@indigoai-us/hq-cli 5.311.4 → 5.312.1

package/dist/lib/lanes/watcher-main.js

@@ -5,7 +5,7 @@
  * Usage: node watcher-main.js <lane-id>
  * Requires HQ_ROOT in the environment.
  */
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -32,6 +32,25 @@ export function watcherMainDeps(hqRoot, laneId, env = process.env, repairDispatc
                 throw new Error(`recovery command exited ${result.status ?? result.signal ?? "without status"}: ${(result.stderr ?? "").trim()}`);
             }
         },
+        scheduleTerminalKeepAlive: async ({ laneId: scheduledLaneId, version, dueAt }) => {
+            await new Promise((resolve, reject) => {
+                const child = spawn(process.execPath, [
+                    cliEntry,
+                    "lanes",
+                    "_keep-alive-terminal-trigger",
+                    scheduledLaneId,
+                    String(version),
+                    dueAt,
+                ], {
+                    env,
+                    detached: true,
+                    stdio: "ignore",
+                });
+                child.once("error", reject);
+                child.once("spawn", resolve);
+                child.unref();
+            });
+        },
     };
 }
 function deliverLaneSeniorMessage(cliEntry, laneId, text) {

package/dist/lib/lanes/watcher.d.ts

@@ -238,6 +238,15 @@ export interface WatcherLoopDeps {
     readKrFreshnessFlag?: typeof readLanesRegistryFlag;
     /** Test seam; production reads the company-scoped hq-flags row. */
     readEnvelopeRepairContinueFlag?: typeof readLanesRegistryFlag;
+    /** Test seam; production reads the company-scoped hq-flags row. */
+    readTerminalKeepAliveFlag?: typeof readLanesRegistryFlag;
+    /** Schedule an immediate reconcile check for the terminal lane version. */
+    scheduleTerminalKeepAlive?: (input: {
+        laneId: string;
+        version: number;
+        terminalAt: string;
+        dueAt: string;
+    }) => Promise<void>;
 }
 /**
  * Wrap one mesh call. A failed emit is logged as `mesh_event_failed` with

