@indigoai-us/hq-cli 5.224.0 → 5.226.0

package/dist/commands/lanes.js

@@ -51,12 +51,13 @@ import { assertUniqueAccountHomes, providerCompactAfterMs } from "../lib/lanes/c
 import { parseCliEffort, resolveLaneEffort, } from "../lib/lanes/effort.js";
 import { LanesError } from "../lib/lanes/errors.js";
 import { dispatchLaneDelivery } from "../lib/lanes/delivery-core.js";
-import { formatMonitorEvent } from "../lib/lanes/dropbox.js";
+import { dropboxInboxHasMessages, drainDropbox, formatDropboxMessages, formatMonitorEvent, requeueDropboxMessages, } from "../lib/lanes/dropbox.js";
+import { isPidAlive, runWatcherLoop, WATCHER_OUT_MAX_BYTES, watcherOutLogPath, writeWatcherDecision, } from "../lib/lanes/watcher.js";
 import { accountQuotaView, loadQuotaState, quotaBlockFor } from "../lib/lanes/quota.js";
 import { SESSION_MOVE_REASON } from "../lib/lanes/move-account.js";
 import { ensureSessionHome } from "../lib/lanes/session-relink.js";
 import { defaultProbe, validateProfileLaneModel, validateLaneModel, } from "../lib/lanes/models.js";
-import { parseCliModel, refuseOutpostSelfTarget, resolveLaneModel, FOREGROUND_ONLY_RULE, STANDING_AUTHORIZATION, spawnLaneWorker, laneRunDir, readSpawnManifest, stopLaneProcesses, } from "../lib/lanes/spawn.js";
+import { parseCliModel, refuseOutpostSelfTarget, resolveLaneModel, FOREGROUND_ONLY_RULE, STANDING_AUTHORIZATION, spawnLaneWorker, laneRunDir, readSpawnManifest, readPidRecord, probePidRecord, readProcStarttime, stopLaneProcesses, } from "../lib/lanes/spawn.js";
 import { handOffInstallHere } from "../lib/daemon/handoff.js";
 export { spawnLaneWorker };
 export { questionBodyAbsPath };
@@ -283,6 +284,8 @@ function resolveDeps(deps = {}) {
         proveDetached: deps.proveDetached,
         killProcess: deps.killProcess,
         isAlive: deps.isAlive,
+        readStarttime: deps.readStarttime,
+        watcherLoopDeps: deps.watcherLoopDeps,
         stopSleepMs: deps.stopSleepMs,
         livenessDeps: deps.livenessDeps,
         presenceConnected: deps.presenceConnected,
@@ -5552,7 +5555,13 @@ function assertCurrentResumeAccountAvailable(ctx, lane) {
 }
 async function runMessage(ctx, laneId, opts) {
     const hqRoot = ctx.hqRoot();
-    const text = opts.text;
+    let accepted = false;
+    let claimedMessages = [];
+    const markAccepted = () => {
+        accepted = true;
+        opts.onAccepted?.();
+    };
+    let text = opts.text;
     if (!text) {
         throw new LanesError("missing_text", "--text is required", {});
     }
@@ -5562,330 +5571,498 @@ async function runMessage(ctx, laneId, opts) {
         return;
     }
     assertLaneRunsHereForOperatorMutation(ctx, lane, "message");
-    const cliEffort = parseCliEffort(lane.provider, opts.effort);
-    if (cliEffort !== undefined && !providerSupportsSessionResume(lane.provider)) {
-        throw new LanesError("effort_resume_unsupported", `Provider ${lane.provider} cannot change effort on a resumed session`, { lane_id: laneId, provider: lane.provider });
-    }
-    // Check before transcript recovery, account probing, or message writes.
-    // The final state transition repeats this check under the senior lock.
-    await withResumeHireAdmission(ctx, lane, () => undefined);
-    lane = laneWithRecoveredProviderSession(hqRoot, lane);
-    const keepCurrentAccount = opts.account !== undefined && accountRequestKeepsCurrentLane(lane, opts.account);
-    if (keepCurrentAccount)
-        assertCurrentResumeAccountAvailable(ctx, lane);
-    // A real account move is refused on its own terms first: a running lane and
-    // a provider without session resume get the move's named errors, not the
-    // generic delivery refusal below. Naming the current account is a keep.
-    if (opts.account !== undefined && !keepCurrentAccount && lane.state === "running") {
-        throw new LanesError("lane_running", `Lane ${laneId} is running; stop it or wait for it to exit before moving its session`, {
-            lane_id: laneId,
-            state: lane.state,
-        });
-    }
-    if (opts.account !== undefined && !keepCurrentAccount && !providerSessionPortable(lane.provider)) {
-        throw new LanesError("provider_session_not_portable", sessionNotPortableMessage(lane.provider), { lane_id: laneId, provider: lane.provider });
-    }
-    // One decision point for how a follow-up reaches this lane (delivery.ts).
-    // `none` refuses before anything is written: no inbox append, no spawn.
