@indigoai-us/hq-cli 5.252.0 → 5.254.0

package/CHANGELOG.md

@@ -2,7 +2,32 @@
 
 ## [Unreleased]
 
+## [5.254.0] — 2026-09-28
+
+### Added
+
+- The `lanes.manager-status-gate` flag checks a manager lane's declared
+  status file after each provider turn. It queues at most one corrective
+  resume if the file was not updated. An invalid or out-of-boundary mapping
+  disables the gate for that lane and lets the lane start.
+
+### Fixed
+
+- The end-of-session work report is no longer dropped when the background
+- `hq db sql --remote` is hidden because remote SQL is not available in this
+  CLI build. Existing scripts get a clear error, and local SQL remains
+  available without `--remote`.
+
+## [5.253.0] — 2026-09-27
+
+### Added
+
+- `hq publish --handle <handle>` publishes a pack under one of the creator handles your
+  account owns, for accounts that own more than one. The server refuses a handle you do
+  not own with a plain message. `--as` is unchanged and cannot be combined with `--handle`.
+
 ## [5.252.0] — 2026-09-27
+
 ### Added
 
 - `hq report publish` takes a snapshot of the finished page and publishes it as the report's preview image, using a browser already installed on the computer. A page that names its own preview image keeps it. If no browser is found the report publishes without a preview.

package/dist/command-catalog.generated.d.ts

@@ -418,6 +418,9 @@ export declare const COMMAND_CATALOG: readonly [{
     }, {
         readonly flags: "--on-behalf <handle>";
         readonly description: "Alias for --as.";
+    }, {
+        readonly flags: "--handle <handle>";
+        readonly description: "Publish as one of your own claimed creator handles (for accounts that own more than one). Defaults to your first claimed handle.";
     }];
     readonly subcommands: readonly [];
 }, {
@@ -1267,7 +1270,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "sql";
-        readonly description: "Run SQL against the company vault DB (local default; --remote for secrets-injected remote; read-only by default)";
+        readonly description: "Run SQL against the company vault DB (local; read-only by default)";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] [sql...]";
@@ -1284,7 +1287,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Allow write/DDL statements (discouraged for ad-hoc DDL)";
         }, {
             readonly flags: "--remote";
-            readonly description: "Use remote tier via vault-bound credentials (not auto-replicated with local)";
+            readonly description: "Remote SQL is not available in this CLI build yet; local queries work without --remote";
         }, {
             readonly flags: "--db-path <path>";
             readonly description: "Dangerous: open a non-canonical DB path (denied unless --allow-cross-company-path)";

package/dist/command-catalog.generated.js

@@ -530,6 +530,10 @@ export const COMMAND_CATALOG = [
             {
                 "flags": "--on-behalf <handle>",
                 "description": "Alias for --as."
+            },
+            {
+                "flags": "--handle <handle>",
+                "description": "Publish as one of your own claimed creator handles (for accounts that own more than one). Defaults to your first claimed handle."
             }
         ],
         "subcommands": []
@@ -1615,7 +1619,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "sql",
-                "description": "Run SQL against the company vault DB (local default; --remote for secrets-injected remote; read-only by default)",
+                "description": "Run SQL against the company vault DB (local; read-only by default)",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options] [sql...]",
@@ -1637,7 +1641,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--remote",
-                        "description": "Use remote tier via vault-bound credentials (not auto-replicated with local)"
+                        "description": "Remote SQL is not available in this CLI build yet; local queries work without --remote"
                     },
                     {
                         "flags": "--db-path <path>",

package/dist/commands/db-sql.js

@@ -4,9 +4,9 @@
  * Default is read-only. Prefer `hq db migrate` for schema changes.
  * Never prints remote connection strings.
  */
+import { Option } from "commander";
 import chalk from "chalk";
 import fs from "node:fs";
-import { runRemoteSql } from "../lib/db/remote-sql.js";
 import { formatSqlResult, runLocalSql } from "../lib/db/sql.js";
 function readSqlArg(sqlArgs, stdinFlag) {
     if (stdinFlag || sqlArgs.length === 0) {
@@ -19,10 +19,10 @@ function readSqlArg(sqlArgs, stdinFlag) {
 }
 export function registerDbSqlCommand(db) {
     db.command("sql")
-        .description("Run SQL against the company vault DB (local default; --remote for secrets-injected remote; read-only by default)")
+        .description("Run SQL against the company vault DB (local; read-only by default)")
         .requiredOption("--company <slug>", "Company slug (tenant scope; required)")
         .option("--write", "Allow write/DDL statements (discouraged for ad-hoc DDL)", false)
-        .option("--remote", "Use remote tier via vault-bound credentials (not auto-replicated with local)", false)
+        .addOption(new Option("--remote", "Remote SQL is not available in this CLI build yet; local queries work without --remote").hideHelp())
         .option("--db-path <path>", "Dangerous: open a non-canonical DB path (denied unless --allow-cross-company-path)")
         .option("--allow-cross-company-path", "Dangerous: permit --db-path outside this company's canonical local DB", false)
         .option("--format <fmt>", "Output format: jsonl | table", "jsonl")
@@ -37,27 +37,13 @@ export function registerDbSqlCommand(db) {
                 process.exitCode = 1;
                 return;
             }
-            const sql = readSqlArg(sqlParts, !!opts.stdin).trim();
-            const format = opts.format === "table" ? "table" : "jsonl";
             if (opts.remote) {
-                // Local and remote are not auto-replicated (v1 limitation).
-                const remoteResult = await runRemoteSql({
-                    company,
-                    sql,
-                    getConnectionConfig: async () => {
-                        throw new Error("no remote binding");
-                    },
-                });
-                console.log(formatSqlResult({
-                    columns: remoteResult.rows[0]
-                        ? Object.keys(remoteResult.rows[0])
-                        : [],
-                    rows: remoteResult.rows,
-                    changes: 0,
-                    readonly: true,
-                }, format));
+                console.error(chalk.red("Error: Remote SQL is not available in this CLI build yet. Local queries work without --remote."));
+                process.exitCode = 1;
                 return;
             }
+            const sql = readSqlArg(sqlParts, !!opts.stdin).trim();
+            const format = opts.format === "table" ? "table" : "jsonl";
             const result = runLocalSql({
                 company,
                 sql,

package/dist/commands/lanes-checks.js

@@ -9,6 +9,7 @@ import { createLocalTrackerStore } from "../lib/lanes/tracker-store.js";
 import { sessionLiveness } from "../lib/lanes/liveness.js";
 import { findOrphanLanes, parseOrphanMinAge } from "../lib/lanes/orphans.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
+import { checkCompanyPath } from "../lib/lanes/checked-company-path.js";
 import { LANES_TRACKER_FLAG } from "./lanes-tracker.js";
 function fail(error, message, details = {}) {
     throw new LanesError(error, message, details);
@@ -56,37 +57,6 @@ function readJsonObject(file, missing = "error") {
         return fail("tracker_checks_input_invalid", "Checks input must be a JSON object", { path: file });
     return parsed;
 }
-function isWithin(root, candidate) {
-    const relative = path.relative(root, candidate);
-    return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
-}
-function checkCompanyPath(root, company, file, detailsPath) {
-    if (path.isAbsolute(file))
-        return fail("tracker_checks_mapping_invalid", "Mapped path must be relative to the HQ root", { path: detailsPath });
-    const absolute = path.resolve(root, file);
-    const rootReal = fs.realpathSync(root);
-    if (!isWithin(rootReal, absolute))
-        return fail("tracker_checks_mapping_invalid", "Mapped path escapes the HQ root", { path: detailsPath });
-    const relative = path.relative(rootReal, absolute).split(path.sep);
-    if (relative[0] === "companies" && relative[1] !== company) {
-        return fail("tracker_checks_mapping_invalid", "Mapped path crosses the active company boundary", { path: detailsPath });
-    }
-    try {
-        const real = fs.realpathSync(absolute);
-        if (!isWithin(rootReal, real))
-            return fail("tracker_checks_mapping_invalid", "Mapped path resolves outside the HQ root", { path: detailsPath });
-        const realRelative = path.relative(rootReal, real).split(path.sep);
-        if (realRelative[0] === "companies" && realRelative[1] !== company) {
-            return fail("tracker_checks_mapping_invalid", "Mapped path resolves into another company", { path: detailsPath });
-        }
-    }
-    catch (err) {
-        if (err.code !== "ENOENT") {
-            return fail("tracker_checks_mapping_unreadable", `Mapped path could not be checked: ${err instanceof Error ? err.message : String(err)}`, { path: absolute });
-        }
-    }
-    return absolute;
-}
 function projectFromPrdReference(root, company, raw, registryPath) {
     if (typeof raw !== "string" || raw.trim() === "") {
         return fail("tracker_checks_mapping_invalid", "Team mapping needs a PRD path", { path: registryPath });

