@indigoai-us/hq-cli 5.286.0 → 5.288.0

package/dist/commands/cloud-provision.js

@@ -266,6 +266,21 @@ export function writeCompanyConfig(hqRoot, slug, config) {
     return true;
 }
 // ── Vault HTTP client (real impl) ────────────────────────────────────────────
+const VAULT_REQUEST_TIMEOUT_MS = 15_000;
+/** Run a complete Vault HTTP operation under a finite deadline. */
+async function withVaultRequest(url, init, readResponse) {
+    const deadline = AbortSignal.timeout(VAULT_REQUEST_TIMEOUT_MS);
+    try {
+        const res = await fetch(url, { ...init, signal: deadline });
+        return await readResponse(res);
+    }
+    catch (err) {
+        if (deadline.aborted) {
+            throw new ProvisionError(1, `Vault request timed out after ${VAULT_REQUEST_TIMEOUT_MS}ms`);
+        }
+        throw err;
+    }
+}
 /**
  * Default vault HTTP client backed by global `fetch`. Uses the `/v1/entities`
  * route surface (matches AppBar `vault_client.rs` and hq-pro handler routes).
@@ -284,52 +299,56 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
     return {
         async listMyPersonEntities() {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/by-type/person`;
-            const res = await fetch(url, { method: "GET", headers });
-            if (res.status === 404)
-                return [];
-            if (!res.ok) {
-                const body = await safeBody(res);
-                throw new ProvisionError(1, `Vault GET /entity/by-type/person failed: ${res.status} ${res.statusText} — ${body}`);
-            }
-            const data = (await res.json());
-            return data.entities ?? [];
+            return withVaultRequest(url, { method: "GET", headers }, async (res) => {
+                if (res.status === 404)
+                    return [];
+                if (!res.ok) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(1, `Vault GET /entity/by-type/person failed: ${res.status} ${res.statusText} — ${body}`);
+                }
+                const data = (await res.json());
+                return data.entities ?? [];
+            });
         },
         async findCompanyBySlug(slug) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/by-slug/company/${encodeURIComponent(slug)}`;
-            const res = await fetch(url, { method: "GET", headers });
-            if (res.status === 404)
-                return null;
-            if (!res.ok) {
-                const body = await safeBody(res);
-                throw new ProvisionError(1, `Vault GET by-slug failed: ${res.status} ${res.statusText} — ${body}`);
-            }
-            const data = (await res.json());
-            if (!data.entity) {
-                throw new ProvisionError(1, `Vault GET by-slug returned 200 with no entity body`);
-            }
-            return data.entity;
+            return withVaultRequest(url, { method: "GET", headers }, async (res) => {
+                if (res.status === 404)
+                    return null;
+                if (!res.ok) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(1, `Vault GET by-slug failed: ${res.status} ${res.statusText} — ${body}`);
+                }
+                const data = (await res.json());
+                if (!data.entity) {
+                    throw new ProvisionError(1, `Vault GET by-slug returned 200 with no entity body`);
+                }
+                return data.entity;
+            });
         },
         async checkSlugInMyNamespace(slug) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/check-slug/me?type=company&slug=${encodeURIComponent(slug)}`;
-            const res = await fetch(url, { method: "GET", headers });
-            if (!res.ok) {
-                const body = await safeBody(res);
-                throw new ProvisionError(1, `Vault GET /entity/check-slug/me failed: ${res.status} ${res.statusText} — ${body}`);
-            }
-            return (await res.json());
+            return withVaultRequest(url, { method: "GET", headers }, async (res) => {
+                if (!res.ok) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(1, `Vault GET /entity/check-slug/me failed: ${res.status} ${res.statusText} — ${body}`);
+                }
+                return (await res.json());
+            });
         },
         async getCompanyByUid(uid) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/${encodeURIComponent(uid)}`;
-            const res = await fetch(url, { method: "GET", headers });
-            if (!res.ok) {
-                const body = await safeBody(res);
-                throw new ProvisionError(1, `Vault GET /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
-            }
-            const data = (await res.json());
-            if (!data.entity) {
-                throw new ProvisionError(1, `Vault GET /entity/${uid} returned 200 with no entity body`);
-            }
-            return data.entity;
+            return withVaultRequest(url, { method: "GET", headers }, async (res) => {
+                if (!res.ok) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(1, `Vault GET /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+                }
+                const data = (await res.json());
+                if (!data.entity) {
+                    throw new ProvisionError(1, `Vault GET /entity/${uid} returned 200 with no entity body`);
