@indigoai-us/hq-cli 5.312.0 → 5.312.1

package/dist/fast-core.js

@@ -59,12 +59,13 @@ export async function runFastCore(argv) {
         if (typeof handler !== "function") {
             throw new Error(`Native fast handler ${entry.exportName} was not exported`);
         }
+        const readsStdin = entry.readsStdinFor?.(parsed.args) ?? entry.readsStdin ?? false;
         const chunks = [];
-        if (entry.readsStdin) {
+        if (readsStdin) {
             for await (const chunk of process.stdin)
                 chunks.push(chunk);
         }
-        const code = await handler(parsed.args, entry.readsStdin ? Buffer.concat(chunks).toString("utf8") : "", process.cwd(), hqRoot, entry.name.split(" ").at(-1) ?? entry.name, parsed.hqRootArg);
+        const code = await handler(parsed.args, readsStdin ? Buffer.concat(chunks).toString("utf8") : "", process.cwd(), hqRoot, entry.name.split(" ").at(-1) ?? entry.name, parsed.hqRootArg);
         // Let Node drain handler output before terminating. The timeout guard's
         // stderr message must survive the native route's process boundary.
         process.exitCode = code;
@@ -80,12 +81,18 @@ export async function runFastCore(argv) {
         : process.cwd();
     const injectRoot = entry.kind === "shell" || entry.kind === "native" &&
         (entry.shellHqRoot === "live" || entry.shellHqRoot === "reconcile-default" && shouldInjectRoot);
+    const childEnv = {
+        ...(entry.name === "hq-session" ? { HQ_HQ_SESSION_NO_CLI: "1" } : {}),
+        ...(entry.name === "migrate-policy-triggers"
+            ? { CLAUDE_PROJECT_DIR: process.env.CLAUDE_PROJECT_DIR || process.cwd() }
+            : {}),
+    };
     const { code } = runBundledScript({
         asset,
         args: parsed.args,
         cwd,
         ...(injectRoot ? { hqRoot } : {}),
-        env: entry.name === "hq-session" ? { HQ_HQ_SESSION_NO_CLI: "1" } : undefined,
+        ...(Object.keys(childEnv).length ? { env: childEnv } : {}),
     });
     // Propagate verbatim: these scripts use their exit code as their interface.
     process.exit(code);

package/dist/fast-scaffold.d.ts

@@ -40,6 +40,8 @@ export type FastScaffoldScript = {
     shellHqRoot?: "none" | "live" | "reconcile-default";
     /** Whether this handler consumes stdin. Shell companions inherit stdin directly. */
     readsStdin?: boolean;
+    /** Per-invocation stdin policy for handlers whose shell reads conditionally. */
+    readsStdinFor?: (args: readonly string[]) => boolean;
     /** Whether the bundled fast-route module closure needs Node's network timeout patch. */
     requiresNodeNetworkCompatibility?: boolean;
 };

package/dist/fast-scaffold.js

@@ -184,6 +184,17 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         shellCwd: "live",
         shellHqRoot: "live",
     },
+    ...[
+        { name: "eval-trigger", modulePath: "./commands/core-eval-trigger-native.js", exportName: "runEvalTriggerFast", asset: "core/scripts/eval-trigger.sh", root: "cwd", shellCwd: "caller", shellHqRoot: "none", readsStdinFor: (args) => args[0] === "--check" },
+        { name: "migrate-policy-triggers", modulePath: "./commands/core-migrate-policy-triggers-native.js", exportName: "runMigratePolicyTriggersFast", asset: "core/scripts/migrate-policy-triggers.sh", root: "live", shellCwd: "caller", shellHqRoot: "live" },
+        { name: "register-project", modulePath: "./commands/core-register-project-native.js", exportName: "runRegisterProjectFast", asset: "core/scripts/register-project.sh", root: "live", shellCwd: "caller", shellHqRoot: "live" },
+        { name: "work-mesh-live-rebind", modulePath: "./commands/core-work-mesh-live-rebind-native.js", exportName: "runWorkMeshLiveRebindFast", asset: "core/scripts/work-mesh-live-rebind.sh", root: "live", shellCwd: "caller", shellHqRoot: "live" },
+    ].map((entry) => ({
+        ...entry,
+        kind: "native",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-hook-helpers",
+    })),
     ...["resolve", "pickup", "repo", "secrets", "transfer"].map((name) => ({
         name: `delegate ${name}`,
         kind: "native",

