@indigoai-us/hq-cli 5.270.0 → 5.272.0

package/dist/commands/lanes.js

@@ -28,7 +28,7 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
-import { resolveProcessFlagGate } from "../lib/flag-registry.js";
+import { resolveProcessFlagCompanyContext } from "../lib/flag-registry.js";
 import { defaultTrackerActor, LANES_TRACKER_FLAG, registerLaneTrackerCommands, } from "./lanes-tracker.js";
 import { createOutpostHireGrantContext, parseOutpostHireGrantContext, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
 import { createOutpostProfileRepinContext, parseOutpostProfileRepinContext, } from "../lib/lanes/outpost-profile-repin.js";
@@ -50,7 +50,7 @@ import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, lan
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { listLaneReviews } from "../lib/lanes/reviews.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
-import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
 import { activeLaneStories, laneStories, laneStory, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
 import { resolveLaneCompany } from "../lib/lanes/lane-company.js";
@@ -76,12 +76,48 @@ export const LANES_RUNS_REL = path.join("workspace", "lanes-runs");
 /** The lane → mesh seam. Defined in lib/lanes/mesh-events.ts; the watcher shares it. */
 export { emitLaneDecisionEvents };
 export const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
-function defaultLanePlacementEnabled() {
-    return resolveProcessFlagGate(LANE_OUTPOST_LOAD_BALANCING_FLAG, { fallback: false }, () => false);
+function lanePlacementFlagErrorCode(error) {
+    if (error && typeof error === "object") {
+        for (const key of ["code", "error", "name"]) {
+            const value = error[key];
+            if (typeof value === "string" && value.trim())
+                return value;
+        }
+    }
+    return "UnknownError";
+}
+function reportLanePlacementFlagReadFailure(error) {
+    process.stderr.write(`${JSON.stringify({
+        event: "lanes.outpost_load_balancing.flag_read_failed",
+        flag: LANE_OUTPOST_LOAD_BALANCING_FLAG,
+        error: lanePlacementFlagErrorCode(error),
+        fallback: false,
+    })}\n`);
+}
+function defaultLanePlacementEnabled(company) {
+    return readLanesRegistryFlag(LANE_OUTPOST_LOAD_BALANCING_FLAG, {
+        company,
+        reportFailure: reportLanePlacementFlagReadFailure,
+    });
+}
+async function readLanePlacementEnabled(ctx, company) {
+    try {
+        return await ctx.lanePlacementEnabled(company);
+    }
+    catch (error) {
+        reportLanePlacementFlagReadFailure(error);
+        return false;
+    }
 }
 function defaultLaneTrackerEnabled(company) {
     return readLanesRegistryFlag(LANES_TRACKER_FLAG, { company });
 }
+function processLanePlacementCompany(ctx) {
+    const context = resolveProcessFlagCompanyContext(ctx.env);
+    if (!context.companySlug)
+        return undefined;
+    return { slug: context.companySlug, uid: context.companyUid ?? "" };
+}
 function withoutProviderHome(value) {
     if (Array.isArray(value))
         return value.map(withoutProviderHome);
@@ -1059,6 +1095,66 @@ async function readOutpostLaneRecords(ctx, outpostId) {
     }
     return lanes;
 }
+async function resolveCommandLaneTarget(ctx, laneId, options = {}) {
+    try {
+        return { lane: readLane(ctx.hqRoot(), laneId), remoteOnly: false };
+    }
+    catch (err) {
+        if (!(err instanceof LanesError) || err.error !== "lane_not_found")
+            throw err;
+    }
+    const separator = laneId.lastIndexOf("_");
+    const hostSuffix = separator < 0 ? "" : laneId.slice(separator + 1);
+    if (!hostSuffix || sanitizeHostComponent(hostSuffix) !== hostSuffix) {
+        throw commandLaneNotFound(laneId, options.outpostHint === true);
+    }
+    let rawOutpostIds;
+    try {
+        rawOutpostIds = await ctx.listOutpostIds();