-    const mechanism = laneDeliveryMechanism(lane);
-    if (mechanism === "none") {
-        const message = deliveryRefusalReason(lane);
-        throw new LanesError("lane_not_accepting_messages", message, {
-            lane_id: laneId,
-            state: lane.state,
-            provider: lane.provider,
-            message,
-        });
-    }
-    if (keepCurrentAccount && opts.model !== undefined && mechanism !== "resume") {
-        throw new LanesError("model_requires_resume", "--model with --account requires a message that resumes the lane", { lane_id: laneId, state: lane.state });
-    }
-    if (opts.worker !== undefined && mechanism === "dropbox") {
-        throw new LanesError("worker_profile_requires_resume", `Lane ${laneId} is still running; --worker can only be applied when message starts a resumed provider turn`, { lane_id: laneId, state: lane.state });
-    }
-    if (cliEffort !== undefined && mechanism === "dropbox") {
-        throw new LanesError("lane_effort_requires_resume", `Lane ${laneId} is still running; --effort can only be applied when message starts a resumed provider turn`, { lane_id: laneId, state: lane.state });
-    }
-    const resumeProfile = opts.worker !== undefined
-        ? resolveResumeProfile(ctx, lane, opts.worker)
-        : undefined;
-    if (opts.model !== undefined && opts.account === undefined) {
-        throw new LanesError("model_requires_account", "--model on hq lanes message is only accepted together with --account", {});
-    }
-    const automaticAccountSelection = opts.account === undefined && mechanism === "resume"
-        ? await selectAutomaticClaudeResumeAccount(ctx, lane, resumeProfile)
-        : undefined;
-    const resumeEffort = resolveResumeEffort(ctx, lane, {
-        cliEffort,
-        profile: resumeProfile,
-        account: keepCurrentAccount ? lane.account : opts.account ?? automaticAccountSelection?.selection.account,
-        model: opts.model,
-    });
-    const messageId = mintMessageId();
-    const at = ctx.now().toISOString();
-    const projectId = opts.project?.trim() || lane.project_id;
-    const storyId = opts.story?.trim() || lane.story_id;
-    if (opts.story !== undefined && !opts.story.trim()) {
-        throw new LanesError("missing_story", "--story must be non-empty", {});
-    }
-    if ((opts.project !== undefined || opts.story !== undefined) && ctx.storyLedgerEnabled()) {
-        validateProjectStories(hqRoot, projectId, [storyId], lane.company?.slug);
+    if (lane.state === "running") {
+        const workerPidPath = path.join(laneRunDir(hqRoot, laneId), "worker.pid");
+        const workerRecordExists = fs.existsSync(workerPidPath);
+        const worker = readPidRecord(workerPidPath);
+        if (workerRecordExists && worker === null) {
+            throw new LanesError("worker_pid_invalid", `Lane ${laneId} has a malformed worker PID record; message delivery cannot be classified safely`, { lane_id: laneId, worker_pid_path: workerPidPath });
+        }
+        // A fresh spawn may have committed running before publishing worker.pid;
+        // absence is not proof of exit. Reclassify only a recorded process that
+        // fails the PID plus start-time identity probe.
+        const processAlive = worker === null
+            ? true
+            : probePidRecord(worker, ctx.isAlive ?? isPidAlive, ctx.readStarttime ?? readProcStarttime).alive;
+        if (worker !== null && !processAlive) {
+            // The watcher may not have reached its next poll yet. Run the same
+            // classifier synchronously, then make the queue/resume choice again.
+            await runWatcherLoop(hqRoot, laneId, {
+                ...ctx.watcherLoopDeps,
+                now: () => ctx.now().getTime(),
+                isAlive: ctx.isAlive ?? isPidAlive,
+                readStarttime: ctx.readStarttime ?? readProcStarttime,
+                mesh: null,
+                resolveQuestionActiveCompany: () => resolveActiveQuestionCompany(ctx),
+            });
+            lane = readLane(hqRoot, laneId);
+            // This invocation won the race to classify the dead worker, so the
+            // watcher callback did not own recovery. Fold any earlier queued
+            // messages into this resume to keep one provider turn and one delivery.
+            if (laneDeliveryMechanism(lane) === "resume" && dropboxInboxHasMessages(hqRoot, laneId)) {
+                const queuedMessages = drainDropbox(hqRoot, laneId);
+                if (queuedMessages.length > 0) {
+                    claimedMessages = queuedMessages;
+                    text = `${formatDropboxMessages(queuedMessages)}\n\n${text}`;
+                }
+            }
+        }
     }
-    const framedMonitorEvent = opts.monitorEvent === undefined
-        ? undefined
-        : formatMonitorEvent({
-            monitorId: opts.monitorEvent.monitor_id,
-            description: opts.monitorEvent.description,
-            sequence: opts.monitorEvent.sequence,
-            text,
-        });
-    const deliveryText = framedMonitorEvent ?? text;
-    const dropboxMessage = {
-        at,
-        message_id: messageId,
-        text,
-        project_id: projectId,
-        story_id: storyId,
-        ...(opts.monitorEvent === undefined ? {} : {
-            kind: "monitor_event",
-            monitor_id: opts.monitorEvent.monitor_id,
-            description: opts.monitorEvent.description,
-            sequence: opts.monitorEvent.sequence,
-        }),
-    };
-    let resumed = null;
-    let move = null;
-    let queuedOnAdmission = false;
-    if (opts.account !== undefined && !keepCurrentAccount) {
-        // A moved message is always a resume on the target account: a running
-        // lane (the dropbox mechanism) is refused inside prepareAccountMove.
