane_id} is running; balance never moves a running turn`, {
+            lane_id: lane.lane_id,
+            state: lane.state,
+        });
+    }
+    if (lane.host.kind !== suggestion.host.kind || lane.host.id !== suggestion.host.id ||
+        lane.account !== suggestion.from || lane.state !== suggestion.state) {
+        throw new LanesError("claude_account_balance_lane_changed", `Lane ${lane.lane_id} changed after balance was calculated`, {
+            lane_id: lane.lane_id,
+            host: lane.host,
+            account: lane.account ?? null,
+        });
+    }
+    if (!BALANCE_MOVABLE_STATES.includes(lane.state)) {
+        throw new LanesError("claude_account_balance_state_not_movable", `Lane ${lane.lane_id} is no longer between turns`, {
+            lane_id: lane.lane_id,
+            state: lane.state,
+        });
+    }
+    const moved = await prepareAccountMove(ctx, lane, {
+        account: suggestion.to,
+        cliModel: undefined,
+        deferTurnStart: true,
+    });
+    return { lane_id: moved.lane.lane_id, host: moved.lane.host, from: moved.from ?? suggestion.from, to: moved.to, state: moved.lane.state };
+}
+async function runClaudeBalanceMoveTarget(ctx, laneId, opts) {
+    assertBalanceApplyEnabled(ctx.laneClaudeAccountBalanceEnabled());
+    const lane = laneWithRecoveredProviderSession(ctx.hqRoot(), readLane(ctx.hqRoot(), laneId));
+    assertLaneRunsHereForOperatorMutation(ctx, lane, "balance-move-target");
+    if (lane.provider !== "claude") {
+        throw new LanesError("claude_account_balance_provider_mismatch", `Lane ${laneId} does not use Claude`, {
+            lane_id: laneId,
+            provider: lane.provider,
+        });
+    }
+    const expectedFrom = opts.fromAccount?.trim();
+    if (!expectedFrom) {
+        throw new LanesError("claude_account_balance_source_invalid", "Balance move requires --from-account <id>", {
+            lane_id: laneId,
+        });
+    }
+    if (lane.account !== expectedFrom) {
+        throw new LanesError("claude_account_balance_source_changed", `Lane ${laneId} no longer uses the planned source account`, {
+            lane_id: laneId,
+            expected_account: expectedFrom,
+            actual_account: lane.account ?? null,
+        });
+    }
+    const expectedState = opts.expectedState?.trim();
+    if (!expectedState) {
+        throw new LanesError("claude_account_balance_state_invalid", "Balance move requires --expected-state <state>", {
+            lane_id: laneId,
+        });
+    }
+    if (lane.state !== expectedState) {
+        throw new LanesError("claude_account_balance_state_changed", `Lane ${laneId} changed state after balance was calculated`, {
+            lane_id: laneId,
+            expected_state: expectedState,
+            actual_state: lane.state,
+        });
+    }
+    if (!BALANCE_MOVABLE_STATES.includes(lane.state) || lane.pending_resume !== undefined) {
+        throw new LanesError("claude_account_balance_state_not_movable", `Lane ${laneId} is not between turns`, {
+            lane_id: laneId,
+            state: lane.state,
+            pending_resume: lane.pending_resume !== undefined,
+        });
+    }
+    const account = opts.account?.trim();
+    if (!account) {
+        throw new LanesError("claude_account_balance_account_invalid", "Balance move requires --account <id>", {
+            lane_id: laneId,
+        });
+    }
+    const moved = await prepareAccountMove(ctx, lane, {
+        account,
+        cliModel: undefined,
+        deferTurnStart: true,
+    });
+    printJson({
+        ok: true,
+        action: "balance-move-target",
+        lane_id: laneId,
+        from: moved.from,
+        state: moved.lane.state,
+        account: moved.lane.account,
+    });
+}
 function laneWithRecoveredProviderSession(hqRoot, lane) {
     if (lane.provider === "grok")
         return lane;
@@ -4456,6 +5124,9 @@ async function runResume(ctx, laneId, opts) {
     if (resumeProfile !== undefined && opts.account === undefined) {
         validateResumeProfileModel(ctx, lane, resumeProfile.profile);
     }
+    const automaticAccountSelection = opts.account === undefined
+        ? await selectAutomaticClaudeResumeAccount(ctx, lane)
+        : undefined;
     let move = null;
     if (opts.account !== undefined) {
         move = await prepareAccountMove(ctx, lane, {
@@ -4472,6 +5143,27 @@ async function runResume(ctx, laneId, opts) {
         });
         lane = move.lane;
     }
+    else if (automaticAccountSelection !== undefined) {
+        if (automaticAccountSelection.account !== lane.account) {
+            move = await prepareAccountMove(ctx, lane, {
+                account: automaticAccountSelection.account,
+                cliModel: undefined,
+                ...(resumeProfile !== undefined ? { workerProfile: resumeProfile.profile } : {}),
+                pending: {
+                    trigger: "resume",
+                    resumed_from: resumedFrom,
+                    ...(text !== undefined ? { text } : {}),
+                    ...(messageId !== undefined ? { message_id: messageId } : {}),
+                    compact: opts.compact !== false,
