@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/lib/lanes/spawn.js

@@ -1,2668 +0,0 @@
-/**
- * Detached lane-worker spawn (spec §5, §5.1, §5.4, §5.5).
- *
- * The worker must leave the caller's process tree (`detached: true` / setsid)
- * with stdio pointed at files in the run directory. Account selection is the
- * provider home environment variable only. Provider credential files are
- * probed for existence and never read. Identity in the child is `HQ_LANE_ID`;
- * mutable fields are re-read from the lane record (spec §5.4).
- */
-import { spawn, spawnSync } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { fileURLToPath } from "node:url";
-import { PROVIDER_HOME_ENV, accountStatus, isLoggedOut, resolveAccount, selectBalancedAccount, } from "./accounts.js";
-import { effectiveAccountHome } from "./account-home.js";
-import { buildHostCapacitySnapshot } from "./host-capacity.js";
-import { selectClaudeAccount } from "./claude-balance.js";
-import { loadQuotaState } from "./quota.js";
-import { COMPACTION_PROMPT, compactionAfterUsage, compactionDue, compactLaneSession, } from "./compaction.js";
-import { installDrainHook } from "./hooks-install.js";
-import { loadLanesConfig, providerAutoCompactTokens, providerCompactAfterMs, } from "./config.js";
-import { appendEffortFlag, resolveLaneEffort, } from "./effort.js";
-import { defaultProbe, validateLaneModel, validateProfileLaneModel, } from "./models.js";
-import { claimableStatesFor, planLaneLaunch, providerSupportsSessionResume, } from "./delivery.js";
-import { AccountResolutionError, LanesError } from "./errors.js";
-import { ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, materializeWorkerProfile, workerProfilePrompt, } from "./profile.js";
-import { registryWorkerRecord } from "./registry-persona.js";
-import { resolveMachineIdentity, } from "./machine-identity.js";
-import { appendCappedHistory, listLaneIds, readLane, retryUpdateLane } from "./store.js";
-import { managerStatusGateHeartbeat } from "./manager-status-gate.js";
-import { LEAD_LANE_KEEP_ALIVE_BLOCKED_RESUME_TEXT } from "./keep-alive.js";
-import { copySessionFiles, planSessionCopy } from "./move-account.js";
-import { ensureSessionHome } from "./session-relink.js";
-import { MESSAGE_REPLAY_STATE_NAME } from "./message-replay.js";
-import { markAnsweredQuestionsDelivered } from "./questions.js";
-import { hasEarlierEligibleQueuedLane, laneAdmissionCapReason, withLaneAdmissionLock, } from "./admission.js";
-import { resolveAdmissionHost } from "./admission-host.js";
-import { checkLaneDiskSpace, lowDiskGuardEnabledForLane } from "./disk-guard.js";
-import { LANE_ENVELOPE_JSON_SCHEMA, ENVELOPE_INVALID_REASON, parseLaneProvider, } from "./types.js";
-export const LANES_RUNS_REL = path.join("workspace", "lanes-runs");
-/** Written by reconcile before a resume spawn; the worker prompt names this path. */
-export const ANSWERED_QUESTIONS_FILE = "answered-questions.json";
-export const SPAWN_TERMINAL_REASONS = [
-    "account_not_logged_in",
-    "unknown_account",
-    "account_disabled",
-    "no_enabled_account",
-    "spawn_failed",
-    "not_detached",
-    "watcher_not_armed",
-    "model_unsupported",
-];
-const PROVIDER_COMMAND = {
-    claude: "claude",
-    codex: "codex",
-    grok: "grok",
-};
-export function providerCommandOnPath(command, pathEnv) {
-    // Test and embedded callers can intentionally omit PATH and delegate lookup
-    // to their spawn implementation. A present PATH is authoritative.
-    if (pathEnv === undefined)
-        return true;
-    if (!pathEnv)
-        return false;
-    return pathEnv.split(path.delimiter).some((dir) => {
-        if (!dir)
-            return false;
-        const candidate = path.join(dir, command);
-        try {
-            fs.accessSync(candidate, fs.constants.X_OK);
-            return true;
-        }
-        catch {
-            return false;
-        }
-    });
-}
-/** Per-provider model flag. A missing entry means --model is refused. */
-export const PROVIDER_MODEL_FLAG = {
-    claude: "--model",
-    codex: "-m",
-    grok: "-m",
-};
-export const CLAUDE_AUTO_COMPACT_ENV = "CLAUDE_CODE_AUTO_COMPACT_WINDOW";
-/** Codex CLI overrides required for its ChatGPT fast service tier. */
-export const CODEX_FAST_MODE_FLAGS = [
-    "-c",
-    'service_tier="fast"',
-    "--enable",
-    "fast_mode",
-];
-export function parseCliModel(raw) {
-    if (raw === undefined)
-        return undefined;
-    const trimmed = raw.trim();
-    if (trimmed.length === 0) {
-        throw new LanesError("empty_model", "--model is empty or whitespace-only", {
-            value: raw,
-        });
-    }
-    return trimmed;
-}
-export function resolveLaneModel(input) {
-    if (input.cliModel !== undefined)
-        return input.cliModel;
-    if (input.profileModel !== undefined && input.profileModel.trim().length > 0) {
-        return input.profileModel.trim();
-    }
-    if (input.accountModel !== undefined && input.accountModel.trim().length > 0) {
-        return input.accountModel.trim();
-    }
-    if (input.providerModel !== undefined && input.providerModel.trim().length > 0) {
-        return input.providerModel.trim();
-    }
-    return undefined;
-}
-function accountModelForSpawn(provider, accountId, config, pinnedModel, profileModel) {
-    return resolveLaneModel({
-        cliModel: pinnedModel,
-        profileModel,
-        accountModel: config.providers[provider].accounts[accountId]?.model,
-        providerModel: config.providers[provider].model,
-    });
-}
-function supportsSpawnModel(provider, accountId, config, pinnedModel, profileModel, modelDeps, hostname) {
-    const account = config.providers[provider].accounts[accountId];
-    if (account === undefined)
-        return false;
-    const model = accountModelForSpawn(provider, accountId, config, pinnedModel, profileModel);
-    if (model === undefined)
-        return true;
-    try {
-        validateLaneModel(provider, model, effectiveAccountHome(account, hostname).home, modelDeps);
-        return true;
-    }
-    catch (err) {
-        if (err instanceof LanesError && err.error === "model_unsupported")
-            return false;
-        throw err;
-    }
-}
-function spawnModelFailure(provider, accountId, config, pinnedModel, profileModel, profileId, modelDeps, hostname) {
-    const account = config.providers[provider].accounts[accountId];
-    if (account === undefined)
-        return new LanesError("unknown_account", `Unknown account ${accountId} for ${provider}`, { provider, account: accountId });
-    const model = accountModelForSpawn(provider, accountId, config, pinnedModel, profileModel);
-    if (model === undefined)
-        return null;
-    try {
-        validateLaneModel(provider, model, effectiveAccountHome(account, hostname).home, modelDeps);
-        return null;
-    }
-    catch (err) {
-        if (!(err instanceof LanesError) || err.error !== "model_unsupported")
-            throw err;
-        if (profileModel !== undefined && pinnedModel === undefined && profileId !== undefined) {
-            return new LanesError(err.error, err.message, {
-                ...err.details,
-                profile_id: profileId,
-                worker_profile: profileId,
-                model_source: "profile",
-            });
-        }
-        return err;
-    }
-}
-function selectSpawnAccount(input) {
-    const { hqRoot, lane, config, existsSync, accountDeps, modelDeps, pinnedModel, profileModel, currentModelValidated, hostname, repairRecordedAccount, recordedModel, now } = input;
-    const context = {
-        hqRoot,
-        existsSync,
-        accountDeps,
-        hostname,
-        ...(pinnedModel ?? profileModel ? { model: pinnedModel ?? profileModel } : {}),
-    };
-    if (lane.account === undefined) {
-        const modelSpecified = pinnedModel !== undefined || profileModel !== undefined;
-        const allowedAccounts = modelSpecified
-            ? Object.keys(config.providers[lane.provider].accounts).filter((id) => supportsSpawnModel(lane.provider, id, config, pinnedModel, profileModel, modelDeps, hostname))
-            : undefined;
-        return {
-            account: selectBalancedAccount(lane.provider, config, {
-                ...context,
-                ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
-                preferredAccounts: config.providers[lane.provider].preferred_accounts ?? [],
-            }),
-            changeReason: "first_assignment",
-        };
-    }
-    const current = config.providers[lane.provider].accounts[lane.account];
-    let reason;
-    let refusal;
-    const operatorMovePending = lane.pending_resume !== undefined &&
-        lane.account_history?.at(-1)?.reason === "operator_move";
-    if (current === undefined || !current.enabled) {
-        reason = "account_unavailable";
-        refusal = new AccountResolutionError(current === undefined ? "unknown_account" : "account_disabled", `Account ${JSON.stringify(lane.account)} is unavailable for ${lane.provider}`, { provider: lane.provider, account: lane.account });
-    }
-    else {
-        const status = accountStatus(lane.provider, lane.account, config, {
-            existsSync,
-            hostname,
-            ...(accountDeps?.probe ? { probe: accountDeps.probe } : {}),
-            ...(accountDeps?.env ? { env: accountDeps.env } : {}),
-        });
-        if (isLoggedOut(status)) {
-            reason = repairRecordedAccount ? "recorded_account_logged_out" : "account_unavailable";
-            refusal = new LanesError("account_not_logged_in", `Account ${lane.account} for ${lane.provider} is not logged in`, { provider: lane.provider, account: lane.account });
-        }
-        else {
-            try {
-                resolveAccount(lane.provider, lane.account, config, context);
-                const modelFailure = currentModelValidated
-                    ? null
-                    : spawnModelFailure(lane.provider, lane.account, config, pinnedModel, profileModel, lane.worker_profile, modelDeps, hostname);
-                if (modelFailure !== null) {
-                    reason = "model_change";
-                    refusal = modelFailure;
-                }
-                else {
-                    return { account: resolveAccount(lane.provider, lane.account, config, context) };
-                }
-            }
-            catch (err) {
-                if (err instanceof AccountResolutionError && err.error === "account_quota_exhausted") {
-                    reason = "usage_limit";
-                    refusal = err;
-                }
-                else if (err instanceof AccountResolutionError && err.error === "account_model_unavailable") {
-                    reason = "usage_limit";
-                    refusal = err;
-                }
-                else if (err instanceof LanesError && err.error === "model_unsupported") {
-                    reason = "model_change";
-                    refusal = err;
-                }
-                else {
-                    throw err;
-                }
-            }
-        }
-    }
-    if (operatorMovePending) {
-        if (refusal instanceof Error)
-            throw refusal;
-        throw new LanesError("account_unavailable", `Explicit account move target ${lane.account} is unavailable`, {
-            provider: lane.provider,
-            account: lane.account,
-        });
-    }
-    const recoverRecordedClaudeModel = lane.provider === "claude" &&
-        reason !== undefined &&
-        (reason === "recorded_account_logged_out" ||
-            (reason === "account_unavailable" && repairRecordedAccount && recordedModel !== undefined));
-    if (recoverRecordedClaudeModel) {
-        const lanes = listLaneIds(hqRoot)
-            .map((laneId) => readLane(hqRoot, laneId))
-            .filter((record) => record.host.kind === lane.host.kind && record.host.id === lane.host.id);
-        const capacity = buildHostCapacitySnapshot({
-            host: lane.host,
-            lanes,
-            config,
-            existsSync,
-            probe: accountDeps?.probe,
-            env: accountDeps?.env,
-            hostname,
-            now,
-        });
-        const selection = selectClaudeAccount({
-            hosts: [{ capacity, lanes, laneListAvailable: true }],
-            targetHost: lane.host,
-            config,
-            quotaState: loadQuotaState(hqRoot),
-            ...((recordedModel ?? pinnedModel ?? profileModel) !== undefined
-                ? { model: recordedModel ?? pinnedModel ?? profileModel }
-                : {}),
-        });
-        return {
-            account: resolveAccount(lane.provider, selection.account, config, context),
-            changeReason: reason,
-            ...(recordedModel !== undefined ? { preservedModel: recordedModel } : {}),