+    }
+    catch (err) {
+        throw new LanesError("outpost_list_unavailable", `Could not resolve registered Outposts for lane ${laneId}: ${dispatchErrorMessage(err)}`, { lane_id: laneId });
+    }
+    if (!Array.isArray(rawOutpostIds)) {
+        throw new LanesError("outpost_list_invalid", "Registered Outpost list is not an array", { lane_id: laneId });
+    }
+    const outpostIds = rawOutpostIds.map((id) => typeof id === "string" ? id.trim() : "");
+    if (outpostIds.length > MAX_PLACEMENT_OUTPOSTS ||
+        outpostIds.some((id) => id === "") ||
+        new Set(outpostIds).size !== outpostIds.length) {
+        throw new LanesError("outpost_list_invalid", "Registered Outpost list is malformed or exceeds the lane lookup limit", { lane_id: laneId, count: outpostIds.length, maximum: MAX_PLACEMENT_OUTPOSTS });
+    }
+    const matches = [];
+    for (const outpostId of outpostIds) {
+        const ownerLanes = await readOutpostLaneRecords(ctx, outpostId);
+        for (const lane of ownerLanes) {
+            if (lane.lane_id === laneId &&
+                lane.host.kind === "local" &&
+                sanitizeHostComponent(lane.host.id) === hostSuffix) {
+                matches.push({ outpostId, lane });
+            }
+        }
+    }
+    if (matches.length === 0) {
+        throw commandLaneNotFound(laneId, options.outpostHint === true);
+    }
+    if (matches.length !== 1) {
+        throw new LanesError("lane_outpost_ambiguous", `More than one registered Outpost reported lane ${laneId} with the same recorded host identity`, { lane_id: laneId, outpost_ids: matches.map((match) => match.outpostId) });
+    }
+    const match = matches[0];
+    return {
+        lane: { ...match.lane, host: { kind: "outpost", id: match.outpostId } },
+        remoteOnly: true,
+        outpostId: match.outpostId,
+        ownerHost: match.lane.host,
+    };
+}
+function commandLaneNotFound(laneId, outpostHint) {
+    const hint = outpostHint
+        ? "; pass --outpost <id> to confirm a registered Outpost"
+        : "";
+    return new LanesError("lane_not_found", `Lane ${laneId} was not found locally or on a registered Outpost with a matching host suffix${hint}`, { lane_id: laneId });
+}
 async function loadClaudeBalanceHostSnapshots(ctx, hqRoot, config) {
     const localHost = laneHostFromCtx(ctx);
     const localLanes = loadAllLanes(hqRoot);
@@ -1196,8 +1292,8 @@ function parsePlacementPolicy(raw) {
         return { kind: "outpost", id };
     throw new LanesError("lane_placement_invalid", `Invalid placement ${JSON.stringify(raw)}. Accepted: local, auto, outpost:<id>`, { value: raw, accepted: ["local", "auto", "outpost:<id>"] });
 }
-function assertPlacementEnabled(ctx) {
-    if (ctx.lanePlacementEnabled())
+async function assertPlacementEnabled(ctx, company, readPlacementEnabled = () => readLanePlacementEnabled(ctx, company)) {
+    if (await readPlacementEnabled())
         return;
     throw new LanesError("lane_placement_disabled", `Lane placement options require hq-flags gate ${LANE_OUTPOST_LOAD_BALANCING_FLAG}`, { flag: LANE_OUTPOST_LOAD_BALANCING_FLAG });
 }
@@ -2171,14 +2267,6 @@ async function runCreate(ctx, opts) {
     if (opts.outpost !== undefined && requestedPlacement !== undefined) {
         throw new LanesError("lane_placement_conflict", "Pass either --outpost or --placement, not both", {});
     }
-    let placementGate;
-    const placementEnabled = () => {
-        placementGate ??= ctx.lanePlacementEnabled();
-        return placementGate;
-    };
-    if ((requestedPlacement !== undefined || defaultPlacement !== undefined) && !placementEnabled()) {
-        assertPlacementEnabled(ctx);
-    }
     const companyFlag = opts.company?.trim();
     const meshCompanyFlag = opts.meshCompany?.trim();
     const project = opts.project?.trim();