package/dist/commands/lanes-message.js

@@ -10,6 +10,7 @@ import { isPidAlive, runWatcherLoop, WATCHER_OUT_MAX_BYTES, watcherOutLogPath, w
 import { laneStories, laneStory, storyWarning } from "../lib/lanes/stories.js";
 import { laneRunDir, probePidRecord, readPidRecord, readProcStarttime, spawnLaneWorker } from "../lib/lanes/spawn.js";
 import { keepAliveExclusion, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, loadRetiredLaneIds } from "../lib/lanes/keep-alive.js";
+import { managerStatusGateEnabledForLane } from "../lib/lanes/manager-status-gate.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
 import { accountMoveSummary, accountRequestKeepsCurrentLane, assertCurrentResumeAccountAvailable, recordedResumeEffort, resetKeepAliveProgress, resolveResumeEffort } from "./lanes-shared.js";
 export function createLaneMessageHandlers(deps) {
@@ -285,6 +286,7 @@ export function createLaneMessageHandlers(deps) {
                 markAccepted();
             }
             else {
+                const managerStatusGateEnabled = await managerStatusGateEnabledForLane(hqRoot, lane, { env: ctx.env });
                 const dispatched = await dispatchLaneDelivery(lane, {
                     dropbox: () => {
                         // Live (or about-to-be-live) process: the PreToolUse drain delivers it.
@@ -341,6 +343,7 @@ export function createLaneMessageHandlers(deps) {
                                 }
                                 const started = spawnLaneWorker(hqRoot, lane, {
                                     env: ctx.env,
+                                    managerStatusGateEnabled,
                                     modelDeps: {
                                         readFileSync: ctx.readFileSync,
                                         probe: ctx.probeProvider,

package/dist/commands/lanes-resume.js

@@ -5,6 +5,7 @@ import { parseCliEffort } from "../lib/lanes/effort.js";
 import { parseOutpostHireGrantContext } from "../lib/lanes/hire-grant-dispatch.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { laneStories, laneStory, storyWarning } from "../lib/lanes/stories.js";
+import { managerStatusGateEnabledForLane } from "../lib/lanes/manager-status-gate.js";
 import { spawnLaneWorker } from "../lib/lanes/spawn.js";
 import { accountMoveSummary, accountRequestKeepsCurrentLane, assertCurrentResumeAccountAvailable, hasKeepAliveProgress, recordedResumeEffort, resetKeepAliveProgress, resolveResumeEffort } from "./lanes-shared.js";
 export function createLaneResumeHandlers(deps) {
@@ -281,6 +282,7 @@ export function createLaneResumeHandlers(deps) {
             resumed = lane;
         }
         else {
+            const managerStatusGateEnabled = await managerStatusGateEnabledForLane(hqRoot, lane, { env: ctx.env });
             resumed = await withLaneAdmissionLock(hqRoot, lane.provider, async () => {
                 const admission = await assessLaneAdmission(ctx, lane, { queueAt: at });
                 if (admission.action === "refuse" && admission.error)
@@ -327,6 +329,7 @@ export function createLaneResumeHandlers(deps) {
                     }
                     return spawnLaneWorker(hqRoot, lane, {
                         env: ctx.env,
+                        managerStatusGateEnabled,
                         modelDeps: {
                             readFileSync: ctx.readFileSync,
                             probe: ctx.probeProvider,

package/dist/commands/lanes.d.ts

@@ -58,7 +58,7 @@ export interface LanesCommandDeps {
     /** Test seam for worker PID identity checks. */
     readStarttime?: (pid: number) => number | null;
     /** Test seams for synchronous dead-worker classification and repair. */
-    watcherLoopDeps?: Pick<WatcherLoopDeps, "sleep" | "spawnRepair">;
+    watcherLoopDeps?: Pick<WatcherLoopDeps, "sleep" | "spawnRepair" | "readManagerStatusGateFlag">;
     stopSleepMs?: (ms: number) => void;
     livenessDeps?: LivenessDeps;
     presenceConnected?: boolean;

package/dist/commands/lanes.js

@@ -57,6 +57,7 @@ import { LanesError } from "../lib/lanes/errors.js";
 import { LANE_WAIT_INVALID_INPUT_EXIT_CODE, LANE_WAIT_TIMEOUT_EXIT_CODE, runLaneWait, } from "../lib/lanes/wait.js";
 import { loadQuotaState, quotaBlockFor } from "../lib/lanes/quota.js";
 import { SESSION_MOVE_REASON } from "../lib/lanes/move-account.js";
+import { managerStatusGateEnabledForLane, resolveManagerStatusGateForLane, } from "../lib/lanes/manager-status-gate.js";
 import { ensureSessionHome } from "../lib/lanes/session-relink.js";
 import { defaultProbe, validateProfileLaneModel, validateLaneModel, } from "../lib/lanes/models.js";
 import { parseCliModel, refuseOutpostSelfTarget, resolveLaneModel, FOREGROUND_ONLY_RULE, STANDING_AUTHORIZATION, spawnLaneWorker, laneRunDir, readSpawnManifest, stopLaneProcesses, } from "../lib/lanes/spawn.js";
@@ -3072,6 +3073,7 @@ async function runCreate(ctx, opts) {
     if (admission.action === "start") {
         started = spawnLaneWorker(hqRoot, lane, {
             env: ctx.env,
+            managerStatusGateEnabled: await managerStatusGateEnabledForLane(hqRoot, lane, { env: ctx.env }),
             modelDeps: {
                 readFileSync: ctx.readFileSync,
                 probe: ctx.probeProvider,
@@ -4043,6 +4045,7 @@ async function runPickup(ctx, opts) {
         try {
             return spawnLaneWorker(hqRoot, current, {
                 env: ctx.env,
+                managerStatusGateEnabled: await managerStatusGateEnabledForLane(hqRoot, current, { env: ctx.env }),
                 modelDeps: {
                     readFileSync: ctx.readFileSync,
                     probe: ctx.probeProvider,
@@ -4724,6 +4727,8 @@ async function runShow(ctx, laneId) {
         : storedLane;
     const askDeliveryFailed = readJsonFile(askDeliveryFailedPath(hqRoot, laneId));
     const keepAliveState = resolveLaneKeepAlive(hqRoot, storedLane);
+    const managerStatusGate = await resolveManagerStatusGateForLane(hqRoot, storedLane, { env: ctx.env });
+    const managerStatusTarget = managerStatusGate.target;
     printJson({
         ok: true,
         action: "show",
@@ -4762,6 +4767,22 @@ async function runShow(ctx, laneId) {
             next_eligible_at: lane.keep_alive_next_eligible_at ?? null,
             exhausted_at: lane.keep_alive_exhausted_at ?? null,
         },
+        manager_status_gate: managerStatusGate.error !== undefined
+            ? {
+                status_path: null,
+                skipped: null,
+                consecutive_misses: storedLane.status_gate?.consecutive_misses ?? 0,
+                error: managerStatusGate.error,
+            }
+            : managerStatusTarget?.manager
+                ? {
+                    status_path: managerStatusTarget.statusPath ?? null,
+                    skipped: managerStatusTarget.skipped === "no_juniors_row"
+                        ? "no_declared_status_file"
+                        : null,
+                    consecutive_misses: storedLane.status_gate?.consecutive_misses ?? 0,
+                }
+                : null,
         last_message_at: lane.last_message_at ?? null,
         last_compaction: lane.last_compaction
             ? { ...lane.last_compaction, after: compactionAfterUsage(storedLane) }
@@ -5221,6 +5242,7 @@ async function runAdmit(ctx, laneId, opts) {
         }
         const started = spawnLaneWorker(hqRoot, lane, {
             env: ctx.env,
+            managerStatusGateEnabled: await managerStatusGateEnabledForLane(hqRoot, lane, { env: ctx.env }),
             modelDeps: {
                 readFileSync: ctx.readFileSync,
                 probe: ctx.probeProvider,