package/dist/lib/agents/model-catalog.d.ts

@@ -1,6 +1,6 @@
 export declare const AGENT_MODEL_PROVIDERS: readonly ["codex", "grok", "claude"];
 export type AgentModelProvider = (typeof AGENT_MODEL_PROVIDERS)[number];
-export interface AgentCatalogModel {
+interface AgentCatalogModel {
     id: string;
     label: string;
     visibility: string;
@@ -10,7 +10,7 @@ export interface AgentCatalogModel {
     selectable: boolean;
     unavailableReason?: string | null;
 }
-export interface AgentCatalogProvider {
+interface AgentCatalogProvider {
     models: AgentCatalogModel[];
     defaultModel: string;
 }
@@ -58,4 +58,5 @@ export declare function validateAgentModelSelection(catalog: AgentModelCatalog,
 export declare function modelSelectionErrorMessage(modelId: string, result: Extract<ModelSelectionResult, {
     ok: false;
 }>): string;
+export {};
 //# sourceMappingURL=model-catalog.d.ts.map

package/dist/lib/company-skill-wrapper.d.ts

@@ -1,12 +1,4 @@
 import * as fs from "node:fs";
-export interface CompanySkillWrapperOwnershipDiagnostics {
-    kind: "directory" | "symlink" | "file" | "other";
-    bridgeState: "all_live" | "partial" | "none" | "empty" | "not_applicable";
-    markerState: "bound" | "missing" | "invalid" | "unbound" | "unavailable" | "not_applicable";
-    linkTarget: "company_skills" | "outside_company_skills" | "unavailable" | "not_applicable";
-    platform: "win32" | "darwin" | "linux" | "other";
-    nameEncoding: "percent_encoded" | "literal";
-}
 export declare function companySkillWrapperSentryTagsFor(error: unknown): Record<string, string> | undefined;
 export interface SurfaceCompanySkillInput {
     hqRoot: string;

package/dist/lib/core-utils/codex-skill-bridge.d.ts

@@ -1,4 +1,4 @@
-export type BridgeCommand = "status" | "install" | "doctor";
+type BridgeCommand = "status" | "install" | "doctor";
 export type BridgeOptions = {
     command: BridgeCommand;
     hqRoot: string;
@@ -28,4 +28,5 @@ export declare function isHqRootLike(candidate: string): boolean;
 export declare function outputStyleSlug(name: string): string;
 /** Runs one bridge command; returns the process exit code. */
 export declare function runCodexSkillBridge(options: BridgeOptions, io: BridgeIo): number;
+export {};
 //# sourceMappingURL=codex-skill-bridge.d.ts.map

package/dist/lib/deploy-api.d.ts

@@ -1,6 +1,5 @@
 /** Shared authenticated request path for the hq-deploy control plane. */
 export declare const DEPLOY_API_URL: string;
 export declare function deployHeaders(token: string, json?: boolean, extra?: Record<string, string>): Record<string, string>;
-export declare function deployApiUrl(route: string): string;
 export declare function deployApiRequest(token: string, route: string, method: string, body?: unknown, extraHeaders?: Record<string, string>): Promise<Response>;
 //# sourceMappingURL=deploy-api.d.ts.map

package/dist/lib/deploy-api.js

@@ -8,7 +8,7 @@ export function deployHeaders(token, json = true, extra = {}) {
         ...extra,
     };
 }
-export function deployApiUrl(route) {
+function deployApiUrl(route) {
     return `${DEPLOY_API_URL.replace(/\/+$/, "")}${route}`;
 }
 export async function deployApiRequest(token, route, method, body, extraHeaders = {}) {