package/dist/lib/lanes/watcher.js

@@ -53,7 +53,7 @@ import { laneCompanyUidSource, resolveLaneCompany } from "./lane-company.js";
 import { blockerFreshnessFingerprint, resolveBlockerFreshnessForLane, } from "./blocker-freshness.js";
 import { krFreshnessFingerprint, resolveKrFreshnessForLane, } from "./kr-freshness.js";
 import { managerStatusWasWritten, readStatusSnapshot, resolveManagerStatusTarget, } from "./manager-status-gate.js";
-import { queueLaneTerminalResume, queueManagerStatusGateResume } from "./keep-alive.js";
+import { LEAD_LANE_KEEP_ALIVE_FIRST_RESUME_SETTLE_MS, LEAD_LANE_KEEP_ALIVE_FLAG, LEAD_LANE_KEEP_ALIVE_IMMEDIATE_FIRST_RESUME_FLAG, LEAD_LANE_KEEP_ALIVE_TERMINAL_TRIGGER_FLAG, queueLaneTerminalResume, queueManagerStatusGateResume, } from "./keep-alive.js";
 import { LANE_ENVELOPE_REPAIR_CONTINUE_FLAG } from "./flag-keys.js";
 import { monitorSessionDir } from "../monitor.js";
 import { laneRunDir, missingPidProbe, probePidRecord, readPidRecord, readProcStarttime, readSpawnManifest, envelopeRepairMode, spawnEnvelopeRepair, writePidRecord, retryLaneOnAlternateAccount, } from "./spawn.js";
@@ -1780,6 +1780,52 @@ async function runWatcherLoopOwned(hqRoot, laneId, deps) {
                         });
                     }
                 }
+                const terminalEnvelopeNextCheckMs = effectiveEnvelope?.next_check_at === undefined
+                    ? undefined
+                    : Date.parse(effectiveEnvelope.next_check_at);
+                const hasFutureTerminalNextCheck = terminalEnvelopeNextCheckMs !== undefined &&
+                    Number.isFinite(terminalEnvelopeNextCheckMs) &&
+                    terminalEnvelopeNextCheckMs > Date.parse(tick.emit.at);
+                if (terminalWrite.changed &&
+                    updated.keep_alive === true &&
+                    effectiveEnvelope?.decision === "done" &&
+                    effectiveEnvelope.story_complete === false &&
+                    !hasFutureTerminalNextCheck &&
+                    updated.state === "done" &&
+                    deps.scheduleTerminalKeepAlive) {
+                    try {
+                        const current = readLane(hqRoot, laneId);
+                        if (current.state === "done" && current.version === updated.version && current.keep_alive === true) {
+                            const resolution = resolveLaneCompany(hqRoot, current);
+                            const company = resolution.company;
+                            if (company) {
+                                const readFlag = deps.readTerminalKeepAliveFlag ?? readLanesRegistryFlag;
+                                const flagOptions = { company, companyUidSource: laneCompanyUidSource(resolution.source) };
+                                const [triggerEnabled, keepAliveEnabled, immediateFirstResumeEnabled] = await Promise.all([
+                                    readFlag(LEAD_LANE_KEEP_ALIVE_TERMINAL_TRIGGER_FLAG, flagOptions),
+                                    readFlag(LEAD_LANE_KEEP_ALIVE_FLAG, flagOptions),
+                                    readFlag(LEAD_LANE_KEEP_ALIVE_IMMEDIATE_FIRST_RESUME_FLAG, flagOptions),
+                                ]);
+                                if (triggerEnabled && keepAliveEnabled && immediateFirstResumeEnabled) {
+                                    const terminalAtMs = Date.parse(tick.emit.at);