-        move = await prepareAccountMove(ctx, lane, {
-            account: opts.account,
-            cliModel: opts.model?.trim() || undefined,
-            ...(resumeProfile !== undefined ? { workerProfile: resumeProfile } : {}),
-            ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
-            pending: {
-                trigger: "message",
-                text: deliveryText,
-                ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
-                message_id: messageId,
-                compact: opts.compact !== false,
-            },
-        });
-        lane = move.lane;
-        if (move.queued) {
-            archiveResumeMessage(hqRoot, laneId, dropboxMessage);
-        }
-    }
-    else if (mechanism === "resume") {
-        const automatic = automaticAccountSelection;
-        if (automatic !== undefined) {
-            const selection = automatic.selection;
-            if (selection.account !== lane.account) {
-                move = await prepareAccountMove(ctx, lane, {
-                    account: selection.account,
-                    cliModel: undefined,
-                    ...(automatic.historyReason !== undefined ? { accountHistoryReason: automatic.historyReason } : {}),
-                    ...(resumeProfile !== undefined ? { workerProfile: resumeProfile } : {}),
-                    ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
-                    pending: {
-                        trigger: "message",
-                        text: deliveryText,
-                        ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
-                        message_id: messageId,
-                        compact: opts.compact !== false,
-                    },
-                    accountSelection: selection,
-                });
-                lane = move.lane;
-                if (move.queued)
-                    archiveResumeMessage(hqRoot, laneId, dropboxMessage);
+    try {
+        const exclusion = messageLaneExclusion(ctx, lane);
+        if (exclusion !== undefined) {
+            let messageCount;
+            if (dropboxInboxHasMessages(hqRoot, laneId)) {
+                messageCount = drainDropbox(hqRoot, laneId, { archiveDirectory: "undeliverable" }).length;
             }
-            else {
-                lane = persistClaudeAccountSelection(hqRoot, lane, selection);
+            recordMessageUndeliverable(ctx, lane, exclusion, messageCount);
+            const refusalMessage = deliveryRefusalReason(lane);
+            throw new LanesError("lane_not_accepting_messages", refusalMessage || `Lane ${laneId} cannot receive messages: ${exclusion}`, { lane_id: laneId, state: lane.state, reason: exclusion });
+        }
+        if (lane.state === "done" && dropboxInboxHasMessages(hqRoot, laneId)) {
+            const staleMessages = drainDropbox(hqRoot, laneId, { archiveDirectory: "undeliverable" });
+            if (staleMessages.length > 0) {
+                recordMessageUndeliverable(ctx, lane, "done_before_queued_message", staleMessages.length);
             }
         }
-    }
-    if (resumeProfile !== undefined && (opts.account === undefined || keepCurrentAccount)) {
-        validateResumeProfileModel(ctx, lane, resumeProfile.profile);
-    }
-    if (move === null && (resumeProfile !== undefined || resumeEffort !== undefined || (keepCurrentAccount && opts.model !== undefined))) {
-        lane = recordResumeSetup(ctx, lane, {
-            ...(resumeProfile !== undefined ? { profile: resumeProfile } : {}),
-            ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
-            ...(keepCurrentAccount && opts.model !== undefined ? { cliModel: opts.model } : {}),
+        const cliEffort = parseCliEffort(lane.provider, opts.effort);
+        if (cliEffort !== undefined && !providerSupportsSessionResume(lane.provider)) {
+            throw new LanesError("effort_resume_unsupported", `Provider ${lane.provider} cannot change effort on a resumed session`, { lane_id: laneId, provider: lane.provider });
+        }
+        // Check before transcript recovery, account probing, or message writes.
+        // The final state transition repeats this check under the senior lock.
+        await withResumeHireAdmission(ctx, lane, () => undefined);
+        lane = laneWithRecoveredProviderSession(hqRoot, lane);
+        const keepCurrentAccount = opts.account !== undefined && accountRequestKeepsCurrentLane(lane, opts.account);
+        if (keepCurrentAccount)
+            assertCurrentResumeAccountAvailable(ctx, lane);
+        // A real account move is refused on its own terms first: a running lane and
+        // a provider without session resume get the move's named errors, not the
+        // generic delivery refusal below. Naming the current account is a keep.
+        if (opts.account !== undefined && !keepCurrentAccount && lane.state === "running") {
+            throw new LanesError("lane_running", `Lane ${laneId} is running; stop it or wait for it to exit before moving its session`, {
+                lane_id: laneId,
+                state: lane.state,
+            });
+        }
+        if (opts.account !== undefined && !keepCurrentAccount && !providerSessionPortable(lane.provider)) {
+            throw new LanesError("provider_session_not_portable", sessionNotPortableMessage(lane.provider), { lane_id: laneId, provider: lane.provider });
+        }
+        // One decision point for how a follow-up reaches this lane (delivery.ts).