@@ -2266,6 +2354,29 @@ async function runCreate(ctx, opts) {
         }
         meshCompany = resolvedMeshCompany;
     }
+    let placementCompanyResolved = false;
+    let placementCompany;
+    let placementGate;
+    const resolvePlacementCompany = () => {
+        if (!placementCompanyResolved) {
+            const projectCompany = company === null
+                ? resolveProjectQuestionCompany(hqRoot, {
+                    lane_id: "create",
+                    project_id: project,
+                })
+                : null;
+            placementCompany = company ?? projectCompany ?? meshCompany ?? undefined;
+            placementCompanyResolved = true;
+        }
+        return placementCompany;
+    };
+    const placementEnabled = () => {
+        placementGate ??= readLanePlacementEnabled(ctx, resolvePlacementCompany());
+        return placementGate;
+    };
+    if (requestedPlacement !== undefined || defaultPlacement !== undefined) {
+        await assertPlacementEnabled(ctx, resolvePlacementCompany(), placementEnabled);
+    }
     const seniorCompany = companyOfSenior(hqRoot, senior, ctx);
     assertSameTenant(company, senior, seniorCompany);
     const createStoryWarnings = [];
@@ -2316,15 +2427,17 @@ async function runCreate(ctx, opts) {
     const callerLaneId = ctx.env.HQ_LANE_ID?.trim() || undefined;
     if (requestedPlacement === undefined &&
         outpostId === undefined &&
-        callerLaneId !== undefined &&
-        placementEnabled()) {
+        callerLaneId !== undefined) {
         const callerLane = tryReadLane(hqRoot, callerLaneId);
         if (!callerLane) {
-            throw new LanesError("lane_not_found", `Caller lane ${callerLaneId} not found`, {
-                lane_id: callerLaneId,
-            });
+            if (await placementEnabled()) {
+                throw new LanesError("lane_not_found", `Caller lane ${callerLaneId} not found`, {
+                    lane_id: callerLaneId,
+                });
+            }
         }
-        if (callerLane.placement_default !== undefined) {
+        else if (callerLane.placement_default !== undefined &&
+            await placementEnabled()) {
             if (!sameLaneCompany(company, callerLane.company)) {
                 throw new LanesError("lane_placement_tenant_mismatch", "Cannot inherit placement from a manager lane in another tenant", { caller_lane_id: callerLaneId });
             }
@@ -2456,7 +2569,7 @@ async function runCreate(ctx, opts) {
     }
     if (outpostId !== undefined &&
         profile !== undefined &&
-        !placementEnabled()) {
+        !(await placementEnabled())) {
         throw new LanesError("worker_profile_outpost_unsupported", `Worker profile ${JSON.stringify(profile.id)} cannot be used with --outpost; personal profiles are local-only`, {
             worker: profile.id,
             outpost: outpostId,
@@ -3352,7 +3465,7 @@ function assertLaneRunsHereForOperatorMutation(ctx, lane, action) {
         return;
     throw new LanesError("lane_remote", `Cannot ${action} lane ${lane.lane_id} from this host; its state is owned by ${lane.host.kind}:${lane.host.id}`, { lane_id: lane.lane_id, host: lane.host, action });
 }
-async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
+async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior = {}) {
     if (lane.host.kind !== "outpost") {
         throw new LanesError("outpost_dispatch_failed", `Lane ${lane.lane_id} has no Outpost host to dispatch to`, { lane_id: lane.lane_id });
     }
@@ -3550,7 +3663,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         });
     }
     if (action === "grant") {
-        const ownerLane = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, remote.lane, undefined, { allowNonTerminal: true });
+        const ownerLane = dispatchedOwnerLane(ctx, lane.lane_id, outpostId, remote.lane, behavior);