+                                    const dueAt = new Date(terminalAtMs + LEAD_LANE_KEEP_ALIVE_FIRST_RESUME_SETTLE_MS).toISOString();
+                                    logDecision({ event: "keep_alive_terminal_trigger_scheduled", at: tick.emit.at, due_at: dueAt, version: current.version });
+                                    await deps.scheduleTerminalKeepAlive({
+                                        laneId,
+                                        version: current.version,
+                                        terminalAt: tick.emit.at,
+                                        dueAt,
+                                    });
+                                }
+                            }
+                        }
+                    }
+                    catch (err) {
+                        const message = err instanceof Error ? err.message : String(err);
+                        process.stderr.write(`hq lanes watcher: terminal keep-alive trigger failed for ${laneId}: ${message}\n`);
+                        logDecision({ event: "keep_alive_terminal_trigger_failed", at: tick.emit.at, error: message });
+                    }
+                }
             }
         }
         lastSignalMs = tick.nextLastSignalMs;

package/dist/lib/mesh/client.js

@@ -4,6 +4,7 @@
  * vault HTTP + receipt-shaped responses (US-007A / US-007B).
  */
 import { listActiveMembershipCompanies, meshJson, requireToken, resolveMeshCompany, } from "./api.js";
+import { isWorkSessionDenialCode } from "./denial-codes.js";
 export { meshJson, requireToken, resolveMeshCompany, listActiveMembershipCompanies };
 export async function openMeshTransport(opts) {
     const token = await requireToken();
@@ -50,11 +51,28 @@ export function createWorkSessionDeliverer(opts) {
             const message = err instanceof Error ? err.message : String(err);
             // meshJson throws on !ok with error text; classify by leading status when present.
             const statusMatch = /^(\d{3})\b/.exec(message);
-            if (statusMatch) {
-                const status = Number(statusMatch[1]);
-                if (status === 401 || status === 403) {
-                    return { ok: false, retryable: false, code: "AUTH_DENIED" };
-                }
+            const errorFields = err && typeof err === "object"
+                ? err
+                : {};
+            const status = typeof errorFields.status === "number" &&
+                Number.isInteger(errorFields.status)
+                ? errorFields.status
+                : statusMatch
+                    ? Number(statusMatch[1])
+                    : undefined;
+            if (status === 401 || status === 403) {
+                const serverCode = isWorkSessionDenialCode(errorFields.code)
+                    ? errorFields.code
+                    : undefined;
+                return {
+                    ok: false,
+                    retryable: false,
+                    code: "AUTH_DENIED",
+                    httpStatus: status,
+                    ...(serverCode ? { serverCode } : {}),
+                };
+            }
+            if (status !== undefined) {
                 if (status === 400 || status === 422) {
                     return { ok: false, retryable: false, code: "VALIDATION_FAILED" };
                 }