+        // `none` refuses before anything is written: no inbox append, no spawn.
+        const mechanism = laneDeliveryMechanism(lane);
+        if (mechanism === "none") {
+            const message = deliveryRefusalReason(lane);
+            throw new LanesError("lane_not_accepting_messages", message, {
+                lane_id: laneId,
+                state: lane.state,
+                provider: lane.provider,
+                message,
+            });
+        }
+        if (keepCurrentAccount && opts.model !== undefined && mechanism !== "resume") {
+            throw new LanesError("model_requires_resume", "--model with --account requires a message that resumes the lane", { lane_id: laneId, state: lane.state });
+        }
+        if (opts.worker !== undefined && mechanism === "dropbox") {
+            throw new LanesError("worker_profile_requires_resume", `Lane ${laneId} is still running; --worker can only be applied when message starts a resumed provider turn`, { lane_id: laneId, state: lane.state });
+        }
+        if (cliEffort !== undefined && mechanism === "dropbox") {
+            throw new LanesError("lane_effort_requires_resume", `Lane ${laneId} is still running; --effort can only be applied when message starts a resumed provider turn`, { lane_id: laneId, state: lane.state });
+        }
+        const resumeProfile = opts.worker !== undefined
+            ? resolveResumeProfile(ctx, lane, opts.worker)
+            : undefined;
+        if (opts.model !== undefined && opts.account === undefined) {
+            throw new LanesError("model_requires_account", "--model on hq lanes message is only accepted together with --account", {});
+        }
+        const automaticAccountSelection = opts.account === undefined && mechanism === "resume"
+            ? await selectAutomaticClaudeResumeAccount(ctx, lane, resumeProfile)
+            : undefined;
+        const resumeEffort = resolveResumeEffort(ctx, lane, {
+            cliEffort,
+            profile: resumeProfile,
+            account: keepCurrentAccount ? lane.account : opts.account ?? automaticAccountSelection?.selection.account,
+            model: opts.model,
         });
-    }
-    if (move?.queued) {
-        // Parked at the target's cap: reconcile resumes the session there.
-    }
-    else {
-        const dispatched = await dispatchLaneDelivery(lane, {
-            dropbox: () => {
-                // Live (or about-to-be-live) process: the PreToolUse drain delivers it.
-                if (!laneAcceptsOperatorMessage(lane)) {
-                    throw new LanesError("lane_not_accepting_messages", operatorMessageRefusalReason(lane.state), { lane_id: laneId, state: lane.state });
+        const messageId = mintMessageId();
+        const at = ctx.now().toISOString();
+        const projectId = opts.project?.trim() || lane.project_id;
+        const storyId = opts.story?.trim() || lane.story_id;
+        if (opts.story !== undefined && !opts.story.trim()) {
+            throw new LanesError("missing_story", "--story must be non-empty", {});
+        }
+        if ((opts.project !== undefined || opts.story !== undefined) && ctx.storyLedgerEnabled()) {
+            validateProjectStories(hqRoot, projectId, [storyId], lane.company?.slug);
+        }
+        const framedMonitorEvent = opts.monitorEvent === undefined
+            ? undefined
+            : formatMonitorEvent({
+                monitorId: opts.monitorEvent.monitor_id,
+                description: opts.monitorEvent.description,
+                sequence: opts.monitorEvent.sequence,
+                text,
+            });
+        const deliveryText = framedMonitorEvent ?? text;
+        const dropboxMessage = {
+            at,
+            message_id: messageId,
+            text,
+            project_id: projectId,
+            story_id: storyId,
+            ...(opts.monitorEvent === undefined ? {} : {
+                kind: "monitor_event",
+                monitor_id: opts.monitorEvent.monitor_id,
+                description: opts.monitorEvent.description,
+                sequence: opts.monitorEvent.sequence,
+            }),
+        };
+        let resumed = null;
+        let move = null;
+        let queuedOnAdmission = false;
+        if (opts.account !== undefined && !keepCurrentAccount) {
+            // A moved message is always a resume on the target account: a running
+            // lane (the dropbox mechanism) is refused inside prepareAccountMove.
+            move = await prepareAccountMove(ctx, lane, {
+                account: opts.account,
+                cliModel: opts.model?.trim() || undefined,
+                ...(resumeProfile !== undefined ? { workerProfile: resumeProfile } : {}),
+                ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
+                pending: {
+                    trigger: "message",
+                    text: deliveryText,
+                    ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                    message_id: messageId,
+                    compact: opts.compact !== false,
+                },
+            });
+            lane = move.lane;
+            if (move.queued) {
+                archiveResumeMessage(hqRoot, laneId, dropboxMessage);
+            }
+        }
+        else if (mechanism === "resume") {
+            const automatic = automaticAccountSelection;
+            if (automatic !== undefined) {
+                const selection = automatic.selection;
+                if (selection.account !== lane.account) {
+                    move = await prepareAccountMove(ctx, lane, {
+                        account: selection.account,
+                        cliModel: undefined,
+                        ...(automatic.historyReason !== undefined ? { accountHistoryReason: automatic.historyReason } : {}),
+                        ...(resumeProfile !== undefined ? { workerProfile: resumeProfile } : {}),
+                        ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
+                        pending: {
+                            trigger: "message",
+                            text: deliveryText,
+                            ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                            message_id: messageId,
+                            compact: opts.compact !== false,
+                        },
+                        accountSelection: selection,
+                    });
+                    lane = move.lane;
+                    if (move.queued)
+                        archiveResumeMessage(hqRoot, laneId, dropboxMessage);
                 }
-                appendDropboxMessage(hqRoot, laneId, dropboxMessage);
-                return null;
-            },
-            resume: async () => {
-                // Exited worker with a recorded session: queue the message when capacity
-                // is occupied, otherwise start its next turn under the shared admission lock.