-        };
-    }
-    const allowedAccounts = Object.entries(config.providers[lane.provider].accounts)
-        .filter(([id, account]) => id !== lane.account && account.enabled)
-        .filter(([id]) => accountStatus(lane.provider, id, config, {
-        existsSync,
-        hostname,
-        ...(accountDeps?.probe ? { probe: accountDeps.probe } : {}),
-        ...(accountDeps?.env ? { env: accountDeps.env } : {}),
-    }).logged_in === true)
-        .filter(([id]) => supportsSpawnModel(lane.provider, id, config, pinnedModel, profileModel, modelDeps, hostname))
-        .map(([id]) => id);
-    try {
-        return {
-            account: selectBalancedAccount(lane.provider, config, {
-                ...context,
-                allowedAccounts,
-            }),
-            changeReason: reason,
-        };
-    }
-    catch (err) {
-        if (reason === "account_unavailable" || reason === "recorded_account_logged_out") {
-            if (refusal instanceof Error)
-                throw refusal;
-            throw new LanesError("account_not_logged_in", `Account ${lane.account} for ${lane.provider} is not logged in or available, and no other logged-in account can serve this lane`, { provider: lane.provider, account: lane.account });
-        }
-        if (refusal instanceof Error)
-            throw refusal;
-        throw err;
-    }
-}
-function previouslyUnavailableAccounts(lane) {
-    const excluded = new Set();
-    for (const entry of [...(lane.account_history ?? [])].reverse()) {
-        if (entry.reason === "first_assignment" || entry.reason === "operator_move")
-            break;
-        if ((entry.reason === "account_unavailable" || entry.reason === "recorded_account_logged_out") &&
-            entry.from !== null)
-            excluded.add(entry.from);
-    }
-    return excluded;
-}
-function archivedResumeMessageText(hqRoot, laneId, messageId) {
-    if (!messageId || /[\\/\0]/.test(messageId))
-        return undefined;
-    const file = path.join(laneRunDir(hqRoot, laneId), "dropbox", "delivered", `${messageId}.resume.jsonl`);
-    let raw;
-    try {
-        raw = fs.readFileSync(file, "utf8");
-    }
-    catch (err) {
-        if (err.code === "ENOENT")
-            return undefined;
-        throw new LanesError("account_retry_context_unreadable", `Could not read the archived message needed to resume lane ${laneId}`, { lane_id: laneId, message_id: messageId });
-    }
-    const records = [];
-    for (const line of raw.split(/\r?\n/)) {
-        if (line.trim().length === 0)
-            continue;
-        let parsed;
-        try {
-            parsed = JSON.parse(line);
-        }
-        catch {
-            continue;
-        }
-        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
-            continue;
-        records.push(parsed);
-    }
-    if (records.length !== 1) {
-        throw new LanesError("account_retry_context_invalid", `The archived message needed to resume lane ${laneId} is malformed`, { lane_id: laneId, message_id: messageId });
-    }
-    const value = records[0];
-    if (value === null ||
-        typeof value !== "object" ||
-        value.message_id !== messageId ||
-        typeof value.text !== "string") {
-        throw new LanesError("account_retry_context_invalid", `The archived message needed to resume lane ${laneId} is malformed`, { lane_id: laneId, message_id: messageId });
-    }
-    return value.text;
-}
-function pendingResumeForRetry(hqRoot, lane, sessionId, at) {
-    const last = lane.last_resume;
-    const keepAlive = last?.keep_alive === true ? { keep_alive: true } : {};
-    if (last === undefined || last.session_id !== sessionId) {
-        return { session_id: sessionId, trigger: "resume", resumed_from: "interrupted", at, ...keepAlive };
-    }
-    const compact = last.compact === undefined ? {} : { compact: last.compact };
-    if (last.trigger === "answered_questions") {
-        return { session_id: sessionId, trigger: "answered_questions", at, ...compact, ...keepAlive };
-    }
-    if (last.trigger === "watcher") {
-        return {
-            session_id: sessionId,
-            trigger: "watcher",
-            resumed_from: last.resumed_from ?? "interrupted",
-            ...(last.text !== undefined ? { text: last.text } : {}),
-            at,
-            ...compact,
-            ...keepAlive,
-        };
-    }
-    if (last.trigger === "message" || last.trigger === "monitor_event" || last.trigger === "system_notice") {
-        if (last.message_id === undefined) {
-            throw new LanesError("account_retry_context_missing", `The message id needed to resume lane ${lane.lane_id} is missing`, { lane_id: lane.lane_id, trigger: last.trigger });
-        }
-        const text = last.text ?? archivedResumeMessageText(hqRoot, lane.lane_id, last.message_id);
-        if (text === undefined) {
-            throw new LanesError("account_retry_context_missing", `The operator message needed to resume lane ${lane.lane_id} is unavailable`, { lane_id: lane.lane_id, message_id: last.message_id });
-        }
-        return {
-            session_id: sessionId,
-            trigger: last.trigger === "message" && last.monitor_event === true ? "monitor_event" : last.trigger,
-            text,
-            message_id: last.message_id,
-            ...(last.monitor_event === true || last.trigger === "monitor_event" ? { monitor_event: true } : {}),
-            at,
-            ...compact,
-            ...keepAlive,
-        };
-    }
-    return {
-        session_id: sessionId,
-        trigger: "resume",
-        resumed_from: last.resumed_from ?? "interrupted",
-        ...(last.text !== undefined ? { text: last.text } : {}),
-        ...(last.message_id !== undefined ? { message_id: last.message_id } : {}),
-        at,
-        ...compact,
-        ...keepAlive,
-    };
-}
-/** Change account only after a provider/runtime account failure, then re-admit. */
-export async function retryLaneOnAlternateAccount(hqRoot, lane, reason, writer = "watcher", deps = {}) {
-    const config = loadLanesConfig(hqRoot);
-    const existsSync = deps.existsSync ?? ((p) => fs.existsSync(p));
-    const env = deps.env ?? process.env;
-    const admissionHost = deps.admissionHost ?? resolveAdmissionHost();
-    const hostname = deps.hostname?.trim() || admissionHost.hostname.trim() || resolveAdmissionHost().hostname;
-    const modelDeps = {
-        ...deps.modelDeps,
-        env: deps.modelDeps?.env ?? env,
-    };
-    const accountDeps = {
-        probe: modelDeps.probe ?? defaultProbe,
-        env,
-    };
-    const profile = lane.worker_profile ? loadWorkerProfile(hqRoot, lane.worker_profile) : undefined;
-    const profileModel = profile?.meta.provider === lane.provider ? profile.meta.model : undefined;
-    const pinnedModel = lane.model_source === undefined || lane.model_source === "cli" || lane.model_source === "preserved"
-        ? lane.model
-        : undefined;
-    const unavailableAccounts = previouslyUnavailableAccounts(lane);
-    const allowedAccounts = Object.entries(config.providers[lane.provider].accounts)
-        .filter(([id, account]) => id !== lane.account && !unavailableAccounts.has(id) && account.enabled)
-        .filter(([id]) => accountStatus(lane.provider, id, config, {
-        existsSync,
-        hostname,
-        ...(accountDeps?.probe ? { probe: accountDeps.probe } : {}),
-        ...(accountDeps?.env ? { env: accountDeps.env } : {}),
-    }).logged_in === true)
-        .filter(([id]) => supportsSpawnModel(lane.provider, id, config, pinnedModel, profileModel, modelDeps, hostname))
-        .map(([id]) => id);
-    const modelContext = {
-        hqRoot,
-        existsSync,
-        accountDeps,
-        hostname,
-        ...(pinnedModel ?? profileModel ? { model: pinnedModel ?? profileModel } : {}),
-        allowedAccounts,
-    };
-    let target;
-    try {
-        target = selectBalancedAccount(lane.provider, config, modelContext);
-    }
-    catch (err) {
-        if (reason === "account_unavailable" || unavailableAccounts.size > 0) {
-            throw new LanesError("account_not_logged_in", `Account ${lane.account ?? "(none)"} for ${lane.provider} is unavailable and no other logged-in account can serve this lane`, { provider: lane.provider, account: lane.account ?? null });
-        }
-        throw err;
-    }
-    const source = lane.account ? config.providers[lane.provider].accounts[lane.account] : undefined;
-    const sessionId = providerSupportsSessionResume(lane.provider) &&
-        typeof lane.provider_session_id === "string" &&
-        lane.provider_session_id.trim().length > 0
-        ? lane.provider_session_id
-        : undefined;
-    if (source && sessionId) {
-        copySessionFiles(planSessionCopy(lane.provider, {
-            sourceHome: lane.provider_home_at_spawn ?? effectiveAccountHome(source, hostname).home,
-            targetHome: target.home,
-            cwd: hqRoot,
-            sessionId,
-        }));
-    }
-    const now = (deps.now ?? (() => new Date()))();
-    const at = now.toISOString();
-    const nowMs = now.getTime();
-    return withLaneAdmissionLock(hqRoot, lane.provider, async () => {
-        const current = readLane(hqRoot, lane.lane_id);
-        if (current.state !== "running" ||
-            current.account !== lane.account ||
-            current.provider_session_id !== lane.provider_session_id) {
-            throw new LanesError("account_retry_conflict", `Lane ${lane.lane_id} changed while account recovery was prepared`, {
-                lane_id: lane.lane_id,
-                state: current.state,
-                account: current.account ?? null,
-                provider_session_id_changed: current.provider_session_id !== lane.provider_session_id,
-            });
-        }
-        const moveToRetryQueue = (row) => {
-            const entry = {
-                from: row.account ?? null,
-                to: target.id,
-                at,
-                reason,
-            };
-            return {
-                ...row,
-                state: "queued",
-                queued_reason: "account_retry",
-                queued_details: undefined,
-                queued_at: at,
-                admission_reserved_at: undefined,
-                terminal_reason: undefined,
-                terminal_details: undefined,
-                account: target.id,
-                account_history: appendCappedHistory(row.account_history ?? [], entry),
-                pending_resume: sessionId
-                    ? pendingResumeForRetry(hqRoot, row, sessionId, at)
-                    : undefined,
-            };
-        };
-        const candidate = moveToRetryQueue(current);
-        const admissionLanes = listLaneIds(hqRoot)
-            .filter((id) => id !== current.lane_id)
-            .map((id) => readLane(hqRoot, id));
-        admissionLanes.push(candidate);
-        const profileMaxFor = (row) => row.worker_profile === undefined
-            ? undefined
-            : loadWorkerProfile(hqRoot, row.worker_profile).meta.max_concurrent;
-        const capacityReason = laneAdmissionCapReason(admissionLanes, candidate, config, admissionHost, profile?.meta.max_concurrent, nowMs);
-        const earlierEligibleLane = hasEarlierEligibleQueuedLane(admissionLanes, candidate, config, admissionHost, profileMaxFor, nowMs);
-        const moved = retryUpdateLane(hqRoot, lane.lane_id, writer, (row) => {
-            if (row.state !== "running" ||
-                row.account !== lane.account ||
-                row.provider_session_id !== lane.provider_session_id) {
-                throw new LanesError("account_retry_conflict", `Lane ${lane.lane_id} changed while account recovery was prepared`, {
-                    lane_id: lane.lane_id,
-                    state: row.state,
-                    account: row.account ?? null,
-                    provider_session_id_changed: row.provider_session_id !== lane.provider_session_id,
-                });
-            }
-            return moveToRetryQueue(row);
-        });
-        if (capacityReason !== undefined || earlierEligibleLane)
-            return moved;
-        return spawnLaneWorker(hqRoot, moved, {
-            ...deps,
-            lowDiskGuardEnabled: deps.lowDiskGuardEnabled ?? await lowDiskGuardEnabledForLane(hqRoot, moved),
-        });
-    });
-}
-export function appendModelFlag(provider, args, model) {
-    if (model === undefined)
-        return args;
-    const flag = PROVIDER_MODEL_FLAG[provider];
-    if (flag === undefined) {
-        throw new LanesError("model_unsupported", `Provider ${provider} does not accept --model`, { provider, model });
-    }
-    if (provider === "codex") {
-        // `codex exec -- <prompt>`: an option after `--` is read as a positional.