package/dist/lib/mesh/denial-codes.d.ts

@@ -0,0 +1,5 @@
+/** Explicit 401/403 codes returned by hq-pro's work-session registration path. */
+export declare const WORK_SESSION_DENIAL_CODES: readonly ["AUTH_REQUIRED", "AGENT_IDENTITY_UNVERIFIED", "IMPERSONATION_FORBIDDEN", "NO_PERSON_ENTITY", "INVALID_COMPANY", "WORK_REGISTRY_DISABLED"];
+export type WorkSessionDenialCode = (typeof WORK_SESSION_DENIAL_CODES)[number];
+export declare function isWorkSessionDenialCode(value: unknown): value is WorkSessionDenialCode;
+//# sourceMappingURL=denial-codes.d.ts.map

package/dist/lib/mesh/denial-codes.js

@@ -0,0 +1,14 @@
+/** Explicit 401/403 codes returned by hq-pro's work-session registration path. */
+export const WORK_SESSION_DENIAL_CODES = [
+    "AUTH_REQUIRED",
+    "AGENT_IDENTITY_UNVERIFIED",
+    "IMPERSONATION_FORBIDDEN",
+    "NO_PERSON_ENTITY",
+    "INVALID_COMPANY",
+    "WORK_REGISTRY_DISABLED",
+];
+export function isWorkSessionDenialCode(value) {
+    return typeof value === "string" &&
+        WORK_SESSION_DENIAL_CODES.includes(value);
+}
+//# sourceMappingURL=denial-codes.js.map

package/dist/lib/mesh/live/daemon/doctor.d.ts

@@ -27,6 +27,8 @@ export interface DaemonDoctorReport {
     outboxDepth: number;
     outboxQuarantined?: number;
     outboxLastQuarantineReason?: string;
+    outboxLastQuarantineHttpStatus?: number;
+    outboxLastQuarantineServerCode?: string;
     lastFlushAt?: string;
     lastFlushResult?: DaemonStateFile["lastFlushResult"];
     unhealthy: boolean;

package/dist/lib/mesh/live/daemon/doctor.js

@@ -263,6 +263,8 @@ export function collectDaemonDoctor(deps = {}) {
             ? {
                 outboxQuarantined: outbox.quarantined,
                 outboxLastQuarantineReason: outbox.lastQuarantineReason ?? undefined,
+                outboxLastQuarantineHttpStatus: outbox.lastQuarantineHttpStatus ?? undefined,
+                outboxLastQuarantineServerCode: outbox.lastQuarantineServerCode ?? undefined,
             }
             : {}),
         lastFlushAt: state?.lastFlushAt,
@@ -310,7 +312,15 @@ export function formatDaemonDoctor(report) {
         lines.push(`spool depth: ${report.spoolDepth}`, `held: ${report.heldCount}${report.heldCount > 0 ? " (needs_company; not sent as NONE)" : ""}`, `held with no local evidence: ${report.heldWithNoLocalEvidence}`, `outbox depth: ${report.outboxDepth}`);
     }
     if (report.outboxQuarantined !== undefined) {
-        lines.push(`outbox quarantined: ${report.outboxQuarantined} (last reason=${report.outboxLastQuarantineReason ?? "unknown"})`);
+        const quarantineDetails = [
+            report.outboxLastQuarantineHttpStatus !== undefined
+                ? `HTTP ${report.outboxLastQuarantineHttpStatus}`
+                : "",
+            report.outboxLastQuarantineServerCode ?? "",
+        ]
+            .filter(Boolean)
+            .join(" ");
+        lines.push(`outbox quarantined: ${report.outboxQuarantined} (last reason=${report.outboxLastQuarantineReason ?? "unknown"}${quarantineDetails ? `; ${quarantineDetails}` : ""})`);
     }
     if (report.emitMode !== "legacy" && report.heldCount > 0) {
         lines.push(`held: ${report.heldCount} (needs_company; not sent as NONE)`);