+                },
+                accountSelection: automaticAccountSelection,
+            });
+            lane = move.lane;
+        }
+        else {
+            lane = persistClaudeAccountSelection(hqRoot, lane, automaticAccountSelection);
+        }
+    }
     lane = recordResumeSetup(ctx, lane, {
         ...(resumeProfile !== undefined ? { profile: resumeProfile } : {}),
         ...(requestedMeshCompany !== undefined
@@ -5212,6 +5904,16 @@ async function readOutpostTerminalLane(ctx, laneId, outpostId, stopCommandId) {
         !commandId ||
         dispatched.status !== "Success" ||
         dispatched.exitCode !== 0) {
+        const ownerError = ownerErrorFromOutput(dispatched.stdout);
+        if (ownerError) {
+            throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the lane read after stop: ${ownerError.message}`, {
+                lane_id: laneId,
+                outpost_id: outpostId,
+                command_id: stopCommandId,
+                sync_command_id: commandId || null,
+                owner_error: ownerError,
+            });
+        }
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not confirm a lane read after stop ${laneId}`, {
             lane_id: laneId,
             outpost_id: outpostId,
@@ -5235,6 +5937,16 @@ async function readOutpostTerminalLane(ctx, laneId, outpostId, stopCommandId) {
             cause: err instanceof Error ? err.message : String(err),
         });
     }
+    const ownerError = ownerErrorFromOutput(dispatched.stdout);
+    if (ownerError) {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the lane read after stop: ${ownerError.message}`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            command_id: stopCommandId,
+            sync_command_id: commandId,
+            owner_error: ownerError,
+        });
+    }
     if (remote?.ok !== true || remote.action !== "show") {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not return lane ${laneId} after stop`, {
             lane_id: laneId,
@@ -5265,6 +5977,18 @@ async function dispatchOutpostLaneStop(ctx, lane) {
     catch (err) {
         throw new LanesError("outpost_dispatch_failed", `Could not dispatch stop for lane ${lane.lane_id} to Outpost ${outpostId}: ${dispatchErrorMessage(err)}`, { lane_id: lane.lane_id, outpost_id: outpostId });
     }
+    const ownerError = ownerErrorFromOutput(dispatched.stdout);
+    if (ownerError) {
+        throw new LanesError("outpost_dispatch_failed", `Outpost ${outpostId} rejected the stop command: ${ownerError.message}`, {
+            lane_id: lane.lane_id,
+            outpost_id: outpostId,
+            command_id: dispatched.commandId,
+            status: dispatched.status,
+            done: dispatched.done ?? false,
+            exit_code: dispatched.exitCode,
+            owner_error: ownerError,
+        });
+    }
     const commandId = dispatched.commandId?.trim();
     if (dispatched.done !== true || !commandId) {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} did not return a completed stop command for lane ${lane.lane_id}`, {
@@ -5308,13 +6032,13 @@ async function dispatchOutpostLaneStop(ctx, lane) {
         syncCommandId = owner.commandId;
     }
     else if (remote?.error !== undefined) {
-        throw new LanesError("outpost_remote_command_failed", typeof remote.message === "string"
+        throw new LanesError("outpost_dispatch_failed", typeof remote.message === "string"
             ? remote.message
             : `Outpost ${outpostId} rejected the stop command for lane ${lane.lane_id}`, {
             lane_id: lane.lane_id,
             outpost_id: outpostId,
             command_id: commandId,
-            remote_error: remote.error,
+            owner_error: ownerErrorFromOutput(dispatched.stdout),
         });
     }
     else {
@@ -5750,6 +6474,105 @@ async function runAccountsList(ctx, opts) {
         accounts,
     });
 }
+async function runAccountsBalance(ctx, opts) {
+    const provider = parseLaneProvider(opts.provider ?? "");
+    if (provider !== "claude") {
+        throw new LanesError("claude_account_balance_provider_unsupported", "Account balance is available only for --provider claude", {
+            provider,
+            accepted: ["claude"],
+        });
+    }
+    if (opts.apply)
+        assertBalanceApplyEnabled(ctx.laneClaudeAccountBalanceEnabled());
+    const hqRoot = ctx.hqRoot();
+    const config = loadLanesConfig(hqRoot);
+    const loaded = await loadClaudeBalanceHostSnapshots(ctx, hqRoot, config);
+    const loads = accountLoadsForReport({ hosts: loaded.snapshots, config });
+    const suggestions = planClaudeBalanceMoves({ hosts: loaded.snapshots, config });
+    const selections = loaded.snapshots.map((host) => {
+        try {
+            const selection = selectClaudeAccount({
+                hosts: loaded.snapshots,
+                targetHost: host.capacity.host,
+                config,
+                unavailableHosts: loaded.unavailableHosts,
+            });
+            return {
+                target_host: host.capacity.host,
+                account: selection.account,
+                signal: selection.signal,