package/dist/commands/publish.d.ts

@@ -130,7 +130,7 @@ export declare function unwrapListing(body: Record<string, unknown>): ListingRes
  * locally-resolved author handle — falling back gracefully when the server
  * omits either field.
  */
-export declare function buildListingNotice(status: number, body: Record<string, unknown>, packName: string, packVersion: string): string;
+export declare function buildListingNotice(status: number, body: Record<string, unknown>, packName: string, packVersion: string, selectedHandle?: string): string;
 /**
  * The exact JSON body the deployed `POST /v1/listings` handler expects. Field
  * shapes mirror the server contract: `type` ∈ {skill,worker}, `contributes` is
@@ -151,6 +151,12 @@ export interface ListingRequest {
      * caller is staff (`@getindigo.ai`) and the server has the capability enabled.
      */
     publishAsHandle?: string;
+    /**
+     * OPTIONAL explicit choice among the caller's OWN claimed creator handles
+     * (`hq publish --handle <h>`). The server refuses a handle the caller does
+     * not own (403 CREATOR_HANDLE_NOT_OWNED) instead of falling back.
+     */
+    ownedCreatorHandle?: string;
     /** Base64-encoded gzip pack tarball (pack.tar.gz bytes). */
     tarball: string;
 }
@@ -196,6 +202,7 @@ export interface PublishResult {
  */
 export declare function runPublish(targetPath: string, deps: PublishDeps, opts?: {
     publishAsHandle?: string;
+    creatorHandle?: string;
 }): Promise<PublishResult>;
 export declare function registerPublishCommand(program: Command): void;
 //# sourceMappingURL=publish.d.ts.map

package/dist/commands/publish.js

@@ -231,7 +231,7 @@ export function unwrapListing(body) {
  * locally-resolved author handle — falling back gracefully when the server
  * omits either field.
  */
-export function buildListingNotice(status, body, packName, packVersion) {
+export function buildListingNotice(status, body, packName, packVersion, selectedHandle) {
     if (status === 409) {
         throw new Error(`${packName}@${packVersion} is already published (duplicate version). ` +
             `Bump the version in package.yaml and re-run \`hq publish\`.`);
@@ -246,6 +246,10 @@ export function buildListingNotice(status, body, packName, packVersion) {
     }
     if (status === 401 || status === 403) {
         const code = typeof body.code === 'string' ? body.code : '';
+        if (code === 'CREATOR_HANDLE_NOT_OWNED') {
+            const h = selectedHandle ?? '(unknown)';
+            throw new Error(`You do not own the creator handle ${h}. Claim it first with hq creators apply --handle ${h}.`);
+        }
         if (code === 'NOT_VERIFIED_CREATOR') {
             throw new Error('Only verified creators can publish to the marketplace. ' +
                 'Run `hq creators apply --reason "..."` to request verified-creator access; ' +
@@ -287,6 +291,12 @@ export async function runPublish(targetPath, deps, opts = {}) {
     const publishAsHandle = typeof opts.publishAsHandle === 'string' && opts.publishAsHandle.length > 0
         ? opts.publishAsHandle
         : undefined;
+    const selectedHandle = typeof opts.creatorHandle === 'string' && opts.creatorHandle.trim().length > 0
+        ? opts.creatorHandle.trim().replace(/^@/, '')
+        : undefined;
+    if (publishAsHandle && selectedHandle) {
+        throw new Error('Use either --as or --handle, not both. Nothing was uploaded.');
+    }
     // Resolve a payload dir. We stamp/validate against a temp copy so we never
     // mutate the user's working tree's package.yaml.
     const absTarget = path.resolve(process.cwd(), targetPath);
@@ -335,12 +345,13 @@ export async function runPublish(targetPath, deps, opts = {}) {
             // server is authoritative for attribution either way). Normal: our
             // resolved handle is a backwards-compat fallback under the server's
             // claimed-handle lookup.
-            creatorHandle: publishAsHandle ?? author.handle,
+            creatorHandle: publishAsHandle ?? selectedHandle ?? author.handle,
             ...(publishAsHandle ? { publishAsHandle } : {}),
+            ...(selectedHandle ? { ownedCreatorHandle: selectedHandle } : {}),
             tarball: Buffer.from(tarballBytes).toString('base64'),
         };
         const { status, body } = await deps.upload({ token, listing });
-        const notice = buildListingNotice(status, body, pkg.name, pkg.version);
+        const notice = buildListingNotice(status, body, pkg.name, pkg.version, selectedHandle);
         // Unwrap the `{ listing }` success envelope the server sends so attribution
         // reads the server's resolved handle (fall back to top-level for compat).
         const serverHandle = unwrapListing(body).creatorHandle?.trim();
@@ -362,6 +373,8 @@ export function registerPublishCommand(program) {
         .option('--as <handle>', 'Publish on behalf of a seeded, unclaimed creator by handle (HQ staff only). ' +
         'The listing is attributed to that creator instead of you.')
         .option('--on-behalf <handle>', 'Alias for --as.')
+        .option('--handle <handle>', 'Publish as one of your own claimed creator handles (for accounts that own more than one). ' +
+        'Defaults to your first claimed handle.')
         .action(async (targetPath, options) => {
         try {
             const publishAsHandle = options.as ?? options.onBehalf;
@@ -390,7 +403,7 @@ export function registerPublishCommand(program) {
                 },
                 hqRoot,
                 hqVersion: readHqVersion(hqRoot),
-            }, { publishAsHandle });
+            }, { publishAsHandle, creatorHandle: options.handle });
             console.log(chalk.green(result.notice));
             // Only print the locally-resolved author as a fallback when the server
             // did NOT return its own resolved handle (already in the notice).

package/dist/lib/db/remote-sql.d.ts

@@ -1,8 +1,8 @@
 /**
- * Remote SQL via secrets-exec style injection (US-010).
+ * Remote SQL helper with injected credentials and executor (US-010).
  *
  * Connection string never appears in argv, logs, or stdout.
- * Local remains default when --remote is absent (handled by command layer).
+ * The CLI command does not currently wire this helper to a remote executor.
  */
 export interface RemoteSqlOptions {
     company: string;

package/dist/lib/db/remote-sql.js

@@ -1,8 +1,8 @@
 /**
- * Remote SQL via secrets-exec style injection (US-010).
+ * Remote SQL helper with injected credentials and executor (US-010).
  *
  * Connection string never appears in argv, logs, or stdout.
- * Local remains default when --remote is absent (handled by command layer).
+ * The CLI command does not currently wire this helper to a remote executor.
  */
 function assertNoLeak(label, value) {
     const s = typeof value === "string" ? value : JSON.stringify(value);
@@ -23,7 +23,7 @@ export async function runRemoteSql(opts) {
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : "no remote binding";
-        throw new Error(`remote SQL unavailable: ${msg}. Run \`hq db provision --company ${opts.company}\` first.`);
+        throw new Error(`remote SQL unavailable: ${msg}`);
     }
     assertNoLeak("connection config", config);
     if (!opts.execute) {

package/dist/lib/lanes/checked-company-path.d.ts

@@ -0,0 +1,3 @@
+/** The shared HQ/company path validation used by lane tracker mappings. */
+export declare function checkCompanyPath(root: string, company: string, file: string, detailsPath: string): string;
+//# sourceMappingURL=checked-company-path.d.ts.map

package/dist/lib/lanes/checked-company-path.js

@@ -0,0 +1,39 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { LanesError } from "./errors.js";
+function fail(error, message, details) {
+    throw new LanesError(error, message, details);
+}
+function isWithin(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
+}
+/** The shared HQ/company path validation used by lane tracker mappings. */
+export function checkCompanyPath(root, company, file, detailsPath) {
+    if (path.isAbsolute(file))
+        return fail("tracker_checks_mapping_invalid", "Mapped path must be relative to the HQ root", { path: detailsPath });
+    const absolute = path.resolve(root, file);
+    const rootReal = fs.realpathSync(root);
+    if (!isWithin(rootReal, absolute))
+        return fail("tracker_checks_mapping_invalid", "Mapped path escapes the HQ root", { path: detailsPath });
+    const relative = path.relative(rootReal, absolute).split(path.sep);
+    if (relative[0] === "companies" && relative[1] !== company) {
+        return fail("tracker_checks_mapping_invalid", "Mapped path crosses the active company boundary", { path: detailsPath });
+    }
+    try {
+        const real = fs.realpathSync(absolute);
+        if (!isWithin(rootReal, real))
+            return fail("tracker_checks_mapping_invalid", "Mapped path resolves outside the HQ root", { path: detailsPath });
+        const realRelative = path.relative(rootReal, real).split(path.sep);
+        if (realRelative[0] === "companies" && realRelative[1] !== company) {
+            return fail("tracker_checks_mapping_invalid", "Mapped path resolves into another company", { path: detailsPath });
+        }
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            return fail("tracker_checks_mapping_unreadable", `Mapped path could not be checked: ${err instanceof Error ? err.message : String(err)}`, { path: absolute });
+        }
+    }
+    return absolute;
+}
+//# sourceMappingURL=checked-company-path.js.map