package/dist/lib/doctor/checks/work-context.js

@@ -89,12 +89,20 @@ function runChecks(deps) {
         message: `Outbox queued depth=${stats.depth} (acked=${stats.acked}).`,
     });
     const showQuarantineReason = stats.quarantined > 0 && outboxQuarantineStatusEnabled();
+    const quarantineDetails = [
+        stats.lastQuarantineHttpStatus !== null
+            ? `HTTP ${stats.lastQuarantineHttpStatus}`
+            : "",
+        stats.lastQuarantineServerCode ?? "",
+    ]
+        .filter(Boolean)
+        .join(" ");
     results.push({
         status: stats.quarantined > 0 ? "WARN" : "PASS",
         checkId: "work-context.outbox-quarantined",
         target: path.join(root, "outbox"),
         message: `Outbox quarantined count=${stats.quarantined}${showQuarantineReason
-            ? ` (last reason=${stats.lastQuarantineReason ?? "unknown"})`
+            ? ` (last reason=${stats.lastQuarantineReason ?? "unknown"}${quarantineDetails ? `; ${quarantineDetails}` : ""})`
             : ""}.`,
     });
     // Default-company mode + migration capability (US-017B)

package/dist/lib/mesh/client.js

@@ -4,6 +4,7 @@
  * vault HTTP + receipt-shaped responses (US-007A / US-007B).
  */
 import { listActiveMembershipCompanies, meshJson, requireToken, resolveMeshCompany, } from "./api.js";
+import { isWorkSessionDenialCode } from "./denial-codes.js";
 export { meshJson, requireToken, resolveMeshCompany, listActiveMembershipCompanies };
 export async function openMeshTransport(opts) {
     const token = await requireToken();
@@ -50,11 +51,28 @@ export function createWorkSessionDeliverer(opts) {
             const message = err instanceof Error ? err.message : String(err);
             // meshJson throws on !ok with error text; classify by leading status when present.
             const statusMatch = /^(\d{3})\b/.exec(message);
-            if (statusMatch) {
-                const status = Number(statusMatch[1]);
-                if (status === 401 || status === 403) {
-                    return { ok: false, retryable: false, code: "AUTH_DENIED" };
-                }
+            const errorFields = err && typeof err === "object"
+                ? err
+                : {};
+            const status = typeof errorFields.status === "number" &&
+                Number.isInteger(errorFields.status)
+                ? errorFields.status
+                : statusMatch
+                    ? Number(statusMatch[1])
+                    : undefined;
+            if (status === 401 || status === 403) {
+                const serverCode = isWorkSessionDenialCode(errorFields.code)
+                    ? errorFields.code
+                    : undefined;
+                return {
+                    ok: false,
+                    retryable: false,
+                    code: "AUTH_DENIED",
+                    httpStatus: status,
+                    ...(serverCode ? { serverCode } : {}),
+                };
+            }
+            if (status !== undefined) {
                 if (status === 400 || status === 422) {
                     return { ok: false, retryable: false, code: "VALIDATION_FAILED" };
                 }

package/dist/lib/mesh/denial-codes.d.ts

@@ -0,0 +1,5 @@
+/** Explicit 401/403 codes returned by hq-pro's work-session registration path. */
+export declare const WORK_SESSION_DENIAL_CODES: readonly ["AUTH_REQUIRED", "AGENT_IDENTITY_UNVERIFIED", "IMPERSONATION_FORBIDDEN", "NO_PERSON_ENTITY", "INVALID_COMPANY", "WORK_REGISTRY_DISABLED"];
+export type WorkSessionDenialCode = (typeof WORK_SESSION_DENIAL_CODES)[number];
+export declare function isWorkSessionDenialCode(value: unknown): value is WorkSessionDenialCode;
+//# sourceMappingURL=denial-codes.d.ts.map

package/dist/lib/mesh/denial-codes.js

@@ -0,0 +1,14 @@
+/** Explicit 401/403 codes returned by hq-pro's work-session registration path. */
+export const WORK_SESSION_DENIAL_CODES = [
+    "AUTH_REQUIRED",
+    "AGENT_IDENTITY_UNVERIFIED",
+    "IMPERSONATION_FORBIDDEN",
+    "NO_PERSON_ENTITY",
+    "INVALID_COMPANY",
+    "WORK_REGISTRY_DISABLED",
+];
+export function isWorkSessionDenialCode(value) {
+    return typeof value === "string" &&
+        WORK_SESSION_DENIAL_CODES.includes(value);
+}
+//# sourceMappingURL=denial-codes.js.map

package/dist/lib/mesh/live/daemon/doctor.d.ts

@@ -27,6 +27,8 @@ export interface DaemonDoctorReport {
     outboxDepth: number;
     outboxQuarantined?: number;
     outboxLastQuarantineReason?: string;
+    outboxLastQuarantineHttpStatus?: number;
+    outboxLastQuarantineServerCode?: string;
     lastFlushAt?: string;
     lastFlushResult?: DaemonStateFile["lastFlushResult"];
     unhealthy: boolean;