         printJson({
             ...remote,
             lane_id: ownerLane.lane_id,
@@ -3566,7 +3679,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         (remote.delivery_status === "worker_spawned" ||
             remote.delivery_status === "queued_on_target_account" ||
             remote.delivery_status === "queued_on_admission")) {
-        const ownerLane = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, remote.lane, undefined, { allowNonTerminal: true });
+        const ownerLane = dispatchedOwnerLane(ctx, lane.lane_id, outpostId, remote.lane, behavior);
         printJson({
             ...remote,
             lane_id: ownerLane.lane_id,
@@ -3578,7 +3691,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         return;
     }
     if (action === "approve" || action === "reparent" || action === "resume") {
-        const ownerLane = syncLaneRecordFromOwner(ctx.hqRoot(), lane.lane_id, outpostId, remote.lane, undefined, { allowNonTerminal: true });
+        const ownerLane = dispatchedOwnerLane(ctx, lane.lane_id, outpostId, remote.lane, behavior);
         const descendants = [];
         if (action === "reparent") {
             for (const descendantId of changedDescendantIds) {
@@ -3606,6 +3719,32 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         outpost_transport: "outposts_exec",
     });
 }
+function dispatchedOwnerLane(ctx, laneId, outpostId, rawLane, behavior) {
+    if (behavior.syncPrimary !== false) {
+        return syncLaneRecordFromOwner(ctx.hqRoot(), laneId, outpostId, rawLane, undefined, { allowNonTerminal: true });
+    }
+    let ownerLane;
+    try {
+        ownerLane = parseLaneRecord(rawLane);
+    }
+    catch (err) {
+        throw new LanesError("outpost_lane_sync_invalid", `Outpost ${outpostId} returned an invalid lane snapshot for ${laneId}`, { lane_id: laneId, outpost_id: outpostId, cause: dispatchErrorMessage(err) });
+    }
+    const expectedHost = behavior.expectedOwnerHost;
+    if (!expectedHost ||
+        ownerLane.lane_id !== laneId ||
+        ownerLane.host.kind !== expectedHost.kind ||
+        ownerLane.host.id !== expectedHost.id) {
+        throw new LanesError("outpost_lane_sync_invalid", `Outpost ${outpostId} returned a lane snapshot that does not match its recorded owner identity`, {
+            lane_id: laneId,
+            outpost_id: outpostId,
+            owner_lane_id: ownerLane.lane_id,
+            owner_host: ownerLane.host,
+            expected_host: expectedHost ?? null,
+        });
+    }
+    return ownerLane;
+}
 function parseReparentDescendantIds(value, laneId, outpostId) {
     if (!Array.isArray(value) || value.some((id) => typeof id !== "string" || id.trim() === "")) {
         throw new LanesError("outpost_reparent_result_invalid", `Outpost ${outpostId} returned an invalid descendant list for lane ${laneId}`, { lane_id: laneId, outpost_id: outpostId });
@@ -3992,7 +4131,8 @@ async function runList(ctx, opts) {
                 : false,
         };
     });
-    const host_capacity = ctx.lanePlacementEnabled()
+    const placementCompany = company ?? processLanePlacementCompany(ctx);
+    const host_capacity = await readLanePlacementEnabled(ctx, placementCompany)
         ? (await loadHostCapacitySnapshots(ctx, hqRoot)).entries
         : undefined;
     const result = {
@@ -4194,10 +4334,16 @@ function readLaneTimeout(hqRoot, laneId) {
     return { timeout_secs: record.timeout_secs, deadline_at: record.deadline_at };
 }
 async function runMove(ctx, laneId, opts) {
-    assertPlacementEnabled(ctx);
     const hqRoot = ctx.hqRoot();
     const policy = parsePlacementPolicy(opts.placement ?? "");
     const source = readLane(hqRoot, laneId);
+    const placementCompany = resolveLaneCompany(hqRoot, source).company ?? undefined;
+    let placementGate;