package/dist/lib/report-run.d.ts

@@ -8,12 +8,12 @@ export type DigestSignal = {
     kind: string;
     text: string;
 };
-export type FocusItem = {
+type FocusItem = {
     title: string;
     project: string;
     reason: string;
 };
-export type ReportRunRecord = {
+type ReportRunRecord = {
     generatedAt: string;
     inputs: {
         template: string;
@@ -58,4 +58,5 @@ export declare function renderDailyDigest(input: {
     generatedAt?: string;
 }): DigestPage;
 export declare function writeDigestPage(directory: string, page: DigestPage): void;
+export {};
 //# sourceMappingURL=report-run.d.ts.map

package/dist/lib/report-templates.d.ts

@@ -3,7 +3,6 @@ export type ReportTemplate = {
     path: string;
     body: string;
 };
-export declare function reportPackageRoot(): string;
 export declare function listReportTemplates(root?: string): ReportTemplate[];
 /** Verbatim runbook. Callers substitute `<reportId>` when the id is known. */
 export declare function loadUpdateReportRunbook(root?: string): string;

package/dist/lib/report-templates.js

@@ -3,9 +3,6 @@ import { readdirSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
-export function reportPackageRoot() {
-    return PACKAGE_ROOT;
-}
 export function listReportTemplates(root = PACKAGE_ROOT) {
     const dir = path.join(root, "templates", "reports");
     return readdirSync(dir)

package/dist/lib/scaffold-cli-floor.d.ts

@@ -1,4 +1,3 @@
-export declare const SCAFFOLD_CLI_UPGRADE_COMMAND = "npm install -g @indigoai-us/hq-cli@latest";
 export type ScaffoldCliFloorComparison = {
     status: "pass" | "fail" | "warn" | "skip";
     message: string;

package/dist/lib/scaffold-cli-floor.js

@@ -1,5 +1,5 @@
 import semver from "semver";
-export const SCAFFOLD_CLI_UPGRADE_COMMAND = "npm install -g @indigoai-us/hq-cli@latest";
+const SCAFFOLD_CLI_UPGRADE_COMMAND = "npm install -g @indigoai-us/hq-cli@latest";
 const MINIMUM_VERSION_RANGE = /^>=(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
 /** Compare an installed CLI version with the scaffold's supported floor. */
 export function compareScaffoldCliFloor(required, currentVersion) {

package/dist/lib/search-index/embed-lock.d.ts

@@ -4,6 +4,8 @@ export type EmbedLockDependencies = {
     pid: number;
     random: () => string;
     isProcessAlive: (pid: number) => boolean;
+    /** Test seam for a contender arriving after mkdir and before owner publication. */
+    beforeOwnerPublish?: (ownerFile: string) => void;
     /** Test seam for simulating a competing owner replacing the atomic record. */
     afterOwnerPublish?: (ownerFile: string) => void;
 };

package/dist/lib/search-index/embed-lock.js

@@ -184,8 +184,13 @@ function createAndPublishLock(home, dependencies) {
         // parity: the script's write_owner_record honored the same variable.
         if (dependencies.env.QMD_FORCE_OWNER_WRITE_FAIL)
             throw new Error('forced owner write failure');
+        dependencies.beforeOwnerPublish?.(ownerFile);
         fs.writeFileSync(temporary, `pid=${dependencies.pid}\nts=${dependencies.now()}\nnonce=${nonce}\n`);
-        fs.renameSync(temporary, ownerFile);
+        // renameSync replaces an existing owner on POSIX. A stale reclaim can
+        // replace this ownerless directory while this publisher is paused, so
+        // publish only if this exact generation still has no owner.
+        fs.linkSync(temporary, ownerFile);
+        fs.unlinkSync(temporary);
         dependencies.afterOwnerPublish?.(ownerFile);
         const verified = readOwner(directory);
         if (!verified || verified.pid !== dependencies.pid || verified.nonce !== nonce)
@@ -196,6 +201,10 @@ function createAndPublishLock(home, dependencies) {
     catch {
         // The marker identifies only the directory this process created. Do not
         // recursively remove the fixed lock path after a failed publication.
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch { /* absent after link or moved with a stale generation */ }
         fs.rmSync(marker, { recursive: true, force: true });
         removeDirectoryIfEmpty(directory);
         return false;