package/dist/lib/lanes/keep-alive.d.ts

@@ -1,4 +1,4 @@
-import type { LaneRecord, QuestionRecord } from "./types.js";
+import type { LaneRecord, ManagerStatusGateHistoryEntry, QuestionRecord } from "./types.js";
 export declare const LEAD_LANE_KEEP_ALIVE_FLAG = "lanes.lead-keep-alive";
 export declare const LEAD_LANE_KEEP_ALIVE_DEFAULT_ENABLED = false;
 /** Missing or unreadable registry values retain the legacy supersession behavior. */
@@ -7,6 +7,8 @@ export declare const LANE_SUPERSESSION_LINEAGE_AWARE_DEFAULT_ENABLED = false;
 export declare const LEAD_LANE_KEEP_ALIVE_MAX_RESUMES = 24;
 export declare const LEAD_LANE_KEEP_ALIVE_BASE_BACKOFF_MS: number;
 export declare const LEAD_LANE_KEEP_ALIVE_MAX_BACKOFF_MS: number;
+/** Persist a manager status miss and queue its one bounded follow-up turn. */
+export declare function queueManagerStatusGateResume(hqRoot: string, laneId: string, entry: Omit<ManagerStatusGateHistoryEntry, "event" | "resume_queued" | "resume_skipped_reason">, resumeText: string): LaneRecord;
 export declare const LEAD_LANE_KEEP_ALIVE_RESUME_TEXT = "Automatic keep-alive resume: your last turn ended with decision done and story_complete false. Continue the open work from where you stopped. End with done only when story_complete is true; if you are waiting, use hq lanes ask or stay in the loop.";
 export declare const LEAD_LANE_KEEP_ALIVE_INTERRUPTED_RESUME_TEXT = "Automatic keep-alive resume: your previous turn was interrupted by a provider process exit. Check your last state before continuing. Continue the open work from where you stopped. End with done only when story_complete is true; if you are waiting, use hq lanes ask or stay in the loop.";
 export type KeepAliveBlockedReason = NonNullable<LaneRecord["keep_alive_blocked_reason"]>;

package/dist/lib/lanes/keep-alive.js

@@ -2,7 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { LanesError } from "./errors.js";
 import { dropboxInboxHasMessages } from "./dropbox.js";
-import { listQuestionIds, readQuestion } from "./store.js";
+import { appendCappedHistory, listQuestionIds, readQuestion, retryUpdateLane } from "./store.js";
 export const LEAD_LANE_KEEP_ALIVE_FLAG = "lanes.lead-keep-alive";
 export const LEAD_LANE_KEEP_ALIVE_DEFAULT_ENABLED = false;
 /** Missing or unreadable registry values retain the legacy supersession behavior. */
@@ -11,6 +11,61 @@ export const LANE_SUPERSESSION_LINEAGE_AWARE_DEFAULT_ENABLED = false;
 export const LEAD_LANE_KEEP_ALIVE_MAX_RESUMES = 24;
 export const LEAD_LANE_KEEP_ALIVE_BASE_BACKOFF_MS = 5 * 60 * 1000;
 export const LEAD_LANE_KEEP_ALIVE_MAX_BACKOFF_MS = 60 * 60 * 1000;
+/** Persist a manager status miss and queue its one bounded follow-up turn. */
+export function queueManagerStatusGateResume(hqRoot, laneId, entry, resumeText) {
+    return retryUpdateLane(hqRoot, laneId, "watcher", (current) => {
+        const gate = current.status_gate;
+        if (gate === undefined || gate.turn_id !== entry.turn_id)
+            return current;
+        const history = current.status_gate_history ?? [];
+        if (history.some((prior) => prior.event === "status_missed" && prior.turn_id === entry.turn_id)) {
+            return current;
+        }
+        const consecutiveMisses = gate.consecutive_misses + 1;
+        let resumeSkippedReason;
+        if (current.state === "blocked")
+            resumeSkippedReason = "blocked";
+        else if (current.state === "awaiting_input")
+            resumeSkippedReason = "open_question";
+        else if (consecutiveMisses > 1)
+            resumeSkippedReason = "miss_limit";
+        else if (!current.provider_session_id)
+            resumeSkippedReason = "no_provider_session";
+        const resumeQueued = resumeSkippedReason === undefined &&
+            (current.state === "done" || current.state === "interrupted" || current.state === "failed");
+        const missed = {
+            event: "status_missed",
+            ...entry,
+            ...(resumeQueued ? { resume_queued: true } : {}),
+            ...(resumeSkippedReason !== undefined ? { resume_skipped_reason: resumeSkippedReason } : {}),
+        };
+        const next = {
+            ...current,
+            status_gate: { ...gate, consecutive_misses: consecutiveMisses },
+            status_gate_history: appendCappedHistory(history, missed),
+        };
+        if (!resumeQueued || !current.provider_session_id)
+            return next;
+        const resumedFrom = current.state;
+        return {
+            ...next,
+            state: "queued",
+            queued_reason: undefined,
+            queued_at: entry.at,
+            admission_reserved_at: undefined,
+            terminal_reason: undefined,
+            terminal_details: undefined,
+            pending_resume: {
+                session_id: current.provider_session_id,
+                trigger: "resume",
+                resumed_from: resumedFrom,
+                text: resumeText,
+                compact: true,
+                at: entry.at,
+            },
+        };
+    });
+}
 export const LEAD_LANE_KEEP_ALIVE_RESUME_TEXT = "Automatic keep-alive resume: your last turn ended with decision done and story_complete false. Continue the open work from where you stopped. End with done only when story_complete is true; if you are waiting, use hq lanes ask or stay in the loop.";
 export const LEAD_LANE_KEEP_ALIVE_INTERRUPTED_RESUME_TEXT = "Automatic keep-alive resume: your previous turn was interrupted by a provider process exit. Check your last state before continuing. Continue the open work from where you stopped. End with done only when story_complete is true; if you are waiting, use hq lanes ask or stay in the loop.";
 /**

package/dist/lib/lanes/manager-status-gate.d.ts

@@ -0,0 +1,34 @@
+import { readLanesRegistryFlag } from "./registry-flag.js";
+import type { LaneRecord, ManagerStatusGate } from "./types.js";
+export declare const MANAGER_STATUS_GATE_FLAG = "lanes.manager-status-gate";
+export interface ManagerStatusTarget {
+    manager: boolean;
+    identified_by?: "story_id" | "worker_profile" | "juniors";
+    statusPath?: string;
+    skipped?: "no_juniors_row";
+}
+export interface StatusSnapshot {
+    mtime: number | null;
+    updatedAt: string | null;
+}
+export interface ManagerStatusGateResolution {
+    enabled: boolean;
+    target?: ManagerStatusTarget;
+    error?: string;
+}
+/** Resolve manager identity and the single declared status file, if present. */
+export declare function resolveManagerStatusTarget(root: string, lane: LaneRecord): ManagerStatusTarget;
+export declare function resolveManagerStatusGateForLane(root: string, lane: LaneRecord, options?: {
+    env?: NodeJS.ProcessEnv;
+    readFlag?: typeof readLanesRegistryFlag;
+    onError?: (error: unknown) => void;
+}): Promise<ManagerStatusGateResolution>;
+export declare function managerStatusGateEnabledForLane(root: string, lane: LaneRecord, options?: {
+    env?: NodeJS.ProcessEnv;
+    readFlag?: typeof readLanesRegistryFlag;
+    onError?: (error: unknown) => void;
+}): Promise<boolean>;
+export declare function readStatusSnapshot(filePath: string): StatusSnapshot;
+export declare function managerStatusGateHeartbeat(root: string, lane: LaneRecord, turnId: string, turnStartedAt: string): ManagerStatusGate | undefined;
+export declare function managerStatusWasWritten(gate: ManagerStatusGate, snapshot: StatusSnapshot): boolean;
+//# sourceMappingURL=manager-status-gate.d.ts.map