-        const end = args.indexOf("--");
-        if (end !== -1)
-            return [...args.slice(0, end), flag, model, ...args.slice(end)];
-    }
-    return [...args, flag, model];
-}
-/** Add Codex fast-mode flags before the prompt/positional separator. */
-export function appendFastModeFlags(provider, args, enabled) {
-    if (provider !== "codex" || enabled !== true)
-        return args;
-    const flags = [...CODEX_FAST_MODE_FLAGS];
-    const end = args.indexOf("--");
-    if (end === -1)
-        return [...args, ...flags];
-    return [...args.slice(0, end), ...flags, ...args.slice(end)];
-}
-function appendProviderProfileFlags(provider, args, profile) {
-    if (profile === undefined)
-        return args;
-    const ignored = new Set(profile.ignoredFields ?? []);
-    switch (provider) {
-        case "claude": {
-            const flags = [
-                "--append-system-prompt",
-                profile.systemPrompt,
-                // A profile is a per-spawn input. Do not let Claude's session resume
-                // snapshot hide a changed profile from the next launch.
-                "--system-prompt-snapshot",
-                "off",
-                ...(profile.settingsPath !== undefined && !ignored.has("settings")
-                    ? ["--settings", profile.settingsPath]
-                    : []),
-            ];
-            return [...args, ...flags];
-        }
-        case "codex": {
-            const flags = ["-c", `developer_instructions=${JSON.stringify(profile.systemPrompt)}`];
-            const end = args.indexOf("--");
-            if (end === -1)
-                return [...args, ...flags];
-            return [...args.slice(0, end), ...flags, ...args.slice(end)];
-        }
-        case "grok":
-            return [...args, "--rules", profile.systemPrompt];
-        default: {
-            const _exhaustive = provider;
-            return _exhaustive;
-        }
-    }
-}
-/** Make the worker policy directory available to Codex hook subprocesses. */
-function appendCodexWorkerPolicyDirFlag(provider, args, workerPolicyDir) {
-    if (provider !== "codex" || workerPolicyDir === undefined)
-        return args;
-    if (!workerPolicyDir.trim()) {
-        throw new LanesError("invalid_worker_policy_dir", "Worker policy directory must not be empty");
-    }
-    const setting = `shell_environment_policy.set.HQ_POLICY_WORKER_DIR=${JSON.stringify(workerPolicyDir)}`;
-    const separator = args.indexOf("--");
-    if (separator === -1)
-        return [...args, "-c", setting];
-    return [...args.slice(0, separator), "-c", setting, ...args.slice(separator)];
-}
-function accountHomeHostname(deps) {
-    return (deps.hostname?.trim() ||
-        deps.admissionHost?.hostname.trim() ||
-        resolveAdmissionHost().hostname);
-}
-export const PID_LIVENESS_DECISIONS = [
-    "esrch",
-    "starttime_mismatch",
-    "eperm",
-    "starttime_match",
-    "no_recorded_starttime",
-    "starttime_unreadable",
-    "missing_pid_file",
-];
-export function missingPidProbe() {
-    return {
-        pid: null,
-        recorded_starttime: null,
-        live_starttime: null,
-        starttime_error: "ENOENT",
-        alive: false,
-        decided_by: "missing_pid_file",
-    };
-}
-export function defaultPidIsAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ESRCH")
-            return false;
-        if (code === "EPERM")
-            return true;
-        throw err;
-    }
-}
-export const STOP_TERM_WAIT_MS = 500;
-export const STOP_KILL_WAIT_MS = 200;
-const defaultSpawnProcess = (command, args, options) => spawn(command, args, options);
-function defaultKillProcess(pid, signal = "SIGTERM") {
-    process.kill(pid, signal);
-}
-export function parseSpawnTerminalReason(value) {
-    if (SPAWN_TERMINAL_REASONS.includes(value)) {
-        return value;
-    }
-    throw new LanesError("unknown_spawn_reason", `Unknown spawn terminal reason ${JSON.stringify(value)}. Accepted: ${SPAWN_TERMINAL_REASONS.join(", ")}`, { accepted: [...SPAWN_TERMINAL_REASONS], value });
-}
-export function laneRunDir(hqRoot, laneId) {
-    return path.join(hqRoot, LANES_RUNS_REL, laneId);
-}
-export function watcherMainPath() {
-    return fileURLToPath(new URL("./watcher-main.js", import.meta.url));
-}
-export function parseProcStat(text) {
-    const open = text.indexOf("(");
-    const close = text.lastIndexOf(")");
-    if (open <= 0 || close <= open) {
-        throw new LanesError("proc_stat_unreadable", "Could not parse /proc/<pid>/stat", { text: text.slice(0, 120) });
-    }
-    const pid = Number(text.slice(0, open).trim());
-    const rest = text.slice(close + 1).trim().split(/\s+/);
-    const ppid = Number(rest[1]);
-    const pgrp = Number(rest[2]);
-    const session = Number(rest[3]);
-    if (![pid, ppid, pgrp, session].every((n) => Number.isInteger(n))) {
-        throw new LanesError("proc_stat_unreadable", "Could not parse pid/ppid/pgrp/session from /proc/<pid>/stat", { text: text.slice(0, 120) });
-    }
-    // /proc/<pid>/stat fields are 1-indexed and `rest` begins at field 3 (state),
-    // so field N lives at rest[N - 3]. starttime is field 22 -> rest[19].
-    // rest[21] is field 24 (rss), which at spawn is a page count like 1 and grows
-    // as the process runs — recording it made every fresh lane look dead within
-    // seconds of starting.
-    const startRaw = rest[19];
-    const starttime = startRaw !== undefined ? Number(startRaw) : undefined;
-    return {
-        pid,
-        ppid,
-        pgrp,
-        session,
-        starttime: Number.isInteger(starttime) ? starttime : undefined,
-    };
-}
-export function readProcStarttimeDetailed(pid) {
-    const proc = path.join("/proc", String(pid), "stat");
-    try {
-        const starttime = parseProcStat(fs.readFileSync(proc, "utf8")).starttime;
-        if (starttime === undefined)
-            return { starttime: null, error: "missing_field" };
-        return { starttime, error: null };
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ENOENT")
-            return { starttime: null, error: "ENOENT" };
-        process.stderr.write(`hq lanes: failed to read starttime for pid ${pid}: ${err instanceof Error ? err.message : String(err)}\n`);
-        return {
-            starttime: null,
-            error: typeof code === "string" ? code : "unreadable",
-        };
-    }
-}
-export function readProcStarttime(pid) {
-    return readProcStarttimeDetailed(pid).starttime;
-}
-export function formatPidRecord(rec) {
-    return rec.starttime !== undefined ? `${rec.pid} ${rec.starttime}\n` : `${rec.pid}\n`;
-}
-export function parsePidRecord(text) {
-    const tokens = text.trim().split(/\s+/);
-    const pid = Number(tokens[0]);
-    if (!Number.isInteger(pid) || pid <= 0)
-        return null;
-    const starttime = tokens[1] !== undefined ? Number(tokens[1]) : undefined;
-    return {
-        pid,
-        starttime: Number.isInteger(starttime) ? starttime : undefined,
-    };
-}
-export function readPidRecord(filePath) {
-    try {
-        return parsePidRecord(fs.readFileSync(filePath, "utf8"));
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ENOENT")
-            return null;
-        process.stderr.write(`hq lanes: failed to read pid file ${filePath}: ${err instanceof Error ? err.message : String(err)}\n`);
-        throw err;
-    }
-}
-export function writePidRecord(filePath, rec) {
-    writeText(filePath, formatPidRecord(rec));
-}
-export function probePidRecord(rec, isAlive = defaultPidIsAlive, readStarttime = readProcStarttime) {
-    const recorded = rec.starttime ?? null;
-    const base = { pid: rec.pid, recorded_starttime: recorded };
-    let killAlive;
-    let killDecision = "starttime_match";
-    try {
-        killAlive = isAlive(rec.pid);
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ESRCH") {
-            return {
-                ...base,
-                live_starttime: null,
-                starttime_error: null,
-                alive: false,
-                decided_by: "esrch",
-            };
-        }
-        if (code === "EPERM") {
-            killAlive = true;
-            killDecision = "eperm";
-        }
-        else {
-            throw err;
-        }
-    }
-    if (!killAlive) {
-        return {
-            ...base,
-            live_starttime: null,
-            starttime_error: null,
-            alive: false,
-            decided_by: "esrch",
-        };
-    }
-    if (recorded === null) {
-        return {
-            ...base,
-            live_starttime: null,
-            starttime_error: null,
-            alive: true,
-            decided_by: killDecision === "eperm" ? "eperm" : "no_recorded_starttime",
-        };
-    }
-    let live;
-    let starttime_error = null;
-    try {
-        live = readStarttime(rec.pid);
-        if (live === null)
-            starttime_error = "unreadable";
-    }
-    catch (err) {
-        const code = err.code;
-        live = null;
-        starttime_error = typeof code === "string" ? code : "unreadable";
-    }
-    if (live === null) {
-        return {
-            ...base,
-            live_starttime: null,
-            starttime_error,
-            alive: true,
-            decided_by: "starttime_unreadable",
-        };
-    }
-    if (live !== recorded) {
-        return {
-            ...base,
-            live_starttime: live,
-            starttime_error: null,
-            alive: false,
-            decided_by: "starttime_mismatch",
-        };
-    }
-    return {
-        ...base,
-        live_starttime: live,
-        starttime_error: null,
-        alive: true,
-        decided_by: killDecision === "eperm" ? "eperm" : "starttime_match",
-    };
-}
-export function isPidRecordAlive(rec, isAlive = defaultPidIsAlive, readStarttime = readProcStarttime) {
-    return probePidRecord(rec, isAlive, readStarttime).alive;
-}
-function blockingSleep(ms) {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-export function signalProcessGroup(pid, signal, killProcess) {
-    try {
-        killProcess(-pid, signal);
-        return;
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ESRCH")
-            return;
-        if (code !== "EINVAL" && code !== "EPERM") {
-            process.stderr.write(`hq lanes: process-group ${signal} for pid ${pid} failed: ${err instanceof Error ? err.message : String(err)}\n`);
-        }
-    }
-    try {
-        killProcess(pid, signal);
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ESRCH")
-            return;
-        process.stderr.write(`hq lanes: ${signal} for pid ${pid} failed: ${err instanceof Error ? err.message : String(err)}\n`);
-        throw err;
-    }
-}
-export function stopLaneProcesses(hqRoot, laneId, deps = {}) {
-    const killProcess = deps.killProcess ?? defaultKillProcess;
-    const isAlive = deps.isAlive ??