-                assertLaneRunsHereForAdmission(ctx, lane);
-                return withLaneAdmissionLock(hqRoot, lane.provider, async () => {
-                    const admission = await assessLaneAdmission(ctx, lane, { queueAt: at });
-                    if (admission.action === "refuse" && admission.error)
-                        throw admission.error;
-                    return withResumeHireAdmission(ctx, lane, () => {
-                        if (admission.action === "queue") {
-                            const sessionId = lane.provider_session_id;
-                            if (!sessionId) {
-                                throw new LanesError("no_provider_session", `Lane ${laneId} has no provider session id to queue this message resume`, {
-                                    lane_id: laneId,
-                                    provider: lane.provider,
-                                });
-                            }
-                            archiveResumeMessage(hqRoot, laneId, dropboxMessage);
-                            queuedOnAdmission = true;
-                            return casUpdateLane(hqRoot, laneId, (current) => {
-                                if (current.version !== lane.version || current.state !== lane.state) {
-                                    throw new LanesError("lane_admission_conflict", `Lane ${laneId} changed while message admission was checked`, {
+                else {
+                    lane = persistClaudeAccountSelection(hqRoot, lane, selection);
+                }
+            }
+        }
+        if (resumeProfile !== undefined && (opts.account === undefined || keepCurrentAccount)) {
+            validateResumeProfileModel(ctx, lane, resumeProfile.profile);
+        }
+        if (move === null && (resumeProfile !== undefined || resumeEffort !== undefined || (keepCurrentAccount && opts.model !== undefined))) {
+            lane = recordResumeSetup(ctx, lane, {
+                ...(resumeProfile !== undefined ? { profile: resumeProfile } : {}),
+                ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
+                ...(keepCurrentAccount && opts.model !== undefined ? { cliModel: opts.model } : {}),
+            });
+        }
+        if (move?.queued) {
+            // Parked at the target's cap: reconcile resumes the session there.
+            markAccepted();
+        }
+        else {
+            const dispatched = await dispatchLaneDelivery(lane, {
+                dropbox: () => {
+                    // Live (or about-to-be-live) process: the PreToolUse drain delivers it.
+                    if (!laneAcceptsOperatorMessage(lane)) {
+                        throw new LanesError("lane_not_accepting_messages", operatorMessageRefusalReason(lane.state), { lane_id: laneId, state: lane.state });
+                    }
+                    appendDropboxMessage(hqRoot, laneId, dropboxMessage);
+                    return null;
+                },
+                resume: async () => {
+                    // Exited worker with a recorded session: queue the message when capacity
+                    // is occupied, otherwise start its next turn under the shared admission lock.
+                    assertLaneRunsHereForAdmission(ctx, lane);
+                    return withLaneAdmissionLock(hqRoot, lane.provider, async () => {
+                        const admission = await assessLaneAdmission(ctx, lane, { queueAt: at });
+                        if (admission.action === "refuse" && admission.error)
+                            throw admission.error;
+                        return withResumeHireAdmission(ctx, lane, () => {
+                            if (admission.action === "queue") {
+                                const sessionId = lane.provider_session_id;
+                                if (!sessionId) {
+                                    throw new LanesError("no_provider_session", `Lane ${laneId} has no provider session id to queue this message resume`, {
                                         lane_id: laneId,
-                                        prepared_version: lane.version,
-                                        version: current.version,
-                                        state: current.state,
+                                        provider: lane.provider,
                                     });
                                 }
-                                return {
-                                    ...current,
-                                    state: "queued",
-                                    queued_reason: admission.reason ?? "throttle",
-                                    queued_at: at,
-                                    pending_resume: {
-                                        session_id: sessionId,
-                                        trigger: "message",
-                                        text: deliveryText,
-                                        ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
-                                        message_id: messageId,
-                                        compact: opts.compact !== false,
-                                        at,
-                                    },
-                                };
-                            });
-                        }
-                        const started = spawnLaneWorker(hqRoot, lane, {
-                            env: ctx.env,
-                            modelDeps: {
-                                readFileSync: ctx.readFileSync,
-                                probe: ctx.probeProvider,
+                                archiveResumeMessage(hqRoot, laneId, dropboxMessage);
+                                queuedOnAdmission = true;
+                                return casUpdateLane(hqRoot, laneId, (current) => {
+                                    if (current.version !== lane.version || current.state !== lane.state) {
+                                        throw new LanesError("lane_admission_conflict", `Lane ${laneId} changed while message admission was checked`, {
+                                            lane_id: laneId,
+                                            prepared_version: lane.version,
+                                            version: current.version,
+                                            state: current.state,
+                                        });
+                                    }
+                                    return {
+                                        ...current,
+                                        state: "queued",
+                                        queued_reason: admission.reason ?? "throttle",
+                                        queued_at: at,
+                                        pending_resume: {
+                                            session_id: sessionId,
+                                            trigger: "message",
+                                            text: deliveryText,