package/dist/lib/lanes/manager-status-gate.js

@@ -0,0 +1,168 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { checkCompanyPath } from "./checked-company-path.js";
+import { LanesError } from "./errors.js";
+import { readLanesRegistryFlag } from "./registry-flag.js";
+export const MANAGER_STATUS_GATE_FLAG = "lanes.manager-status-gate";
+function isObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function invalidMapping(message, filePath, details = {}) {
+    throw new LanesError("manager_status_mapping_invalid", message, { path: filePath, ...details });
+}
+function readJuniors(root) {
+    const filePath = path.join(root, "workspace", "lane-briefs", "juniors.json");
+    let raw;
+    try {
+        const stat = fs.lstatSync(filePath);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            invalidMapping("juniors.json must be a regular file", filePath);
+        raw = fs.readFileSync(filePath, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { filePath, rows: [] };
+        if (err instanceof LanesError)
+            throw err;
+        throw new LanesError("manager_status_mapping_unreadable", `Cannot read manager mapping ${filePath}: ${err instanceof Error ? err.message : String(err)}`, { path: filePath });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        invalidMapping("juniors.json contains invalid JSON", filePath);
+    }
+    if (!isObject(parsed) || !Array.isArray(parsed.juniors))
+        invalidMapping("juniors.json must contain a juniors array", filePath);
+    const rows = [];
+    for (const [index, row] of parsed.juniors.entries()) {
+        if (!isObject(row))
+            invalidMapping(`juniors[${index}] must be an object`, filePath, { index });
+        rows.push(row);
+    }
+    return { filePath, rows };
+}
+function matchesLane(rowLane, laneId) {
+    const row = rowLane.trim();
+    const bareLaneId = laneId.split("_", 1)[0] ?? "";
+    return row === laneId || row === bareLaneId;
+}
+function managerStatusGateErrorCode(err) {
+    return err instanceof LanesError ? err.error : "manager_status_gate_unavailable";
+}
+function logManagerStatusGateFailure(lane, err) {
+    const code = managerStatusGateErrorCode(err);
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`hq lanes: manager status gate disabled for ${lane.lane_id}: ${code}: ${message}\n`);
+}
+/** Resolve manager identity and the single declared status file, if present. */
+export function resolveManagerStatusTarget(root, lane) {
+    const directIdentity = lane.story_id === "MANAGER"
+        ? "story_id"
+        : lane.worker_profile?.endsWith("-manager") === true
+            ? "worker_profile"
+            : undefined;
+    const registry = readJuniors(root);
+    const matches = [];
+    for (const [index, row] of registry.rows.entries()) {
+        if (typeof row.lane !== "string")
+            invalidMapping(`juniors[${index}].lane must be a string`, registry.filePath, { index });
+        if (matchesLane(row.lane, lane.lane_id))
+            matches.push(row);
+    }
+    if (matches.length > 1)
+        invalidMapping("More than one juniors row maps to this manager lane", registry.filePath, { lane_id: lane.lane_id });
+    const row = matches[0];
+    if (row === undefined) {
+        return directIdentity
+            ? { manager: true, identified_by: directIdentity, skipped: "no_juniors_row" }
+            : { manager: false };
+    }
+    for (const field of ["team", "lane", "host", "status", "prd"]) {
+        if (typeof row[field] !== "string" || row[field].trim() === "") {
+            invalidMapping(`Matched juniors row needs a non-empty ${field}`, registry.filePath, { lane_id: lane.lane_id, field });
+        }
+    }
+    const company = lane.company?.slug ?? lane.mesh_company?.slug ?? "";
+    const statusPath = checkCompanyPath(root, company, row.status, registry.filePath);
+    return {
+        manager: true,
+        identified_by: directIdentity ?? "juniors",
+        statusPath,
+    };
+}
+export async function resolveManagerStatusGateForLane(root, lane, options = {}) {
+    const reportError = options.onError ?? ((err) => logManagerStatusGateFailure(lane, err));
+    let enabled;
+    try {
+        enabled = await (options.readFlag ?? readLanesRegistryFlag)(MANAGER_STATUS_GATE_FLAG, {
+            company: lane.company ?? lane.mesh_company ?? undefined,
+            env: options.env,
+        });
+    }
+    catch (err) {
+        reportError(err);
+        return { enabled: false, error: managerStatusGateErrorCode(err) };
+    }
+    if (!enabled)
+        return { enabled: false };
+    try {
+        const target = resolveManagerStatusTarget(root, lane);
+        return { enabled: target.manager && target.statusPath !== undefined, target };
+    }
+    catch (err) {
+        reportError(err);
+        return { enabled: false, error: managerStatusGateErrorCode(err) };
+    }
+}
+export async function managerStatusGateEnabledForLane(root, lane, options = {}) {
+    return (await resolveManagerStatusGateForLane(root, lane, options)).enabled;
+}
+export function readStatusSnapshot(filePath) {
+    let stat;
+    try {
+        stat = fs.statSync(filePath);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { mtime: null, updatedAt: null };
+        throw new LanesError("manager_status_unreadable", `Cannot stat manager status ${filePath}: ${err instanceof Error ? err.message : String(err)}`, { path: filePath });
+    }
+    if (!stat.isFile())
+        throw new LanesError("manager_status_invalid", `Manager status path is not a file: ${filePath}`, { path: filePath });
+    let updatedAt = null;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        if (isObject(parsed) && typeof parsed.updated_at === "string")
+            updatedAt = parsed.updated_at;
+    }
+    catch (err) {
+        if (!(err instanceof SyntaxError)) {
+            if (err.code === "ENOENT")
+                return { mtime: null, updatedAt: null };
+            throw new LanesError("manager_status_unreadable", `Cannot read manager status ${filePath}: ${err instanceof Error ? err.message : String(err)}`, { path: filePath });
+        }
+    }
+    return { mtime: stat.mtimeMs, updatedAt };
+}
+export function managerStatusGateHeartbeat(root, lane, turnId, turnStartedAt) {
+    const target = resolveManagerStatusTarget(root, lane);
+    if (!target.manager || target.statusPath === undefined)
+        return undefined;
+    const snapshot = readStatusSnapshot(target.statusPath);
+    return {
+        turn_started_at: turnStartedAt,
+        status_mtime_at_start: snapshot.mtime,
+        status_updated_at_at_start: snapshot.updatedAt,
+        status_path: target.statusPath,
+        turn_id: turnId,
+        consecutive_misses: lane.status_gate?.consecutive_misses ?? 0,
+    };
+}
+export function managerStatusWasWritten(gate, snapshot) {
+    const startedAt = Date.parse(gate.turn_started_at);
+    return ((snapshot.mtime !== null && Number.isFinite(startedAt) && snapshot.mtime > startedAt) ||
+        snapshot.updatedAt !== gate.status_updated_at_at_start);
+}
+//# sourceMappingURL=manager-status-gate.js.map

package/dist/lib/lanes/reconcile.d.ts

@@ -79,6 +79,8 @@ export interface ReconcileDeps {
     env?: NodeJS.ProcessEnv;
     /** Flag reader seam used to assert rollout reads happen before admission locks. */
     readRegistryFlag?: typeof readLanesRegistryFlag;
+    /** Pre-read manager gate decisions, scoped to each lane for this pass. */
+    managerStatusGateByLane?: ReadonlyMap<string, boolean>;
     /** Active-company fallback for questions raised from an unscoped lane. */
     resolveQuestionActiveCompany?: () => Promise<LaneCompanyRef>;
     /** Resume queued messages after this pass wins a local dead-worker CAS. */