package/dist/lib/work-context/contract.d.ts

@@ -61,6 +61,9 @@ export interface ContextResult {
     bindingEpisodeId?: string;
     clientOperationId: string;
     errorCode?: string;
+    /** Sanitized HTTP denial details; raw response bodies are never included. */
+    httpStatus?: number;
+    serverCode?: string;
     /** Why a project was chosen, or why the session is asking. Local consumers only. */
     projectBindReason?: string;
     /** Ranked alternatives when classification is needs_project. */

package/dist/lib/work-context/contract.schema.json

@@ -100,7 +100,9 @@
         "taskId": { "type": "string", "maxLength": 128 },
         "bindingEpisodeId": { "type": "string", "maxLength": 128 },
         "clientOperationId": { "type": "string", "minLength": 1, "maxLength": 128 },
-        "errorCode": { "type": "string", "maxLength": 64 }
+        "errorCode": { "type": "string", "maxLength": 64 },
+        "httpStatus": { "type": "number" },
+        "serverCode": { "type": "string", "maxLength": 64 }
       }
     }
   }

package/dist/lib/work-context/outbox.d.ts

@@ -5,7 +5,7 @@
 import type { DeliveryState } from "./contract.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 /** Fields allowed on a durable outbox operation (privacy allowlist). */
-export declare const OUTBOX_ALLOWLIST: readonly ["contractVersion", "operationId", "clientOperationId", "sessionId", "harness", "companyUid", "companySlug", "projectId", "taskId", "companyConfidence", "kind", "digest", "delivery", "createdAt", "updatedAt", "attemptCount", "lastErrorCode", "receiptId", "destinationCompanyUid", "destinationCompanySlug", "nextAttemptAt"];
+export declare const OUTBOX_ALLOWLIST: readonly ["contractVersion", "operationId", "clientOperationId", "sessionId", "harness", "companyUid", "companySlug", "projectId", "taskId", "companyConfidence", "kind", "digest", "delivery", "createdAt", "updatedAt", "attemptCount", "lastErrorCode", "lastErrorHttpStatus", "lastServerErrorCode", "receiptId", "destinationCompanyUid", "destinationCompanySlug", "nextAttemptAt"];
 /** Base delay for outbox retry backoff (attempt 1 → 30s). */
 export declare const OUTBOX_RETRY_BASE_MS = 30000;
 /** Cap for outbox retry backoff (6 hours). */
@@ -34,6 +34,8 @@ export interface OutboxOperation {
     updatedAt: string;
     attemptCount: number;
     lastErrorCode?: string;
+    lastErrorHttpStatus?: number;
+    lastServerErrorCode?: string;
     receiptId?: string;
     /** Destination company for kind=migrate (source is companyUid). */
     destinationCompanyUid?: string;
@@ -88,8 +90,13 @@ export declare function markOutboxAcked(operationId: string, root: string, recei
 export declare function writeAckedRegisterState(op: OutboxOperation, root: string, receiptId: string, now?: () => Date): void;
 /** Repair older unresolved session projections from acknowledged registrations. */
 export declare function repairAckedRegisterStates(root: string, sessionIds?: ReadonlySet<string>, now?: () => Date): number;
-export declare function markOutboxQueued(operationId: string, root: string, errorCode: string, now?: () => Date, random?: () => number): OutboxOperation | null;
-export declare function markOutboxQuarantined(operationId: string, root: string, errorCode: string, now?: () => Date): OutboxOperation | null;
+export declare function markOutboxQueued(operationId: string, root: string, errorCode: string, now?: () => Date, random?: () => number, details?: OutboxErrorDetails): OutboxOperation | null;
+export declare function markOutboxQuarantined(operationId: string, root: string, errorCode: string, now?: () => Date, details?: OutboxErrorDetails): OutboxOperation | null;
+export interface OutboxErrorDetails {
+    httpStatus?: number;
+    serverCode?: string;
+}
+export declare function sanitizeOutboxErrorDetails(details?: OutboxErrorDetails): OutboxErrorDetails;
 /**
  * Requeue quarantined outbox operations so the daemon's replay picks them up
  * again. Quarantine is otherwise terminal: after the work-mesh-live gap 10 fix
@@ -119,16 +126,18 @@ export interface OutboxStats {
     queued: number;
     acked: number;
     lastQuarantineReason: string | null;
+    lastQuarantineHttpStatus: number | null;
+    lastQuarantineServerCode: string | null;
 }
 export declare function outboxStats(root: string): OutboxStats;
 export type DeliverFn = (op: OutboxOperation) => Promise<{
     ok: true;
     receiptId: string;
-} | {
+} | ({
     ok: false;
     retryable: boolean;
     code: string;
-}>;
+} & OutboxErrorDetails)>;
 /**
  * Replay queued (and recover lost-receipt) operations.
  * FIFO per sessionId; bounded parallelism across sessions.

