@indigoai-us/hq-cli 5.273.0 → 5.274.1

package/dist/commands/lanes.js

@@ -13,9 +13,12 @@ import * as path from "node:path";
 import { Option } from "commander";
 import { createLaneAccountsHandlers } from "./lanes-accounts.js";
 import { createLaneMessageHandlers } from "./lanes-message.js";
+import { createLaneMoveHandlers } from "./lanes-move.js";
 import { createLaneQuestionsHandlers } from "./lanes-questions.js";
 import { createLaneResumeHandlers } from "./lanes-resume.js";
 import { createLaneWatchHandlers } from "./lanes-watch.js";
+import { callerMatchesSessionSenior, assertPlacementEnabled, defaultLanePlacementEnabled, parsePlacementPolicy, processLanePlacementCompany, readLanePlacementEnabled, } from "./lanes-shared.js";
+export { LANE_OUTPOST_LOAD_BALANCING_FLAG } from "./lanes-shared.js";
 export { resolveAnswerChoice } from "./lanes-questions.js";
 import { registerOutpostPrunerCommand } from "./outpost-pruner.js";
 import { registerLaneKpisCommand } from "./lanes-kpis.js";
@@ -27,13 +30,12 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
-import { resolveProcessFlagCompanyContext } from "../lib/flag-registry.js";
 import { createOutpostHireGrantContext, parseOutpostHireGrantContext, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
 import { createOutpostProfileRepinContext, parseOutpostProfileRepinContext, } from "../lib/lanes/outpost-profile-repin.js";
 import { createOutpostRegistryWorkerApprovalContext, parseOutpostRegistryWorkerApprovalContext, } from "../lib/lanes/outpost-registry-worker-approval.js";
 import { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity, resolveAdmissionHost, } from "../lib/lanes/admission-host.js";
 export { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity } from "../lib/lanes/admission-host.js";
-import { buildOutpostCapacityCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostMoveTargetCommand, buildOutpostQuestionListCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, buildOutpostLaneListCommand, outpostRejectedEffortOption, parseOutpostPickupPayload, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
+import { buildOutpostCapacityCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostQuestionListCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, buildOutpostLaneListCommand, outpostRejectedEffortOption, parseOutpostPickupPayload, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
 import { outpostHireSummaryCacheKey, readOutpostHireSummaryCache, writeOutpostHireSummaryCache, } from "../lib/lanes/outpost-hire-cache.js";
 import { buildHostCapacitySnapshot, chooseHostForLane, parseHostCapacitySnapshot, } from "../lib/lanes/host-capacity.js";
 import { BALANCE_MOVABLE_STATES, selectClaudeAccount, } from "../lib/lanes/claude-balance.js";
@@ -73,46 +75,6 @@ export { MAX_LANE_DEPTH };
 export const LANES_RUNS_REL = path.join("workspace", "lanes-runs");
 /** The lane → mesh seam. Defined in lib/lanes/mesh-events.ts; the watcher shares it. */
 export { emitLaneDecisionEvents };
-export const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
-function lanePlacementFlagErrorCode(error) {
-    if (error && typeof error === "object") {
-        for (const key of ["code", "error", "name"]) {
-            const value = error[key];
-            if (typeof value === "string" && value.trim())
-                return value;
-        }
-    }
-    return "UnknownError";
-}
-function reportLanePlacementFlagReadFailure(error) {
-    process.stderr.write(`${JSON.stringify({
-        event: "lanes.outpost_load_balancing.flag_read_failed",
-        flag: LANE_OUTPOST_LOAD_BALANCING_FLAG,
-        error: lanePlacementFlagErrorCode(error),
-        fallback: false,
-    })}\n`);
-}
-function defaultLanePlacementEnabled(company) {
-    return readLanesRegistryFlag(LANE_OUTPOST_LOAD_BALANCING_FLAG, {
-        company,
-        reportFailure: reportLanePlacementFlagReadFailure,
-    });
-}
-async function readLanePlacementEnabled(ctx, company) {
-    try {
-        return await ctx.lanePlacementEnabled(company);
-    }
-    catch (error) {
-        reportLanePlacementFlagReadFailure(error);
-        return false;
-    }
-}
-function processLanePlacementCompany(ctx) {
-    const context = resolveProcessFlagCompanyContext(ctx.env);
-    if (!context.companySlug)
-        return undefined;
-    return { slug: context.companySlug, uid: context.companyUid ?? "" };
-}
 function withoutProviderHome(value) {
     if (Array.isArray(value))
         return value.map(withoutProviderHome);
@@ -507,6 +469,12 @@ function mergeOwnerLaneHierarchy(supplied, ownerLanes) {
         byId.set(lane.lane_id, lane);
     return [...byId.values()];
 }
+function mergeOwnerLaneRecords(supplied, ownerLanes) {
+    const byId = new Map(supplied.map((lane) => [lane.lane_id, lane]));
+    for (const lane of ownerLanes)
+        byId.set(lane.lane_id, lane);
+    return [...byId.values()];
+}
 function outpostCliOverride(ctx, outpostId) {
     const envKey = `HQ_LANES_OUTPOST_CLI_${outpostId.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
     const configured = ctx.env[envKey];
@@ -857,11 +825,10 @@ async function mapWithConcurrency(values, concurrency, map) {
 async function withResumeHireAdmission(ctx, lane, fn, grantContext) {
     const hqRoot = ctx.hqRoot();
     if (grantContext !== undefined && (!ctx.isSsmOwnerDispatch() ||
-        lane.host.kind !== "outpost" ||
-        !laneIsHostedHere(ctx, lane) ||
-        lane.senior.kind !== "lane" ||
+        !laneGrantTargetHostedHere(ctx, lane) ||
+        (lane.senior.kind !== "lane" && lane.senior.kind !== "session") ||
         !sameHireGrantSenior(lane.senior, grantContext.expected_senior))) {
-        throw new LanesError("hire_grant_senior_changed", `Lane ${lane.lane_id}'s senior changed after the primary authorized its resume`, { lane_id: lane.lane_id, expected_senior: grantContext.expected_senior, current_senior: lane.senior });