-        ((pid) => {
-            try {
-                process.kill(pid, 0);
-                return true;
-            }
-            catch (err) {
-                const code = err.code;
-                if (code === "ESRCH")
-                    return false;
-                if (code === "EPERM")
-                    return true;
-                throw err;
-            }
-        });
-    const sleepMs = deps.sleepMs ?? blockingSleep;
-    const readStarttime = deps.readStarttime ?? readProcStarttime;
-    const runDir = laneRunDir(hqRoot, laneId);
-    const worker = readPidRecord(path.join(runDir, "worker.pid"));
-    const watcher = readPidRecord(path.join(runDir, "watcher.pid"));
-    const signals = [];
-    const targets = [worker, watcher].filter((rec) => rec !== null);
-    const fire = (rec, signal) => {
-        if (!isPidRecordAlive(rec, isAlive, readStarttime))
-            return;
-        signals.push({ pid: rec.pid, signal, group: true });
-        signalProcessGroup(rec.pid, signal, killProcess);
-    };
-    for (const rec of targets)
-        fire(rec, "SIGTERM");
-    if (targets.some((rec) => isPidRecordAlive(rec, isAlive, readStarttime))) {
-        sleepMs(STOP_TERM_WAIT_MS);
-    }
-    for (const rec of targets) {
-        if (isPidRecordAlive(rec, isAlive, readStarttime))
-            fire(rec, "SIGKILL");
-    }
-    return { worker, watcher, signals };
-}
-export function defaultProveDetached(pid, deps = {}) {
-    const proc = path.join("/proc", String(pid), "stat");
-    try {
-        const text = deps.readProcStatText
-            ? deps.readProcStatText(pid)
-            : fs.readFileSync(proc, "utf8");
-        const parsed = parseProcStat(text);
-        const leader = parsed.pid === pid && parsed.pgrp === parsed.pid && parsed.session === parsed.pgrp;
-        return {
-            detached: leader,
-            pid,
-            pgid: parsed.pgrp,
-            sid: parsed.session,
-            method: "proc_stat_session_leader",
-            reason: leader ? undefined : "not_session_leader",
-        };
-    }
-    catch (err) {
-        const code = err.code;
-        if (code !== "ENOENT") {
-            process.stderr.write(`hq lanes: failed to read ${proc}: ${err instanceof Error ? err.message : String(err)}\n`);
-            throw err;
-        }
-    }
-    try {
-        process.kill(pid, 0);
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ESRCH") {
-            return { detached: false, pid, method: "pid_alive", reason: "pid_not_alive" };
-        }
-        if (code !== "EPERM") {
-            process.stderr.write(`hq lanes: liveness probe for pid ${pid} failed: ${err instanceof Error ? err.message : String(err)}\n`);
-            throw err;
-        }
-    }
-    const psProof = proveDetachedViaPs(pid);
-    if (psProof)
-        return psProof;
-    return {
-        detached: false,
-        pid,
-        method: "pid_alive_without_proc",
-        reason: "not_session_leader",
-    };
-}
-function proveDetachedViaPs(pid) {
-    try {
-        const result = spawnSync("ps", ["-p", String(pid), "-o", "pid=,pgid="], {
-            encoding: "utf8",
-            timeout: 500,
-        });
-        if (result.error || result.status !== 0)
-            return null;
-        const parts = (result.stdout ?? "").trim().split(/\s+/).map(Number);
-        if (parts.length < 2 || parts.some((n) => !Number.isInteger(n)))
-            return null;
-        const psPid = parts[0];
-        const pgid = parts[1];
-        const leader = psPid === pid && pgid === pid;
-        return {
-            detached: leader,
-            pid,
-            pgid,
-            method: "ps_session_leader",
-            reason: leader ? undefined : "not_session_leader",
-        };
-    }
-    catch (err) {
-        process.stderr.write(`hq lanes: ps detach proof failed for pid ${pid}: ${err instanceof Error ? err.message : String(err)}\n`);
-        return null;
-    }
-}
-export function nextEnvelopePath(runDir) {
-    const dir = path.join(runDir, "envelopes");
-    let n = 1;
-    while (true) {
-        const name = `${String(n).padStart(3, "0")}.json`;
-        const filePath = path.join(dir, name);
-        if (!fs.existsSync(filePath))
-            return filePath;
-        n += 1;
-        if (n > 999) {
-            throw new LanesError("envelope_sequence_exhausted", `No free envelope slot under ${dir}`, { dir });
-        }
-    }
-}
-export function envelopeInstruction(envelopePath) {
-    return (`When finished, write a JSON object to ${envelopePath} using these key names exactly: ` +
-        `schema_version, decision, summary, story_status, artifacts, story_complete, story_complete_reason, questions, blocked_reason, next_check_at. ` +
-        `schema_version must be the exact string "hq-lane-envelope.v1". ` +
-        `decision must be one of "done", "ask", "blocked". ` +
-        `summary is a string. ` +
-        `story_status must be one of "queued", "in_progress", "review", "done". ` +
-        `artifacts is an array. ` +
-        `story_complete is a boolean and story_complete_reason is a non-empty string. ` +
-        `story_complete true requires story_status done and a reason stating what was delivered and how it was verified. ` +
-        `story_complete false requires story_status other than done and a reason stating what is still missing. ` +
-        `questions is present and non-empty exactly when decision is "ask". ` +
-        `blocked_reason is present exactly when decision is "blocked". ` +
-        `next_check_at is optional; when present, use an ISO date-time for the next time-based keep-alive check.`);
-}
-/**
- * Standing authorization carried by every brief and every resume turn. A
- * lane that ends each turn asking "continue or stop" has asked the operator
- * to re-grant what the brief already granted; the paragraph names that as
- * out of bounds and says what a `decision: ask` envelope is for.
- */
-export const STANDING_AUTHORIZATION = "STANDING AUTHORIZATION. This brief authorises completing every item it lists; " +
-    "you do not need to ask before finishing any of them. " +
-    'A "decision": "ask" envelope is only for a decision this brief does not settle, ' +
-    "and it must name that decision and its options. " +
-    'Do not raise a question whose options amount to "continue" or "stop" the work this brief describes; ' +
-    "continue that work until it is complete or you are blocked on something only the operator can supply.";
-/**
- * Foreground-only rule carried next to the standing authorization. Two lanes
- * ended `interrupted` after backgrounding a slow test suite and ending the
- * turn while it was still running; nothing in the brief said not to.
- */
-export const FOREGROUND_ONLY_RULE = "FOREGROUND ONLY. Run every command, test suite and check in the foreground and wait for it to finish. " +
-    "Never background a process and end the turn while it is still running. " +
-    "A turn that ends before the envelope is written is classified interrupted, " +
-    "and whatever the background process produces afterwards is not read.";
-/**
- * The answers as written by the reconcile pass (`answered-questions.json`),
- * reduced to id + choice. A malformed file reads as no inline answers; the
- * path is still named so the worker can read it.
- */
-export function readAnsweredQuestionLines(answersPath) {
-    let text;
-    try {
-        text = fs.readFileSync(answersPath, "utf8");
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ENOENT")
-            return [];
-        process.stderr.write(`hq lanes: failed to read ${answersPath}: ${err instanceof Error ? err.message : String(err)}\n`);
-        throw err;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch (err) {
-        throw new LanesError("answered_questions_invalid", `Answered questions at ${answersPath} are not valid JSON`, { path: answersPath });
-    }
-    if (!Array.isArray(parsed)) {
-        throw new LanesError("answered_questions_invalid", `Answered questions at ${answersPath} must be a JSON array`, { path: answersPath });
-    }
-    const out = [];
-    for (const [index, item] of parsed.entries()) {
-        if (!item || typeof item !== "object" || Array.isArray(item)) {
-            throw new LanesError("answered_questions_invalid", `Answered question ${index} at ${answersPath} must be an object`, { path: answersPath, index });
-        }
-        const rec = item;
-        if (typeof rec.question_id !== "string" || !rec.question_id.trim()) {
-            throw new LanesError("answered_questions_invalid", `Answered question ${index} at ${answersPath} must have a question_id`, { path: answersPath, index });
-        }
-        if (typeof rec.choice !== "string") {
-            throw new LanesError("answered_questions_invalid", `Answered question ${rec.question_id} at ${answersPath} must have a choice`, { path: answersPath, question_id: rec.question_id });
-        }
-        const line = {
-            question_id: rec.question_id,
-            choice: rec.choice,
-        };
-        if (rec.notes !== undefined && typeof rec.notes !== "string") {
-            throw new LanesError("answered_questions_invalid", `Answered question ${rec.question_id} at ${answersPath} has invalid notes`, { path: answersPath, question_id: rec.question_id });
-        }
-        if (typeof rec.notes === "string" && rec.notes.length > 0)
-            line.notes = rec.notes;
-        out.push(line);
-    }
-    return out;
-}
-export function resumePrompt(input) {
-    const parts = [];
-    if (input.resumedFrom !== undefined) {
-        parts.push(`${input.resumeSource === "watcher" ? "The lane watcher" : "The operator"} resumed this lane from state ${input.resumedFrom}. ` +
-            (input.resumedFrom === "interrupted"
-                ? "The previous run ended without writing its envelope; continue the work from where it stopped."
-                : "Continue the work from where the previous run stopped."));
-    }
-    if (input.monitorEvent !== undefined) {
-        parts.push(input.monitorEvent);
-    }
-    else if (input.operatorMessage !== undefined) {
-        parts.push("OPERATOR INSTRUCTION (outranks the lane brief). " +
-            "The following message was sent to this lane by the operator. Treat it as an operator instruction that outranks the brief.\n\n" +
-            input.operatorMessage);
-    }
-    if (input.answersPath !== undefined) {
-        const lines = (input.answers ?? []).map((item) => item.notes !== undefined
-            ? `- ${item.question_id}: ${item.choice}\n  Operator notes: ${item.notes}`
-            : `- ${item.question_id}: ${item.choice}`);
-        parts.push([
-            `Previously answered questions are at ${input.answersPath}; treat those choices and the operator notes under them as operator decisions that outrank the brief. Continue the work.`,
-            ...(lines.length > 0 ? ["Answers:", ...lines] : []),
-        ].join("\n"));
-    }
-    if (input.envelopeRepairErrors !== undefined) {
-        const errors = [input.envelopeRepairErrors.first_error, input.envelopeRepairErrors.second_error]
-            .filter((error) => typeof error === "string" && error.length > 0);
-        parts.push([
-            `The previous envelope repair failed validation. The next envelope slot is ${input.envelopePath}; write a new valid envelope there.`,
-            "Exact validation errors recorded in envelope_repair:",
-            ...errors.map((error, index) => `- envelope_repair.${index === 0 ? "first_error" : "second_error"}: ${JSON.stringify(error)}`),
-            "For an ask question, include non-empty id, question, and context fields.",
-        ].join("\n"));
-    }
-    // Every resume turn carries the authorization, including a textless
-    // `hq lanes resume`: a pre-upgrade session's brief never had the paragraph.