+    const placementEnabled = () => {
+        placementGate ??= readLanePlacementEnabled(ctx, placementCompany);
+        return placementGate;
+    };
+    await assertPlacementEnabled(ctx, placementCompany, placementEnabled);
     if (!laneCanMoveBeforeStart(source)) {
         throw new LanesError(source.state === "queued" ? "lane_move_started" : "lane_not_queued", `Lane ${laneId} cannot move after it has started; current state is ${source.state}`, { lane_id: laneId, state: source.state });
     }
@@ -4222,7 +4368,7 @@ async function runMove(ctx, laneId, opts) {
     });
     let moved;
     if (laneRunsHere(source, reconcileHostFromCtx(ctx))) {
-        moved = await commitLaneMove(ctx, laneId, choice.host, choice.account);
+        moved = await commitLaneMove(ctx, laneId, choice.host, choice.account, placementEnabled);
     }
     else if (source.host.kind === "outpost") {
         moved = await dispatchRemoteLaneMove(ctx, source, choice.host, choice.account);
@@ -4240,11 +4386,11 @@ async function runMove(ctx, laneId, opts) {
         lane: moved,
     });
 }
-async function commitLaneMove(ctx, laneId, target, account) {
-    assertPlacementEnabled(ctx);
+async function commitLaneMove(ctx, laneId, target, account, readPlacementEnabled) {
     const hqRoot = ctx.hqRoot();
     const before = readLane(hqRoot, laneId);
     assertLaneRunsHereForOperatorMutation(ctx, before, "move-target");
+    await assertPlacementEnabled(ctx, resolveLaneCompany(hqRoot, before).company ?? undefined, readPlacementEnabled);
     if (before.host.kind === target.kind && before.host.id === target.id) {
         throw new LanesError("lane_move_same_host", `Lane ${laneId} is already on ${target.kind}:${target.id}`, {
             lane_id: laneId,
@@ -4653,6 +4799,12 @@ function callerMatchesSenior(ctx, seniorRef) {
         (senior !== null && typeof senior === "object" && !Array.isArray(senior) &&
             senior.kind === "user");
 }
+function laneGrantTargetHostedHere(ctx, lane) {
+    if (lane.host.kind === "local") {
+        return laneRunsHere(lane, reconcileHostFromCtx(ctx));
+    }
+    return lane.host.kind === "outpost" && laneIsHostedHere(ctx, lane);
+}
 function forceAdmissionAuthorized(ctx, lane) {
     return callerMatchesSenior(ctx, lane.senior);
 }
@@ -4663,7 +4815,7 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
         throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: initial.senior });
     }
     if (authorization === "ssm-owner-dispatch" &&
-        (initial.host.kind !== "outpost" || !laneIsHostedHere(ctx, initial))) {
+        !laneGrantTargetHostedHere(ctx, initial)) {
         throw new LanesError("lane_remote", `Outpost grant dispatch cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: initial.host });
     }
     if (authorization === "ssm-owner-dispatch" &&
@@ -4682,7 +4834,7 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
             throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(current.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: current.senior });
         }
         if (authorization === "ssm-owner-dispatch" &&
-            (current.host.kind !== "outpost" || !laneIsHostedHere(ctx, current))) {
+            !laneGrantTargetHostedHere(ctx, current)) {
             throw new LanesError("lane_remote", `Outpost grant dispatch cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: current.host });
         }
         if (authorization === "ssm-owner-dispatch" &&
@@ -4808,10 +4960,34 @@ async function runGrant(ctx, laneId, opts) {
     }
     const hireGrant = parseHireGrant(opts.hire);
     const hqRoot = ctx.hqRoot();
-    const initial = readLane(hqRoot, laneId);
+    const target = await resolveCommandLaneTarget(ctx, laneId, { outpostHint: true });
+    const initial = target.lane;
     if (!callerMatchesSenior(ctx, initial.senior)) {
         throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: initial.senior });
     }
+    if (opts.outpost !== undefined) {
+        const requestedOutpost = opts.outpost.trim();
+        const recordedOutpost = target.remoteOnly
+            ? target.outpostId
+            : initial.host.kind === "outpost"
+                ? initial.host.id
+                : undefined;
+        if (!requestedOutpost || requestedOutpost !== recordedOutpost) {
+            throw new LanesError("lane_outpost_mismatch", `--outpost ${requestedOutpost || "<empty>"} does not match lane ${laneId}'s recorded host ${initial.host.kind}:${initial.host.id}`, {
+                lane_id: laneId,
+                requested_outpost_id: requestedOutpost || null,
+                recorded_host: target.remoteOnly ? target.ownerHost : initial.host,
+                matched_outpost_id: recordedOutpost ?? null,
+            });
+        }
+    }
+    if (target.remoteOnly) {
+        await dispatchOutpostLaneCommand(ctx, initial, "grant", { hire: String(hireGrant) }, {
+            syncPrimary: false,
+            expectedOwnerHost: target.ownerHost,
+        });
+        return;
+    }
     if (initial.host.kind === "outpost" && !laneRunsHere(initial, reconcileHostFromCtx(ctx))) {
         await dispatchOutpostLaneCommand(ctx, initial, "grant", { hire: String(hireGrant) });
         return;
@@ -6865,6 +7041,7 @@ export function registerLanesCommand(parent, deps = {}) {
         persistClaudeAccountSelection,
         printJson,
         recordResumeSetup,
+        resolveCommandLane: (commandCtx, laneId) => resolveCommandLaneTarget(commandCtx, laneId),
         resolveActiveQuestionCompany,
         resolveResumeProfile,
         selectAutomaticClaudeResumeAccount,
@@ -6889,6 +7066,7 @@ export function registerLanesCommand(parent, deps = {}) {
         persistClaudeAccountSelection,
         printJson,
         recordResumeSetup,
+        resolveCommandLane: (commandCtx, laneId) => resolveCommandLaneTarget(commandCtx, laneId),
         resolveResumeProfile,
         selectAutomaticClaudeResumeAccount,
         validateResumeProfileModel,
@@ -7022,6 +7200,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .description("Set a lane's alive child-lane grant as its senior")
         .argument("<lane-id>", "Lane id")
         .requiredOption("--hire <n>", "Non-negative safe integer hire grant")
+        .option("--outpost <id>", "Confirm the registered Outpost hosting a native lane")
         .action(wrap(async (laneId, opts) => {
         await runGrant(ctx, laneId, opts);
     }));

package/dist/lib/checkpoint-ontology/merge-copies.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Merge numbered entity copies (`<slug> 2.md`) into their original file and
+ * delete them (CO-54, owner decision CO-D-007 option 2).
+ *
+ * Gated by `checkpoint.ontology.merge-copies`. A copy is a file named
+ * `<slug> <n>.md` next to `<slug>.md` of the same type, with the same `id`,
+ * in one duplicate group. Other members of a group are never touched.
+ *
+ * Two steps, run separately so sync can push the merged original before its
+ * copy goes away:
+ *
+ * - merge: the copy's fresh aliases, back-references and relationship lines
+ *   are added to the original, `signal_count` takes the higher value, and
+ *   entity files that link to the copy are re-pointed at the original. Every
+ *   rewritten file is recorded in the outbox before it is written, so sync
+ *   pushes it. Keys the checkpoint does not own keep the original's value.
+ * - delete: a copy is deleted from the vault, by exact key, only when merging
+ *   it again would change nothing and no entity file or signal links to it.
+ *   The vault keeps every old version. The local file goes after the vault
+ *   delete succeeds, or when the vault no longer has the key.