package/dist/lib/lanes/reconcile.js

@@ -29,6 +29,7 @@ import { answeredQuestionEntries, questionRecordRefusalCode, raiseEnvelopeQuesti
 import { SILENCE_MS, classifyLaneExit, isPidAlive, missingExpectedEnvelopeFile, readLatestEnvelopeFile, readLatestEnvelopeRecord, watcherEventsPath, watcherOutLogPath, writeWatcherDecision, } from "./watcher.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshCompany, } from "./mesh-events.js";
 import { laneStories, storyStatusForEnvelope } from "./stories.js";
+import { resolveManagerStatusGateForLane } from "./manager-status-gate.js";
 import { decideEnvelopeRepair, envelopeQuestionIds, routeProviderFailure } from "./watcher.js";
 import { PROVIDER_REJECTED_REASON, providerRejectionDetails, readProviderRejection, } from "./provider-rejection.js";
 /** Spec §9: unanswered at the current hop for 60 minutes → one hop. */
@@ -44,11 +45,43 @@ export const PICKUP_VALIDATION_MAX_AGE_MS = 15 * 60 * 1000;
 export const PICKUP_VALIDATION_TIMEOUT_REASON = "pickup_validation_timeout";
 export const RECONCILE_UNIT_NAME = "hq-lanes-reconcile.service";
 export const RECONCILE_TIMER_NAME = "hq-lanes-reconcile.timer";
-function spawnDepsForHost(deps) {
+function spawnDepsForHost(deps, lane) {
     return {
         ...(deps.spawnLaneDeps ?? {}),
         hostname: deps.host.hostname,
         admissionHost: deps.host,
+        ...(lane !== undefined && deps.managerStatusGateByLane?.has(lane.lane_id)
+            ? { managerStatusGateEnabled: deps.managerStatusGateByLane.get(lane.lane_id) === true }
+            : {}),
+    };
+}
+async function prepareManagerStatusGateStarts(root, lanes, deps, summary) {
+    const enabledByLane = new Map();
+    let gateFailureRecorded = false;
+    if (!deps.dryRun) {
+        await Promise.all(lanes.filter((lane) => laneRunsHere(lane, deps.host)).map(async (lane) => {
+            const resolution = await resolveManagerStatusGateForLane(root, lane, {
+                env: deps.env,
+                readFlag: deps.readRegistryFlag,
+                onError: (err) => {
+                    if (gateFailureRecorded)
+                        return;
+                    gateFailureRecorded = true;
+                    const code = err instanceof LanesError ? err.error : "manager_status_gate_unavailable";
+                    const message = err instanceof Error ? err.message : String(err);
+                    summary.skipped.push({
+                        kind: "lane",
+                        id: lane.lane_id,
+                        why: `manager status gate disabled for this reconcile pass: ${code}: ${message}`,
+                    });
+                },
+            });
+            enabledByLane.set(lane.lane_id, resolution.enabled);
+        }));
+    }
+    return {
+        ...deps,
+        managerStatusGateByLane: enabledByLane,
     };
 }
 function logSkip(skip) {
@@ -694,8 +727,9 @@ export async function runPassBody(hqRoot, deps) {
         : QUESTION_AGE_MS;
     if (deps.afterLoad)
         await deps.afterLoad();
+    const startDeps = await prepareManagerStatusGateStarts(hqRoot, lanes, deps, summary);
     markOverdueLanes(hqRoot, lanes, summary, deps, now);
-    await heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now);
+    await heartbeatAndDeadHosts(hqRoot, lanes, summary, startDeps, now);
     for (const question of questions) {
         if (question.status !== "pending")
             continue;
@@ -838,10 +872,10 @@ export async function runPassBody(hqRoot, deps) {
     await withAllLaneAdmissionLocks(hqRoot, async () => {
         const freshLanes = loadLaneRecords(hqRoot, summary);
         const freshQuestions = loadQuestionRecords(hqRoot, summary);
-        resumeKeepAlive(hqRoot, freshLanes, freshQuestions, summary, deps, now, keepAliveFlagByCompany, supersessionLineageAwareByCompany);
+        resumeKeepAlive(hqRoot, freshLanes, freshQuestions, summary, startDeps, now, keepAliveFlagByCompany, supersessionLineageAwareByCompany);
         const drainLanes = loadLaneRecords(hqRoot, summary);
-        await admitQueued(hqRoot, drainLanes, summary, deps, now);
-        await resumeAwaiting(hqRoot, drainLanes, freshQuestions, summary, deps);
+        await admitQueued(hqRoot, drainLanes, summary, startDeps, now);
+        await resumeAwaiting(hqRoot, drainLanes, freshQuestions, summary, startDeps);
     });
     if (!deps.dryRun && summary.errors.length === 0) {
         try {
@@ -1024,10 +1058,12 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                         classification.reason === "account_model_unavailable")) {
                     recordAccountQuota(hqRoot, classified.provider, classified.account, quota);
                 }
-                if (!deps.dryRun && accountRetryReason && classified.account) {
+                if (!deps.dryRun &&
+                    accountRetryReason &&
+                    classified.account) {
                     try {
                         const recovered = await retryLaneOnAlternateAccount(hqRoot, classified, accountRetryReason, "reconcile", {
-                            ...spawnDepsForHost(deps),
+                            ...spawnDepsForHost(deps, classified),
                         });
                         summary.dead_host.push({
                             id: lane.lane_id,
@@ -1308,7 +1344,7 @@ async function admitQueued(hqRoot, lanes, summary, deps, now) {
         nowMs,
     });
     const spawnFn = deps.spawn ??
-        ((root, lane) => spawnLaneWorker(root, lane, spawnDepsForHost(deps)));
+        ((root, lane) => spawnLaneWorker(root, lane, spawnDepsForHost(deps, lane)));
     const running = lanes.filter((lane) => (lane.state === "running" ||
         hasFreshAdmissionReservation(lane, now.getTime()) ||
         hasActivePendingResume(lane, now.getTime())) &&
@@ -1977,7 +2013,7 @@ async function resumeAwaiting(hqRoot, lanes, questions, summary, deps, onlyLaneI
         const throttle = await decideAdmission(hqRoot, config.throttle, throttleDeps);
         throttleDecision = throttle.decision;
     }
-    const spawnFn = deps.spawn ?? ((root, lane) => spawnLaneWorker(root, lane, spawnDepsForHost(deps)));
+    const spawnFn = deps.spawn ?? ((root, lane) => spawnLaneWorker(root, lane, spawnDepsForHost(deps, lane)));
     const nowMs = deps.now().getTime();
     const fallbackAnswerAt = new Date(nowMs).toISOString();
     const answerAtByLane = new Map();

package/dist/lib/lanes/spawn.d.ts

@@ -86,6 +86,8 @@ export interface SpawnLaneDeps {
     runCompaction?: RunCompactionFn;
     /** Finds a session transcript under an account home. Injected in tests. */
     locateTranscript?: (home: string, sessionId: string) => string | null;
+    /** Pre-read by the async command/reconcile boundary before this sync spawn. */
+    managerStatusGateEnabled?: boolean;
 }
 export interface ProviderLaunch {
     command: string;
@@ -254,6 +256,7 @@ export declare function refuseOutpostSelfTarget(hqRoot: string, lane: LaneRecord
 export declare function armLaneWatcher(hqRoot: string, laneId: string, deps?: SpawnLaneDeps): number;
 export interface SpawnManifestFile {
     envelope_path?: string;
+    turn_id?: string;
     resume?: {
         session_id: string;
     } | null;

package/dist/lib/lanes/spawn.js

@@ -27,6 +27,7 @@ import { ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithReg
 import { registryWorkerRecord } from "./registry-persona.js";
 import { resolveMachineIdentity, } from "./machine-identity.js";
 import { appendCappedHistory, listLaneIds, readLane, retryUpdateLane } from "./store.js";
+import { managerStatusGateHeartbeat } from "./manager-status-gate.js";
 import { copySessionFiles, planSessionCopy } from "./move-account.js";
 import { ensureSessionHome } from "./session-relink.js";
 import { MESSAGE_REPLAY_STATE_NAME } from "./message-replay.js";
@@ -1476,6 +1477,7 @@ function writeSpawnManifest(runDir, input) {
         watcher_pid: input.watcherPid,
         detached: true,
         envelope_path: input.envelopePath,
+        ...(input.turnId !== undefined ? { turn_id: input.turnId } : {}),
         resume: input.resume,
         worker_out_offset: input.workerOutOffset,
         ...(input.fastMode ? { fast_mode: true } : {}),
@@ -1552,6 +1554,8 @@ export function readSpawnManifest(runDir) {
     const out = {};
     if (typeof rec.envelope_path === "string")
         out.envelope_path = rec.envelope_path;
+    if (typeof rec.turn_id === "string")
+        out.turn_id = rec.turn_id;
     if (typeof rec.provider_home_at_spawn === "string") {
         out.provider_home_at_spawn = rec.provider_home_at_spawn;
     }
@@ -1982,6 +1986,9 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
     // Claim running before spawning. Two callers that both observe queued must
     // not both start processes; the CAS loser returns without spawn.
     const nowIso = (deps.now ?? (() => new Date()))().toISOString();
+    const statusGateHeartbeat = deps.managerStatusGateEnabled === true
+        ? managerStatusGateHeartbeat(hqRoot, existing, laneTurnId, nowIso)
+        : undefined;
     let claimed = false;
     const claimedRecord = retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => {
         claimed = false;
@@ -2033,6 +2040,7 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
                 }
                 : { model_source: "none" }),
             effort_source: effort.source,
+            status_gate: statusGateHeartbeat,
             last_host_report_at: nowIso,
             ...(profile
                 ? {
@@ -2167,6 +2175,7 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
             workerPid,
             watcherPid,
             envelopePath,
+            turnId: laneTurnId,
             resume: resume ? { session_id: resume.session_id } : null,
             workerOutOffset,
             fastMode,