-    if (input.operatorMessage !== undefined ||
-        input.monitorEvent !== undefined ||
-        input.answersPath !== undefined ||
-        input.resumedFrom !== undefined) {
-        parts.push(STANDING_AUTHORIZATION);
-        parts.push(FOREGROUND_ONLY_RULE);
-    }
-    parts.push(envelopeInstruction(input.envelopePath));
-    return parts.join("\n\n");
-}
-/** Spec §4: the one repair turn. Schema, parser error, raw text, JSON only. */
-export function envelopeRepairPrompt(input) {
-    const maxRawTextChars = 24_000;
-    const rawText = input.rawText.length <= maxRawTextChars
-        ? input.rawText
-        : `${input.rawText.slice(0, 12_000)}\n\n[... raw envelope truncated; inspect ${input.envelopePath} for the complete file ...]\n\n${input.rawText.slice(-12_000)}`;
-    if (input.missing) {
-        return [
-            `Missing expected envelope file: ${input.envelopePath}`,
-            "The previous envelope is stale and must not be reused or copied into this run's result.",
-            "Printing an envelope in the conversation or writing it to last-message.txt is not enough; write the JSON object directly to the expected file.",
-            "If the task is unfinished, write decision: done, story_complete: false, and set story_status and story_complete_reason to describe the work that remains. The repair turn itself is never a reason for blocked.",
-            "This repair turn only writes the missing envelope; do not resume the task.",
-            "Schema:",
-            JSON.stringify(LANE_ENVELOPE_JSON_SCHEMA, null, 2),
-            `Write the corrected JSON object to ${input.envelopePath}, overwriting it. ` +
-                `Output only that JSON. Do not add keys the schema does not name, and do not resume the task.`,
-        ].join("\n\n");
-    }
-    return [
-        `The file you wrote at ${input.envelopePath} is not a valid hq-lane-envelope.v1. ` +
-            `This is the single repair turn: rewrite that file so it validates, and do nothing else.`,
-        `Parser error: ${input.error}`,
-        "For an ask question, include non-empty id, question, and context fields.",
-        "Schema:",
-        JSON.stringify(LANE_ENVELOPE_JSON_SCHEMA, null, 2),
-        "Your previous output was:",
-        rawText,
-        `Write the corrected JSON object to ${input.envelopePath}, overwriting it. ` +
-            `Output only that JSON. Do not add keys the schema does not name, and do not resume the task.`,
-    ].join("\n\n");
-}
-export function buildProviderCommand(provider, input) {
-    const parsed = parseLaneProvider(provider);
-    const command = PROVIDER_COMMAND[parsed];
-    if (input.resume && !providerSupportsSessionResume(parsed)) {
-        throw new LanesError("resume_unsupported", `Provider ${parsed} cannot resume an exited worker from a session id`, { provider: parsed });
-    }
-    if (input.resume && input.freshTurnPrompt !== undefined) {
-        throw new LanesError("invalid_launch", "resume and freshTurnPrompt cannot both be set on one launch", { provider: parsed });
-    }
-    let prompt;
-    if (input.freshTurnPrompt !== undefined) {
-        prompt = input.freshTurnPrompt;
-    }
-    else {
-        prompt = `Execute the lane brief at ${input.briefPath}. ${envelopeInstruction(input.envelopePath)}`;
-        if (input.extraPrompt)
-            prompt += ` ${input.extraPrompt}`;
-    }
-    let args;
-    if (input.resume && parsed === "codex") {
-        // `codex exec resume` (0.155.1) takes `[SESSION_ID] [PROMPT]` and has
-        // neither `-C` nor `--color`; the session keeps its recorded cwd. `--json`
-        // makes the resumed run re-emit `thread.started` with the same id.
-        args = [
-            "exec",
-            "resume",
-            "--dangerously-bypass-hook-trust",
-            "--skip-git-repo-check",
-            "--dangerously-bypass-approvals-and-sandbox",
-            "--json",
-            "--output-last-message",
-            input.lastMessagePath,
-            "--",
-            input.resume.session_id,
-            input.resume.prompt,
-        ];
-    }
-    else if (input.resume && parsed === "grok") {
-        // `grok --single <prompt> --resume <id>` (1.0.34) continues the recorded
-        // session and prints the same `sessionId` in its JSON result.
-        args = [
-            "--single",
-            input.resume.prompt,
-            "--resume",
-            input.resume.session_id,
-            "--permission-mode",
-            "bypassPermissions",
-            "--always-approve",
-            "--output-format",
-            "json",
-        ];
-    }
-    else if (input.resume) {
-        args = [
-            "-p",
-            "--resume",
-            input.resume.session_id,
-            input.resume.prompt,
-            "--permission-mode",
-            "bypassPermissions",
-            "--output-format",
-            "json",
-        ];
-    }
-    else if (parsed === "codex") {
-        // `--json` puts the thread id on stdout (`thread.started`); that is the
-        // only place `codex exec` exposes the id a later resume needs.
-        args = [
-            "exec",
-            "--dangerously-bypass-hook-trust",
-            "--skip-git-repo-check",
-            "--dangerously-bypass-approvals-and-sandbox",
-            "--color",
-            "never",
-            "--json",
-            "-C",
-            input.hqRoot,
-            "--output-last-message",
-            input.lastMessagePath,
-            "--",
-            prompt,
-        ];
-    }
-    else if (parsed === "grok") {
-        args = [
-            "--single",
-            prompt,
-            "--permission-mode",
-            "bypassPermissions",
-            "--always-approve",
-            "--output-format",
-            "json",
-        ];
-    }
-    else {
-        args = [
-            "-p",
-            prompt,
-            "--permission-mode",
-            "bypassPermissions",
-            "--output-format",
-            "json",
-        ];
-    }
-    return {
-        command,
-        args: appendFastModeFlags(parsed, appendEffortFlag(parsed, appendModelFlag(parsed, appendCodexWorkerPolicyDirFlag(parsed, appendProviderProfileFlags(parsed, args, input.profile), input.workerPolicyDir), input.model), input.effort), input.fastMode),
-    };
-}
-export function workerEnv(base, resolved, laneId, hqRoot, autoCompactTokens, meshCompany, workerPolicyDir, registryWorker) {
-    const accepted = Object.values(PROVIDER_HOME_ENV);
-    if (!accepted.includes(resolved.envVar)) {
-        throw new LanesError("unknown_provider_home_env", `Unknown provider home variable ${JSON.stringify(resolved.envVar)}. Accepted: ${accepted.join(", ")}`, { accepted, value: resolved.envVar });
-    }
-    const env = { ...base };
-    delete env.HQ_PROJECT_ID;
-    delete env.HQ_STORY_ID;
-    delete env.HQ_POLICY_WORKER_DIR;
-    delete env.HQ_LANE_APPROVAL_REQUIRED;
-    delete env.HQ_LANE_HUMAN_CHECKPOINTS;
-    env[resolved.envVar] = resolved.home;
-    delete env[CLAUDE_AUTO_COMPACT_ENV];
-    if (resolved.envVar === PROVIDER_HOME_ENV.claude && autoCompactTokens !== undefined) {
-        env[CLAUDE_AUTO_COMPACT_ENV] = String(autoCompactTokens);
-    }
-    env.HQ_LANE_ID = laneId;
-    env.HQ_ROOT = hqRoot;
-    if (registryWorker && (registryWorker.approval_required || registryWorker.human_checkpoints.length > 0)) {
-        env.HQ_LANE_APPROVAL_REQUIRED = "1";
-        env.HQ_LANE_HUMAN_CHECKPOINTS = registryWorker.human_checkpoints.length > 0
-            ? registryWorker.human_checkpoints.join(",")
-            : "external_publish";
-    }
-    if (workerPolicyDir !== undefined &&
-        (resolved.envVar === PROVIDER_HOME_ENV.claude || resolved.envVar === PROVIDER_HOME_ENV.codex)) {
-        env.HQ_POLICY_WORKER_DIR = workerPolicyDir;
-    }
-    if (meshCompany) {
-        env.HQ_SPAWN_COMPANY = meshCompany.slug || meshCompany.uid;
-    }
-    else {
-        delete env.HQ_SPAWN_COMPANY;
-    }
-    return env;
-}
-export const WORKER_POLICY_HOOK_CAPABILITY = "# hq-capability: worker-policy-dir v1";
-function installedWorkerPolicyHookSupportsDirectory(hqRoot) {
-    const hookPath = path.join(hqRoot, ".claude", "hooks", "inject-policy-on-trigger.sh");
-    try {
-        return fs.readFileSync(hookPath, "utf8")
-            .split(/\r?\n/)
-            .some((line) => line === WORKER_POLICY_HOOK_CAPABILITY);
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ENOENT")
-            return false;
-        process.stderr.write(`hq lanes: cannot inspect worker-policy hook capability at ${hookPath}: ${err instanceof Error ? err.message : String(err)}; keeping policy prompt delivery\n`);
-        return false;
-    }
-}
-/** Grok does not run HQ hooks; Claude and Codex use the installed capability marker. */
-export function workerPolicyDeliveryMode(hqRoot, provider) {
-    return provider !== "grok" && installedWorkerPolicyHookSupportsDirectory(hqRoot)
-        ? "hook"
-        : "prompt";
-}
-function ensureDir(dir) {
-    fs.mkdirSync(dir, { recursive: true });
-}
-function fileSizeOrZero(filePath) {
-    try {
-        return fs.statSync(filePath).size;
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ENOENT")
-            return 0;
-        process.stderr.write(`hq lanes: failed to stat ${filePath}: ${err instanceof Error ? err.message : String(err)}\n`);
-        throw err;
-    }
-}
-function writeText(filePath, text) {
-    ensureDir(path.dirname(filePath));
-    fs.writeFileSync(filePath, text, "utf8");
-}
-function appendWorkerProfileEvent(runDir, event) {
-    const eventsPath = path.join(runDir, "watcher", "profile-events.jsonl");
-    ensureDir(path.dirname(eventsPath));
-    fs.appendFileSync(eventsPath, `${JSON.stringify({
-        event: "profile_applied",
-        ...event,
-        at: new Date().toISOString(),
-    })}\n`);
-}
-function openLog(filePath) {
-    ensureDir(path.dirname(filePath));
-    return fs.openSync(filePath, "a");
-}
-function closeFd(fd, label) {
-    try {
-        fs.closeSync(fd);
-    }
-    catch (err) {
-        process.stderr.write(`hq lanes: failed to close ${label} fd ${fd}: ${err instanceof Error ? err.message : String(err)}\n`);
-        throw err;
-    }
-}
-function killQuietly(kill, pid, label) {
-    try {
-        signalProcessGroup(pid, "SIGTERM", kill);
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ESRCH")
-            return;
-        process.stderr.write(`hq lanes: failed to stop ${label} pid ${pid}: ${err instanceof Error ? err.message : String(err)}\n`);
-        throw err;
-    }
-}
-export function markSpawnFailure(hqRoot, laneId, reasonRaw, details) {
-    const reason = parseSpawnTerminalReason(reasonRaw);
-    return retryUpdateLane(hqRoot, laneId, "spawn", (current) => {
-        const existing = current
-            .terminal_reason;
-        if (current.state === "failed" && existing === reason)
-            return current;
-        return {
-            ...current,
-            state: "failed",
-            queued_reason: undefined,
-            queued_details: undefined,
-            queued_at: undefined,
-            admission_reserved_at: undefined,
-            terminal_reason: reason,
-            terminal_details: details,
-        };
-    });
-}
-function spawnDetached(spawnProcess, command, args, env, cwd, stdoutPath, stderrPath) {
-    const outFd = openLog(stdoutPath);
-    let errFd;
-    try {
-        errFd = openLog(stderrPath);
-        const child = spawnProcess(command, args, {
-            detached: true,
-            windowsHide: true,
-            stdio: ["ignore", outFd, errFd],
-            env,
-            cwd,
-        });
-        child.unref();
-        if (typeof child.pid !== "number" || child.pid <= 0) {
-            throw new LanesError("spawn_failed", `Failed to start ${command} (no pid)`, { command, args });
-        }
-        return child.pid;
-    }
-    catch (err) {
-        if (err instanceof LanesError)
-            throw err;
-        throw new LanesError("spawn_failed", `Failed to start ${command}: ${err instanceof Error ? err.message : String(err)}`, {
-            command,
-            args,
-            message: err instanceof Error ? err.message : String(err),
-        });
-    }
-    finally {
-        closeFd(outFd, stdoutPath);
-        if (errFd !== undefined)
-            closeFd(errFd, stderrPath);
-    }
-}
-function requireDetached(proveDetached, pid, kind) {
-    const proof = proveDetached(pid);
-    if (proof.detached)
-        return proof;
-    const error = kind === "watcher" ? "watcher_not_armed" : "not_detached";
-    throw new LanesError(error, `${kind} pid ${pid} was not proven detached`, { pid, kind, reason: proof.reason ?? error, method: proof.method });
-}
-function originHostOf(lane) {
-    const value = lane.origin_host;
-    return typeof value === "string" ? value : "";
-}
-function originHostSourceOf(lane) {
-    const value = lane.origin_host_source;
-    return value === "imds" || value === "hostname" ? value : "";
-}
-function markOutpostSelfTarget(hqRoot, laneId, details) {
-    return retryUpdateLane(hqRoot, laneId, "spawn", (current) => {
-        const existing = current
-            .terminal_reason;
-        if (current.state === "cancelled" && existing === "outpost_self_target") {
-            return current;
-        }
-        return {
-            ...current,
-            state: "cancelled",
-            queued_reason: undefined,
-            queued_details: undefined,
-            terminal_reason: "outpost_self_target",
-            terminal_details: details,
-        };
-    });
-}
-/**
- * Spec §5.2 executing-side check. Compares this machine's identity to
- * `origin_host` (never to `host.id`). Unresolvable identity is a cancel.