package/dist/lib/mesh/live/daemon/doctor.js

@@ -263,6 +263,8 @@ export function collectDaemonDoctor(deps = {}) {
             ? {
                 outboxQuarantined: outbox.quarantined,
                 outboxLastQuarantineReason: outbox.lastQuarantineReason ?? undefined,
+                outboxLastQuarantineHttpStatus: outbox.lastQuarantineHttpStatus ?? undefined,
+                outboxLastQuarantineServerCode: outbox.lastQuarantineServerCode ?? undefined,
             }
             : {}),
         lastFlushAt: state?.lastFlushAt,
@@ -310,7 +312,15 @@ export function formatDaemonDoctor(report) {
         lines.push(`spool depth: ${report.spoolDepth}`, `held: ${report.heldCount}${report.heldCount > 0 ? " (needs_company; not sent as NONE)" : ""}`, `held with no local evidence: ${report.heldWithNoLocalEvidence}`, `outbox depth: ${report.outboxDepth}`);
     }
     if (report.outboxQuarantined !== undefined) {
-        lines.push(`outbox quarantined: ${report.outboxQuarantined} (last reason=${report.outboxLastQuarantineReason ?? "unknown"})`);
+        const quarantineDetails = [
+            report.outboxLastQuarantineHttpStatus !== undefined
+                ? `HTTP ${report.outboxLastQuarantineHttpStatus}`
+                : "",
+            report.outboxLastQuarantineServerCode ?? "",
+        ]
+            .filter(Boolean)
+            .join(" ");
+        lines.push(`outbox quarantined: ${report.outboxQuarantined} (last reason=${report.outboxLastQuarantineReason ?? "unknown"}${quarantineDetails ? `; ${quarantineDetails}` : ""})`);
     }
     if (report.emitMode !== "legacy" && report.heldCount > 0) {
         lines.push(`held: ${report.heldCount} (needs_company; not sent as NONE)`);

package/dist/lib/report-run.d.ts

@@ -8,12 +8,12 @@ export type DigestSignal = {
     kind: string;
     text: string;
 };
-export type FocusItem = {
+type FocusItem = {
     title: string;
     project: string;
     reason: string;
 };
-export type ReportRunRecord = {
+type ReportRunRecord = {
     generatedAt: string;
     inputs: {
         template: string;
@@ -58,4 +58,5 @@ export declare function renderDailyDigest(input: {
     generatedAt?: string;
 }): DigestPage;
 export declare function writeDigestPage(directory: string, page: DigestPage): void;
+export {};
 //# sourceMappingURL=report-run.d.ts.map

package/dist/lib/report-templates.d.ts

@@ -3,7 +3,6 @@ export type ReportTemplate = {
     path: string;
     body: string;
 };
-export declare function reportPackageRoot(): string;
 export declare function listReportTemplates(root?: string): ReportTemplate[];
 /** Verbatim runbook. Callers substitute `<reportId>` when the id is known. */
 export declare function loadUpdateReportRunbook(root?: string): string;

package/dist/lib/report-templates.js

@@ -3,9 +3,6 @@ import { readdirSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
-export function reportPackageRoot() {
-    return PACKAGE_ROOT;
-}
 export function listReportTemplates(root = PACKAGE_ROOT) {
     const dir = path.join(root, "templates", "reports");
     return readdirSync(dir)

package/dist/lib/scaffold-cli-floor.d.ts

@@ -1,4 +1,3 @@
-export declare const SCAFFOLD_CLI_UPGRADE_COMMAND = "npm install -g @indigoai-us/hq-cli@latest";
 export type ScaffoldCliFloorComparison = {
     status: "pass" | "fail" | "warn" | "skip";
     message: string;

package/dist/lib/scaffold-cli-floor.js

@@ -1,5 +1,5 @@
 import semver from "semver";
-export const SCAFFOLD_CLI_UPGRADE_COMMAND = "npm install -g @indigoai-us/hq-cli@latest";
+const SCAFFOLD_CLI_UPGRADE_COMMAND = "npm install -g @indigoai-us/hq-cli@latest";
 const MINIMUM_VERSION_RANGE = /^>=(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
 /** Compare an installed CLI version with the scaffold's supported floor. */
 export function compareScaffoldCliFloor(required, currentVersion) {