+                                            ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                                            message_id: messageId,
+                                            compact: opts.compact !== false,
+                                            at,
+                                        },
+                                    };
+                                });
+                            }
+                            const started = spawnLaneWorker(hqRoot, lane, {
                                 env: ctx.env,
-                            },
-                            existsSync: ctx.existsSync,
-                            spawnProcess: ctx.spawnProcess,
-                            proveDetached: ctx.proveDetached,
-                            killProcess: ctx.killProcess,
-                            now: ctx.now,
-                            resolveMachineIdentity: ctx.resolveMachineIdentity,
-                            runCompaction: ctx.runCompaction,
-                            locateTranscript: ctx.locateTranscript,
-                        }, {
-                            trigger: {
-                                kind: "message",
-                                text: deliveryText,
-                                message_id: messageId,
-                                ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
-                            },
-                            compact: opts.compact !== false,
-                            effort: resumeEffort ?? recordedResumeEffort(lane),
+                                modelDeps: {
+                                    readFileSync: ctx.readFileSync,
+                                    probe: ctx.probeProvider,
+                                    env: ctx.env,
+                                },
+                                existsSync: ctx.existsSync,
+                                spawnProcess: ctx.spawnProcess,
+                                proveDetached: ctx.proveDetached,
+                                killProcess: ctx.killProcess,
+                                now: ctx.now,
+                                resolveMachineIdentity: ctx.resolveMachineIdentity,
+                                runCompaction: ctx.runCompaction,
+                                locateTranscript: ctx.locateTranscript,
+                            }, {
+                                trigger: {
+                                    kind: "message",
+                                    text: deliveryText,
+                                    message_id: messageId,
+                                    ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                                },
+                                compact: opts.compact !== false,
+                                effort: resumeEffort ?? recordedResumeEffort(lane),
+                            });
+                            archiveResumeMessage(hqRoot, laneId, dropboxMessage);
+                            return started;
                         });
-                        archiveResumeMessage(hqRoot, laneId, dropboxMessage);
-                        return started;
-                    });
-                }, ctx.sleep);
-            },
-        }, mechanism);
-        if (dispatched.mechanism === "resume")
-            resumed = dispatched.value;
-    }
-    // Every accepted message moves the compaction reference forward.
-    let next = casUpdateLane(hqRoot, laneId, (current) => ({
-        ...resetKeepAliveProgress(current),
-        last_message_at: at,
-    }));
-    if (projectId !== lane.project_id || storyId !== lane.story_id) {
-        next = casUpdateLane(hqRoot, laneId, (current) => {
-            const already = current.attribution_history.some((entry) => entry.message_id === messageId);
-            if (already)
-                return current;
-            return {
-                ...current,
-                project_id: projectId,
-                story_id: storyId,
-                no_story_reason: storyId ? undefined : current.no_story_reason,
-                stories: laneStory(current, projectId, storyId)
-                    ? laneStories(current)
-                    : [
-                        ...laneStories(current),
-                        {
-                            project_id: projectId,
-                            story_id: storyId,
-                            status: "in_progress",
-                            added_at: at,
-                            updated_at: at,
-                        },
-                    ],
-                attribution_history: appendCappedHistory(current.attribution_history, {
+                    }, ctx.sleep);
+                },
+            }, mechanism);
+            if (dispatched.mechanism === "resume")
+                resumed = dispatched.value;
+            markAccepted();
+        }
+        // Every accepted message moves the compaction reference forward.
+        let next = casUpdateLane(hqRoot, laneId, (current) => ({
+            ...resetKeepAliveProgress(current),
+            last_message_at: at,
+        }));
+        if (projectId !== lane.project_id || storyId !== lane.story_id) {
+            next = casUpdateLane(hqRoot, laneId, (current) => {
+                const already = current.attribution_history.some((entry) => entry.message_id === messageId);
+                if (already)
+                    return current;
+                return {
+                    ...current,
                     project_id: projectId,
                     story_id: storyId,
-                    message_id: messageId,
-                    at,
-                }),
-            };
+                    no_story_reason: storyId ? undefined : current.no_story_reason,
+                    stories: laneStory(current, projectId, storyId)
+                        ? laneStories(current)
+                        : [
+                            ...laneStories(current),
+                            {
+                                project_id: projectId,
+                                story_id: storyId,
+                                status: "in_progress",
+                                added_at: at,
+                                updated_at: at,
+                            },
+                        ],
+                    attribution_history: appendCappedHistory(current.attribution_history, {
+                        project_id: projectId,
+                        story_id: storyId,
+                        message_id: messageId,
+                        at,
+                    }),
+                };
+            });
+        }
+        // What this command can claim when it returns: the message is durably
+        // written (accepted). Delivery to the model is asynchronous in both
+        // mechanisms. `dropbox` delivers on the worker's next tool call, and only
+        // if the drain hook is registered in the account home the worker was
+        // started from; `resume` has started a new worker with the message as its
+        // prompt. Neither is "delivered", so the response never says so.