- * Must run before the worker is spawned.
- */
-export function refuseOutpostSelfTarget(hqRoot, lane, deps) {
-    const identity = (deps.resolveMachineIdentity ?? resolveMachineIdentity)();
-    const origin = originHostOf(lane);
-    const originSource = originHostSourceOf(lane);
-    let selfTargeted = origin === "" || identity.status !== "ok";
-    if (!selfTargeted && identity.status === "ok") {
-        if (originSource === "imds") {
-            const execImds = identity.imds ?? (identity.source === "imds" ? identity.id : null);
-            selfTargeted = execImds === null || execImds === origin;
-        }
-        else if (originSource === "hostname") {
-            const execHost = identity.hostname ??
-                (identity.source === "hostname" ? identity.id : null);
-            selfTargeted = execHost === null ? identity.id === origin : execHost === origin;
-        }
-        else {
-            selfTargeted = identity.id === origin;
-        }
-    }
-    if (!selfTargeted)
-        return;
-    const cancelled = markOutpostSelfTarget(hqRoot, lane.lane_id, {
-        origin_host: origin,
-        identity,
-    });
-    throw new LanesError("outpost_self_target", "Outpost exec came back to the caller; lane cancelled before work", {
-        origin_host: origin,
-        identity,
-        lane_id: lane.lane_id,
-        lane: cancelled,
-    });
-}
-function writeSpawnManifest(runDir, input) {
-    writeText(path.join(runDir, "spawn.json"), `${JSON.stringify({
-        command: input.command,
-        args: input.args,
-        env_var: input.envVar,
-        account: input.account,
-        worker_pid: input.workerPid,
-        watcher_pid: input.watcherPid,
-        detached: true,
-        envelope_path: input.envelopePath,
-        ...(input.turnId !== undefined ? { turn_id: input.turnId } : {}),
-        resume: input.resume,
-        worker_out_offset: input.workerOutOffset,
-        ...(input.fastMode ? { fast_mode: true } : {}),
-        ...(input.profile
-            ? {
-                worker_profile: input.profile.id,
-                worker_profile_hash: input.profile.hash,
-                worker_profile_ignored: [...input.profile.ignoredFields],
-                worker_policy_delivery: input.profile.policyDelivery,
-                ...(input.profile.policyDir !== undefined
-                    ? {
-                        worker_policy_dir: input.profile.policyDir,
-                        worker_policy_env: { HQ_POLICY_WORKER_DIR: input.profile.policyDir },
-                    }
-                    : {}),
-                ...(input.profile.settingsPath
-                    ? { worker_profile_settings: input.profile.settingsPath }
-                    : {}),
-            }
-            : {}),
-    }, null, 2)}\n`);
-}
-/** Arm (or re-arm) the detached per-lane watcher. */
-export function armLaneWatcher(hqRoot, laneId, deps = {}) {
-    const env = deps.env ?? process.env;
-    const spawnProcess = deps.spawnProcess ?? defaultSpawnProcess;
-    const proveDetached = deps.proveDetached ?? defaultProveDetached;
-    const runDir = laneRunDir(hqRoot, laneId);
-    const logsDir = path.join(runDir, "logs");
-    ensureDir(logsDir);
-    const cliEntry = deps.hqCliEntry?.trim() || process.argv[1]?.trim();
-    if (!cliEntry) {
-        throw new LanesError("watcher_cli_entry_unavailable", "Cannot arm the lane watcher without the current hq CLI entrypoint", { lane_id: laneId });
-    }
-    const watcherPid = spawnDetached(spawnProcess, process.execPath, [watcherMainPath(), laneId], {
-        ...env,
-        HQ_ROOT: hqRoot,
-        HQ_LANE_ID: laneId,
-        HQ_LANE_CLI_ENTRY: path.resolve(cliEntry),
-    }, hqRoot, path.join(logsDir, "watcher.out"), path.join(logsDir, "watcher.err"));
-    writePidRecord(path.join(runDir, "watcher.pid"), {
-        pid: watcherPid,
-        starttime: readProcStarttime(watcherPid) ?? undefined,
-    });
-    try {
-        requireDetached(proveDetached, watcherPid, "watcher");
-    }
-    catch (err) {
-        killQuietly(deps.killProcess ?? defaultKillProcess, watcherPid, "watcher");
-        throw err;
-    }
-    return watcherPid;
-}
-/** Read the per-run manifest. Missing file or field reads as absent. */
-export function readSpawnManifest(runDir) {
-    const filePath = path.join(runDir, "spawn.json");
-    let text;
-    try {
-        text = fs.readFileSync(filePath, "utf8");
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ENOENT")
-            return {};
-        process.stderr.write(`hq lanes: failed to read ${filePath}: ${err instanceof Error ? err.message : String(err)}\n`);
-        throw err;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch (err) {
-        process.stderr.write(`hq lanes: ${filePath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}\n`);
-        return {};
-    }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-        return {};
-    const rec = parsed;
-    const out = {};
-    if (typeof rec.envelope_path === "string")
-        out.envelope_path = rec.envelope_path;
-    if (typeof rec.turn_id === "string")
-        out.turn_id = rec.turn_id;
-    if (typeof rec.provider_home_at_spawn === "string") {
-        out.provider_home_at_spawn = rec.provider_home_at_spawn;
-    }
-    if (typeof rec.worker_out_offset === "number" &&
-        Number.isInteger(rec.worker_out_offset) &&
-        rec.worker_out_offset >= 0) {
-        out.worker_out_offset = rec.worker_out_offset;
-    }
-    if (typeof rec.fast_mode === "boolean")
-        out.fast_mode = rec.fast_mode;
-    if (typeof rec.worker_profile === "string")
-        out.worker_profile = rec.worker_profile;
-    if (typeof rec.worker_profile_hash === "string")
-        out.worker_profile_hash = rec.worker_profile_hash;
-    if (Array.isArray(rec.worker_profile_ignored) && rec.worker_profile_ignored.every((item) => typeof item === "string")) {
-        out.worker_profile_ignored = rec.worker_profile_ignored;
-    }
-    if (typeof rec.worker_profile_settings === "string")
-        out.worker_profile_settings = rec.worker_profile_settings;
-    if (rec.resume &&
-        typeof rec.resume === "object" &&
-        typeof rec.resume.session_id === "string") {
-        out.resume = { session_id: rec.resume.session_id };
-    }
-    else if (rec.resume === null) {
-        out.resume = null;
-    }
-    return out;
-}
-function laneLaunchResult(lane) {
-    const { provider_home_at_spawn: _providerHomeAtSpawn, ...safe } = lane;
-    return safe;
-}
-function sameSeniorRef(a, b) {
-    return a.kind === b.kind && a.id === b.id;
-}
-function inferTrigger(lane) {
-    if (lane.state === "awaiting_input")
-        return { kind: "answered_questions" };
-    return { kind: "admit" };
-}
-/**
- * Bind the account, spawn the worker and its watcher outside the caller's
- * tree, then CAS the record to `running`. A spawn that cannot be proven
- * started and detached is a named terminal reason, never a bare `failed`.
- *
- * Fresh-vs-resume is decided by `planLaneLaunch` (delivery.ts), never here.
- */
-export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
-    const env = deps.env ?? process.env;
-    const hostname = accountHomeHostname(deps);
-    const modelDeps = {
-        ...deps.modelDeps,
-        env: deps.modelDeps?.env ?? env,
-    };
-    const existsSync = deps.existsSync ?? ((p) => fs.existsSync(p));
-    const spawnProcess = deps.spawnProcess ?? defaultSpawnProcess;
-    const proveDetached = deps.proveDetached ?? defaultProveDetached;
-    const killProcess = deps.killProcess ?? defaultKillProcess;
-    const runDir = laneRunDir(hqRoot, lane.lane_id);
-    const previousSpawn = readSpawnManifest(runDir);
-    const stored = readLane(hqRoot, lane.lane_id);
-    const recoveredSessionId = (typeof stored.provider_session_id === "string" && stored.provider_session_id.trim()
-        ? stored.provider_session_id
-        : undefined) ??
-        (typeof stored.last_resume?.session_id === "string" && stored.last_resume.session_id.trim()
-            ? stored.last_resume.session_id
-            : undefined) ??
-        (typeof previousSpawn.resume?.session_id === "string" && previousSpawn.resume.session_id.trim()
-            ? previousSpawn.resume.session_id
-            : undefined);
-    const existing = {
-        ...stored,
-        ...(stored.provider_session_id === undefined && recoveredSessionId !== undefined
-            ? { provider_session_id: recoveredSessionId }
-            : {}),
-        ...(stored.provider_home_at_spawn === undefined && previousSpawn.provider_home_at_spawn !== undefined
-            ? { provider_home_at_spawn: previousSpawn.provider_home_at_spawn }
-            : {}),
-    };
-    if (existing.state === "running") {
-        if (launch.trigger?.kind === "resume") {
-            throw new LanesError("lane_not_resumable", `Lane ${lane.lane_id} is already running`, { lane_id: lane.lane_id, state: existing.state });
-        }
-        return laneLaunchResult(existing);
-    }
-    // A queued lane that a move parked at the target's cap carries the turn
-    // it was resumed with: the admit spawn continues that session instead of
-    // starting fresh from the brief.
-    const pendingResume = launch.trigger === undefined && existing.state === "queued" ? existing.pending_resume : undefined;
-    const trigger = launch.trigger ?? inferTrigger(existing);
-    const failedResumeClaim = (trigger.kind === "resume" && trigger.fromFailed === true) || pendingResume?.from_failed === true;
-    const failedResumeExpectedSenior = trigger.kind === "resume" && trigger.fromFailed === true
-        ? trigger.expectedSenior
-        : pendingResume?.from_failed === true
-            ? pendingResume.expected_senior
-            : undefined;
-    // A message into a finished lane must not turn that lane `failed` when the
-    // account cannot be bound: nothing has started yet, so the record keeps its
-    // state and the caller sees the error. Admission and question resume keep
-    // today's behaviour of naming the terminal reason on the record.