package/dist/lib/search-index/embed-lock.d.ts

@@ -4,6 +4,8 @@ export type EmbedLockDependencies = {
     pid: number;
     random: () => string;
     isProcessAlive: (pid: number) => boolean;
+    /** Test seam for a contender arriving after mkdir and before owner publication. */
+    beforeOwnerPublish?: (ownerFile: string) => void;
     /** Test seam for simulating a competing owner replacing the atomic record. */
     afterOwnerPublish?: (ownerFile: string) => void;
 };

package/dist/lib/search-index/embed-lock.js

@@ -184,8 +184,13 @@ function createAndPublishLock(home, dependencies) {
         // parity: the script's write_owner_record honored the same variable.
         if (dependencies.env.QMD_FORCE_OWNER_WRITE_FAIL)
             throw new Error('forced owner write failure');
+        dependencies.beforeOwnerPublish?.(ownerFile);
         fs.writeFileSync(temporary, `pid=${dependencies.pid}\nts=${dependencies.now()}\nnonce=${nonce}\n`);
-        fs.renameSync(temporary, ownerFile);
+        // renameSync replaces an existing owner on POSIX. A stale reclaim can
+        // replace this ownerless directory while this publisher is paused, so
+        // publish only if this exact generation still has no owner.
+        fs.linkSync(temporary, ownerFile);
+        fs.unlinkSync(temporary);
         dependencies.afterOwnerPublish?.(ownerFile);
         const verified = readOwner(directory);
         if (!verified || verified.pid !== dependencies.pid || verified.nonce !== nonce)
@@ -196,6 +201,10 @@ function createAndPublishLock(home, dependencies) {
     catch {
         // The marker identifies only the directory this process created. Do not
         // recursively remove the fixed lock path after a failed publication.
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch { /* absent after link or moved with a stale generation */ }
         fs.rmSync(marker, { recursive: true, force: true });
         removeDirectoryIfEmpty(directory);
         return false;

package/dist/lib/work-context/contract.d.ts

@@ -61,6 +61,9 @@ export interface ContextResult {
     bindingEpisodeId?: string;
     clientOperationId: string;
     errorCode?: string;
+    /** Sanitized HTTP denial details; raw response bodies are never included. */
+    httpStatus?: number;
+    serverCode?: string;
     /** Why a project was chosen, or why the session is asking. Local consumers only. */
     projectBindReason?: string;
     /** Ranked alternatives when classification is needs_project. */

package/dist/lib/work-context/contract.schema.json

@@ -100,7 +100,9 @@
         "taskId": { "type": "string", "maxLength": 128 },
         "bindingEpisodeId": { "type": "string", "maxLength": 128 },
         "clientOperationId": { "type": "string", "minLength": 1, "maxLength": 128 },
-        "errorCode": { "type": "string", "maxLength": 64 }
+        "errorCode": { "type": "string", "maxLength": 64 },
+        "httpStatus": { "type": "number" },
+        "serverCode": { "type": "string", "maxLength": 64 }
       }
     }
   }

package/dist/lib/work-context/outbox.d.ts

@@ -5,7 +5,7 @@
 import type { DeliveryState } from "./contract.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 /** Fields allowed on a durable outbox operation (privacy allowlist). */
-export declare const OUTBOX_ALLOWLIST: readonly ["contractVersion", "operationId", "clientOperationId", "sessionId", "harness", "companyUid", "companySlug", "projectId", "taskId", "companyConfidence", "kind", "digest", "delivery", "createdAt", "updatedAt", "attemptCount", "lastErrorCode", "receiptId", "destinationCompanyUid", "destinationCompanySlug", "nextAttemptAt"];
+export declare const OUTBOX_ALLOWLIST: readonly ["contractVersion", "operationId", "clientOperationId", "sessionId", "harness", "companyUid", "companySlug", "projectId", "taskId", "companyConfidence", "kind", "digest", "delivery", "createdAt", "updatedAt", "attemptCount", "lastErrorCode", "lastErrorHttpStatus", "lastServerErrorCode", "receiptId", "destinationCompanyUid", "destinationCompanySlug", "nextAttemptAt"];
 /** Base delay for outbox retry backoff (attempt 1 → 30s). */
 export declare const OUTBOX_RETRY_BASE_MS = 30000;
 /** Cap for outbox retry backoff (6 hours). */
@@ -34,6 +34,8 @@ export interface OutboxOperation {
     updatedAt: string;
     attemptCount: number;
     lastErrorCode?: string;
+    lastErrorHttpStatus?: number;
+    lastServerErrorCode?: string;
     receiptId?: string;
     /** Destination company for kind=migrate (source is companyUid). */
     destinationCompanyUid?: string;
@@ -88,8 +90,13 @@ export declare function markOutboxAcked(operationId: string, root: string, recei
 export declare function writeAckedRegisterState(op: OutboxOperation, root: string, receiptId: string, now?: () => Date): void;
 /** Repair older unresolved session projections from acknowledged registrations. */
 export declare function repairAckedRegisterStates(root: string, sessionIds?: ReadonlySet<string>, now?: () => Date): number;
-export declare function markOutboxQueued(operationId: string, root: string, errorCode: string, now?: () => Date, random?: () => number): OutboxOperation | null;
-export declare function markOutboxQuarantined(operationId: string, root: string, errorCode: string, now?: () => Date): OutboxOperation | null;
+export declare function markOutboxQueued(operationId: string, root: string, errorCode: string, now?: () => Date, random?: () => number, details?: OutboxErrorDetails): OutboxOperation | null;
+export declare function markOutboxQuarantined(operationId: string, root: string, errorCode: string, now?: () => Date, details?: OutboxErrorDetails): OutboxOperation | null;
+export interface OutboxErrorDetails {
+    httpStatus?: number;
+    serverCode?: string;
+}
+export declare function sanitizeOutboxErrorDetails(details?: OutboxErrorDetails): OutboxErrorDetails;
 /**
  * Requeue quarantined outbox operations so the daemon's replay picks them up
  * again. Quarantine is otherwise terminal: after the work-mesh-live gap 10 fix
@@ -119,16 +126,18 @@ export interface OutboxStats {
     queued: number;
     acked: number;
     lastQuarantineReason: string | null;
+    lastQuarantineHttpStatus: number | null;
+    lastQuarantineServerCode: string | null;
 }
 export declare function outboxStats(root: string): OutboxStats;
 export type DeliverFn = (op: OutboxOperation) => Promise<{
     ok: true;
     receiptId: string;
-} | {
+} | ({
     ok: false;
     retryable: boolean;
     code: string;
-}>;
+} & OutboxErrorDetails)>;
 /**
  * Replay queued (and recover lost-receipt) operations.
  * FIFO per sessionId; bounded parallelism across sessions.

package/dist/lib/work-context/outbox.js

@@ -8,6 +8,7 @@ import * as path from "node:path";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 import { atomicWriteJson, ensureOwnerDir } from "./atomic.js";
 import { NotTrackingError } from "./errors.js";
+import { isWorkSessionDenialCode } from "../mesh/denial-codes.js";
 import { readSessionState, stripRegisterReceiptEpisodes, updateSessionState, writeAcknowledgedRegisterBinding, } from "./state.js";
 import { isSafeWorkContextSegment, workContextOutboxDir, workContextOutboxPath, } from "./paths.js";
 /** Fields allowed on a durable outbox operation (privacy allowlist). */
@@ -29,6 +30,8 @@ export const OUTBOX_ALLOWLIST = [
     "updatedAt",
     "attemptCount",
     "lastErrorCode",
+    "lastErrorHttpStatus",
+    "lastServerErrorCode",
     "receiptId",
     "destinationCompanyUid",
     "destinationCompanySlug",
@@ -101,6 +104,11 @@ function projectOutbox(op) {
         out.companyConfidence = op.companyConfidence;
     if (op.lastErrorCode)
         out.lastErrorCode = op.lastErrorCode;
+    if (op.lastErrorHttpStatus !== undefined) {
+        out.lastErrorHttpStatus = op.lastErrorHttpStatus;
+    }
+    if (op.lastServerErrorCode)
+        out.lastServerErrorCode = op.lastServerErrorCode;
     if (op.receiptId)
         out.receiptId = op.receiptId;
     if (op.destinationCompanyUid) {
@@ -337,12 +345,13 @@ export function repairAckedRegisterStates(root, sessionIds, now = () => new Date
     }
     return repaired;
 }
-export function markOutboxQueued(operationId, root, errorCode, now = () => new Date(), random = Math.random) {
+export function markOutboxQueued(operationId, root, errorCode, now = () => new Date(), random = Math.random, details) {
     const op = readOutboxOperation(operationId, root);
     if (!op)
         return null;
     op.delivery = "queued";
     op.lastErrorCode = errorCode;
+    applyOutboxErrorDetails(op, details);
     op.attemptCount += 1;
     const at = now();
     op.updatedAt = at.toISOString();
@@ -351,17 +360,40 @@ export function markOutboxQueued(operationId, root, errorCode, now = () => new D
     updateOutboxOperation(op, root);
     return op;
 }
-export function markOutboxQuarantined(operationId, root, errorCode, now = () => new Date()) {
+export function markOutboxQuarantined(operationId, root, errorCode, now = () => new Date(), details) {
     const op = readOutboxOperation(operationId, root);
     if (!op)
         return null;
     op.delivery = "quarantined";
     op.lastErrorCode = errorCode;
+    applyOutboxErrorDetails(op, details);
     op.attemptCount += 1;
     op.updatedAt = now().toISOString();
     updateOutboxOperation(op, root);
     return op;
 }
+function applyOutboxErrorDetails(op, details) {
+    delete op.lastErrorHttpStatus;
+    delete op.lastServerErrorCode;
+    const safe = sanitizeOutboxErrorDetails(details);
+    if (safe.httpStatus !== undefined)
+        op.lastErrorHttpStatus = safe.httpStatus;
+    if (safe.serverCode !== undefined)
+        op.lastServerErrorCode = safe.serverCode;
+}
+export function sanitizeOutboxErrorDetails(details) {
+    const safe = {};
+    if (details?.httpStatus !== undefined &&
+        Number.isInteger(details.httpStatus) &&
+        details.httpStatus >= 100 &&
+        details.httpStatus <= 599) {
+        safe.httpStatus = details.httpStatus;
+    }
+    if (isWorkSessionDenialCode(details?.serverCode)) {
+        safe.serverCode = details.serverCode;
+    }
+    return safe;
+}
 /**
  * Requeue quarantined outbox operations so the daemon's replay picks them up
  * again. Quarantine is otherwise terminal: after the work-mesh-live gap 10 fix
@@ -389,6 +421,8 @@ export function requeueQuarantinedOutbox(root, opts = {}) {
         op.delivery = "queued";
         op.attemptCount = 0;
         op.lastErrorCode = undefined;
+        op.lastErrorHttpStatus = undefined;
+        op.lastServerErrorCode = undefined;
         op.nextAttemptAt = undefined;
         op.updatedAt = now().toISOString();
         updateOutboxOperation(op, root);
@@ -469,6 +503,15 @@ export function outboxStats(root) {
         queued: ops.filter((o) => o.delivery === "queued").length,
         acked: ops.filter((o) => o.delivery === "acked").length,
         lastQuarantineReason: latestQuarantine?.lastErrorCode ?? null,
+        lastQuarantineHttpStatus: latestQuarantine &&
+            Number.isInteger(latestQuarantine.lastErrorHttpStatus) &&
+            latestQuarantine.lastErrorHttpStatus >= 100 &&
+            latestQuarantine.lastErrorHttpStatus <= 599
+            ? latestQuarantine.lastErrorHttpStatus
+            : null,
+        lastQuarantineServerCode: isWorkSessionDenialCode(latestQuarantine?.lastServerErrorCode)
+            ? latestQuarantine.lastServerErrorCode
+            : null,
     };
 }
 function isOutboxDue(op, nowIso) {
@@ -551,18 +594,18 @@ export async function replayOutbox(root, deliver, opts = {}) {
             }
             else if (result.retryable) {
                 if (op.attemptCount + 1 >= OUTBOX_MAX_ATTEMPTS) {
-                    markOutboxQuarantined(op.operationId, root, `${result.code}_MAX_ATTEMPTS`, now);
+                    markOutboxQuarantined(op.operationId, root, `${result.code}_MAX_ATTEMPTS`, now, result);
                     quarantined += 1;
                 }
                 else {
-                    markOutboxQueued(op.operationId, root, result.code, now, random);
+                    markOutboxQueued(op.operationId, root, result.code, now, random, result);
                     queued += 1;
                 }
                 // Stop this session's FIFO on transient failure.
                 break;
             }
             else {
-                markOutboxQuarantined(op.operationId, root, result.code, now);
+                markOutboxQuarantined(op.operationId, root, result.code, now, result);
                 quarantined += 1;
                 break;
             }