+        throw new LanesError("hire_grant_senior_changed", `Lane ${lane.lane_id}'s senior changed after the primary authorized its Outpost dispatch`, { lane_id: lane.lane_id, expected_senior: grantContext.expected_senior, current_senior: lane.senior });
     }
     if (!isTerminalLaneState(lane.state) ||
         lane.senior.kind !== "lane" ||
@@ -1118,9 +1085,27 @@ async function resolveCommandLaneTarget(ctx, laneId, options = {}) {
         new Set(outpostIds).size !== outpostIds.length) {
         throw new LanesError("outpost_list_invalid", "Registered Outpost list is malformed or exceeds the lane lookup limit", { lane_id: laneId, count: outpostIds.length, maximum: MAX_PLACEMENT_OUTPOSTS });
     }
+    const requestedOutpostId = options.outpostId?.trim();
+    if (options.outpostId !== undefined && !requestedOutpostId) {
+        throw new LanesError("outpost_id_invalid", "--outpost must be a registered Outpost id", { lane_id: laneId });
+    }
+    if (requestedOutpostId !== undefined && !outpostIds.includes(requestedOutpostId)) {
+        throw new LanesError("outpost_not_registered", `Outpost ${requestedOutpostId} is not registered`, { lane_id: laneId, outpost_id: requestedOutpostId });
+    }
     const matches = [];
-    for (const outpostId of outpostIds) {
-        const ownerLanes = await readOutpostLaneRecords(ctx, outpostId);
+    const failedOutpostIds = [];
+    const lookupOutpostIds = requestedOutpostId === undefined ? outpostIds : [requestedOutpostId];
+    for (const outpostId of lookupOutpostIds) {
+        let ownerLanes;
+        try {
+            ownerLanes = await readOutpostLaneRecords(ctx, outpostId);
+        }
+        catch (err) {
+            if (requestedOutpostId !== undefined)
+                throw err;
+            failedOutpostIds.push(outpostId);
+            continue;
+        }
         for (const lane of ownerLanes) {
             if (lane.lane_id === laneId &&
                 lane.host.kind === "local" &&
@@ -1130,7 +1115,7 @@ async function resolveCommandLaneTarget(ctx, laneId, options = {}) {
         }
     }
     if (matches.length === 0) {
-        throw commandLaneNotFound(laneId, options.outpostHint === true);
+        throw commandLaneNotFound(laneId, options.outpostHint === true, failedOutpostIds.length > 0 ? { failed_outpost_ids: failedOutpostIds } : undefined);
     }
     if (matches.length !== 1) {
         throw new LanesError("lane_outpost_ambiguous", `More than one registered Outpost reported lane ${laneId} with the same recorded host identity`, { lane_id: laneId, outpost_ids: matches.map((match) => match.outpostId) });
@@ -1143,11 +1128,11 @@ async function resolveCommandLaneTarget(ctx, laneId, options = {}) {
         ownerHost: match.lane.host,
     };
 }
-function commandLaneNotFound(laneId, outpostHint) {
+function commandLaneNotFound(laneId, outpostHint, details = {}) {
     const hint = outpostHint
         ? "; pass --outpost <id> to confirm a registered Outpost"
         : "";
-    return new LanesError("lane_not_found", `Lane ${laneId} was not found locally or on a registered Outpost with a matching host suffix${hint}`, { lane_id: laneId });
+    return new LanesError("lane_not_found", `Lane ${laneId} was not found locally or on a registered Outpost with a matching host suffix${hint}`, { lane_id: laneId, ...details });
 }
 async function loadClaudeBalanceHostSnapshots(ctx, hqRoot, config) {
     const localHost = laneHostFromCtx(ctx);
@@ -1274,29 +1259,18 @@ async function loadClaudeBalanceHostSnapshots(ctx, hqRoot, config) {
     }
     return { snapshots, unavailableHosts };
 }
-function parsePlacementPolicy(raw) {
-    const value = raw.trim();
-    if (value === "local")
-        return { kind: "local" };
-    if (value === "auto")
-        return { kind: "auto" };
-    const match = /^outpost:(.+)$/.exec(value);
-    const id = match?.[1]?.trim();
-    if (id)
-        return { kind: "outpost", id };
-    throw new LanesError("lane_placement_invalid", `Invalid placement ${JSON.stringify(raw)}. Accepted: local, auto, outpost:<id>`, { value: raw, accepted: ["local", "auto", "outpost:<id>"] });
-}
-async function assertPlacementEnabled(ctx, company, readPlacementEnabled = () => readLanePlacementEnabled(ctx, company)) {
-    if (await readPlacementEnabled())
-        return;
-    throw new LanesError("lane_placement_disabled", `Lane placement options require hq-flags gate ${LANE_OUTPOST_LOAD_BALANCING_FLAG}`, { flag: LANE_OUTPOST_LOAD_BALANCING_FLAG });
-}
 function loadAllQuestions(hqRoot) {
     return listQuestionIds(hqRoot).map((id) => readQuestion(hqRoot, id));
 }
 function sessionMetaPath(hqRoot, sessionId) {
     return path.join(hqRoot, "workspace", "sessions", sessionId, "meta.yaml");
 }
+function isSessionMetaDocument(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
 function loadSessionMeta(hqRoot, sessionId, ctx) {
     const filePath = sessionMetaPath(hqRoot, sessionId);
     if (!ctx.existsSync(filePath))
@@ -1317,7 +1291,7 @@ function loadSessionMeta(hqRoot, sessionId, ctx) {
         process.stderr.write(`hq lanes: failed to parse session meta ${filePath}: ${err instanceof Error ? err.message : String(err)}\n`);
         return { status: "malformed" };
     }
-    if (doc === null || typeof doc !== "object" || Array.isArray(doc)) {
+    if (!isSessionMetaDocument(doc)) {
         return { status: "malformed" };
     }
     return { status: "ok", doc: doc };
@@ -1328,11 +1302,21 @@ function readSessionMeta(hqRoot, sessionId, ctx) {
         return null;
     return loaded.doc;
 }
+/**
+ * Apply the documented session senior default only when the key was never
+ * written. `core/scripts/hq-session.sh` section 3.1 defaults new sessions to
+ * `user` and says authority walkers apply that default at the walk site.