+        const drainHook = drainHookStatusFor(ctx, next);
+        const deliveryStatus = move?.queued
+            ? "queued_on_target_account"
+            : queuedOnAdmission
+                ? "queued_on_admission"
+                : mechanism === "dropbox"
+                    ? "awaiting_next_tool_call"
+                    : "worker_spawned";
+        const warning = mechanism === "dropbox" && drainHook !== null && !drainHook.registered
+            ? `The drain hook is not registered in ${drainHook.path}; the running worker will not receive this message. It stays in the inbox and is delivered on the lane's next start.`
+            : mechanism === "dropbox" && next.stalled === true
+                ? `The worker has made no tool call since ${next.stalled_at ?? "an unknown time"} (${next.stalled_reason ?? "stalled"}); delivery waits on its next tool call.`
+                : null;
+        if (!opts.silent)
+            printJson({
+                ok: true,
+                action: "message",
+                lane_id: laneId,
+                message_id: messageId,
+                accepted: true,
+                delivered: false,
+                delivery: mechanism,
+                delivery_status: deliveryStatus,
+                inbox_path: mechanism === "dropbox" ? dropboxInboxPath(hqRoot, laneId) : null,
+                drain_hook: drainHook,
+                warning,
+                resumed_session_id: resumed?.last_resume?.session_id ?? null,
+                compaction: resumed?.last_compaction && resumed.last_compaction.resume_at === resumed.last_resume?.at
+                    ? resumed.last_compaction
+                    : null,
+                account_move: move ? accountMoveSummary(move) : null,
+                project_id: next.project_id,
+                story_id: next.story_id,
+                stories: laneStories(next),
+                story_warning: storyWarning(next) ?? null,
+                lane: next,
+            });
+    }
+    catch (err) {
+        if (claimedMessages.length > 0 && !accepted) {
+            const error = err instanceof Error ? err.message : String(err);
+            writeWatcherDecision(watcherOutLogPath(hqRoot, laneId), {
+                event: "message_recovery_failed",
+                at: ctx.now().toISOString(),
+                state: lane.state,
+                error,
+                message_count: claimedMessages.length,
+            }, WATCHER_OUT_MAX_BYTES);
+            try {
+                requeueDropboxMessages(hqRoot, laneId, claimedMessages);
+            }
+            catch (requeueErr) {
+                const requeueMessage = requeueErr instanceof Error ? requeueErr.message : String(requeueErr);
+                writeWatcherDecision(watcherOutLogPath(hqRoot, laneId), {
+                    event: "message_requeue_failed",
+                    at: ctx.now().toISOString(),
+                    state: lane.state,
+                    recovery_error: error,
+                    requeue_error: requeueMessage,
+                    message_count: claimedMessages.length,
+                }, WATCHER_OUT_MAX_BYTES);
+                throw new LanesError("message_requeue_failed", `Could not return ${claimedMessages.length} queued lane message(s) to the inbox after recovery failed: ${requeueMessage}`, { lane_id: laneId, message_count: claimedMessages.length, recovery_error: error });
+            }
+        }
+        throw err;
+    }
+}
+function messageLaneExclusion(ctx, lane) {
+    if (lane.state === "killed" || lane.state === "cancelled")
+        return lane.state;
+    return keepAliveExclusion(lane, loadAllLanes(ctx.hqRoot()), loadRetiredLaneIds(ctx.hqRoot()));
+}
+function recordMessageUndeliverable(ctx, lane, reason, messageCount) {
+    writeWatcherDecision(watcherOutLogPath(ctx.hqRoot(), lane.lane_id), {
+        event: "message_undeliverable",
+        at: ctx.now().toISOString(),
+        state: lane.state,
+        reason,
+        ...(messageCount === undefined ? {} : { message_count: messageCount }),
+    }, WATCHER_OUT_MAX_BYTES);
+}
+/**
+ * Watcher and reconcile call the hidden command below after they win the
+ * terminal transition. The inbox is claimed once with the normal atomic
+ * dropbox drain, and an accepted message is routed through runMessage so the
+ * existing provider, admission, account, worker-profile and senior checks
+ * remain authoritative.