package/dist/lib/work-context/reconcile.js

@@ -14,7 +14,7 @@ import { refineProjectBinding } from "./bind-best.js";
 import { rebindNeedsProjectOnPrompt } from "./prompt-rebind.js";
 import { resolveProjectTask, shouldAskAfter } from "./project.js";
 import { deriveRemoteOwnerSlug, deriveRepoIdentityKey } from "./repo-remote.js";
-import { enqueueOutbox, listOutboxOperations, markOutboxAcked, markOutboxQuarantined, markOutboxQueued, replayOutbox, writeAckedRegisterState, } from "./outbox.js";
+import { enqueueOutbox, listOutboxOperations, markOutboxAcked, markOutboxQuarantined, markOutboxQueued, replayOutbox, sanitizeOutboxErrorDetails, writeAckedRegisterState, } from "./outbox.js";
 import { mergeLocalSessionFields, isRegisterReceiptEpisodeId, readSessionState, stripRegisterReceiptEpisodes, writeSessionState, } from "./state.js";
 function resultOf(parts) {
     const out = {
@@ -38,6 +38,10 @@ function resultOf(parts) {
         out.bindingEpisodeId = parts.bindingEpisodeId;
     if (parts.errorCode)
         out.errorCode = parts.errorCode;
+    if (parts.httpStatus !== undefined)
+        out.httpStatus = parts.httpStatus;
+    if (parts.serverCode)
+        out.serverCode = parts.serverCode;
     if (parts.projectBindReason)
         out.projectBindReason = parts.projectBindReason;
     if (parts.projectCandidates)
@@ -974,7 +978,8 @@ export async function reconcileObservation(obs, deps) {
         };
     }
     if (delivered.retryable) {
-        markOutboxQueued(outboxOp.operationId, deps.root, delivered.code, nowFn);
+        const details = sanitizeOutboxErrorDetails(delivered);
+        markOutboxQueued(outboxOp.operationId, deps.root, delivered.code, nowFn, undefined, details);
         return {
             result: resultOf({
                 kind: "queued",
@@ -986,15 +991,20 @@ export async function reconcileObservation(obs, deps) {
                 projectId,
                 taskId,
                 errorCode: delivered.code,
+                ...details,
                 ...bindResultFields,
             }),
             exitCode: EXIT_OK,
-            diagnostics: [...diagnostics, `transient ${delivered.code}; remains queued`],
+            diagnostics: [
+                ...diagnostics,
+                `transient ${delivered.code}${formatDeliveryDetails(details)}; remains queued`,
+            ],
             statePath,
             outboxOperationId: outboxOp.operationId,
         };
     }
-    markOutboxQuarantined(outboxOp.operationId, deps.root, delivered.code, nowFn);
+    const details = sanitizeOutboxErrorDetails(delivered);
+    markOutboxQuarantined(outboxOp.operationId, deps.root, delivered.code, nowFn, details);
     return {
         result: resultOf({
             kind: "error",
@@ -1007,13 +1017,24 @@ export async function reconcileObservation(obs, deps) {
             projectId,
             taskId,
             errorCode: delivered.code,
+            ...details,
             ...bindResultFields,
         }),
         exitCode: EXIT_OK,
-        diagnostics: [...diagnostics, `quarantined: ${delivered.code}`],
+        diagnostics: [
+            ...diagnostics,
+            `quarantined: ${delivered.code}${formatDeliveryDetails(details)}`,
+        ],
         statePath,
         outboxOperationId: outboxOp.operationId,
     };
 }
+function formatDeliveryDetails(details) {
+    const parts = [
+        details.httpStatus !== undefined ? `HTTP ${details.httpStatus}` : "",
+        details.serverCode ?? "",
+    ].filter(Boolean);
+    return parts.length ? ` (${parts.join(" ")})` : "";
+}
 export { replayOutbox };
 //# sourceMappingURL=reconcile.js.map