+                skipped_accounts: selection.skipped_accounts,
+            };
+        }
+        catch (err) {
+            return {
+                target_host: host.capacity.host,
+                error: isLanesError(err) ? err.error : "claude_account_balance_selection_failed",
+                message: dispatchErrorMessage(err),
+            };
+        }
+    });
+    const accounts = Object.keys(config.providers.claude.accounts).sort().map((account) => {
+        const load = loads.find((row) => row.account === account);
+        return {
+            account,
+            enabled: config.providers.claude.accounts[account]?.enabled === true,
+            live_lanes: load?.live_lanes ?? 0,
+            counts_complete: load?.counts_complete ?? false,
+            hosts: loaded.snapshots.map((host) => {
+                const accountStatus = host.capacity.providers.claude.accounts[account];
+                const accountLoad = load?.hosts.find((row) => row.host.kind === host.capacity.host.kind && row.host.id === host.capacity.host.id);
+                return {
+                    host: host.capacity.host,
+                    enabled: accountStatus?.enabled ?? false,
+                    logged_in: accountStatus?.logged_in ?? null,
+                    live_lanes: accountLoad?.live_lanes ?? null,
+                    lane_counts: accountLoad?.lane_counts ?? { running: null, queued: null, awaiting_input: null },
+                    count_source: accountLoad?.count_source ?? "unavailable",
+                    usage: accountStatus?.usage ?? null,
+                };
+            }),
+        };
+    });
+    const moved = [];
+    const skipped = [];
+    if (opts.apply) {
+        for (const suggestion of suggestions) {
+            if (!suggestion.apply) {
+                skipped.push({
+                    lane_id: suggestion.lane_id,
+                    host: suggestion.host,
+                    from: suggestion.from,
+                    to: suggestion.to,
+                    reason: suggestion.skip_reason ?? "not_movable",
+                });
+                continue;
+            }
+            try {
+                moved.push(await applyClaudeBalanceMove(ctx, suggestion));
+            }
+            catch (err) {
+                skipped.push({
+                    lane_id: suggestion.lane_id,
+                    host: suggestion.host,
+                    from: suggestion.from,
+                    to: suggestion.to,
+                    reason: isLanesError(err) ? `${err.error}: ${err.message}` : dispatchErrorMessage(err),
+                });
+            }
+        }
+    }
+    printJson({
+        ok: true,
+        action: "accounts.balance",
+        provider: "claude",
+        accounts,
+        selections,
+        unavailable_hosts: loaded.unavailableHosts,
+        suggestions,
+        ...(opts.apply ? { moved, skipped } : {}),
+    });
+}
 async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     const callerCwd = ctx.callerCwd();
     const hqRoot = ctx.hqRoot();
@@ -6056,6 +6879,14 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (opts) => {
         await runCreate(ctx, opts);
     }));
+    lanes
+        .command("grant-target", { hidden: true })
+        .argument("<lane-id>", "Lane id")
+        .option("--hire <n>", "Non-negative safe integer hire grant")
+        .option("--grant-context <base64url>", "Primary-authorized hire hierarchy and gate decision")
+        .action(wrap(async (laneId, opts) => {
+        await runGrantOwnerTarget(ctx, laneId, opts);
+    }));
     lanes
         .command("grant")
         .description("Set a lane's alive child-lane grant as its senior")
@@ -6123,6 +6954,15 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (laneId, opts) => {
         await runMoveTarget(ctx, laneId, opts);
     }));
+    lanes
+        .command("balance-move-target", { hidden: true })
+        .argument("<lane-id>", "Lane id")
+        .requiredOption("--account <id>", "Target Claude account id")
+        .requiredOption("--from-account <id>", "Expected source Claude account id")
+        .requiredOption("--expected-state <state>", "Expected lane state from the balance plan")
+        .action(wrap(async (laneId, opts) => {
+        await runClaudeBalanceMoveTarget(ctx, laneId, opts);
+    }));
     lanes
         .command("admit")
         .description("Try to admit the oldest eligible queued lane")
@@ -6321,6 +7161,15 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (opts) => {
         await runAccountsList(ctx, opts);
     }));
+    accounts
+        .command("balance")
+        .description("Report Claude account load and suggest safe between-turn moves")
+        .requiredOption("--provider <name>", "claude")
+        .option("--apply", "Move eligible between-turn sessions (requires the Claude account balance gate)")
+        .option("--json", "JSON on stdout (always)")
+        .action(wrap(async (opts) => {
+        await runAccountsBalance(ctx, opts);
+    }));
     accounts
         .command("login")
         .description("Create a home, run the vendor login, and register the account")