package/dist/lib/lanes/types.d.ts

@@ -334,6 +334,23 @@ export interface LastEnvelopeRef {
     artifacts?: unknown[];
     blocked_reason?: string;
 }
+export interface ManagerStatusGate {
+    turn_started_at: string;
+    status_mtime_at_start: number | null;
+    status_updated_at_at_start: string | null;
+    status_path: string;
+    turn_id: string;
+    consecutive_misses: number;
+}
+export interface ManagerStatusGateHistoryEntry {
+    event: "status_missed";
+    turn_id: string;
+    path: string;
+    at: string;
+    identified_by: "story_id" | "worker_profile" | "juniors";
+    resume_queued?: boolean;
+    resume_skipped_reason?: "open_question" | "blocked" | "miss_limit" | "no_provider_session";
+}
 export interface LaneStory {
     project_id: string;
     story_id: string;
@@ -473,6 +490,10 @@ export interface LaneRecord {
     fast_mode?: boolean;
     /** Time of the last operator message accepted for this lane. Drives compaction. */
     last_message_at?: string;
+    /** Turn-start baseline used by the optional manager status gate. */
+    status_gate?: ManagerStatusGate;
+    /** Bounded audit history of manager turns that missed their declared status artifact. */
+    status_gate_history?: ManagerStatusGateHistoryEntry[];
     /** Last automatic compaction of a resumed session (compaction.ts). */
     last_compaction?: LaneCompactionRecord;
     /**

package/dist/lib/lanes/types.js

@@ -228,7 +228,7 @@ export const LANE_FIELD_WRITERS = {
     provider: ["creator"], account: ["creator", "spawn", "command", "watcher", "reconcile"], account_selection: ["creator", "command"], admission_accounts: ["creator", "command"], account_history: ["command", "spawn", "watcher", "reconcile"], failed_resume_history: ["command"], pending_resume: ["command", "spawn", "watcher", "reconcile"], placement_default: ["creator"], host: ["creator", "command"], origin_host: ["creator"], origin_host_source: ["creator"],
     version: ["creator"], created_at: ["creator"], updated_at: ["creator"], attribution_history: ["command"],
     last_envelope: ["watcher", "reconcile"], model: ["creator", "spawn", "command"], model_source: ["creator", "spawn", "command"], effort: ["creator", "spawn", "command"], effort_source: ["creator", "spawn", "command"], fast_mode: ["spawn"],
-    last_message_at: ["command"], last_compaction: ["spawn"], story_complete: ["watcher", "reconcile"], story_complete_reason: ["watcher", "reconcile"], story_status: ["watcher", "reconcile"],
+    last_message_at: ["command"], status_gate: ["spawn", "watcher"], status_gate_history: ["watcher"], last_compaction: ["spawn"], story_complete: ["watcher", "reconcile"], story_complete_reason: ["watcher", "reconcile"], story_status: ["watcher", "reconcile"],
     overdue: ["reconcile"], overdue_at: ["reconcile"], last_host_report_at: ["watcher", "spawn", "reconcile"], stalled: ["watcher"], stalled_at: ["watcher"], stalled_reason: ["watcher"],
     admitted_reason: ["command", "reconcile"], terminal_reason: ["command", "watcher", "spawn", "reconcile"], stop_history: ["command"], interrupted_at: ["watcher", "reconcile"], terminal_details: ["command", "spawn", "watcher", "reconcile"],
     quota_reset_at: ["watcher", "reconcile"], model_quota_marker: ["watcher", "reconcile"], outpost_command_id: ["command"],

package/dist/lib/lanes/watcher.d.ts

@@ -36,6 +36,7 @@ import { type QuotaSignal } from "./quota.js";
 import { type ProviderRejection } from "./provider-rejection.js";
 import type { AdmissionHost } from "./admission.js";
 import { type LaneMesh } from "./mesh-events.js";
+import { readLanesRegistryFlag } from "./registry-flag.js";
 import { type EnvelopeRepairSpawnInput, type SpawnLaneDeps } from "./spawn.js";
 /** Spec §5.7: no signal for 20 minutes while the process is still alive. */
 export declare const SILENCE_MS: number;
@@ -226,6 +227,8 @@ export interface WatcherLoopDeps {
     resolveQuestionActiveCompany?: () => Promise<LaneCompanyRef>;
     /** Resume an atomically queued inbox after this watcher wins terminal CAS. */
     recoverQueuedMessages?: (lane: LaneRecord) => Promise<void>;
+    /** Test seam; production reads the company-scoped hq-flags row. */
+    readManagerStatusGateFlag?: typeof readLanesRegistryFlag;
 }
 /**
  * Wrap one mesh call. A failed emit is logged as `mesh_event_failed` with