+                }
+                return data.entity;
+            });
         },
         async createCompanyEntity(input) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity`;
@@ -340,54 +359,56 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
             };
             if (input.ownerUid)
                 body.ownerUid = input.ownerUid;
-            const res = await fetch(url, {
+            return withVaultRequest(url, {
                 method: "POST",
                 headers,
                 body: JSON.stringify(body),
+            }, async (res) => {
+                if (!res.ok) {
+                    const text = await safeBody(res);
+                    // 409 SLUG_IN_USE_FOR_PERSON: the caller already has the slug
+                    // in their namespace (owned ∪ active-member-of). Under the
+                    // per-user-namespace model this is the new same-user-collision
+                    // signal — distinct from the legacy global EntityAlreadyExists.
+                    // The CLI normally reaches `createCompanyEntity` only after
+                    // `checkSlugInMyNamespace` reported `available: true`, so a
+                    // 409 here means a race between the pre-check and the POST.
+                    // Surface the response body verbatim so the caller can see the
+                    // `code` + `conflictingCompanyUid` and resolve / retry.
+                    throw new ProvisionError(1, `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`);
+                }
+                const data = (await res.json());
+                if (!data.entity) {
+                    throw new ProvisionError(1, `Vault POST /entity returned ${res.status} with no entity body`);
+                }
+                return data.entity;
             });
-            if (!res.ok) {
-                const text = await safeBody(res);
-                // 409 SLUG_IN_USE_FOR_PERSON: the caller already has the slug
-                // in their namespace (owned ∪ active-member-of). Under the
-                // per-user-namespace model this is the new same-user-collision
-                // signal — distinct from the legacy global EntityAlreadyExists.
-                // The CLI normally reaches `createCompanyEntity` only after
-                // `checkSlugInMyNamespace` reported `available: true`, so a
-                // 409 here means a race between the pre-check and the POST.
-                // Surface the response body verbatim so the caller can see the
-                // `code` + `conflictingCompanyUid` and resolve / retry.
-                throw new ProvisionError(1, `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`);
-            }
-            const data = (await res.json());
-            if (!data.entity) {
-                throw new ProvisionError(1, `Vault POST /entity returned ${res.status} with no entity body`);
-            }
-            return data.entity;
         },
         async softDeleteCompany(uid) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/${encodeURIComponent(uid)}`;
-            const res = await fetch(url, { method: "DELETE", headers });
-            if (res.status === 403) {
-                const body = await safeBody(res);
-                throw new ProvisionError(2, `Refusing to retire '${uid}': only the company owner can soft-tombstone it. ${body}`);
-            }
-            if (res.status === 404) {
-                const body = await safeBody(res);
-                throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: not found — ${body}`);
-            }
-            if (res.status === 400) {
-                const body = await safeBody(res);
-                throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
-            }
-            if (!res.ok) {
-                const body = await safeBody(res);
-                throw new ProvisionError(1, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
-            }
-            const data = (await res.json());
-            if (data.deleted !== true || typeof data.uid !== "string") {
-                throw new ProvisionError(1, `Vault DELETE /entity/${uid} returned ${res.status} with no deleted confirmation`);
-            }
-            return { deleted: true, uid: data.uid };
+            return withVaultRequest(url, { method: "DELETE", headers }, async (res) => {
+                if (res.status === 403) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(2, `Refusing to retire '${uid}': only the company owner can soft-tombstone it. ${body}`);
+                }
+                if (res.status === 404) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: not found — ${body}`);
+                }
+                if (res.status === 400) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+                }
+                if (!res.ok) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(1, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+                }
+                const data = (await res.json());
+                if (data.deleted !== true || typeof data.uid !== "string") {
+                    throw new ProvisionError(1, `Vault DELETE /entity/${uid} returned ${res.status} with no deleted confirmation`);
+                }
+                return { deleted: true, uid: data.uid };
+            });
         },
     };
 }