+ */
+async function recoverQueuedMessages(ctx, laneId) {
+    const hqRoot = ctx.hqRoot();
+    const lane = readLane(hqRoot, laneId);
+    if (!dropboxInboxHasMessages(hqRoot, laneId))
+        return { action: "none", message_count: 0 };
+    const exclusion = messageLaneExclusion(ctx, lane);
+    const refusal = exclusion ?? (lane.state === "done"
+        ? "done_before_envelope"
+        : lane.state === "awaiting_input"
+            ? "awaiting_input_requires_question_answer"
+            : laneDeliveryMechanism(lane) !== "resume"
+                ? `no_resume_path_for_${lane.state}`
+                : undefined);
+    if (refusal !== undefined) {
+        const messages = drainDropbox(hqRoot, laneId, { archiveDirectory: "undeliverable" });
+        if (messages.length > 0)
+            recordMessageUndeliverable(ctx, lane, refusal, messages.length);
+        return { action: messages.length > 0 ? "undeliverable" : "none", message_count: messages.length };
+    }
+    const messages = drainDropbox(hqRoot, laneId);
+    if (messages.length === 0)
+        return { action: "none", message_count: 0 };
+    let accepted = false;
+    try {
+        await runMessage(ctx, laneId, {
+            text: formatDropboxMessages(messages),
+            compact: false,
+            silent: true,
+            onAccepted: () => { accepted = true; },
         });
+        return { action: "resumed", message_count: messages.length };
+    }
+    catch (err) {
+        const error = err instanceof Error ? err.message : String(err);
+        writeWatcherDecision(watcherOutLogPath(hqRoot, laneId), {
+            event: "message_recovery_failed",
+            at: ctx.now().toISOString(),
+            state: lane.state,
+            error,
+            message_count: messages.length,
+        }, WATCHER_OUT_MAX_BYTES);
+        if (!accepted) {
+            try {
+                requeueDropboxMessages(hqRoot, laneId, messages);
+            }
+            catch (requeueErr) {
+                const requeueMessage = requeueErr instanceof Error ? requeueErr.message : String(requeueErr);
+                writeWatcherDecision(watcherOutLogPath(hqRoot, laneId), {
+                    event: "message_requeue_failed",
+                    at: ctx.now().toISOString(),
+                    state: lane.state,
+                    recovery_error: error,
+                    requeue_error: requeueMessage,
+                    message_count: messages.length,
+                }, WATCHER_OUT_MAX_BYTES);
+                throw new LanesError("message_requeue_failed", `Could not return ${messages.length} queued lane message(s) to the inbox after recovery failed: ${requeueMessage}`, { lane_id: laneId, message_count: messages.length, recovery_error: error });
+            }
+        }
+        throw err;
     }
-    // What this command can claim when it returns: the message is durably
-    // written (accepted). Delivery to the model is asynchronous in both
-    // mechanisms. `dropbox` delivers on the worker's next tool call, and only
-    // if the drain hook is registered in the account home the worker was
-    // started from; `resume` has started a new worker with the message as its
-    // prompt. Neither is "delivered", so the response never says so.
-    const drainHook = drainHookStatusFor(ctx, next);
-    const deliveryStatus = move?.queued
-        ? "queued_on_target_account"
-        : queuedOnAdmission
-            ? "queued_on_admission"
-            : mechanism === "dropbox"
-                ? "awaiting_next_tool_call"
-                : "worker_spawned";
-    const warning = mechanism === "dropbox" && drainHook !== null && !drainHook.registered
-        ? `The drain hook is not registered in ${drainHook.path}; the running worker will not receive this message. It stays in the inbox and is delivered on the lane's next start.`
-        : mechanism === "dropbox" && next.stalled === true
-            ? `The worker has made no tool call since ${next.stalled_at ?? "an unknown time"} (${next.stalled_reason ?? "stalled"}); delivery waits on its next tool call.`
-            : null;
-    printJson({
-        ok: true,
-        action: "message",
-        lane_id: laneId,
-        message_id: messageId,
-        accepted: true,
-        delivered: false,
-        delivery: mechanism,
-        delivery_status: deliveryStatus,
-        inbox_path: mechanism === "dropbox" ? dropboxInboxPath(hqRoot, laneId) : null,
-        drain_hook: drainHook,
-        warning,
-        resumed_session_id: resumed?.last_resume?.session_id ?? null,
-        compaction: resumed?.last_compaction && resumed.last_compaction.resume_at === resumed.last_resume?.at
-            ? resumed.last_compaction
-            : null,
-        account_move: move ? accountMoveSummary(move) : null,
-        project_id: next.project_id,
-        story_id: next.story_id,
-        stories: laneStories(next),
-        story_warning: storyWarning(next) ?? null,
-        lane: next,
-    });
 }
 function accountMoveSummary(move) {
     return {
@@ -8532,6 +8709,9 @@ async function runReconcile(ctx, opts) {
         livenessDeps: livenessDepsFromCtx(ctx),
         presenceConnected: ctx.presenceConnected,
         resolveQuestionActiveCompany: () => resolveActiveQuestionCompany(ctx),
+        recoverQueuedMessages: async (lane) => {
+            await recoverQueuedMessages(ctx, lane.lane_id);
+        },
         mesh: ctx.mesh,
         env: ctx.env,
     });
@@ -8863,6 +9043,12 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (laneId, opts) => {
         await runMessage(ctx, laneId, opts);
     }));
+    lanes
+        .command("_recover-queued-messages", { hidden: true })
+        .argument("<lane-id>", "Lane id")
+        .action(wrap(async (laneId) => {
+        printJson(await recoverQueuedMessages(ctx, laneId));
+    }));
     lanes
         .command("_monitor-message", { hidden: true })
         .argument("<lane-id>", "Lane id")