-    const markPreSpawnFailure = trigger.kind !== "message" && trigger.kind !== "resume";
-    const plan = pendingResume?.trigger === "answered_questions"
-        ? pendingResume.session_id !== undefined && providerSupportsSessionResume(existing.provider)
-            ? { mode: "resume", session_id: pendingResume.session_id }
-            : planLaneLaunch(existing, { kind: "answered_questions" })
-        : pendingResume?.session_id !== undefined && providerSupportsSessionResume(existing.provider)
-            ? { mode: "resume", session_id: pendingResume.session_id }
-            : planLaneLaunch(existing, trigger);
-    if (existing.host.kind === "outpost") {
-        refuseOutpostSelfTarget(hqRoot, existing, deps);
-    }
-    const logsDir = path.join(runDir, "logs");
-    ensureDir(logsDir);
-    ensureDir(path.join(runDir, "envelopes"));
-    const profile = existing.worker_profile
-        ? loadWorkerProfileWithRegistry(hqRoot, existing.worker_profile, {
-            laneCompany: existing.company?.slug ?? existing.mesh_company?.slug,
-            ...(existing.registry_worker !== undefined
-                ? { registryWorkerRecord: existing.registry_worker }
-                : {}),
-        })
-        : undefined;
-    if (existing.host.kind === "outpost" &&
-        profile !== undefined &&
-        existing.worker_profile_hash !== profile.contentHash) {
-        throw new LanesError("worker_profile_hash_mismatch", `Worker profile ${JSON.stringify(existing.worker_profile)} on Outpost ${existing.host.id} changed after pickup validation`, {
-            lane_id: existing.lane_id,
-            worker: existing.worker_profile,
-            outpost: existing.host.id,
-            expected_hash: existing.worker_profile_hash ?? null,
-            actual_hash: profile.contentHash,
-        });
-    }
-    const profileDefaultsApply = profile !== undefined && profile.meta.provider === existing.provider;
-    const profileModel = profileDefaultsApply ? profile.meta.model : undefined;
-    const profileEffort = profileDefaultsApply ? profile.meta.effort : undefined;
-    const ignoredProfileFields = profile
-        ? ignoredWorkerProfileFields(existing.provider)
-        : [];
-    const policyDelivery = profile
-        ? workerPolicyDeliveryMode(hqRoot, existing.provider)
-        : undefined;
-    const workerPolicyDir = profile !== undefined && existing.provider !== "grok"
-        ? path.relative(hqRoot, profile.dir).split(path.sep).join("/")
-        : undefined;
-    const profileRuntime = profile
-        ? materializeWorkerProfile(profile, runDir)
-        : undefined;
-    const profileLaunch = profile
-        ? {
-            systemPrompt: workerProfilePrompt(profile, policyDelivery ?? "prompt"),
-            ...(profileRuntime?.settingsPath !== undefined
-                ? { settingsPath: profileRuntime.settingsPath }
-                : {}),
-            ignoredFields: ignoredProfileFields,
-        }
-        : undefined;
-    const profileChanged = profile !== undefined && existing.worker_profile_hash !== profile.contentHash;
-    const config = loadLanesConfig(hqRoot);
-    const repairRecordedAccount = plan.mode === "resume" &&
-        (trigger.kind === "resume" || pendingResume?.trigger === "resume" || pendingResume?.trigger === "watcher");
-    const recordedModel = repairRecordedAccount && existing.model_source === "account"
-        ? existing.model
-        : undefined;
-    // `hq lanes set` on a running lane leaves the change pending until this spawn.
-    const pendingSettings = existing.pending_settings;
-    let pinnedModel = pendingSettings?.model ?? (existing.model_source === undefined || existing.model_source === "cli" || existing.model_source === "preserved"
-        ? existing.model
-        : undefined);
-    const accountDeps = {
-        probe: modelDeps.probe ?? defaultProbe,
-        env,
-    };
-    let selection;
-    try {
-        selection = selectSpawnAccount({
-            hqRoot,
-            lane: existing,
-            config,
-            existsSync,
-            accountDeps,
-            modelDeps,
-            pinnedModel,
-            profileModel,
-            currentModelValidated: deps.currentModelValidated === true,
-            hostname,
-            repairRecordedAccount,
-            ...(recordedModel !== undefined ? { recordedModel } : {}),
-            now: (deps.now ?? (() => new Date()))(),
-        });
-    }
-    catch (err) {
-        if (err instanceof AccountResolutionError ||
-            (err instanceof LanesError &&
-                (err.error === "account_not_logged_in" || err.error === "model_unsupported"))) {
-            if (markPreSpawnFailure) {
-                markSpawnFailure(hqRoot, lane.lane_id, err.error, err.details);
-            }
-            throw err;
-        }
-        process.stderr.write(`hq lanes: account bind failed for ${lane.lane_id}: ${err instanceof Error ? err.message : String(err)}\n`);
-        throw err;
-    }
-    const preservedAccountModel = selection.preservedModel;
-    if (preservedAccountModel !== undefined)
-        pinnedModel = preservedAccountModel;
-    const resolved = selection.account;
-    if (deps.lowDiskGuardEnabled === true) {
-        const free = checkLaneDiskSpace(hqRoot, resolved.home, deps.statfs, config.low_disk_min_free_bytes);
-        if (free.low) {
-            const measuredAt = (deps.now ?? (() => new Date()))().toISOString();
-            return retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => ({
-                ...current,
-                state: "queued",
-                queued_reason: "low_disk",
-                queued_details: {
-                    reason: "low_disk",
-                    hq_free_bytes: free.hq.free_bytes,
-                    provider_free_bytes: free.provider.free_bytes,
-                    measured_at: measuredAt,
-                },
-                queued_at: current.queued_at ?? measuredAt,
-                admission_reserved_at: undefined,
-                terminal_reason: undefined,
-                terminal_details: undefined,
-            }));
-        }
-    }
-    const status = accountStatus(lane.provider, resolved.id, config, { existsSync, hostname });
-    if (isLoggedOut(status)) {
-        const failed = markPreSpawnFailure
-            ? markSpawnFailure(hqRoot, lane.lane_id, "account_not_logged_in", {
-                provider: lane.provider,
-                account: resolved.id,
-            })
-            : existing;
-        throw new LanesError("account_not_logged_in", `Account ${resolved.id} for ${lane.provider} is not logged in (no credential file)`, { provider: lane.provider, account: resolved.id, lane_id: lane.lane_id, lane: failed });
-    }
-    if (existing.account !== resolved.id) {
-        const source = existing.account
-            ? config.providers[existing.provider].accounts[existing.account]
-            : undefined;
-        if (source &&
-            existing.provider_session_id &&
-            providerSupportsSessionResume(existing.provider)) {
-            copySessionFiles(planSessionCopy(existing.provider, {
-                sourceHome: existing.provider_home_at_spawn ?? effectiveAccountHome(source, hostname).home,
-                targetHome: resolved.home,
-                cwd: hqRoot,
-                sessionId: existing.provider_session_id,
-            }));
-        }
-    }
-    if (plan.mode === "resume" && existing.provider !== "grok") {
-        ensureSessionHome({
-            provider: existing.provider,
-            sessionId: plan.session_id,
-            cwd: hqRoot,
-            targetHome: resolved.home,
-            registeredHomes: Object.values(config.providers[existing.provider].accounts)
-                .map((account) => effectiveAccountHome(account, hostname).home),
-            providerHomeAtSpawn: existing.provider_home_at_spawn,
-        });
-    }
-    if (existing.account !== resolved.id) {
-        const at = (deps.now ?? (() => new Date()))().toISOString();
-        const reason = selection.changeReason ?? "first_assignment";
-        retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => {
-            if (current.account === resolved.id)
-                return current;
-            if (current.account !== existing.account) {
-                throw new LanesError("account_bind_conflict", `Lane ${lane.lane_id} changed accounts while its worker spawn was prepared`, { lane_id: lane.lane_id, expected_account: existing.account ?? null, account: current.account ?? null });
-            }
-            const entry = {
-                from: current.account ?? null,
-                to: resolved.id,
-                at,
-                reason,
-            };
-            return {
-                ...current,
-                account: resolved.id,
-                ...(preservedAccountModel !== undefined
-                    ? { model: preservedAccountModel, model_source: "preserved" }
-                    : {}),
-                account_history: appendCappedHistory(current.account_history ?? [], entry),
-            };
-        });
-    }
-    try {
-        installDrainHook(lane.provider, resolved.home);
-    }
-    catch (err) {
-        process.stderr.write(`hq lanes: drain hook install failed for ${resolved.home}: ${err instanceof Error ? err.message : String(err)}\n`);
-        throw err;
-    }
-    const briefPath = path.join(runDir, "brief.md");
-    const envelopePath = nextEnvelopePath(runDir);
-    const lastMessagePath = path.join(logsDir, "last-message.txt");
-    const answersPath = path.join(runDir, ANSWERED_QUESTIONS_FILE);
-    const carriesAnsweredQuestions = trigger.kind === "answered_questions" || pendingResume?.trigger === "answered_questions";
-    const answeredLines = carriesAnsweredQuestions && existsSync(answersPath)
-        ? readAnsweredQuestionLines(answersPath)
-        : undefined;
-    const extraPrompt = existsSync(answersPath)
-        ? `Previously answered questions are at ${answersPath}; treat those choices as operator decisions that outrank the brief.`
-        : undefined;
-    const accountCfg = config.providers[lane.provider].accounts[resolved.id];
-    const autoCompactTokens = lane.provider === "claude"
-        ? providerAutoCompactTokens(config.providers.claude)
-        : undefined;
-    const childEnv = workerEnv(env, { envVar: resolved.envVar, home: resolved.home }, lane.lane_id, hqRoot, autoCompactTokens, lane.mesh_company ?? lane.company ?? undefined, workerPolicyDir, lane.registry_worker);
-    const laneTurnId = randomUUID();
-    childEnv.HQ_LANE_TURN_ID = laneTurnId;
-    const model = resolveLaneModel({
-        cliModel: pinnedModel,
-        profileModel,
-        accountModel: accountCfg?.model,
-        providerModel: config.providers[lane.provider].model,
-    });
-    const pendingResumeEffort = pendingResume !== undefined
-        ? pendingSettings?.effort !== undefined
-            ? { effort: pendingSettings.effort, source: "cli" }
-            : {
-                ...(existing.effort !== undefined ? { effort: existing.effort } : {}),
-                source: existing.effort_source ?? "none",
-            }
-        : undefined;
-    const effort = launch.effort ?? pendingResumeEffort ?? resolveLaneEffort({
-        cliEffort: pendingSettings?.effort ?? (existing.effort_source === "cli" ? existing.effort : undefined),
-        profileEffort,
-        accountEffort: accountCfg?.effort,
-        providerEffort: config.providers[lane.provider].effort,
-        model,
-    });
-    const fastMode = lane.provider === "codex"
-        ? (profileDefaultsApply ? profile?.meta.fast_mode : undefined) ??
-            (model !== undefined && (config.providers.codex.fast_mode_models ?? []).includes(model))
-        : false;
-    const resume = plan.mode === "resume"
-        ? {
-            session_id: plan.session_id,
-            prompt: resumePrompt({
-                envelopePath,
-                operatorMessage: trigger.kind === "message" && trigger.monitor_event !== true
-                    ? trigger.text
-                    : trigger.kind === "resume"
-                        ? trigger.text
-                        : pendingResume?.monitor_event === true
-                            ? undefined
-                            : pendingResume?.text,
-                monitorEvent: trigger.kind === "message" && trigger.monitor_event === true
-                    ? trigger.text
-                    : pendingResume?.monitor_event === true
-                        ? pendingResume.text
-                        : undefined,
-                resumedFrom: trigger.kind === "resume" ? trigger.from : pendingResume?.resumed_from,
-                resumeSource: pendingResume?.trigger === "watcher" ? "watcher" : undefined,
-                answersPath: answeredLines !== undefined ? answersPath : undefined,
-                answers: answeredLines,
-                envelopeRepairErrors: lane.terminal_reason === ENVELOPE_INVALID_REASON &&
-                    lane.envelope_repair?.attempted === true &&
-                    lane.envelope_repair.succeeded === false
-                    ? {
-                        first_error: lane.envelope_repair.first_error,
-                        ...(lane.envelope_repair.second_error !== undefined
-                            ? { second_error: lane.envelope_repair.second_error }
-                            : {}),
-                    }
-                    : undefined,
-            }),
-        }
-        : undefined;
-    const command = buildProviderCommand(lane.provider, {
-        hqRoot,
-        briefPath,
-        envelopePath,
-        lastMessagePath,
-        extraPrompt,
-        model,
-        effort: effort.effort,
-        fastMode,
-        profile: profileLaunch,
-        workerPolicyDir,
-        resume,
-    });
-    // A systemd PATH mismatch is an environment defect, not a lane failure.
-    // Keep the lane eligible for a later reconcile after the installer repairs it.