package/dist/lib/work-context/outbox.js

@@ -8,6 +8,7 @@ import * as path from "node:path";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 import { atomicWriteJson, ensureOwnerDir } from "./atomic.js";
 import { NotTrackingError } from "./errors.js";
+import { isWorkSessionDenialCode } from "../mesh/denial-codes.js";
 import { readSessionState, stripRegisterReceiptEpisodes, updateSessionState, writeAcknowledgedRegisterBinding, } from "./state.js";
 import { isSafeWorkContextSegment, workContextOutboxDir, workContextOutboxPath, } from "./paths.js";
 /** Fields allowed on a durable outbox operation (privacy allowlist). */
@@ -29,6 +30,8 @@ export const OUTBOX_ALLOWLIST = [
     "updatedAt",
     "attemptCount",
     "lastErrorCode",
+    "lastErrorHttpStatus",
+    "lastServerErrorCode",
     "receiptId",
     "destinationCompanyUid",
     "destinationCompanySlug",
@@ -101,6 +104,11 @@ function projectOutbox(op) {
         out.companyConfidence = op.companyConfidence;
     if (op.lastErrorCode)
         out.lastErrorCode = op.lastErrorCode;
+    if (op.lastErrorHttpStatus !== undefined) {
+        out.lastErrorHttpStatus = op.lastErrorHttpStatus;
+    }
+    if (op.lastServerErrorCode)
+        out.lastServerErrorCode = op.lastServerErrorCode;
     if (op.receiptId)
         out.receiptId = op.receiptId;
     if (op.destinationCompanyUid) {
@@ -337,12 +345,13 @@ export function repairAckedRegisterStates(root, sessionIds, now = () => new Date
     }
     return repaired;
 }
-export function markOutboxQueued(operationId, root, errorCode, now = () => new Date(), random = Math.random) {
+export function markOutboxQueued(operationId, root, errorCode, now = () => new Date(), random = Math.random, details) {
     const op = readOutboxOperation(operationId, root);
     if (!op)
         return null;
     op.delivery = "queued";
     op.lastErrorCode = errorCode;
+    applyOutboxErrorDetails(op, details);
     op.attemptCount += 1;
     const at = now();
     op.updatedAt = at.toISOString();
@@ -351,17 +360,40 @@ export function markOutboxQueued(operationId, root, errorCode, now = () => new D
     updateOutboxOperation(op, root);
     return op;
 }
-export function markOutboxQuarantined(operationId, root, errorCode, now = () => new Date()) {
+export function markOutboxQuarantined(operationId, root, errorCode, now = () => new Date(), details) {
     const op = readOutboxOperation(operationId, root);
     if (!op)
         return null;
     op.delivery = "quarantined";
     op.lastErrorCode = errorCode;
+    applyOutboxErrorDetails(op, details);
     op.attemptCount += 1;
     op.updatedAt = now().toISOString();
     updateOutboxOperation(op, root);
     return op;
 }
+function applyOutboxErrorDetails(op, details) {
+    delete op.lastErrorHttpStatus;
+    delete op.lastServerErrorCode;
+    const safe = sanitizeOutboxErrorDetails(details);
+    if (safe.httpStatus !== undefined)
+        op.lastErrorHttpStatus = safe.httpStatus;
+    if (safe.serverCode !== undefined)
+        op.lastServerErrorCode = safe.serverCode;
+}
+export function sanitizeOutboxErrorDetails(details) {
+    const safe = {};
+    if (details?.httpStatus !== undefined &&
+        Number.isInteger(details.httpStatus) &&
+        details.httpStatus >= 100 &&
+        details.httpStatus <= 599) {
+        safe.httpStatus = details.httpStatus;
+    }
+    if (isWorkSessionDenialCode(details?.serverCode)) {
+        safe.serverCode = details.serverCode;
+    }
+    return safe;
+}
 /**
  * Requeue quarantined outbox operations so the daemon's replay picks them up
  * again. Quarantine is otherwise terminal: after the work-mesh-live gap 10 fix
@@ -389,6 +421,8 @@ export function requeueQuarantinedOutbox(root, opts = {}) {
         op.delivery = "queued";
         op.attemptCount = 0;
         op.lastErrorCode = undefined;
+        op.lastErrorHttpStatus = undefined;
+        op.lastServerErrorCode = undefined;
         op.nextAttemptAt = undefined;
         op.updatedAt = now().toISOString();
         updateOutboxOperation(op, root);
@@ -469,6 +503,15 @@ export function outboxStats(root) {
         queued: ops.filter((o) => o.delivery === "queued").length,
         acked: ops.filter((o) => o.delivery === "acked").length,
         lastQuarantineReason: latestQuarantine?.lastErrorCode ?? null,
+        lastQuarantineHttpStatus: latestQuarantine &&
+            Number.isInteger(latestQuarantine.lastErrorHttpStatus) &&
+            latestQuarantine.lastErrorHttpStatus >= 100 &&
+            latestQuarantine.lastErrorHttpStatus <= 599
+            ? latestQuarantine.lastErrorHttpStatus
+            : null,
+        lastQuarantineServerCode: isWorkSessionDenialCode(latestQuarantine?.lastServerErrorCode)
+            ? latestQuarantine.lastServerErrorCode
+            : null,
     };
 }
 function isOutboxDue(op, nowIso) {
@@ -551,18 +594,18 @@ export async function replayOutbox(root, deliver, opts = {}) {
             }
             else if (result.retryable) {
                 if (op.attemptCount + 1 >= OUTBOX_MAX_ATTEMPTS) {
-                    markOutboxQuarantined(op.operationId, root, `${result.code}_MAX_ATTEMPTS`, now);
+                    markOutboxQuarantined(op.operationId, root, `${result.code}_MAX_ATTEMPTS`, now, result);
                     quarantined += 1;
                 }
                 else {
-                    markOutboxQueued(op.operationId, root, result.code, now, random);
+                    markOutboxQueued(op.operationId, root, result.code, now, random, result);
                     queued += 1;
                 }
                 // Stop this session's FIFO on transient failure.
                 break;
             }
             else {
-                markOutboxQuarantined(op.operationId, root, result.code, now);
+                markOutboxQuarantined(op.operationId, root, result.code, now, result);
                 quarantined += 1;
                 break;
             }