+ *
+ * Copies of one original merge in path order, each into the result of the
+ * previous one, and none of them counts as holding a name the others move.
+ * A copy whose body has lines the merged original lacks (prose the merge does
+ * not carry) is merged but never deleted. A copy linked from any file the
+ * merge cannot rewrite (a copy, a knowledge file, a signal) is held.
+ *
+ * A signal whose `entity_refs` names a copy holds that copy: signals are
+ * server-owned, so the ref cannot be re-pointed from here.
+ */
+import { type OntologyCompany } from "./company.js";
+import { type EntityIndex } from "./tree.js";
+export declare const MERGE_COPIES_FLAG = "checkpoint.ontology.merge-copies";
+export type CopySkipReason = "no_original" | "original_invalid" | "identity_differs" | "not_in_duplicate_group";
+export interface CopySkip {
+    copy: string;
+    reason: CopySkipReason;
+}
+export interface CopyPair {
+    type: string;
+    /** Company-relative path of the copy. */
+    copy: string;
+    /** Company-relative path of the original it merges into. */
+    original: string;
+}
+export interface CopyPlan extends CopyPair {
+    add_aliases: string[];
+    /** Copy names the original lacks that another entity already holds, so they do not move. */
+    dropped_aliases: string[];
+    add_backrefs: number;
+    add_relationship_lines: number;
+    /** The copy's higher `signal_count`, when it is higher. */
+    raise_signal_count?: number;
+    /** Keys the checkpoint does not own whose values differ; the original's value stays. */
+    kept_original_keys: string[];
+    /** Entity files that link to the copy. */
+    inbound_links: string[];
+    /** Signal files whose `entity_refs` name the copy. */
+    signal_refs: string[];
+    /** Why the copy cannot be merged or deleted from here. */
+    held?: "signal_refs" | "linked_from_unwritable" | "merge_invalid";
+    detail?: string;
+    /** Body lines of the copy the merged original lacks; a copy with any is never deleted. */
+    unmerged_body_lines: number;
+}
+export interface MergeCopiesReport {
+    company: string;
+    mode: "dry_run" | "merge" | "delete";
+    duplicate_groups_before: number;
+    duplicate_groups_after: number;
+    copies_found: number;
+    plans: CopyPlan[];
+    skipped: CopySkip[];
+    merged: string[];
+    relinked: string[];
+    deleted: string[];
+    /** Deleted copies the vault no longer had (a resumed run, or never synced). */
+    vault_already_absent: string[];
+    /** Copies still carrying content, links or refs, so not deleted this run. */
+    not_ready: {
+        copy: string;
+        reason: string;
+    }[];
+    errors: {
+        path: string;
+        error: string;
+    }[];
+    /** Entity-file links whose target file does not exist. */
+    broken_links_before: number;
+    broken_links_after: number;
+    /** Links in `company-brief.md` to a copy; the brief is re-rendered by the next checkpoint. */
+    brief_links_to_copies: string[];
+}
+/** Deletes one exact vault key; resolves to the number of objects deleted. */
+export type DeleteVaultKey = (key: string) => Promise<number>;
+export interface MergeCopiesOptions {
+    hqRoot: string;
+    company: OntologyCompany;
+    mode: "dry_run" | "merge" | "delete";
+    /** Handle at most this many copies (sorted by path). */
+    limit?: number;
+    now: Date;
+    deleteVaultKey?: DeleteVaultKey;
+}
+/** Copies in scope, and the ones skipped with a reason. Read-only. */
+export declare function findCopyPairs(index: EntityIndex): {
+    pairs: CopyPair[];
+    skipped: CopySkip[];
+};
+/**
+ * Plan, merge or delete numbered copies for one company. The dry run writes
+ * nothing; merge writes entity files only; delete removes vault keys and
+ * local copy files only.
+ */
+export declare function mergeCopies(options: MergeCopiesOptions): Promise<MergeCopiesReport>;
+//# sourceMappingURL=merge-copies.d.ts.map