package/dist/commands/core-native-handoff-flag.d.ts

@@ -0,0 +1,4 @@
+/** Default-off rollout gate for the native Wave 2 worktree/resume helpers. */
+export declare const CORE_NATIVE_HANDOFF_FLAG = "core-native-handoff";
+export declare function coreNativeHandoffEnabled(): Promise<boolean>;
+//# sourceMappingURL=core-native-handoff-flag.d.ts.map

package/dist/commands/core-native-handoff-flag.js

@@ -0,0 +1,7 @@
+/** Default-off rollout gate for the native Wave 2 worktree/resume helpers. */
+export const CORE_NATIVE_HANDOFF_FLAG = "core-native-handoff";
+export async function coreNativeHandoffEnabled() {
+    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
+    return resolveProcessFlagGate(CORE_NATIVE_HANDOFF_FLAG, { fallback: false }, () => false);
+}
+//# sourceMappingURL=core-native-handoff-flag.js.map

package/dist/commands/core-ontology.d.ts

@@ -9,7 +9,7 @@
  */
 import { Command } from "commander";
 import { type FlagReader } from "../lib/checkpoint-ontology/plan.js";
-import { type DeleteVaultKey } from "../lib/checkpoint-ontology/merge-copies.js";
+import { type DeleteVaultKey, type ListedPair } from "../lib/checkpoint-ontology/merge-copies.js";
 export declare const ONTOLOGY_PAYLOAD_FILE = "payload.json";
 /** The hq-flags read, scoped to the payload company. */
 export declare const registryFlagReader: FlagReader;
@@ -32,8 +32,11 @@ export interface MergeCopiesCommandOptions {
     delete?: boolean;
     variants?: boolean;
     limit?: number;
+    only?: string;
     json?: boolean;
 }
+/** Reads a `--only` file: a JSON array of `{ copy, original }` company-relative paths. */
+export declare function readListedPairs(file: string): ListedPair[];
 /**
  * `hq core ontology merge-copies`: merge `<slug> <n>.md` copies into their
  * original (`--apply`), then delete merged copies from the vault

package/dist/commands/core-ontology.js

@@ -153,8 +153,31 @@ function mergeCopiesSummary(report) {
         lines.push(`  held ${plan.copy}: ${plan.held}`);
     for (const error of report.errors)
         lines.push(`  error ${error.path}: ${error.error}`);
+    for (const entry of report.only_unmatched ?? [])
+        lines.push(`  not found ${entry.copy} -> ${entry.original}`);
     return lines.join("\n");
 }
+/** Reads a `--only` file: a JSON array of `{ copy, original }` company-relative paths. */
+export function readListedPairs(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch (error) {
+        throw new OntologyUsageError(`ontology: --only file ${file} is not readable JSON: ${error.message}`);
+    }
+    if (!Array.isArray(parsed) ||
+        parsed.length === 0 ||
+        !parsed.every((entry) => {
+            if (!entry || typeof entry !== "object")
+                return false;
+            const record = entry;
+            return typeof record.copy === "string" && typeof record.original === "string";
+        })) {
+        throw new OntologyUsageError("ontology: --only must be a non-empty JSON array of { copy, original } paths");
+    }
+    return parsed.map((entry) => ({ copy: entry.copy, original: entry.original }));
+}
 /**
  * `hq core ontology merge-copies`: merge `<slug> <n>.md` copies into their
  * original (`--apply`), then delete merged copies from the vault
@@ -171,6 +194,7 @@ export async function runOntologyMergeCopies(hqRoot, slug, options, deps = {}) {
     if (options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1)) {
         throw new OntologyUsageError("ontology: --limit must be a positive whole number");
     }
+    const only = options.only !== undefined ? readListedPairs(options.only) : undefined;
     const resolution = resolveOntologyCompany(hqRoot, slug);
     if (!resolution.ok)
         throw new OntologyUsageError(`ontology: company rejected: ${resolution.reason}`);
@@ -195,6 +219,7 @@ export async function runOntologyMergeCopies(hqRoot, slug, options, deps = {}) {
         now: deps.now?.() ?? new Date(),
         ...(options.variants ? { pairKind: "variants" } : {}),
         ...(options.limit !== undefined ? { limit: options.limit } : {}),
+        ...(only ? { only } : {}),
         ...(deleteVaultKey ? { deleteVaultKey } : {}),
     });
     return options.json ? JSON.stringify(report, null, 2) : mergeCopiesSummary(report);
@@ -248,6 +273,7 @@ export function registerCoreOntologyCommand(core) {
         .option("--delete", "delete fully merged copies from the vault by exact key (after sync pushed the merge)")
         .option("--variants", "merge two-file duplicate groups whose names differ only in case, spacing or punctuation (checkpoint.ontology.merge-variants)")
         .option("--limit <n>", "handle at most this many copies", (value) => Number(value))
+        .option("--only <file>", "handle only the copy -> original pairs listed in this JSON file")
         .option("--json", "print JSON")
         .option("--hq-root <path>", "HQ installation to operate on")
         .action(async (options) => {

package/dist/commands/core.js

@@ -52,6 +52,8 @@ import { qmdReindexAfterSync } from "../lib/core-utils/qmd-reindex-after-sync.js
 import { softTimeoutCommand } from "../lib/core-utils/soft-timeout.js";
 import { timeoutGuardCommand } from "../lib/core-utils/timeout-guard.js";
 import { readSentryReportStdin, reportSentryEvent } from "../lib/core-utils/sentry-report.js";
+import { CLEAN_HANDOFF_ASSET, RESUME_LOCK_ASSET, VERIFY_DELIVERABLES_ASSET, WORKTREE_GC_ASSET, runCleanWorktreeReconcileHandoff, runResumeThreadLock, runVerifyStoryDeliverables, runWorktreeGc, } from "../lib/core-utils/worktree-resume.js";
+import { coreNativeHandoffEnabled } from "./core-native-handoff-flag.js";
 import { describeCoreCommand, registeredCoreCommandListing, } from "./core-command-catalog.js";
 /**
  * These commands are now native implementations. Their retained shell assets
@@ -216,6 +218,12 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/lib/session-scope-capability.sh", root: "live", summary: "Session scope-capability lib sourced by hq-session" },
     { asset: "core/scripts/lib/session-id.sh", root: "live", summary: "Session-id resolver lib sourced by hq-session" },
     { asset: "core/scripts/lib/work-mesh-enqueue.sh", root: "live", summary: "Work Mesh Live spool enqueue lib sourced by hooks" },
+    // Wave 2 handoff/worktree commands retain their old scripts for one release,
+    // behind the shared default-off rollback flag.
+    { asset: WORKTREE_GC_ASSET, root: "live", summary: "Rollback companion for native worktree-gc" },
+    { asset: CLEAN_HANDOFF_ASSET, root: "cwd", summary: "Rollback companion for native clean-worktree-reconcile-handoff" },
+    { asset: RESUME_LOCK_ASSET, root: "live", summary: "Rollback companion for native resume-thread-lock" },
+    { asset: VERIFY_DELIVERABLES_ASSET, root: "live", summary: "Rollback companion for native verify-story-deliverables" },
     // Wave 1a delegate shells remain bundled as the default-off rollback path.
     // Their roots mirror the original scripts; pickup does not read an HQ root.
     { asset: "core/scripts/hq-delegate-resolve.sh", root: "live", summary: "Rollback shell for native delegate resolve" },
@@ -320,6 +328,43 @@ export function registerCoreCommands(program) {
     registerCoreDelegateCommand(core);
     registerCoreKnowledgePrefsCommand(core);
     registerCorePolicyCommand(core);
+    // Wave 2 handoff/worktree commands retain their byte-identical shell assets
+    // as a default-off rollback path for one release. Keep the gate helper small
+    // so sibling Wave 2 work can reuse it without editing this command table.
+    const handoffCommands = [
+        { name: "worktree-gc", asset: WORKTREE_GC_ASSET, root: "live", summary: "Safely collect old, preserved HQ worktrees", run: (args, root) => runWorktreeGc(args, root) },
+        { name: "clean-worktree-reconcile-handoff", asset: CLEAN_HANDOFF_ASSET, root: "cwd", summary: "Remove only byte-identical incoming handoff mirrors", run: (args) => runCleanWorktreeReconcileHandoff(args) },
+        { name: "resume-thread-lock", asset: RESUME_LOCK_ASSET, root: "live", summary: "Inspect or acquire a durable resumework lock", run: (args, root) => runResumeThreadLock(args, root) },
+        { name: "verify-story-deliverables", asset: VERIFY_DELIVERABLES_ASSET, root: "live", summary: "Check declared and returned story deliverables", run: (args, root) => runVerifyStoryDeliverables(args, root) },
+    ];
+    for (const entry of handoffCommands) {
+        const command = core
+            .command(entry.name)
+            .description(entry.summary)
+            .allowUnknownOption()
+            .allowExcessArguments()
+            .helpOption(false)
+            .argument("[args...]")
+            .action(async (args = [], _options, cmd) => {
+            const scope = core.opts();
+            const operands = cmd.args.length > 0 ? cmd.args : args;
+            if (!await coreNativeHandoffEnabled()) {
+                if (entry.root === "live")
+                    runEntry(entry, scope, operands);
+                else {
+                    const result = runBundledScript({ asset: entry.asset, args: operands, cwd: process.cwd() });
+                    if (result.code !== 0)
+                        process.exit(result.code);
+                }
+                return;
+            }
+            const { cwd, hqRoot } = resolveEntryRoot(entry, scope);
+            const code = await entry.run(operands, hqRoot ?? cwd);
+            if (code !== 0)
+                process.exit(code);
+        });
+        describeCoreCommand(command, { execution: "native", asset: entry.asset, root: entry.root });
+    }
     // These command names intentionally own native implementations. Their
     // similarly named scaffold assets are forwarders, so sending them through
     // runEntry would recurse back into this command forever.

package/dist/commands/lanes-resume.js

@@ -153,10 +153,27 @@ export function createLaneResumeHandlers(deps) {
         if (opts.account !== undefined && !providerSessionPortable(lane.provider)) {
             throw new LanesError("provider_session_not_portable", sessionNotPortableMessage(lane.provider), { lane_id: laneId, provider: lane.provider });
         }
-        if (lane.state === "queued") {
+        if (lane.state === "queued" &&
+            (lane.queued_reason !== "worker_profile_changed" || opts.worker === undefined)) {
             throw new LanesError("lane_not_resumable", `Lane ${laneId} is queued; use hq lanes admit ${laneId} to request admission`, { lane_id: laneId, state: lane.state, admission_command: `hq lanes admit ${laneId}` });
         }
-        const refusal = resumeCommandRefusal(lane, { allowFailed: opts.fromFailed === true });
+        const queuedProfileRecovery = lane.state === "queued" &&
+            lane.queued_reason === "worker_profile_changed" &&
+            opts.worker !== undefined;
+        if (queuedProfileRecovery && (opts.text !== undefined ||
+            opts.project !== undefined ||
+            opts.story !== undefined ||
+            opts.account !== undefined ||
+            opts.model !== undefined ||
+            opts.effort !== undefined ||
+            opts.keepAlive !== undefined ||
+            opts.meshCompany !== undefined ||
+            opts.compact === false)) {
+            throw new LanesError("worker_profile_recovery_options_invalid", "Queued worker-profile recovery accepts only --worker; rerun hq lanes resume after reconcile admits the lane", { lane_id: laneId });
+        }
+        const refusal = queuedProfileRecovery
+            ? null
+            : resumeCommandRefusal(lane, { allowFailed: opts.fromFailed === true });
         if (refusal !== null) {
             throw new LanesError(refusal.error, refusal.message, {
                 lane_id: laneId,
@@ -206,6 +223,28 @@ export function createLaneResumeHandlers(deps) {
         if (resumeProfile !== undefined && (opts.account === undefined || keepCurrentAccount)) {
             validateResumeProfileModel(ctx, lane, resumeProfile.profile);
         }
+        if (lane.state === "queued" && lane.queued_reason === "worker_profile_changed") {
+            if (resumeProfile === undefined) {
+                throw new LanesError("worker_profile_required", `Lane ${laneId} needs --worker ${lane.worker_profile ?? "<profile>"} to recover its queued profile`, { lane_id: laneId, worker: lane.worker_profile ?? null });
+            }
+            const recovered = recordResumeSetup(ctx, lane, {
+                profile: resumeProfile,
+                ...(profileRepin !== undefined ? { profileRepin } : {}),
+                clearWorkerProfileChangedQueue: true,
+            });
+            printJson({
+                ok: true,
+                action: "resume",
+                lane_id: laneId,
+                delivery: "profile_repin",
+                delivery_status: "queued_for_reconcile",
+                profile_repin: profileRepin !== undefined
+                    ? recovered.worker_profile_repin_history?.at(-1) ?? null
+                    : null,
+                lane: recovered,
+            });
+            return;
+        }
         const automaticAccountSelection = opts.account === undefined
             ? await selectAutomaticClaudeResumeAccount(ctx, lane, resumeProfile, { repairUnavailableAccount: true })
             : undefined;

package/dist/commands/lanes-shared.d.ts

@@ -113,6 +113,8 @@ export interface RecordResumeSetupInput {
     meshCompany?: LaneCompanyRef;
     threadId?: string;
     profileRepin?: ResumeProfileRepinAuthorization;
+    /** Clear only the recoverable worker_profile_changed queue after its profile is revalidated. */
+    clearWorkerProfileChangedQueue?: boolean;
 }
 export declare function accountRequestKeepsCurrentLane(lane: LaneRecord, rawAccount: string): boolean;
 export declare function assertCurrentResumeAccountAvailable(ctx: Ctx, lane: LaneRecord): void;

package/dist/commands/lanes.js

@@ -29,6 +29,7 @@ import { registerLaneReviewCommand } from "./lanes-review.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { withCliFeatureUsed } from "../utils/cli-telemetry.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
+import { startOutpostLaneSnapshotRefresh } from "../lib/lanes/outpost-snapshot-refresh.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
 import { getOrFetchOutpostSnapshot, OUTPOST_SNAPSHOT_CACHE_TTL_MS, outpostLaneListSnapshotKey, OutpostSnapshotInvocationMemo, } from "../lib/lanes/outpost-snapshot-cache.js";
@@ -1025,34 +1026,6 @@ async function readOutpostSnapshotWithCache(ctx, key, isValue, fetch) {
         return fetch();
     return getOrFetchOutpostSnapshot({ hqRoot: ctx.hqRoot(), key, isValue, fetch });
 }
-function startOutpostLaneSnapshotRefresh(root, env) {
-    let entry;
-    try {
-        const currentEntry = process.argv[1];
-        if (!currentEntry)
-            throw new Error("process.argv[1] is empty");
-        entry = fs.realpathSync(currentEntry);
-    }
-    catch (err) {
-        process.stderr.write(`lanes snapshot refresh could not resolve the running CLI entry: ${dispatchErrorMessage(err)}\n`);
-        return;
-    }
-    try {
-        const child = spawn(process.execPath, [...process.execArgv, entry, "lanes", "list"], {
-            cwd: root,
-            detached: true,
-            stdio: ["ignore", "ignore", "inherit"],
-            env: { ...env, HQ_ROOT: root, HQ_NO_UPDATE_CHECK: "1", HQ_INTERNAL_LANES_REFRESH_REMOTE_SNAPSHOT: "1" },
-        });
-        child.once("error", (err) => {
-            process.stderr.write(`lanes snapshot refresh could not start: ${dispatchErrorMessage(err)}\n`);
-        });
-        child.unref();
-    }
-    catch (err) {
-        process.stderr.write(`lanes snapshot refresh could not start: ${dispatchErrorMessage(err)}\n`);
-    }
-}
 function isLaneRecordArray(value) {
     if (!Array.isArray(value))
         return false;
@@ -3819,6 +3792,29 @@ function authorizeResumeProfileRepin(ctx, lane, profile, encodedContext) {
                 : workerProfileHashMismatch(lane, profile);
         }
     }
+    if (lane.state === "queued" && lane.queued_reason === "worker_profile_changed" && profile !== undefined) {
+        // The hash is for the executing Outpost's profile copy, not the primary
+        // host's copy. Only the lane senior (or its authorized owner dispatch) may
+        // clear this hold after resolving that local copy.
+        if (lane.host.kind !== "outpost" || lane.worker_profile !== profile.id) {
+            throw new LanesError("worker_profile_hash_mismatch", `Queued profile recovery for lane ${lane.lane_id} must use its original Outpost worker profile`, {
+                lane_id: lane.lane_id,
+                worker: profile.id,
+                lane_worker: lane.worker_profile ?? null,
+                outpost: lane.host.kind === "outpost" ? lane.host.id : null,
+            });
+        }
+        if (ssmOwnerDispatch) {
+            if (context === undefined)
+                throw workerProfileHashMismatch(lane, profile);
+        }
+        else {
+            const callerAuthorization = callerSeniorAuthorization(ctx, lane.senior);
+            if (!callerAuthorization.authorized) {
+                throw workerProfileHashMismatch(lane, profile, callerAuthorization);
+            }
+        }
+    }
     if (profile === undefined ||
         (lane.host.kind !== "outpost" && !(ssmOwnerDispatch && laneGrantTargetHostedHere(ctx, lane))) ||
         lane.worker_profile_hash === profile.profile.contentHash) {
@@ -4086,7 +4082,13 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
                                 remote.lane !== null &&
                                 typeof remote.lane === "object" &&
                                 !Array.isArray(remote.lane) &&
-                                remote.lane.state === "queued")));
+                                remote.lane.state === "queued") ||
+                            (remote.delivery_status === "queued_for_reconcile" &&
+                                remote.lane !== null &&
+                                typeof remote.lane === "object" &&
+                                !Array.isArray(remote.lane) &&
+                                remote.lane.state === "queued" &&
+                                remote.lane.queued_reason !== "worker_profile_changed")));
     if (!resultConfirmed) {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} completed exec without a confirmed ${action} result for lane ${lane.lane_id}`, {
             lane_id: lane.lane_id,
@@ -5880,6 +5882,7 @@ function recordResumeSetup(ctx, lane, input) {
         input.keepAlive === undefined &&
         input.cliModel === undefined &&
         input.meshCompany === undefined &&
+        input.clearWorkerProfileChangedQueue !== true &&
         lane.keep_alive_blocked_reason !== "terminal_state")
         return lane;
     return casUpdateLane(ctx.hqRoot(), lane.lane_id, (current) => {
@@ -5889,12 +5892,28 @@ function recordResumeSetup(ctx, lane, input) {
         if (input.profileRepin !== undefined) {
             assertResumeProfileRepinStillAuthorized(ctx, current, input.profileRepin);
         }
+        if (input.clearWorkerProfileChangedQueue === true && (current.state !== "queued" ||
+            current.queued_reason !== "worker_profile_changed" ||
+            input.profile === undefined ||
+            current.worker_profile !== input.profile.id ||
+            (current.worker_profile_hash !== input.profile.profile.contentHash && input.profileRepin === undefined))) {
+            throw new LanesError("lane_resume_setup_conflict", `Lane ${lane.lane_id} is no longer eligible for worker-profile recovery; run the recovery command again`, {
+                lane_id: lane.lane_id,
+                state: current.state,
+                queued_reason: current.queued_reason ?? null,
+            });
+        }
         const next = { ...current };
         // An operator resume takes the lane out of the terminal state reconcile
         // recorded, so keep-alive may continue it again after this turn.
         if (next.keep_alive_blocked_reason === "terminal_state")
             next.keep_alive_blocked_reason = undefined;
         applyResumeProfileAndEffort(current, next, { ...input, at: ctx.now().toISOString() });
+        if (input.clearWorkerProfileChangedQueue === true) {
+            next.queued_reason = undefined;
+            next.queued_details = undefined;
+            next.admission_reserved_at = undefined;
+        }
         if (input.cliModel !== undefined) {
             next.model = input.cliModel.trim();
             next.model_source = "cli";