package/dist/lib/work-context/reconcile.js

@@ -14,7 +14,7 @@ import { refineProjectBinding } from "./bind-best.js";
 import { rebindNeedsProjectOnPrompt } from "./prompt-rebind.js";
 import { resolveProjectTask, shouldAskAfter } from "./project.js";
 import { deriveRemoteOwnerSlug, deriveRepoIdentityKey } from "./repo-remote.js";
-import { enqueueOutbox, listOutboxOperations, markOutboxAcked, markOutboxQuarantined, markOutboxQueued, replayOutbox, writeAckedRegisterState, } from "./outbox.js";
+import { enqueueOutbox, listOutboxOperations, markOutboxAcked, markOutboxQuarantined, markOutboxQueued, replayOutbox, sanitizeOutboxErrorDetails, writeAckedRegisterState, } from "./outbox.js";
 import { mergeLocalSessionFields, isRegisterReceiptEpisodeId, readSessionState, stripRegisterReceiptEpisodes, writeSessionState, } from "./state.js";
 function resultOf(parts) {
     const out = {
@@ -38,6 +38,10 @@ function resultOf(parts) {
         out.bindingEpisodeId = parts.bindingEpisodeId;
     if (parts.errorCode)
         out.errorCode = parts.errorCode;
+    if (parts.httpStatus !== undefined)
+        out.httpStatus = parts.httpStatus;
+    if (parts.serverCode)
+        out.serverCode = parts.serverCode;
     if (parts.projectBindReason)
         out.projectBindReason = parts.projectBindReason;
     if (parts.projectCandidates)
@@ -974,7 +978,8 @@ export async function reconcileObservation(obs, deps) {
         };
     }
     if (delivered.retryable) {
-        markOutboxQueued(outboxOp.operationId, deps.root, delivered.code, nowFn);
+        const details = sanitizeOutboxErrorDetails(delivered);
+        markOutboxQueued(outboxOp.operationId, deps.root, delivered.code, nowFn, undefined, details);
         return {
             result: resultOf({
                 kind: "queued",
@@ -986,15 +991,20 @@ export async function reconcileObservation(obs, deps) {
                 projectId,
                 taskId,
                 errorCode: delivered.code,
+                ...details,
                 ...bindResultFields,
             }),
             exitCode: EXIT_OK,
-            diagnostics: [...diagnostics, `transient ${delivered.code}; remains queued`],
+            diagnostics: [
+                ...diagnostics,
+                `transient ${delivered.code}${formatDeliveryDetails(details)}; remains queued`,
+            ],
             statePath,
             outboxOperationId: outboxOp.operationId,
         };
     }
-    markOutboxQuarantined(outboxOp.operationId, deps.root, delivered.code, nowFn);
+    const details = sanitizeOutboxErrorDetails(delivered);
+    markOutboxQuarantined(outboxOp.operationId, deps.root, delivered.code, nowFn, details);
     return {
         result: resultOf({
             kind: "error",
@@ -1007,13 +1017,24 @@ export async function reconcileObservation(obs, deps) {
             projectId,
             taskId,
             errorCode: delivered.code,
+            ...details,
             ...bindResultFields,
         }),
         exitCode: EXIT_OK,
-        diagnostics: [...diagnostics, `quarantined: ${delivered.code}`],
+        diagnostics: [
+            ...diagnostics,
+            `quarantined: ${delivered.code}${formatDeliveryDetails(details)}`,
+        ],
         statePath,
         outboxOperationId: outboxOp.operationId,
     };
 }
+function formatDeliveryDetails(details) {
+    const parts = [
+        details.httpStatus !== undefined ? `HTTP ${details.httpStatus}` : "",
+        details.serverCode ?? "",
+    ].filter(Boolean);
+    return parts.length ? ` (${parts.join(" ")})` : "";
+}
 export { replayOutbox };
 //# sourceMappingURL=reconcile.js.map

package/dist/main.d.ts

@@ -12,6 +12,25 @@ import { upgradeToTeam } from "./utils/team-upgrade.js";
  * finalization; command execution itself does not consume this allowance.
  */
 export declare const FOREGROUND_NETWORK_BUDGET_MS = 1500;
+/**
+ * Shared accounting for awaited foreground network work. Each lifecycle phase
+ * debits only the bounded await it performs; ordinary command runtime leaves
+ * the allowance untouched. Earlier phases reserve the finalization floor, so
+ * error flushing cannot disappear after a long command.
+ */
+declare class ForegroundNetworkBudget {
+    private readonly budgetMs;
+    private readonly now;
+    private consumedMs;
+    constructor(budgetMs?: number, now?: () => number);
+    timeoutFor(phaseMaximumMs: number, reservedMs?: number): number;
+    waitFor<T>(phaseMaximumMs: number, reservedMs: number, work: (timeoutMs: number) => Promise<T>): Promise<T | undefined>;
+}
+/** Create a shared invocation budget; exported so the time accounting is directly testable. */
+export declare function createForegroundNetworkBudget(options?: {
+    budgetMs?: number;
+    now?: () => number;
+}): ForegroundNetworkBudget;
 export type StreamErrorDependencies = {
     stderr: Pick<typeof process.stderr, "write">;
     exit: (code: number) => void;
@@ -30,4 +49,5 @@ export type TopLevelErrorDependencies = {
 };
 /** Classify a top-level failure without making the CLI process boundary opaque to tests. */
 export declare function handleTopLevelError(err: unknown, deps?: TopLevelErrorDependencies): Promise<void>;
+export {};
 //# sourceMappingURL=main.d.ts.map