package/dist/lib/lanes/watcher.js

@@ -47,6 +47,9 @@ import { loadLanesConfig, providerProgressEventMinIntervalMs, providerQuotaDefau
 import { resolveAdmissionHost as resolveProcessAdmissionHost } from "./admission-host.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneProgressEvent, emitLaneTerminalStateEvent, laneStoryStatusSuppressionKey, progressEventDue, } from "./mesh-events.js";
 import { envelopeQuestionId } from "./questions.js";
+import { readLanesRegistryFlag } from "./registry-flag.js";
+import { MANAGER_STATUS_GATE_FLAG, managerStatusWasWritten, readStatusSnapshot, resolveManagerStatusTarget, managerStatusGateEnabledForLane, } from "./manager-status-gate.js";
+import { queueManagerStatusGateResume } from "./keep-alive.js";
 import { laneRunDir, missingPidProbe, probePidRecord, readPidRecord, readProcStarttime, readSpawnManifest, envelopeRepairMode, spawnEnvelopeRepair, writePidRecord, retryLaneOnAlternateAccount, } from "./spawn.js";
 /** Spec §5.7: no signal for 20 minutes while the process is still alive. */
 export const SILENCE_MS = 20 * 60 * 1000;
@@ -639,6 +642,75 @@ export function missingExpectedEnvelopeFile(hqRoot, laneId, envelopePath) {
         missing: true,
     };
 }
+async function settleManagerStatusGate(hqRoot, lane, manifestTurnId, at, deps, logDecision) {
+    const readFlag = deps.readManagerStatusGateFlag ?? readLanesRegistryFlag;
+    let enabled = false;
+    try {
+        enabled = await readFlag(MANAGER_STATUS_GATE_FLAG, {
+            company: lane.company ?? lane.mesh_company ?? undefined,
+        });
+    }
+    catch (err) {
+        process.stderr.write(`hq lanes watcher: manager status gate flag read failed for ${lane.lane_id}: ${err instanceof Error ? err.message : String(err)}\n`);
+        logDecision({ event: "status_gate_flag_failed", at, error: err instanceof Error ? err.name : "UnknownError" });
+    }
+    if (!enabled)
+        return lane;
+    let target;
+    try {
+        target = resolveManagerStatusTarget(hqRoot, lane);
+    }
+    catch (err) {
+        process.stderr.write(`hq lanes watcher: manager status mapping failed for ${lane.lane_id}: ${err instanceof Error ? err.message : String(err)}\n`);
+        logDecision({ event: "status_gate_mapping_failed", at, error: err instanceof Error ? err.message : String(err) });
+        return lane;
+    }
+    const gate = lane.status_gate;
+    if (!target.manager || target.statusPath === undefined || gate === undefined)
+        return lane;
+    if (manifestTurnId !== undefined && manifestTurnId !== gate.turn_id ||
+        target.statusPath !== gate.status_path) {
+        logDecision({ event: "status_gate_baseline_mismatch", at, turn_id: gate.turn_id });
+        return lane;
+    }
+    let written;
+    try {
+        written = managerStatusWasWritten(gate, readStatusSnapshot(gate.status_path));
+    }
+    catch (err) {
+        process.stderr.write(`hq lanes watcher: manager status read failed for ${lane.lane_id}: ${err instanceof Error ? err.message : String(err)}\n`);
+        logDecision({ event: "status_gate_status_read_failed", at, error: err instanceof Error ? err.message : String(err) });
+        written = false;
+    }
+    if (written) {
+        return retryUpdateLane(hqRoot, lane.lane_id, "watcher", (current) => {
+            if (current.status_gate?.turn_id !== gate.turn_id || current.status_gate.consecutive_misses === 0)
+                return current;
+            return { ...current, status_gate: { ...current.status_gate, consecutive_misses: 0 } };
+        });
+    }
+    const resumeText = `Your turn ended without updating ${gate.status_path}. Write your status now: update updated_at, kpis and current_work, then end the turn.`;
+    const updated = queueManagerStatusGateResume(hqRoot, lane.lane_id, {
+        turn_id: gate.turn_id,
+        path: gate.status_path,
+        at,
+        identified_by: target.identified_by ?? "juniors",
+    }, resumeText);
+    const miss = updated.status_gate_history?.find((entry) => entry.event === "status_missed" && entry.turn_id === gate.turn_id);
+    if (miss) {
+        logDecision({
+            event: "status_missed",
+            at,
+            turn_id: gate.turn_id,
+            path: gate.status_path,
+            consecutive_misses: updated.status_gate?.consecutive_misses ?? 0,
+            resume_queued: miss.resume_queued === true,
+            resume_skipped_reason: miss.resume_skipped_reason,
+            state: updated.state,
+        });
+    }
+    return updated;
+}
 /**
  * Wrap one mesh call. A failed emit is logged as `mesh_event_failed` with
  * the event name and the error message, and never propagates: the lane's
@@ -820,10 +892,17 @@ async function runWatcherLoopOwned(hqRoot, laneId, deps) {
     }
     const progressIntervalMs = deps.progressEventMinIntervalMs ?? readProgressIntervalMs(hqRoot, readLaneSoft(hqRoot, laneId));
     const spawnRepair = deps.spawnRepair ?? spawnEnvelopeRepair;
-    const retryAccount = deps.retryAccount ?? ((root, lane, reason) => retryLaneOnAlternateAccount(root, lane, reason, "watcher", {
-        ...deps.retrySpawnDeps,
-        admissionHost: (deps.resolveAdmissionHost ?? resolveProcessAdmissionHost)(),
-    }));
+    const retryAccount = deps.retryAccount ?? (async (root, lane, reason) => {
+        const managerStatusGateEnabled = await managerStatusGateEnabledForLane(root, lane, {
+            env: deps.retrySpawnDeps?.env,
+            readFlag: deps.readManagerStatusGateFlag,
+        });
+        return retryLaneOnAlternateAccount(root, lane, reason, "watcher", {
+            ...deps.retrySpawnDeps,
+            managerStatusGateEnabled,
+            admissionHost: (deps.resolveAdmissionHost ?? resolveProcessAdmissionHost)(),
+        });
+    });
     let lastSignalMs = now();
     let lastSeenMtime = 0;
     let lastAlive = null;
@@ -1168,7 +1247,7 @@ async function runWatcherLoopOwned(hqRoot, laneId, deps) {
                     quota,
                     providerRejection,
                 });
-                const updated = terminalWrite.record;
+                let updated = terminalWrite.record;
                 const effectiveEnvelope = terminalWrite.envelope ?? envelope;
                 const effectiveClassification = terminalWrite.classification;
                 logDecision({
@@ -1201,7 +1280,14 @@ async function runWatcherLoopOwned(hqRoot, laneId, deps) {
                         await emitMeshSoft(`lane_${updated.state}`, logDecision, tick.emit.at, (signal) => emitLaneTerminalStateEvent(mesh, updated, updated.state, updated.terminal_reason ?? effectiveClassification.reason, signal), meshRequestTimeoutMs);
                     }
                 }
-                if (terminalWrite.changed && deps.recoverQueuedMessages) {
+                if (terminalWrite.changed) {
+                    updated = await settleManagerStatusGate(hqRoot, updated, manifest.turn_id, tick.emit.at, deps, logDecision);
+                }
+                const managerStatusFollowupQueued = manifest.turn_id !== undefined &&
+                    updated.status_gate_history?.some((entry) => entry.event === "status_missed" &&
+                        entry.turn_id === manifest.turn_id &&
+                        entry.resume_queued === true) === true;
+                if (terminalWrite.changed && deps.recoverQueuedMessages && !managerStatusFollowupQueued) {
                     try {
                         if (dropboxInboxHasMessages(hqRoot, laneId)) {
                             await deps.recoverQueuedMessages(updated);

package/dist/lib/mesh/live/daemon/transcript-watch.js

@@ -722,7 +722,7 @@ export class TranscriptWatcher {
                 }
                 if (track.pendingTurn &&
                     nowMs - track.lastChangeAtMs >= TRANSCRIPT_TURN_QUIET_MS) {
-                    if (this.emitKind(track, "turn_end", nowMs)) {
+                    if (this.emitKind(track, "turn_end", nowMs, transcriptTurnAtMs(track, nowMs))) {
                         track.pendingTurn = false;
                         result.turns += 1;
                     }
@@ -824,7 +824,7 @@ export class TranscriptWatcher {
         }
         if (track.pendingTurn &&
             nowMs - track.lastChangeAtMs >= TRANSCRIPT_TURN_QUIET_MS) {
-            if (this.emitKind(track, "turn_end", nowMs)) {
+            if (this.emitKind(track, "turn_end", nowMs, transcriptTurnAtMs(track, nowMs))) {
                 track.pendingTurn = false;
                 result.turns += 1;
             }
@@ -916,7 +916,9 @@ export class TranscriptWatcher {
         }
         return env;
     }
-    emitKind(track, kind, nowMs) {
+    emitKind(track, kind, nowMs, 
+    /** Event time when it differs from detection time (turn_end). */
+    atMs = nowMs) {
         let seq;
         try {
             seq = reserveSessionSeq(track.sessionId, 1, this.seqEnv());
@@ -925,13 +927,18 @@ export class TranscriptWatcher {
             return false;
         }
         track.seq = seq;
+        // `at` must not go backwards against seq: a transcript time older than the
+        // last event this watcher sent for the session is clamped to that event.
+        const eventAtMs = track.lastSentAtMs !== undefined && atMs < track.lastSentAtMs
+            ? track.lastSentAtMs
+            : atMs;
         const opts = {
             kind,
             sessionId: track.sessionId,
             harness: track.harness,
             adapterVersion: TRANSCRIPT_ADAPTER_VERSION,
             source: TRANSCRIPT_EVENT_SOURCE,
-            at: new Date(nowMs).toISOString(),
+            at: new Date(eventAtMs).toISOString(),
             seq,
             cwd: track.cwd,
             hqRoot: this.deps.hqRoot,
@@ -942,6 +949,7 @@ export class TranscriptWatcher {
         };
         try {
             this.enqueueFn(opts);
+            track.lastSentAtMs = eventAtMs;
             return true;
         }
         catch {
@@ -949,6 +957,19 @@ export class TranscriptWatcher {
         }
     }
 }
+/**
+ * A transcript turn ended when the transcript last changed (file mtime), not
+ * when a backed-off or restarted poll noticed it. Never later than now. A
+ * catch-up turn_end sent in the same tick as session_end (restart adoption of
+ * an already quiet transcript) therefore carries the earlier transcript time,
+ * not the session_end time.
+ */
+function transcriptTurnAtMs(track, nowMs) {
+    const mtimeMs = track.lastMtimeMs;
+    if (!Number.isFinite(mtimeMs) || mtimeMs <= 0)
+        return nowMs;
+    return Math.min(mtimeMs, nowMs);
+}
 /**
  * Adaptive interval: busy ticks double up to MAX; quiet ticks return to base.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.252.0",
+  "version": "5.254.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {