@indigoai-us/hq-cli 5.291.0 → 5.293.0

package/dist/commands/core-ontology.d.ts

@@ -9,7 +9,8 @@
  */
 import { Command } from "commander";
 import { type FlagReader } from "../lib/checkpoint-ontology/plan.js";
-import { type DeleteVaultKey, type ListedPair } from "../lib/checkpoint-ontology/merge-copies.js";
+import { type AliasDrop } from "../lib/checkpoint-ontology/drop-aliases.js";
+import { type DeleteVaultKey, type ListedPair, type MergeCopiesReport } from "../lib/checkpoint-ontology/merge-copies.js";
 export declare const ONTOLOGY_PAYLOAD_FILE = "payload.json";
 /** The hq-flags read, scoped to the payload company. */
 export declare const registryFlagReader: FlagReader;
@@ -31,12 +32,15 @@ export interface MergeCopiesCommandOptions {
     apply?: boolean;
     delete?: boolean;
     variants?: boolean;
+    /** Merge exactly the `--only` pairs, whatever their names (flag merge-listed-pairs). */
+    listed?: boolean;
     limit?: number;
     only?: string;
     /** Also re-point refs and links held today (flag merge-rewrite-refs). */
     rewriteRefs?: boolean;
     json?: boolean;
 }
+export declare function mergeCopiesSummary(report: MergeCopiesReport): string;
 /** Reads a `--only` file: a JSON array of `{ copy, original }` company-relative paths. */
 export declare function readListedPairs(file: string): ListedPair[];
 /**
@@ -47,10 +51,24 @@ export declare function readListedPairs(file: string): ListedPair[];
  * With `--variants`, merges two-file duplicate groups whose names differ only
  * in case, spacing or punctuation instead, gated by
  * `checkpoint.ontology.merge-variants`. `--rewrite-refs` (flag
- * `checkpoint.ontology.merge-rewrite-refs`) also re-points signal refs,
- * invoice and bill links, source and knowledge links, and carries external
- * ids and web domains.
+ * `checkpoint.ontology.merge-rewrite-refs`) also re-points invoice and
+ * knowledge links to the survivor and carries external ids and web domains;
+ * pairs named by signals or sources stay held. `--listed` (flag
+ * `checkpoint.ontology.merge-listed-pairs`) merges exactly the `--only` pairs,
+ * which a person reviewed, instead of the pairs a finder produces.
  */
 export declare function runOntologyMergeCopies(hqRoot: string, slug: string | undefined, options: MergeCopiesCommandOptions, deps?: OntologyCommandDeps): Promise<string>;
+/** Reads a `drop-aliases --only` file: a JSON array of `{ entity, alias }`. */
+export declare function readAliasDrops(file: string): AliasDrop[];
+/**
+ * `hq core ontology drop-aliases`: remove the reviewed `{ entity, alias }`
+ * pairs in `--only` from entity files (`--apply`); without it only reports.
+ * Gated by `checkpoint.ontology.drop-aliases` and `checkpoint.ontology.multi-writer`.
+ */
+export declare function runOntologyDropAliases(hqRoot: string, slug: string | undefined, options: {
+    only?: string;
+    apply?: boolean;
+    json?: boolean;
+}, deps?: OntologyCommandDeps): Promise<string>;
 export declare function registerCoreOntologyCommand(core: Command): void;
 //# sourceMappingURL=core-ontology.d.ts.map

package/dist/commands/core-ontology.js

@@ -17,7 +17,8 @@ import { applyOntologyRun, ApplyError } from "../lib/checkpoint-ontology/apply.j
 import { resolveOntologyCompany, WriteBoundsError } from "../lib/checkpoint-ontology/company.js";
 import { findDuplicateGroups, summarizeMergeBack, } from "../lib/checkpoint-ontology/multi-writer.js";
 import { buildEntityIndex } from "../lib/checkpoint-ontology/tree.js";
-import { MERGE_COPIES_FLAG, MERGE_REWRITE_REFS_FLAG, MERGE_VARIANTS_FLAG, mergeCopies, } from "../lib/checkpoint-ontology/merge-copies.js";
+import { DROP_ALIASES_FLAG, dropAliases } from "../lib/checkpoint-ontology/drop-aliases.js";
+import { MERGE_COPIES_FLAG, MERGE_LISTED_PAIRS_FLAG, MERGE_REWRITE_REFS_FLAG, MERGE_VARIANTS_FLAG, mergeCopies, } from "../lib/checkpoint-ontology/merge-copies.js";
 import { callDeleteEndpoint } from "./files.js";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
 import { registerCoreOntologyNativeCommands } from "./core-ontology-native.js";
@@ -142,7 +143,7 @@ async function companyVaultDeleter(companyUid) {
         return (await callDeleteEndpoint({ token, companyUid, prefix: key, dryRun: false })).deleted;
     };
 }
-function mergeCopiesSummary(report) {
+export function mergeCopiesSummary(report) {
     const held = report.plans.filter((plan) => plan.held).length;
     const lines = [
         `ontology merge-copies (${report.mode.replace("_", " ")}) in ${report.company} (${report.pair_kind}): ${report.plans.length} of ${report.copies_found} copies, ${held} held, ${report.skipped.length} skipped`,
@@ -150,7 +151,7 @@ function mergeCopiesSummary(report) {
         `  duplicate groups ${report.duplicate_groups_before} -> ${report.duplicate_groups_after}; broken entity links ${report.broken_links_before} -> ${report.broken_links_after}`,
     ];
     for (const plan of report.plans.filter((entry) => entry.held)) {
-        lines.push(`  held ${plan.copy}: ${plan.held}${plan.held === "external_id_conflict" ? ` (${plan.detail})` : ""}`);
+        lines.push(`  held ${plan.copy}: ${plan.held}${plan.held === "external_id_conflict" || plan.held === "server_owned_refs" ? ` (${plan.detail})` : ""}`);
     }
     for (const error of report.errors)
         lines.push(`  error ${error.path}: ${error.error}`);
@@ -216,9 +217,11 @@ function readResolution(copy, raw) {
  * With `--variants`, merges two-file duplicate groups whose names differ only
  * in case, spacing or punctuation instead, gated by
  * `checkpoint.ontology.merge-variants`. `--rewrite-refs` (flag
- * `checkpoint.ontology.merge-rewrite-refs`) also re-points signal refs,
- * invoice and bill links, source and knowledge links, and carries external
- * ids and web domains.
+ * `checkpoint.ontology.merge-rewrite-refs`) also re-points invoice and
+ * knowledge links to the survivor and carries external ids and web domains;
+ * pairs named by signals or sources stay held. `--listed` (flag
+ * `checkpoint.ontology.merge-listed-pairs`) merges exactly the `--only` pairs,
+ * which a person reviewed, instead of the pairs a finder produces.
  */
 export async function runOntologyMergeCopies(hqRoot, slug, options, deps = {}) {
     if (options.apply && options.delete) {
@@ -227,13 +230,20 @@ export async function runOntologyMergeCopies(hqRoot, slug, options, deps = {}) {
     if (options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1)) {
         throw new OntologyUsageError("ontology: --limit must be a positive whole number");
     }
+    if (options.listed && options.variants) {
+        throw new OntologyUsageError("ontology: use either --listed or --variants");
+    }
+    if (options.listed && options.only === undefined) {
+        throw new OntologyUsageError("ontology: --listed needs --only <file>");
+    }
     const only = options.only !== undefined ? readListedPairs(options.only) : undefined;
     const resolution = resolveOntologyCompany(hqRoot, slug);
     if (!resolution.ok)
         throw new OntologyUsageError(`ontology: company rejected: ${resolution.reason}`);
     const company = resolution.company;
     const readFlag = deps.readFlag ?? registryFlagReader;
-    for (const flag of [options.variants ? MERGE_VARIANTS_FLAG : MERGE_COPIES_FLAG, MULTI_WRITER_FLAG, ...(options.rewriteRefs ? [MERGE_REWRITE_REFS_FLAG] : [])]) {
+    const kindFlag = options.listed ? MERGE_LISTED_PAIRS_FLAG : options.variants ? MERGE_VARIANTS_FLAG : MERGE_COPIES_FLAG;
+    for (const flag of [kindFlag, MULTI_WRITER_FLAG, ...(options.rewriteRefs ? [MERGE_REWRITE_REFS_FLAG] : [])]) {
         if (!(await readFlag(flag, company))) {
             return options.json ? JSON.stringify({ company: company.slug, skipped: `${flag} off` }) : `ontology merge-copies: skipped (${flag} is off)`;
         }
@@ -251,6 +261,7 @@ export async function runOntologyMergeCopies(hqRoot, slug, options, deps = {}) {
         mode,
         now: deps.now?.() ?? new Date(),
         ...(options.variants ? { pairKind: "variants" } : {}),
+        ...(options.listed ? { pairKind: "listed" } : {}),
         ...(options.limit !== undefined ? { limit: options.limit } : {}),
         ...(only ? { only } : {}),
         ...(options.rewriteRefs ? { rewriteRefs: true } : {}),
@@ -258,6 +269,59 @@ export async function runOntologyMergeCopies(hqRoot, slug, options, deps = {}) {
     });
     return options.json ? JSON.stringify(report, null, 2) : mergeCopiesSummary(report);
 }
+/** Reads a `drop-aliases --only` file: a JSON array of `{ entity, alias }`. */
+export function readAliasDrops(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch (error) {
+        throw new OntologyUsageError(`ontology: --only file ${file} is not readable JSON: ${error.message}`);
+    }
+    const usage = "ontology: --only must be a non-empty JSON array of { entity, alias } strings";
+    if (!Array.isArray(parsed) || parsed.length === 0)
+        throw new OntologyUsageError(usage);
+    return parsed.map((item) => {
+        const record = item;
+        if (!record || typeof record.entity !== "string" || typeof record.alias !== "string" || record.alias === "") {
+            throw new OntologyUsageError(usage);
+        }
+        return { entity: record.entity, alias: record.alias };
+    });
+}
+/**
+ * `hq core ontology drop-aliases`: remove the reviewed `{ entity, alias }`
+ * pairs in `--only` from entity files (`--apply`); without it only reports.
+ * Gated by `checkpoint.ontology.drop-aliases` and `checkpoint.ontology.multi-writer`.
+ */
+export async function runOntologyDropAliases(hqRoot, slug, options, deps = {}) {
+    if (options.only === undefined)
+        throw new OntologyUsageError("ontology: drop-aliases needs --only <file>");
+    const drops = readAliasDrops(options.only);
+    const resolution = resolveOntologyCompany(hqRoot, slug);
+    if (!resolution.ok)
+        throw new OntologyUsageError(`ontology: company rejected: ${resolution.reason}`);
+    const company = resolution.company;
+    const readFlag = deps.readFlag ?? registryFlagReader;
+    for (const flag of [DROP_ALIASES_FLAG, MULTI_WRITER_FLAG]) {
+        if (!(await readFlag(flag, company))) {
+            return options.json ? JSON.stringify({ company: company.slug, skipped: `${flag} off` }) : `ontology drop-aliases: skipped (${flag} is off)`;
+        }
+    }
+    const report = dropAliases({ hqRoot, company, mode: options.apply ? "apply" : "dry_run", drops, now: deps.now?.() ?? new Date() });
+    if (options.json)
+        return JSON.stringify(report, null, 2);
+    const planned = Object.values(report.planned).reduce((sum, list) => sum + list.length, 0);
+    const lines = [
+        `ontology drop-aliases (${report.mode.replace("_", " ")}) in ${report.company}: ${planned} alias(es) on ${Object.keys(report.planned).length} entities, written ${report.written.length}, skipped ${report.skipped.length}, errors ${report.errors.length}`,
+        `  duplicate groups ${report.duplicate_groups_before} -> ${report.duplicate_groups_after}`,
+    ];
+    for (const skip of report.skipped)
+        lines.push(`  skipped ${skip.entity} "${skip.alias}": ${skip.reason}${skip.detail ? ` (${skip.detail})` : ""}`);
+    for (const error of report.errors)
+        lines.push(`  error ${error.path}: ${error.error}`);
+    return lines.join("\n");
+}
 function fail(error) {
     if (error instanceof OntologyUsageError || error instanceof ApplyError || error instanceof WriteBoundsError) {
         process.stderr.write(`${error.message}\n`);
@@ -306,9 +370,10 @@ export function registerCoreOntologyCommand(core) {
         .option("--apply", "merge each copy into its original and re-point links (writes entity files)")
         .option("--delete", "delete fully merged copies from the vault by exact key (after sync pushed the merge)")
         .option("--variants", "merge two-file duplicate groups whose names differ only in case, spacing or punctuation (checkpoint.ontology.merge-variants)")
+        .option("--listed", "merge exactly the pairs in the --only file, whatever their names (checkpoint.ontology.merge-listed-pairs)")
         .option("--limit <n>", "handle at most this many copies", (value) => Number(value))
         .option("--only <file>", "handle only the copy -> original pairs listed in this JSON file")
-        .option("--rewrite-refs", "also re-point signal refs, invoice, source and knowledge links to the survivor and carry external ids and web domains (checkpoint.ontology.merge-rewrite-refs)")
+        .option("--rewrite-refs", "also re-point invoice and knowledge links to the survivor and carry external ids and web domains; pairs named by signals or sources stay held (checkpoint.ontology.merge-rewrite-refs)")
         .option("--json", "print JSON")
         .option("--hq-root <path>", "HQ installation to operate on")
         .action(async (options) => {
@@ -320,6 +385,23 @@ export function registerCoreOntologyCommand(core) {
         }
     });
     describeCoreCommand(mergeCopies, { execution: "native", root: "live" });
+    const dropAliasesCommand = ontology
+        .command("drop-aliases")
+        .description("Remove reviewed wrong aliases from entity files (dry run by default)")
+        .requiredOption("--company <slug>", "company to change")
+        .option("--only <file>", "JSON array of { entity, alias } to remove; entity is a company-relative path")
+        .option("--apply", "write the entity files")
+        .option("--json", "print JSON")
+        .option("--hq-root <path>", "HQ installation to operate on")
+        .action(async (options) => {
+        try {
+            process.stdout.write(`${await runOntologyDropAliases(rootFor(options), options.company, options)}\n`);
+        }
+        catch (error) {
+            fail(error);
+        }
+    });
+    describeCoreCommand(dropAliasesCommand, { execution: "native", root: "live" });
     const apply = ontology
         .command("apply")
         .description("Validate the run's entity candidates and write them to the payload company")

package/dist/commands/core.js

@@ -214,6 +214,11 @@ export const SCAFFOLD_COMMANDS = [
 export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/jobs-schedule-parse.sh", root: "live", summary: "Rollback companion for native jobs schedule-parse" },
     { asset: "core/scripts/jobs-validate.sh", root: "live", summary: "Rollback companion for native jobs validate" },
+    { asset: "core/scripts/outpost-jobs-reconcile.sh", root: "live", summary: "Rollback companion for native jobs reconcile" },
+    { asset: "core/scripts/hq-job-probe.sh", root: "live", summary: "Scheduled jobs readiness probe used by the reconcile rollback path" },
+    { asset: "core/scripts/hq-job-run.sh", root: "live", summary: "Scheduled jobs runner used by generated systemd units" },
+    { asset: "core/scripts/hq-job-notify.sh", root: "live", summary: "Scheduled jobs failure notification helper" },
+    { asset: "core/scripts/hq-job-remediate.sh", root: "live", summary: "Scheduled jobs bounded remediation helper" },
     // Shared shell libs sourced by the two relocated scripts (and hooks). Never
     // dispatched on their own (so no `hq core` command), but they MUST ship in the
     // tarball, or the bundled hq-session / checkpoint-stop-gate die at `source`
@@ -235,6 +240,11 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/hq-delegate-repo.sh", root: "live", summary: "Rollback shell for native delegate repo" },
     { asset: "core/scripts/hq-delegate-secrets.sh", root: "live", summary: "Rollback shell for native delegate secrets" },
     { asset: "core/scripts/hq-delegate-transfer.sh", root: "live", summary: "Rollback shell for native delegate transfer" },
+    { asset: "core/scripts/hq-delegate-bundle.sh", root: "live", summary: "Rollback shell for native delegate bundle" },
+    { asset: "core/scripts/hq-delegate-grant.sh", root: "live", summary: "Rollback shell for native delegate grant" },
+    { asset: "core/scripts/hq-delegate-publish.sh", root: "live", summary: "Rollback shell for native delegate publish" },
+    { asset: "core/scripts/hq-delegate-send.sh", root: "live", summary: "Rollback shell for native delegate send" },
+    { asset: "core/scripts/hq-delegate-verify.sh", root: "live", summary: "Rollback shell for native delegate verify" },
     { asset: "core/scripts/lib/secret-patterns.sh", root: "live", summary: "Secret-pattern library sourced by the delegate rollback shells" },
     // Retained rollback companions for the gated native ontology commands. These
     // are loose HQ-tree assets, but `hq core ontology` dispatches natively.

package/dist/commands/lanes-move.js

@@ -19,6 +19,38 @@ export function createLaneMoveHandlers(deps) {
             lane.last_host_report_at === undefined &&
             lane.pending_resume === undefined;
     }
+    function sameHost(a, b) {
+        return a.kind === b.kind && a.id === b.id;
+    }
+    function reportAlreadyOnTarget(lane) {
+        printJson({
+            ok: true,
+            action: "move",
+            lane_id: lane.lane_id,
+            state: lane.state,
+            host: lane.host,
+            account: lane.account ?? null,
+            moved: false,
+            reason: "already_on_target",
+            lane,
+        });
+    }
+    async function reportAlreadyOnTargetIfCurrent(hqRoot, laneId, provider, target, callerHost, runtimeHost, ctx) {
+        const current = await withLaneAdmissionLock(hqRoot, provider, async () => {
+            const lane = readLane(hqRoot, laneId);
+            if (!laneCanMoveBeforeStart(lane)) {
+                throw new LanesError(lane.state === "queued" ? "lane_move_started" : "lane_not_queued", `Lane ${laneId} cannot move after it has started; current state is ${lane.state}`, { lane_id: laneId, state: lane.state });
+            }
+            return sameHost(lane.host, target) ||
+                (laneRunsHere(lane, runtimeHost) && sameHost(callerHost, target))
+                ? lane
+                : undefined;
+        }, ctx.sleep);
+        if (current === undefined)
+            return false;
+        reportAlreadyOnTarget(current);
+        return true;
+    }
     function readLaneTimeout(hqRoot, laneId) {
         const raw = readJsonFile(timeoutPath(hqRoot, laneId));
         if (raw === null)
@@ -51,6 +83,22 @@ export function createLaneMoveHandlers(deps) {
             throw new LanesError(source.state === "queued" ? "lane_move_started" : "lane_not_queued", `Lane ${laneId} cannot move after it has started; current state is ${source.state}`, { lane_id: laneId, state: source.state });
         }
         const sourceHost = source.host;
+        const runtimeHost = reconcileHostFromCtx(ctx);
+        const runningHere = laneRunsHere(source, runtimeHost);
+        const callerHost = runtimeHost.outpostId
+            ? { kind: "outpost", id: runtimeHost.outpostId }
+            : { kind: "local", id: runtimeHost.hostname };
+        const explicitTarget = policy.kind === "local"
+            ? callerHost
+            : policy.kind === "outpost"
+                ? { kind: "outpost", id: policy.id }
+                : undefined;
+        if (explicitTarget !== undefined &&
+            (sameHost(sourceHost, explicitTarget) ||
+                (runningHere && sameHost(callerHost, explicitTarget)))) {
+            if (await reportAlreadyOnTargetIfCurrent(hqRoot, laneId, source.provider, explicitTarget, callerHost, runtimeHost, ctx))
+                return;
+        }
         const config = loadLanesConfig(hqRoot);
         const capacity = await loadHostCapacitySnapshots(ctx, hqRoot, config);
         let targetSnapshots = capacity.snapshots.filter((snapshot) => snapshot.host.kind !== sourceHost.kind || snapshot.host.id !== sourceHost.id);
@@ -69,8 +117,13 @@ export function createLaneMoveHandlers(deps) {
             ...(source.account !== undefined ? { account: source.account } : {}),
             ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
         });
+        if (sameHost(sourceHost, choice.host) ||
+            (runningHere && sameHost(callerHost, choice.host))) {
+            if (await reportAlreadyOnTargetIfCurrent(hqRoot, laneId, source.provider, choice.host, callerHost, runtimeHost, ctx))
+                return;
+        }
         let moved;
-        if (laneRunsHere(source, reconcileHostFromCtx(ctx))) {
+        if (runningHere) {
             moved = await commitLaneMove(ctx, laneId, choice.host, choice.account, placementEnabled);
         }
         else if (source.host.kind === "outpost") {

package/dist/commands/lanes-questions.js

@@ -475,6 +475,8 @@ export function createLaneQuestionsHandlers(deps) {
                 .map((q) => {
                 const row = {
                     ...q,
+                    priority: q.priority ?? null,
+                    priority_display: q.priority ?? "-",
                     audience: resolveAudience(hqRoot, q, ctx),
                     ...(q.question_kind === "continue" ? { flag: "continue-loop" } : {}),
                 };
@@ -503,6 +505,8 @@ export function createLaneQuestionsHandlers(deps) {
             })
                 .map(({ question: q, host, audience }) => ({
                 ...q,
+                priority: q.priority ?? null,
+                priority_display: q.priority ?? "-",
                 host,
                 audience,
                 ...(q.question_kind === "continue" ? { flag: "continue-loop" } : {}),

package/dist/commands/lanes.d.ts

@@ -114,6 +114,8 @@ export declare function parseQuestionBody(raw: unknown): QuestionBody | null;
  */
 export declare const ASK_BACKOFF_MS: readonly [5000, 15000];
 export declare const ASK_ATTEMPTS: number;
+/** Flip to true in the next release to make --priority mandatory. */
+export declare const ASK_PRIORITY_REQUIRED = false;
 export declare function casUpdateQuestion(hqRoot: string, questionId: string, updater: (current: QuestionRecord) => QuestionRecord): QuestionRecord;
 export declare function casUpdateLane(hqRoot: string, laneId: string, updater: (current: LaneRecord) => LaneRecord): LaneRecord;
 /**

package/dist/commands/lanes.js

@@ -490,6 +490,67 @@ function mergeOwnerLaneHierarchy(supplied, ownerLanes) {
         byId.set(lane.lane_id, lane);
     return [...byId.values()];
 }
+function hierarchyWithRemoteSenior(hierarchy, remoteSenior) {
+    return [
+        ...hierarchy.filter((lane) => lane.lane_id !== remoteSenior.lane_id),
+        remoteSenior,
+    ];
+}
+async function readRemoteHireGrantSenior(ctx, hqRoot, seniorLaneId) {
+    if (!listLaneIds(hqRoot).includes(seniorLaneId))
+        return undefined;
+    const mirror = readLane(hqRoot, seniorLaneId);
+    if (mirror.host.kind !== "outpost" ||
+        laneRunsHere(mirror, reconcileHostFromCtx(ctx))) {
+        return undefined;
+    }
+    const outpostId = mirror.host.id;
+    const unavailable = (reason) => new LanesError("hire_grant_senior_unavailable", `Cannot verify senior lane ${seniorLaneId} from owning Outpost ${outpostId}; refusing hire-grant admission (${reason})`, { senior_lane_id: seniorLaneId, outpost_id: outpostId, reason });
+    let ownerRecords;
+    try {
+        ownerRecords = await readOutpostLaneRecords(ctx, outpostId, {
+            laneIds: [seniorLaneId],
+            snapshot: true,
+            strictSnapshot: true,
+        }, {}, { bypassCache: true });
+    }
+    catch (error) {
+        throw unavailable(isLanesError(error) ? error.error : "outpost_lane_list_unavailable");
+    }
+    const matches = ownerRecords.filter((lane) => lane.lane_id === seniorLaneId);
+    const owner = matches[0];
+    const ownerIsHostedByOutpost = owner !== undefined && ((owner.host.kind === "outpost" && owner.host.id === outpostId) ||
+        (owner.host.kind === "local" && owner.host.id.trim() !== ""));
+    if (matches.length !== 1 || owner === undefined || !ownerIsHostedByOutpost) {
+        throw unavailable(matches.length === 0
+            ? "owner_did_not_return_senior"
+            : matches.length > 1
+                ? "owner_returned_duplicate_seniors"
+                : "owner_senior_identity_mismatch");
+    }
+    try {
+        const mirrorCompany = resolveLaneCompany(hqRoot, mirror).company;
+        const ownerCompany = resolveLaneCompany(hqRoot, owner).company;
+        if ((ownerCompany?.uid ?? null) !== (mirrorCompany?.uid ?? null) ||
+            (ownerCompany?.slug ?? null) !== (mirrorCompany?.slug ?? null)) {
+            throw unavailable("owner_company_did_not_match_mirror");
+        }
+    }
+    catch (error) {
+        if (isLanesError(error) && error.error === "hire_grant_senior_unavailable")
+            throw error;
+        throw unavailable("owner_company_identity_unavailable");
+    }
+    return owner;
+}
+async function hierarchyWithVerifiedRemoteSenior(ctx, hqRoot, lane, hierarchy) {
+    if (lane.senior.kind !== "lane" || !lane.senior.id)
+        return [...hierarchy];
+    const remoteSenior = await readRemoteHireGrantSenior(ctx, hqRoot, lane.senior.id);
+    return remoteSenior === undefined
+        ? [...hierarchy]
+        : mergeOwnerLaneRecords(hierarchy, [remoteSenior]);
+}
 function mergeOwnerLaneRecords(supplied, ownerLanes) {
     const byId = new Map(supplied.map((lane) => [lane.lane_id, lane]));
     for (const lane of ownerLanes)
@@ -911,8 +972,18 @@ async function withResumeHireAdmission(ctx, lane, fn, grantContext) {
         throw new LanesError("hire_grant_context_required", `Resume of Outpost lane ${lane.lane_id} requires the primary senior's hire-grant context`, { lane_id: lane.lane_id, senior_lane_id: lane.senior.id });
     }
     await refreshRemoteLaneMirrors(ctx, hqRoot, loadAllLanes(hqRoot), new Set([lane.senior.id]));
+    const remoteSenior = grantContext === undefined
+        ? await readRemoteHireGrantSenior(ctx, hqRoot, lane.senior.id)
+        : undefined;
+    const suppliedHierarchy = grantContext?.hierarchy ?? (remoteSenior === undefined
+        ? undefined
+        : hierarchyWithRemoteSenior(loadAllLanes(hqRoot), remoteSenior));
     return withHireGrantAdmission(hqRoot, lane.senior.id, (snapshot) => {
         const current = readLane(hqRoot, lane.lane_id);
+        if (remoteSenior !== undefined &&
+            (current.senior.kind !== "lane" || current.senior.id !== remoteSenior.lane_id)) {
+            throw new LanesError("hire_grant_senior_changed", `Lane ${current.lane_id}'s senior changed while its owning Outpost was being checked`, { lane_id: current.lane_id, expected_senior_lane_id: remoteSenior.lane_id, current_senior: current.senior });
+        }
         if (grantContext !== undefined &&
             !sameHireGrantSenior(current.senior, grantContext.expected_senior)) {
             throw new LanesError("hire_grant_senior_changed", `Lane ${current.lane_id}'s senior changed before the Outpost resumed it`, {
@@ -929,7 +1000,7 @@ async function withResumeHireAdmission(ctx, lane, fn, grantContext) {
         if (refusal !== null)
             throw refusal;
         return fn();
-    }, grantContext?.hierarchy);
+    }, suppliedHierarchy, remoteSenior === undefined ? undefined : new Set([remoteSenior.lane_id]));
 }
 const CAPACITY_PROBE_TIMEOUT_MS = 15_000;
 const MAX_PLACEMENT_OUTPOSTS = 16;
@@ -1205,8 +1276,11 @@ async function readOutpostLaneRecordsUncached(ctx, outpostId, query, dispatchOpt
     }
     return lanes;
 }
-async function readOutpostLaneRecords(ctx, outpostId, requestedQuery = {}, dispatchOptions = {}) {
+async function readOutpostLaneRecords(ctx, outpostId, requestedQuery = {}, dispatchOptions = {}, options = {}) {
     const query = normalizedLaneListQuery(requestedQuery);
+    if (options.bypassCache === true) {
+        return readOutpostLaneRecordsUncached(ctx, outpostId, query, dispatchOptions);
+    }
     let invocationMemo = outpostLaneListMemo.get(ctx);
     if (!invocationMemo) {
         invocationMemo = new OutpostSnapshotInvocationMemo();
@@ -2144,6 +2218,10 @@ function assertKnownOutpost(requested, known) {
  */
 export const ASK_BACKOFF_MS = [5_000, 15_000];
 export const ASK_ATTEMPTS = ASK_BACKOFF_MS.length + 1;
+/** Flip to true in the next release to make --priority mandatory. */
+export const ASK_PRIORITY_REQUIRED = false;
+const ASK_PRIORITY_WARNING = "--priority will be required in the next release.";
+const QUESTION_PRIORITIES = ["P0", "P1", "P2"];
 function withCasRetry(fn, attempts = 5) {
     let last;
     for (let i = 0; i < attempts; i += 1) {
@@ -3980,19 +4058,21 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
     let grantContext;
     let grantHierarchy;
     if (action === "grant") {
-        const hierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneRecords(ctx, outpostId, {
+        const ownerHierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneRecords(ctx, outpostId, {
             hierarchy: [lane.lane_id],
             snapshot: true,
         }));
+        const hierarchy = await hierarchyWithVerifiedRemoteSenior(ctx, ctx.hqRoot(), lane, ownerHierarchy);
         grantHierarchy = hierarchy;
         grantContext = createOutpostHireGrantContext(lane, hierarchy);
     }
     else if ((action === "resume" && lane.senior.kind === "lane") ||
         (action === "message" && (lane.senior.kind === "lane" || lane.senior.kind === "session"))) {
-        const hierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneRecords(ctx, outpostId, {
+        const ownerHierarchy = mergeOwnerLaneRecords(loadAllLanes(ctx.hqRoot()), await readOutpostLaneRecords(ctx, outpostId, {
             hierarchy: [lane.lane_id],
             snapshot: true,
         }));
+        const hierarchy = await hierarchyWithVerifiedRemoteSenior(ctx, ctx.hqRoot(), lane, ownerHierarchy);
         grantContext = createOutpostHireGrantContext(lane, hierarchy, action === "message" ? options.supersededMessageCallerId : undefined, action === "message" ? options.supersededMessageSessionId : undefined);
     }
     let dispatched;
@@ -5254,6 +5334,10 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
         }
         await refreshRemoteLaneMirrors(ctx, hqRoot, loadAllLanes(hqRoot), parentLaneIds);
     }
+    const remoteSenior = authorization === "senior" &&
+        initial.senior.kind === "lane" && initial.senior.id
+        ? await readRemoteHireGrantSenior(ctx, hqRoot, initial.senior.id)
+        : undefined;
     const updated = ctx.withGrantHireLocks(hqRoot, lockedLaneIds, () => {
         const current = readLane(hqRoot, laneId);
         const currentCallerAuthorization = authorization === "senior"
@@ -5270,11 +5354,18 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
             (!grantContext || !sameHireGrantSenior(current.senior, grantContext.expected_senior))) {
             throw new LanesError("hire_grant_senior_changed", `Lane ${laneId}'s senior changed before the Outpost applied the grant update`, { lane_id: laneId, current_senior: current.senior });
         }
-        const hierarchy = grantContext
+        if (remoteSenior !== undefined &&
+            (current.senior.kind !== "lane" || current.senior.id !== remoteSenior.lane_id)) {
+            throw new LanesError("hire_grant_senior_changed", `Lane ${current.lane_id}'s senior changed while its owning Outpost was being checked`, { lane_id: current.lane_id, expected_senior_lane_id: remoteSenior.lane_id, current_senior: current.senior });
+        }
+        const currentHierarchy = grantContext
             ? authorization === "ssm-owner-dispatch"
                 ? mergeOwnerLaneHierarchy(grantContext.hierarchy, loadAllLanes(hqRoot))
                 : grantContext.hierarchy
             : loadAllLanes(hqRoot);
+        const hierarchy = remoteSenior === undefined
+            ? currentHierarchy
+            : hierarchyWithRemoteSenior(currentHierarchy, remoteSenior);
         if (current.senior.kind === "lane") {
             if (!current.senior.id) {
                 throw new LanesError("hire_grant_senior_invalid", `Lane ${laneId} has a lane senior without an id`, {
@@ -7443,7 +7534,23 @@ export function interruptNotResumableWarning(laneId) {
     return `hq lanes: warning: lane ${laneId} was interrupted before its provider reported a session id, ` +
         `so hq lanes resume cannot continue it. Start a new lane for the remaining work.\n`;
 }
+function parseQuestionPriority(value) {
+    if (value === undefined) {
+        if (ASK_PRIORITY_REQUIRED) {
+            throw new LanesError("ask_priority_required", "--priority is required; choose P0, P1, or P2", {
+                allowed: [...QUESTION_PRIORITIES],
+            });
+        }
+        return undefined;
+    }
+    const normalized = value.toUpperCase();
+    if (!QUESTION_PRIORITIES.includes(normalized)) {
+        throw new LanesError("ask_priority_invalid", `Invalid --priority ${JSON.stringify(value)}. Allowed values: P0, P1, P2`, { allowed: [...QUESTION_PRIORITIES], value });
+    }
+    return normalized;
+}
 async function runAsk(ctx, opts) {
+    const priority = parseQuestionPriority(opts.priority);
     const hqRoot = ctx.hqRoot();
     const laneId = ctx.env.HQ_LANE_ID?.trim();
     if (!laneId) {
@@ -7482,6 +7589,7 @@ async function runAsk(ctx, opts) {
                 at,
                 activeCompany: questionCompany,
                 questionId,
+                priority,
             });
             questionId = withBody.question_id;
             await emitLaneMeshEvent(ctx, lane.mesh_company ?? lane.company, lane.thread_id, "lane_question", {
@@ -7496,12 +7604,16 @@ async function runAsk(ctx, opts) {
                     question_id: withBody.question_id,
                 });
             }
+            if (priority === undefined) {
+                process.stderr.write(`hq lanes ask: warning: ${ASK_PRIORITY_WARNING}\n`);
+            }
             printJson({
                 ok: true,
                 action: "ask",
                 question: withBody,
                 lane_id: lane.lane_id,
                 lane_state: lane.state,
+                ...(priority === undefined ? { warnings: [ASK_PRIORITY_WARNING] } : {}),
             });
             return;
         }
@@ -8493,6 +8605,8 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--context <text>", "Context for the audience")
         .option("--option <text>", "Answer choice (repeatable)", collectRepeatable)
         .option("--recommended <text>", "Recommended option")
+        .option("--priority <P0|P1|P2>", "Urgency: P0 blocks now, P1 needed today, P2 can wait")
+        .addHelpText("after", "\nThe audience may take up to 24 hours to answer; keep working meanwhile.\n")
         .action(wrap(async (opts) => {
         await runAsk(ctx, opts);
     }));

package/dist/lib/checkpoint-ontology/drop-aliases.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `hq core ontology drop-aliases`: remove reviewed wrong aliases from entity
+ * files (CO-74). An alias that names a different entity joins two unrelated
+ * entities into one duplicate group; a person lists each `{ entity, alias }`
+ * to remove, and nothing else changes. The dry run writes nothing; `apply`
+ * writes the entity files through the multi-writer outbox so sync pushes them.
+ */
+import { type OntologyCompany } from "./company.js";
+export declare const DROP_ALIASES_FLAG = "checkpoint.ontology.drop-aliases";
+/** One reviewed removal: `entity` is a company-relative entity path. */
+export interface AliasDrop {
+    entity: string;
+    alias: string;
+}
+export type AliasDropSkipReason = "no_entity" | "type_not_writable" | "alias_absent" | "patch_failed";
+export interface AliasDropReport {
+    company: string;
+    mode: "dry_run" | "apply";
+    duplicate_groups_before: number;
+    duplicate_groups_after: number;
+    /** Entity -> aliases removed (dry run: would be removed). */
+    planned: Record<string, string[]>;
+    written: string[];
+    skipped: Array<AliasDrop & {
+        reason: AliasDropSkipReason;
+        detail?: string;
+    }>;
+    errors: Array<{
+        path: string;
+        error: string;
+    }>;
+}
+export interface DropAliasesOptions {
+    hqRoot: string;
+    company: OntologyCompany;
+    mode: "dry_run" | "apply";
+    drops: AliasDrop[];
+    now: Date;
+}
+export declare function dropAliases(options: DropAliasesOptions): AliasDropReport;
+//# sourceMappingURL=drop-aliases.d.ts.map