+ */
+function sessionSeniorValue(meta) {
+    return Object.prototype.hasOwnProperty.call(meta, "senior")
+        ? meta.senior
+        : "user";
+}
 function seniorOfSession(hqRoot, sessionId, ctx) {
     const meta = readSessionMeta(hqRoot, sessionId, ctx);
     if (!meta)
         return { kind: "user" };
-    const senior = meta.senior;
+    const senior = sessionSeniorValue(meta);
     if (typeof senior === "string" && senior.trim()) {
         return parseSeniorRef(senior);
     }
@@ -2319,13 +2303,16 @@ async function runCreate(ctx, opts) {
     const company = companyFlag
         ? await ctx.resolveCompany(companyFlag)
         : null;
+    const callerAuthorization = requestedHireGrant !== undefined || ctx.env.HQ_LANE_ID?.trim()
+        ? callerSeniorAuthorization(ctx, senior)
+        : { authorized: true };
     if (requestedHireGrant !== undefined &&
-        !callerMatchesSenior(ctx, senior)) {
-        throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(senior)} may set a lane's hire grant`, { senior, hire_grant: requestedHireGrant });
+        !callerAuthorization.authorized) {
+        throw new LanesError("hire_grant_unauthorized", appendCallerSeniorReason(`Only senior ${seniorKey(senior)} may set a lane's hire grant`, callerAuthorization), { senior, hire_grant: requestedHireGrant, reason: callerAuthorization.reason });
     }
     if (ctx.env.HQ_LANE_ID?.trim() &&
-        !callerMatchesSenior(ctx, senior)) {
-        throw new LanesError("hire_grant_unauthorized", `Only senior lane ${senior.id} may create a direct child lane`, { senior_lane_id: senior.id });
+        !callerAuthorization.authorized) {
+        throw new LanesError("hire_grant_unauthorized", appendCallerSeniorReason(`Only senior lane ${senior.id} may create a direct child lane`, callerAuthorization), { senior_lane_id: senior.id, reason: callerAuthorization.reason });
     }
     const hireGrant = requestedHireGrant ?? 0;
     const laneDepth = derivedLaneDepth(hqRoot, senior, ctx);
@@ -3349,7 +3336,7 @@ function authorizeFailedResume(ctx, lane, encodedContext) {
             throw new LanesError("failed_resume_authorization_invalid", "Failed-resume authorization context is only valid on an Outpost owner dispatch", { lane_id: lane.lane_id });
         }
         const context = parseOutpostFailedResumeContext(encodedContext, lane.lane_id);
-        if (lane.host.kind !== "outpost" ||
+        if (!laneGrantTargetHostedHere(ctx, lane) ||
             !sameHireGrantSenior(lane.senior, context.expectedSenior)) {
             throw new LanesError("failed_resume_senior_changed", `Lane ${lane.lane_id}'s senior changed after its failed-resume request was authorized`, {
                 lane_id: lane.lane_id,
@@ -3359,18 +3346,25 @@ function authorizeFailedResume(ctx, lane, encodedContext) {
         }
         return context.actor;
     }
-    if (!callerMatchesSenior(ctx, lane.senior)) {
-        throw new LanesError("failed_resume_unauthorized", "Only the lane's senior may resume a failed lane with --from-failed", { lane_id: lane.lane_id });
+    const callerAuthorization = callerSeniorAuthorization(ctx, lane.senior);
+    if (!callerAuthorization.authorized) {
+        throw new LanesError("failed_resume_unauthorized", appendCallerSeniorReason("Only the lane's senior may resume a failed lane with --from-failed", callerAuthorization), { lane_id: lane.lane_id, reason: callerAuthorization.reason });
     }
     return resumeProfileRepinActor(ctx);
 }
-function workerProfileHashMismatch(lane, profile) {
-    return new LanesError("worker_profile_hash_mismatch", `Worker profile ${JSON.stringify(profile.id)} on Outpost ${lane.host.id} does not match the hash recorded by the lane`, {
+function workerProfileHashMismatch(lane, profile, callerAuthorization) {
+    const message = `Worker profile ${JSON.stringify(profile.id)} on Outpost ${lane.host.id} does not match the hash recorded by the lane`;
+    return new LanesError("worker_profile_hash_mismatch", callerAuthorization && !callerAuthorization.authorized
+        ? appendCallerSeniorReason(message, callerAuthorization)
+        : message, {
         lane_id: lane.lane_id,
         worker: profile.id,
         outpost: lane.host.kind === "outpost" ? lane.host.id : null,
         expected_hash: lane.worker_profile_hash ?? null,
         actual_hash: profile.profile.contentHash,
+        ...(callerAuthorization && !callerAuthorization.authorized
+            ? { reason: callerAuthorization.reason }
+            : {}),
     });
 }
 function authorizeResumeProfileRepin(ctx, lane, profile, encodedContext) {
@@ -3390,7 +3384,7 @@ function authorizeResumeProfileRepin(ctx, lane, profile, encodedContext) {
                 ? new LanesError("worker_profile_hash_mismatch", "Profile re-pin context is invalid", { lane_id: lane.lane_id })
                 : workerProfileHashMismatch(lane, profile);
         }
-        if (lane.host.kind !== "outpost" ||
+        if (!laneGrantTargetHostedHere(ctx, lane) ||
             !sameHireGrantSenior(lane.senior, context.expected_senior)) {
             throw profile === undefined
                 ? new LanesError("worker_profile_hash_mismatch", "Lane senior changed after profile re-pin authorization", { lane_id: lane.lane_id })
@@ -3398,7 +3392,7 @@ function authorizeResumeProfileRepin(ctx, lane, profile, encodedContext) {
         }
     }
     if (profile === undefined ||
-        lane.host.kind !== "outpost" ||
+        (lane.host.kind !== "outpost" && !(ssmOwnerDispatch && laneGrantTargetHostedHere(ctx, lane))) ||
         lane.worker_profile_hash === profile.profile.contentHash) {
         return undefined;
     }
@@ -3413,8 +3407,9 @@ function authorizeResumeProfileRepin(ctx, lane, profile, encodedContext) {
             newHash: profile.profile.contentHash,
         };
     }
-    if (context !== undefined || !callerMatchesSenior(ctx, lane.senior)) {
-        throw workerProfileHashMismatch(lane, profile);
+    const callerAuthorization = callerSeniorAuthorization(ctx, lane.senior);
+    if (context !== undefined || !callerAuthorization.authorized) {
+        throw workerProfileHashMismatch(lane, profile, context === undefined ? callerAuthorization : undefined);
     }
     return {
         kind: "senior",
@@ -3425,18 +3420,26 @@ function authorizeResumeProfileRepin(ctx, lane, profile, encodedContext) {
     };
 }
 function assertResumeProfileRepinStillAuthorized(ctx, current, authorization) {
-    const authorized = current.host.kind === "outpost" &&
-        sameHireGrantSenior(current.senior, authorization.expectedSenior) &&
+    const callerAuthorization = authorization.kind === "senior"
+        ? callerSeniorAuthorization(ctx, current.senior)
+        : undefined;
+    const authorized = sameHireGrantSenior(current.senior, authorization.expectedSenior) &&
         (authorization.kind === "ssm-owner-dispatch"
-            ? ctx.isSsmOwnerDispatch()
-            : callerMatchesSenior(ctx, current.senior));
+            ? ctx.isSsmOwnerDispatch() && laneGrantTargetHostedHere(ctx, current)
+            : current.host.kind === "outpost" && callerAuthorization?.authorized === true);
     if (!authorized) {
-        throw new LanesError("worker_profile_hash_mismatch", `Lane ${current.lane_id}'s senior changed before its Outpost profile could be re-pinned`, {
+        const message = `Lane ${current.lane_id}'s senior changed before its Outpost profile could be re-pinned`;
+        throw new LanesError("worker_profile_hash_mismatch", callerAuthorization && !callerAuthorization.authorized
+            ? appendCallerSeniorReason(message, callerAuthorization)
+            : message, {
             lane_id: current.lane_id,
             expected_senior: authorization.expectedSenior,
             current_senior: current.senior,
             expected_hash: current.worker_profile_hash ?? null,
             actual_hash: authorization.newHash,
+            ...(callerAuthorization && !callerAuthorization.authorized
+                ? { reason: callerAuthorization.reason }
+                : {}),
         });
     }
 }
@@ -3479,19 +3482,14 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
     let grantContext;
     let grantHierarchy;
     if (action === "grant") {
-        let hierarchy = loadAllLanes(ctx.hqRoot());
-        const ownerLanes = await readOutpostLaneRecords(ctx, outpostId);
-        const byId = new Map(hierarchy.map((record) => [record.lane_id, record]));
-        for (const ownerLane of ownerLanes) {
-            byId.set(ownerLane.lane_id, ownerLane);
-        }
-        hierarchy = [...byId.values()];
+        const hierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneRecords(ctx, outpostId));
         grantHierarchy = hierarchy;
         grantContext = createOutpostHireGrantContext(lane, hierarchy);
     }
-    else if ((action === "resume" || action === "message") &&
-        lane.senior.kind === "lane") {
-        grantContext = createOutpostHireGrantContext(lane, loadAllLanes(ctx.hqRoot()), action === "message" ? options.supersededMessageCallerId : undefined);
+    else if ((action === "resume" && lane.senior.kind === "lane") ||
+        (action === "message" && (lane.senior.kind === "lane" || lane.senior.kind === "session"))) {
+        const hierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneRecords(ctx, outpostId));
+        grantContext = createOutpostHireGrantContext(lane, hierarchy, action === "message" ? options.supersededMessageCallerId : undefined, action === "message" ? options.supersededMessageSessionId : undefined);
     }
     let dispatched;
     let grantContextRejected = false;
@@ -4298,336 +4296,6 @@ async function runOutpostIdentityBackfillTarget(ctx, opts) {
         marker_path: OUTPOST_ID_PATH,
     });
 }
-function laneCanMoveBeforeStart(lane) {
-    return lane.state === "queued" &&
-        lane.pickup_validation_pending !== true &&
-        lane.admission_reserved_at === undefined &&
-        lane.provider_session_id === undefined &&
-        lane.provider_session_id_absent === undefined &&
-        lane.provider_home_at_spawn === undefined &&
-        lane.last_resume === undefined &&
-        lane.last_run_usage === undefined &&
-        lane.last_host_report_at === undefined &&
-        lane.pending_resume === undefined;
-}
-function readLaneTimeout(hqRoot, laneId) {
-    const raw = readJsonFile(timeoutPath(hqRoot, laneId));
-    if (raw === null)
-        return undefined;
-    if (typeof raw !== "object" || Array.isArray(raw) ||
-        typeof raw.timeout_secs !== "number" ||
-        typeof raw.deadline_at !== "string" ||
-        !Number.isSafeInteger(raw.timeout_secs) ||
-        raw.timeout_secs <= 0 ||
-        !Number.isFinite(Date.parse(raw.deadline_at))) {
-        throw new LanesError("lane_timeout_invalid", `Lane ${laneId} has a malformed timeout record`, {
-            lane_id: laneId,
-        });
-    }
-    const record = raw;
-    return { timeout_secs: record.timeout_secs, deadline_at: record.deadline_at };
-}
-async function runMove(ctx, laneId, opts) {
-    const hqRoot = ctx.hqRoot();
-    const policy = parsePlacementPolicy(opts.placement ?? "");
-    const source = readLane(hqRoot, laneId);
-    const placementCompany = resolveLaneCompany(hqRoot, source).company ?? undefined;
-    let placementGate;
-    const placementEnabled = () => {
-        placementGate ??= readLanePlacementEnabled(ctx, placementCompany);
-        return placementGate;
-    };
-    await assertPlacementEnabled(ctx, placementCompany, placementEnabled);
-    if (!laneCanMoveBeforeStart(source)) {
-        throw new LanesError(source.state === "queued" ? "lane_move_started" : "lane_not_queued", `Lane ${laneId} cannot move after it has started; current state is ${source.state}`, { lane_id: laneId, state: source.state });
-    }
-    const sourceHost = source.host;
-    const config = loadLanesConfig(hqRoot);
-    const capacity = await loadHostCapacitySnapshots(ctx, hqRoot, config);
-    let targetSnapshots = capacity.snapshots.filter((snapshot) => snapshot.host.kind !== sourceHost.kind || snapshot.host.id !== sourceHost.id);
-    if (policy.kind === "outpost") {
-        targetSnapshots = targetSnapshots.filter((snapshot) => snapshot.host.kind === "outpost" && snapshot.host.id === policy.id);
-    }
-    else if (policy.kind === "local") {
-        targetSnapshots = targetSnapshots.filter((snapshot) => snapshot.host.kind === "local");
-    }
-    const profileAccounts = source.worker_profile === undefined
-        ? undefined
-        : loadWorkerProfile(hqRoot, source.worker_profile).meta.accounts;
-    const allowedAccounts = source.admission_accounts ?? profileAccounts;
-    const choice = chooseHostForLane(targetSnapshots, {
-        provider: source.provider,
-        ...(source.account !== undefined ? { account: source.account } : {}),
-        ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
-    });
-    let moved;
-    if (laneRunsHere(source, reconcileHostFromCtx(ctx))) {
-        moved = await commitLaneMove(ctx, laneId, choice.host, choice.account, placementEnabled);
-    }
-    else if (source.host.kind === "outpost") {
-        moved = await dispatchRemoteLaneMove(ctx, source, choice.host, choice.account);
-    }
-    else {
-        throw new LanesError("lane_remote", `Cannot move lane ${laneId} from this host; its state is owned by ${source.host.kind}:${source.host.id}`, { lane_id: laneId, host: source.host, action: "move" });
-    }
-    printJson({
-        ok: true,
-        action: "move",
-        lane_id: laneId,
-        state: moved.state,
-        host: moved.host,
-        account: moved.account ?? null,
-        lane: moved,
-    });
-}
-async function commitLaneMove(ctx, laneId, target, account, readPlacementEnabled) {
-    const hqRoot = ctx.hqRoot();
-    const before = readLane(hqRoot, laneId);
-    assertLaneRunsHereForOperatorMutation(ctx, before, "move-target");
-    await assertPlacementEnabled(ctx, resolveLaneCompany(hqRoot, before).company ?? undefined, readPlacementEnabled);
-    if (before.host.kind === target.kind && before.host.id === target.id) {
-        throw new LanesError("lane_move_same_host", `Lane ${laneId} is already on ${target.kind}:${target.id}`, {
-            lane_id: laneId,
-            host: target,
-        });
-    }
-    if (!laneCanMoveBeforeStart(before)) {
-        throw new LanesError(before.state === "queued" ? "lane_move_started" : "lane_not_queued", `Lane ${laneId} cannot move after it has started; current state is ${before.state}`, { lane_id: laneId, state: before.state });
-    }
-    if (target.kind === "outpost") {
-        let known;
-        try {
-            known = await ctx.listOutpostIds();
-        }
-        catch (err) {
-            throw new LanesError("outpost_list_unavailable", `Failed to list Outpost ids: ${dispatchErrorMessage(err)}`, {});
-        }
-        assertKnownOutpost(target.id, known);
-    }
-    const accountConfig = loadLanesConfig(hqRoot).providers[before.provider].accounts[account];
-    if (accountConfig === undefined || !accountConfig.enabled) {
-        throw new LanesError("lane_move_account_invalid", `Account ${account} is unavailable for ${before.provider}`, {
-            lane_id: laneId,
-            provider: before.provider,
-            account,
-        });
-    }
-    const profileAccounts = before.worker_profile === undefined
-        ? undefined
-        : loadWorkerProfile(hqRoot, before.worker_profile).meta.accounts;
-    const allowedAccounts = before.admission_accounts ?? profileAccounts;
-    if (allowedAccounts !== undefined &&
-        !allowedAccounts.includes(account)) {
-        throw new LanesError("lane_move_account_invalid", `Account ${account} is not allowed by lane ${laneId}`, {
-            lane_id: laneId,
-            account,
-            allowed_accounts: allowedAccounts,
-        });
-    }
-    const briefText = target.kind === "outpost"
-        ? (() => {
-            const briefPath = path.join(runDir(hqRoot, laneId), "brief.md");
-            if (!ctx.existsSync(briefPath)) {
-                throw new LanesError("lane_move_brief_missing", `Lane ${laneId} has no stored brief to dispatch`, {
-                    lane_id: laneId,
-                });
-            }
-            return ctx.readFileSync(briefPath, "utf8");
-        })()
-        : undefined;
-    const timeout = target.kind === "outpost" ? readLaneTimeout(hqRoot, laneId) : undefined;
-    const moved = await withLaneAdmissionLock(hqRoot, before.provider, async () => {
-        const current = readLane(hqRoot, laneId);
-        assertLaneRunsHereForOperatorMutation(ctx, current, "move-target");
-        if (!laneCanMoveBeforeStart(current)) {
-            throw new LanesError(current.state === "queued" ? "lane_move_started" : "lane_not_queued", `Lane ${laneId} started before the move could commit`, { lane_id: laneId, state: current.state });
-        }
-        return updateLane(hqRoot, laneId, current.version, "command", (live) => ({
-            ...live,
-            host: target,
-            account,
-            queued_reason: undefined,
-            admission_reserved_at: undefined,
-        }));
-    }, ctx.sleep);
-    if (target.kind !== "outpost")
-        return moved;
-    try {
-        return await dispatchCreatedOutpostLane(ctx, {
-            hqRoot,
-            lane: moved,
-            outpostId: target.id,
-            briefText: briefText ?? "",
-            timeout,
-            preserveQueuedOnFailure: true,
-        });
-    }
-    catch (err) {
-        const dispatchDetails = isLanesError(err) ? err.details : {};
-        const commandId = typeof dispatchDetails.command_id === "string" &&
-            dispatchDetails.command_id.trim() !== ""
-            ? dispatchDetails.command_id
-            : undefined;
-        const definitelyNotSubmitted = commandId === undefined &&
-            dispatchDetails.outcome_unknown !== true &&
-            dispatchDetails.done !== false;
-        const knownNoPersistence = (isLanesError(err) && err.error === "outpost_self_target") ||
-            (dispatchDetails.done === true && dispatchDetails.pickup_persisted === false);
-        if (!definitelyNotSubmitted && !knownNoPersistence) {
-            const checkCommand = `hq lanes show ${laneId}`;
-            const message = `Failed to dispatch lane ${laneId} to Outpost ${target.id}; outcome is unknown and the lane remains assigned to Outpost ${target.id}. ` +
-                `Check the target copy by running \`${checkCommand}\` on Outpost ${target.id}. ` +
-                dispatchErrorMessage(err);
-            throw new LanesError("lane_move_dispatch_failed", message, {
-                lane_id: laneId,
-                message,
-                source_host: before.host,
-                target_host: target,
-                source_restored: false,
-                outcome: "unknown",
-                ...(commandId !== undefined ? { command_id: commandId } : {}),
-                check_command: checkCommand,
-                ...(dispatchDetails.owner_error !== undefined
-                    ? { owner_error: dispatchDetails.owner_error }
-                    : {}),
-            });
-        }
-        let restored = false;
-        let rollbackError;
-        try {
-            restored = await withLaneAdmissionLock(hqRoot, before.provider, async () => {
-                const current = readLane(hqRoot, laneId);
-                if (current.version !== moved.version ||
-                    current.state !== "queued" ||
-                    current.host.kind !== target.kind ||
-                    current.host.id !== target.id ||
-                    current.account !== account) {
-                    return false;
-                }
-                updateLane(hqRoot, laneId, current.version, "command", (live) => ({
-                    ...live,
-                    host: before.host,
-                    account: before.account,
-                    queued_reason: before.queued_reason,
-                    admission_reserved_at: before.admission_reserved_at,
-                }));
-                return true;
-            }, ctx.sleep);
-        }
-        catch (restoreErr) {
-            rollbackError = restoreErr;
-        }
-        const dispatchMessage = dispatchErrorMessage(err);
-        const outcome = restored
-            ? "the lane stayed queued on its source"
-            : rollbackError === undefined
-                ? "the lane changed after the move and was not overwritten"
-                : `source restoration failed: ${dispatchErrorMessage(rollbackError)}`;
-        const message = `Failed to dispatch lane ${laneId} to Outpost ${target.id}; ${outcome}: ${dispatchMessage}`;
-        throw new LanesError("lane_move_dispatch_failed", message, {
-            lane_id: laneId,
-            message,
-            source_host: before.host,
-            target_host: target,
-            source_restored: restored,
-            ...(dispatchDetails.owner_error !== undefined
-                ? { owner_error: dispatchDetails.owner_error }
-                : {}),
-            ...(rollbackError !== undefined
-                ? { rollback_error: dispatchErrorMessage(rollbackError) }
-                : {}),
-        });
-    }
-}
-async function dispatchRemoteLaneMove(ctx, source, target, account) {
-    if (source.host.kind !== "outpost") {
-        throw new LanesError("lane_move_wrong_host", `Lane ${source.lane_id} is not Outpost-hosted`, {
-            lane_id: source.lane_id,
-            host: source.host,
-        });
-    }
-    let dispatched;
-    try {
-        dispatched = await ctx.dispatchOutpostExec({
-            outpostId: source.host.id,
-            command: buildOutpostMoveTargetCommand({
-                laneId: source.lane_id,
-                host: target,
-                account,
-            }),
-            timeoutSeconds: 120,
-            waitMs: 120_000,
-        });
-    }
-    catch (err) {
-        throw new LanesError("lane_move_dispatch_failed", `Could not ask Outpost ${source.host.id} to move lane ${source.lane_id}: ${dispatchErrorMessage(err)}`, { lane_id: source.lane_id, source_outpost: source.host.id });
-    }
-    const ownerError = ownerErrorFromOutput(dispatched.stdout);
-    if (ownerError) {
-        throw new LanesError("outpost_dispatch_failed", `Outpost ${source.host.id} rejected the lane move: ${ownerError.message}`, {
-            lane_id: source.lane_id,
-            source_outpost: source.host.id,
-            command_id: dispatched.commandId,
-            status: dispatched.status,
-            done: dispatched.done ?? false,
-            exit_code: dispatched.exitCode,
-            owner_error: ownerError,
-        });
-    }
-    if (dispatched.done !== true || dispatched.status !== "Success" || dispatched.exitCode !== 0) {
-        throw new LanesError("lane_move_dispatch_failed", `Outpost ${source.host.id} did not confirm the lane move`, {
-            lane_id: source.lane_id,
-            source_outpost: source.host.id,
-            command_id: dispatched.commandId,
-            status: dispatched.status,
-            done: dispatched.done ?? false,
-            exit_code: dispatched.exitCode,
-        });
-    }
-    const remote = parseRemoteJson(dispatched.stdout, "Outpost lane move");
-    const remoteHost = remote?.host;
-    if (remote?.ok !== true ||
-        remote.action !== "move-target" ||
-        remote.lane_id !== source.lane_id ||
-        remote.state !== "queued" ||
-        remote.account !== account ||
-        remoteHost === null || typeof remoteHost !== "object" || Array.isArray(remoteHost) ||
-        remoteHost.kind !== target.kind ||
-        remoteHost.id !== target.id) {
-        throw new LanesError("lane_move_unconfirmed", `Outpost ${source.host.id} returned an invalid lane move result`, {
-            lane_id: source.lane_id,
-            source_outpost: source.host.id,
-            target,
-        });
-    }
-    return {
-        ...source,
-        state: "queued",
-        host: target,
-        account,
-    };
-}
-async function runMoveTarget(ctx, laneId, opts) {
-    const kind = opts.hostKind?.trim();
-    const id = opts.hostId?.trim();
-    const account = opts.account?.trim();
-    if ((kind !== "local" && kind !== "outpost") || !id || !account) {
-        throw new LanesError("lane_move_target_invalid", "Move target requires a valid host kind, host id, and account", {
-            host_kind: kind ?? null,
-            host_id: id ?? null,
-            account: account ?? null,
-        });
-    }
-    const moved = await commitLaneMove(ctx, laneId, { kind, id }, account);
-    printJson({
-        ok: true,
-        action: "move-target",
-        lane_id: moved.lane_id,
-        state: moved.state,
-        host: moved.host,
-        account: moved.account ?? null,
-    });
-}
 async function refreshOutpostLaneCopiesForShow(ctx, lane, localLanes) {
     if (lane.host.kind !== "outpost" || laneRunsHere(lane, reconcileHostFromCtx(ctx))) {
         return lane;
@@ -4773,25 +4441,81 @@ async function runShow(ctx, laneId) {
             : null,
     });
 }
-function callerMatchesSenior(ctx, seniorRef) {
+function formatSessionSeniorValue(value) {
+    if (value === undefined)
+        return "<undefined>";
+    try {
+        return JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+function callerSeniorAuthorization(ctx, seniorRef) {
     const sessionId = sessionIdFromEnv(ctx.env);
     const callerLaneId = ctx.env.HQ_LANE_ID?.trim() || undefined;
     if (seniorRef.kind === "lane") {
-        return callerLaneId !== undefined && callerLaneId === seniorRef.id;
+        if (callerLaneId === seniorRef.id)
+            return { authorized: true };
+        if (callerLaneId !== undefined)
+            return { authorized: false, reason: "caller is a different lane" };
+        if (!sessionId)
+            return { authorized: false, reason: "no session id" };
+        return { authorized: false, reason: "caller is not a lane" };
+    }
+    if (callerLaneId !== undefined)
+        return { authorized: false, reason: "caller is a lane" };
+    if (!sessionId)
+        return { authorized: false, reason: "no session id" };
+    if (seniorRef.kind === "session") {
+        const seniorSessionId = seniorRef.id;
+        if (!seniorSessionId)
+            return { authorized: false, reason: "session senior has no id" };
+        return callerMatchesSessionSenior(ctx, seniorSessionId)
+            ? { authorized: true }
+            : { authorized: false, reason: `session id ${sessionId} is not senior session ${seniorSessionId}` };
     }
-    if (!sessionId || callerLaneId !== undefined)
-        return false;
-    if (seniorRef.kind === "session")
-        return sessionId === seniorRef.id;
     if (seniorRef.kind !== "user")
-        return false;
+        return { authorized: false, reason: "senior is not a user" };
     const loaded = loadSessionMeta(ctx.hqRoot(), sessionId, ctx);
-    if (loaded.status !== "ok")
-        return false;
-    const senior = loaded.doc.senior;
-    return senior === "user" ||
+    if (loaded.status === "missing") {
+        return {
+            authorized: false,
+            reason: "session meta missing",
+            repair: "if this is the owner's session, run bash core/scripts/hq-session.sh set senior user",
+        };
+    }
+    if (loaded.status === "unreadable") {
+        return { authorized: false, reason: "session meta unreadable" };
+    }
+    if (loaded.status === "malformed") {
+        return { authorized: false, reason: "session meta invalid" };
+    }
+    const senior = sessionSeniorValue(loaded.doc);
+    if (senior === "user" ||
         (senior !== null && typeof senior === "object" && !Array.isArray(senior) &&
-            senior.kind === "user");
+            senior.kind === "user")) {
+        return { authorized: true };
+    }
+    return {
+        authorized: false,
+        reason: `session senior is ${formatSessionSeniorValue(senior)}`,
+    };
+}
+function callerSeniorReason(authorization) {
+    if (authorization.authorized)
+        return "";
+    return authorization.repair
+        ? `${authorization.reason}; ${authorization.repair}`
+        : authorization.reason;
+}
+function callerMatchesSenior(ctx, seniorRef) {
+    return callerSeniorAuthorization(ctx, seniorRef).authorized;
+}
+function appendCallerSeniorReason(message, authorization) {
+    return authorization.authorized
+        ? message
+        : `${message}; authorization refused: ${callerSeniorReason(authorization)}`;
 }
 function laneGrantTargetHostedHere(ctx, lane) {
     if (lane.host.kind === "local") {
@@ -4799,14 +4523,17 @@ function laneGrantTargetHostedHere(ctx, lane) {
     }
     return lane.host.kind === "outpost" && laneIsHostedHere(ctx, lane);
 }
-function forceAdmissionAuthorized(ctx, lane) {
-    return callerMatchesSenior(ctx, lane.senior);
+function forceAdmissionAuthorization(ctx, lane) {
+    return callerSeniorAuthorization(ctx, lane.senior);
 }
 async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContext) {
     const hqRoot = ctx.hqRoot();
     const initial = readLane(hqRoot, laneId);
-    if (authorization === "senior" && !callerMatchesSenior(ctx, initial.senior)) {
-        throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: initial.senior });
+    const initialCallerAuthorization = authorization === "senior"
+        ? callerSeniorAuthorization(ctx, initial.senior)
+        : { authorized: true };
+    if (!initialCallerAuthorization.authorized) {
+        throw new LanesError("hire_grant_unauthorized", appendCallerSeniorReason(`Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, initialCallerAuthorization), { lane_id: laneId, senior: initial.senior, reason: initialCallerAuthorization.reason });
     }
     if (authorization === "ssm-owner-dispatch" &&
         !laneGrantTargetHostedHere(ctx, initial)) {
@@ -4824,8 +4551,11 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
     ];
     const updated = ctx.withGrantHireLocks(hqRoot, lockedLaneIds, () => {
         const current = readLane(hqRoot, laneId);
-        if (authorization === "senior" && !callerMatchesSenior(ctx, current.senior)) {
-            throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(current.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: current.senior });
+        const currentCallerAuthorization = authorization === "senior"
+            ? callerSeniorAuthorization(ctx, current.senior)
+            : { authorized: true };
+        if (!currentCallerAuthorization.authorized) {
+            throw new LanesError("hire_grant_unauthorized", appendCallerSeniorReason(`Only senior ${seniorKey(current.senior)} may change lane ${laneId}'s hire grant`, currentCallerAuthorization), { lane_id: laneId, senior: current.senior, reason: currentCallerAuthorization.reason });
         }
         if (authorization === "ssm-owner-dispatch" &&
             !laneGrantTargetHostedHere(ctx, current)) {
@@ -4938,8 +4668,9 @@ async function runKeepAlive(ctx, laneId, opts) {
     });
 }
 function assertKeepAliveChangeAllowed(ctx, lane, laneId) {
-    if (!callerMatchesSenior(ctx, lane.senior)) {
-        throw new LanesError("keep_alive_unauthorized", "Only senior " + seniorKey(lane.senior) + " may change lane " + laneId + "'s keep-alive setting", { lane_id: laneId, senior: lane.senior });
+    const callerAuthorization = callerSeniorAuthorization(ctx, lane.senior);
+    if (!callerAuthorization.authorized) {
+        throw new LanesError("keep_alive_unauthorized", appendCallerSeniorReason("Only senior " + seniorKey(lane.senior) + " may change lane " + laneId + "'s keep-alive setting", callerAuthorization), { lane_id: laneId, senior: lane.senior, reason: callerAuthorization.reason });
     }
     if (!laneRunsHere(lane, reconcileHostFromCtx(ctx))) {
         throw new LanesError("keep_alive_owner_host_required", "Run hq lanes keep-alive " + laneId + " on its owner host " + lane.host.kind + ":" + lane.host.id, { lane_id: laneId, host: lane.host });
@@ -4954,10 +4685,14 @@ async function runGrant(ctx, laneId, opts) {
     }
     const hireGrant = parseHireGrant(opts.hire);
     const hqRoot = ctx.hqRoot();
-    const target = await resolveCommandLaneTarget(ctx, laneId, { outpostHint: true });
+    const target = await resolveCommandLaneTarget(ctx, laneId, {
+        outpostHint: true,
+        outpostId: opts.outpost,
+    });
     const initial = target.lane;
-    if (!callerMatchesSenior(ctx, initial.senior)) {
-        throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: initial.senior });
+    const callerAuthorization = callerSeniorAuthorization(ctx, initial.senior);
+    if (!callerAuthorization.authorized) {
+        throw new LanesError("hire_grant_unauthorized", appendCallerSeniorReason(`Only senior ${seniorKey(initial.senior)} may change lane ${laneId}'s hire grant`, callerAuthorization), { lane_id: laneId, senior: initial.senior, reason: callerAuthorization.reason });
     }
     if (opts.outpost !== undefined) {
         const requestedOutpost = opts.outpost.trim();
@@ -5012,8 +4747,9 @@ async function runApprove(ctx, laneId, opts) {
     if (!allowed.includes(checkpoint)) {
         throw new LanesError("registry_worker_checkpoint_unknown", `Checkpoint ${JSON.stringify(checkpoint)} is not declared by the lane's registry worker`, { lane_id: laneId, checkpoint, accepted: allowed });
     }
-    if (!callerMatchesSenior(ctx, initial.senior)) {
-        throw new LanesError("registry_worker_approval_unauthorized", `Only senior ${seniorKey(initial.senior)} may approve lane ${laneId}'s registry worker checkpoint`, { lane_id: laneId, senior: initial.senior });
+    const callerAuthorization = callerSeniorAuthorization(ctx, initial.senior);
+    if (!callerAuthorization.authorized) {
+        throw new LanesError("registry_worker_approval_unauthorized", appendCallerSeniorReason(`Only senior ${seniorKey(initial.senior)} may approve lane ${laneId}'s registry worker checkpoint`, callerAuthorization), { lane_id: laneId, senior: initial.senior, reason: callerAuthorization.reason });
     }
     if (remoteOutpost) {
         const approvalContext = createOutpostRegistryWorkerApprovalContext({
@@ -5039,8 +4775,9 @@ async function runApprove(ctx, laneId, opts) {
     const actor = resumeProfileRepinActor(ctx);
     const updated = retryUpdateLane(hqRoot, laneId, "command", (current) => {
         assertLaneRunsHereForOperatorMutation(ctx, current, "approve");
-        if (!callerMatchesSenior(ctx, current.senior)) {
-            throw new LanesError("registry_worker_approval_unauthorized", `Only senior ${seniorKey(current.senior)} may approve lane ${laneId}'s registry worker checkpoint`, { lane_id: laneId, senior: current.senior });
+        const currentCallerAuthorization = callerSeniorAuthorization(ctx, current.senior);
+        if (!currentCallerAuthorization.authorized) {
+            throw new LanesError("registry_worker_approval_unauthorized", appendCallerSeniorReason(`Only senior ${seniorKey(current.senior)} may approve lane ${laneId}'s registry worker checkpoint`, currentCallerAuthorization), { lane_id: laneId, senior: current.senior, reason: currentCallerAuthorization.reason });
         }
         if (JSON.stringify(current.registry_worker) !== JSON.stringify(initial.registry_worker) ||
             !current.registry_worker ||
@@ -5206,8 +4943,9 @@ async function runAdmit(ctx, laneId, opts) {
         }
         let blockedBy;
         if (opts.force) {
-            if (!forceAdmissionAuthorized(ctx, lane)) {
-                throw new LanesError("force_not_authorized", `Only lane ${lane.senior.kind === "lane" ? lane.senior.id : lane.senior.kind === "session" ? lane.senior.id : "senior/operator"} may force admission of ${laneId}`, { lane_id: laneId, senior: lane.senior });
+            const callerAuthorization = forceAdmissionAuthorization(ctx, lane);
+            if (!callerAuthorization.authorized) {
+                throw new LanesError("force_not_authorized", appendCallerSeniorReason(`Only lane ${lane.senior.kind === "lane" ? lane.senior.id : lane.senior.kind === "session" ? lane.senior.id : "senior/operator"} may force admission of ${laneId}`, callerAuthorization), { lane_id: laneId, senior: lane.senior, reason: callerAuthorization.reason });
             }
             const config = loadLanesConfig(hqRoot);
             const lanes = loadAllLanes(hqRoot).filter((row) => row.lane_id !== laneId && laneRunsHere(row, host));
@@ -5335,7 +5073,7 @@ function applyResumeProfileAndEffort(current, next, input) {
             ? registryWorkerRecord(profile.registryWorker)
             : undefined;
         if (input.profileRepin !== undefined &&
-            current.host.kind === "outpost" &&
+            (current.host.kind === "outpost" || input.profileRepin.kind === "ssm-owner-dispatch") &&
             current.worker_profile_hash !== profile.contentHash) {
             const entry = {
                 old_hash: current.worker_profile_hash ?? null,
@@ -7074,6 +6812,19 @@ export function registerLanesCommand(parent, deps = {}) {
         readOutpostCapacity,
     };
     const watchHandlers = createLaneWatchHandlers(watchHandlerDeps);
+    const moveHandlers = createLaneMoveHandlers({
+        assertKnownOutpost,
+        assertLaneRunsHereForOperatorMutation,
+        dispatchCreatedOutpostLane,
+        loadHostCapacitySnapshots,
+        ownerErrorFromOutput,
+        parseRemoteJson,
+        printJson,
+        readJsonFile,
+        reconcileHostFromCtx,
+        runDir,
+        timeoutPath,
+    });
     const lanes = parent
         .command("lanes", { hidden: true })
         .description("Create, supervise, and steer worker lanes; routed decision queue");
@@ -7242,7 +6993,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .argument("<lane-id>", "Lane id")
         .requiredOption("--placement <mode>", "local | auto | outpost:<id>")
         .action(wrap(async (laneId, opts) => {
-        await runMove(ctx, laneId, opts);
+        await moveHandlers.runMove(ctx, laneId, opts);
     }));
     lanes
         .command("move-target", { hidden: true })
@@ -7251,7 +7002,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .requiredOption("--host-id <id>", "Target host id")
         .requiredOption("--account <id>", "Provider account id")
         .action(wrap(async (laneId, opts) => {
-        await runMoveTarget(ctx, laneId, opts);
+        await moveHandlers.runMoveTarget(ctx, laneId, opts);
     }));
     lanes
         .command("balance-move-target", { hidden: true })