-    if (!providerCommandOnPath(command.command, childEnv.PATH)) {
-        const searchedPath = childEnv.PATH ?? "";
-        // Only admission may re-queue. A resume (answered questions, operator
-        // message) must keep the recorded state so the next reconcile does not
-        // infer `admit` and start a fresh run in place of the recorded session;
-        // the caller keeps the message text and sees the named error.
-        if (trigger.kind !== "admit") {
-            throw new LanesError("provider_binary_missing", `Provider binary ${command.command} for ${lane.provider} is not executable on PATH ${JSON.stringify(searchedPath)}; lane ${lane.lane_id} keeps state ${existing.state}`, {
-                provider: lane.provider,
-                command: command.command,
-                searched_path: searchedPath,
-                lane_id: lane.lane_id,
-                state: existing.state,
-                trigger: trigger.kind,
-            });
-        }
-        return retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => ({
-            ...current,
-            state: "queued",
-            queued_reason: "provider_binary_missing",
-            queued_details: undefined,
-            terminal_reason: undefined,
-            terminal_details: {
-                provider: lane.provider,
-                command: command.command,
-                searched_path: searchedPath,
-            },
-        }));
-    }
-    // Resume-time compaction (compaction.ts). Runs before the claim so the
-    // lane is never `running` without a worker while `/compact` works.
-    let compaction;
-    const compactWanted = pendingResume?.compact ?? launch.compact;
-    if (resume && compactWanted !== false) {
-        const nowFn = deps.now ?? (() => new Date());
-        const decision = compactionDue(existing, nowFn().getTime(), providerCompactAfterMs(config.providers[lane.provider]));
-        if (decision.due) {
-            const compactCommand = buildProviderCommand(lane.provider, {
-                hqRoot,
-                briefPath,
-                envelopePath,
-                lastMessagePath,
-                model,
-                effort: effort.effort,
-                fastMode,
-                profile: profileLaunch,
-                workerPolicyDir,
-                resume: { session_id: resume.session_id, prompt: COMPACTION_PROMPT },
-            });
-            compaction = compactLaneSession({
-                command: compactCommand.command,
-                args: compactCommand.args,
-                sessionId: resume.session_id,
-                accountHome: resolved.home,
-                env: childEnv,
-                cwd: hqRoot,
-                logsDir,
-                decision,
-                before: existing.last_run_usage ?? null,
-                now: nowFn,
-                run: deps.runCompaction,
-                locateTranscript: deps.locateTranscript,
-            });
-        }
-    }
-    // Claim running before spawning. Two callers that both observe queued must
-    // not both start processes; the CAS loser returns without spawn.
-    const nowIso = (deps.now ?? (() => new Date()))().toISOString();
-    const resumeHistoryTrigger = pendingResume?.keep_alive === true
-        ? "keep_alive"
-        : pendingResume?.trigger === "monitor_event" || pendingResume?.monitor_event === true ||
-            (trigger.kind === "message" && trigger.monitor_event === true)
-            ? "monitor_event"
-            : pendingResume?.trigger === "system_notice" ||
-                (trigger.kind === "message" && trigger.system_notice === true)
-                ? "system_notice"
-                : pendingResume?.trigger === "watcher"
-                    ? "watcher"
-                    : pendingResume?.trigger === "message" || trigger.kind === "message"
-                        ? "message"
-                        : pendingResume?.trigger === "resume" || trigger.kind === "resume"
-                            ? "resume_cli"
-                            : "reconcile";
-    const resumeHistoryCaller = pendingResume?.caller ||
-        (pendingResume?.trigger !== "watcher" && typeof env.HQ_LANE_ID === "string" ? env.HQ_LANE_ID.trim() : "") ||
-        (pendingResume?.trigger === "message" || pendingResume?.trigger === "monitor_event" ||
-            pendingResume?.trigger === "system_notice" || trigger.kind === "answered_questions" ||
-            trigger.kind === "resume" || trigger.kind === "message"
-            ? "user"
-            : undefined);
-    let statusGateHeartbeat;
-    try {
-        statusGateHeartbeat = managerStatusGateHeartbeat(hqRoot, existing, laneTurnId, nowIso);
-    }
-    catch (err) {
-        const code = err instanceof LanesError ? err.error : "manager_status_gate_unavailable";
-        const message = err instanceof Error ? err.message : String(err);
-        process.stderr.write(`hq lanes: manager status gate disabled for ${lane.lane_id}: ${code}: ${message}\n`);
-        statusGateHeartbeat = undefined;
-    }
-    let claimed = false;
-    let priorStartRecorded = false;
-    const claimedRecord = retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => {
-        claimed = false;
-        if (current.state === "running" && current.account === resolved.id) {
-            if (trigger.kind === "resume") {
-                throw new LanesError("lane_not_resumable", `Lane ${current.lane_id} is already running`, { lane_id: current.lane_id, state: current.state });
-            }
-            return current;
-        }
-        if (!claimableStatesFor(trigger, current).includes(current.state)) {
-            throw new LanesError("spawn_state_mismatch", `Cannot mark ${current.lane_id} running from ${current.state}`, { lane_id: current.lane_id, state: current.state, trigger: trigger.kind });
-        }
-        // The host report is written in the claim CAS before exec proves that a
-        // worker started. Use the prior spawn manifest's turn id (written only
-        // after detachment is proven), with last_resume for legacy manifests.
-        priorStartRecorded = previousSpawn.turn_id !== undefined ||
-            current.last_resume !== undefined ||
-            (current.resume_history?.length ?? 0) > 0;
-        if (failedResumeClaim &&
-            (failedResumeExpectedSenior === undefined ||
-                !sameSeniorRef(current.senior, failedResumeExpectedSenior))) {
-            throw new LanesError("failed_resume_senior_changed", `Lane ${current.lane_id}'s senior changed after its failed-resume request was authorized`, {
-                lane_id: current.lane_id,
-                expected_senior: failedResumeExpectedSenior ?? null,
-                current_senior: current.senior,
-            });
-        }
-        claimed = true;
-        const next = {
-            ...current,
-            state: "running",
-            queued_reason: undefined,
-            queued_details: undefined,
-            queued_at: undefined,
-            admission_reserved_at: undefined,
-            terminal_reason: undefined,
-            terminal_details: undefined,
-            // An account move's reservation ends with the claim.
-            pending_resume: undefined,
-            pending_settings: undefined,
-            account: resolved.id,
-            provider_home_at_spawn: resolved.home,
-            ...(model !== undefined ? { model } : {}),
-            ...(model !== undefined
-                ? {
-                    model_source: pinnedModel !== undefined
-                        ? preservedAccountModel === undefined && pendingSettings?.model !== undefined
-                            ? "cli"
-                            : preservedAccountModel !== undefined || existing.model_source === "preserved"
-                                ? "preserved"
-                                : "cli"
-                        : profileModel !== undefined
-                            ? "profile"
-                            : accountCfg?.model !== undefined
-                                ? "account"
-                                : config.providers[lane.provider].model !== undefined
-                                    ? "provider"
-                                    : "none",
-                }
-                : { model_source: "none" }),
-            effort_source: effort.source,
-            status_gate: statusGateHeartbeat,
-            last_host_report_at: nowIso,
-            ...(profile
-                ? {
-                    worker_profile_hash: profile.contentHash,
-                    registry_worker: profile.registryWorker !== undefined
-                        ? registryWorkerRecord(profile.registryWorker)
-                        : undefined,
-                    worker_profile_ignored: [...ignoredProfileFields],
-                    worker_policy_delivery: policyDelivery,
-                }
-                : { registry_worker: undefined, worker_policy_delivery: undefined }),
-        };
-        if (resume !== undefined) {
-            next.provider_session_id = resume.session_id;
-            next.provider_session_id_absent = undefined;
-        }
-        if (effort.effort !== undefined)
-            next.effort = effort.effort;
-        else
-            delete next.effort;
-        // `undefined` deliberately overlays the CAS merge's current record so a
-        // dynamic default disappearing removes the stale persisted model.
-        if (model === undefined)
-            next.model = undefined;
-        if (fastMode)
-            next.fast_mode = true;
-        else
-            delete next.fast_mode;
-        // Freeze the counters of the run that followed the previous compaction
-        // before this launch replaces last_resume.
-        if (current.last_compaction && current.last_compaction.after === null) {
-            const after = compactionAfterUsage(current);
-            if (after !== null)
-                next.last_compaction = { ...current.last_compaction, after };
-        }
-        if (compaction)
-            next.last_compaction = { ...compaction, resume_at: nowIso };
-        if (resume && pendingResume !== undefined) {
-            next.last_resume = {
-                session_id: resume.session_id,
-                at: nowIso,
-                account: resolved.id,
-                trigger: pendingResume.trigger,
-                ...(pendingResume.keep_alive === true ? { keep_alive: true } : {}),
-                ...(pendingResume.message_id !== undefined ? { message_id: pendingResume.message_id } : {}),
-                ...(pendingResume.monitor_event === true ? { monitor_event: true } : {}),
-                ...(pendingResume.resumed_from !== undefined ? { resumed_from: pendingResume.resumed_from } : {}),
-                ...(pendingResume.from_failed === true ? { from_failed: true } : {}),
-                ...(pendingResume.text !== undefined ? { text: pendingResume.text } : {}),
-                ...(pendingResume.compact !== undefined ? { compact: pendingResume.compact } : {}),
-            };
-        }
-        else if (resume && trigger.kind !== "admit") {
-            next.last_resume = {
-                session_id: resume.session_id,
-                at: nowIso,
-                account: resolved.id,
-                trigger: trigger.kind === "message" && trigger.system_notice === true ? "system_notice" : trigger.kind,
-                ...(trigger.kind === "message"
-                    ? {
-                        message_id: trigger.message_id,
-                        text: trigger.text,
-                        ...(trigger.monitor_event === true ? { monitor_event: true } : {}),
-                    }
-                    : {}),
-                ...(launch.compact !== undefined ? { compact: launch.compact } : {}),
-                ...(trigger.kind === "resume"
-                    ? {
-                        resumed_from: trigger.from,
-                        ...(trigger.fromFailed === true ? { from_failed: true } : {}),
-                        ...(trigger.text !== undefined ? { text: trigger.text } : {}),
-                        ...(trigger.message_id !== undefined ? { message_id: trigger.message_id } : {}),
-                    }
-                    : {}),
-            };
-        }
-        if (resume && pendingResume?.text !== LEAD_LANE_KEEP_ALIVE_BLOCKED_RESUME_TEXT) {
-            next.keep_alive_blocked_resume_streak = 0;
-        }
-        return next;
-    });
-    if (!claimed) {
-        if (compaction) {
-            const record = compaction;
-            return retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => ({
-                ...current,
-                last_compaction: record,
-            }));
-        }
-        return laneLaunchResult(claimedRecord);
-    }
-    // Each normal spawn/resume starts a fresh provider turn. The resume prompt
-    // carries the prior message text, so only messages delivered after this
-    // reset may be replayed if the new turn compacts.
-    const replayStatePath = path.join(runDir, "dropbox", MESSAGE_REPLAY_STATE_NAME);
-    const replayStateTempPath = `${replayStatePath}.${process.pid}.${laneTurnId}.tmp`;
-    try {
-        fs.mkdirSync(path.dirname(replayStatePath), { recursive: true });
-        fs.writeFileSync(replayStateTempPath, `${JSON.stringify({
-            schema_version: 1,
-            turn_id: laneTurnId,
-            last_compaction_marker: null,
-        })}\n`, { mode: 0o600 });
-        fs.renameSync(replayStateTempPath, replayStatePath);
-    }
-    catch (err) {
-        try {
-            fs.rmSync(replayStateTempPath, { force: true });
-        }
-        catch (cleanupErr) {
-            process.stderr.write(`hq lanes: compaction replay state temp cleanup failed for ${lane.lane_id}: ${cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)}\n`);
-        }
-        delete childEnv.HQ_LANE_TURN_ID;
-        process.stderr.write(`hq lanes: compaction replay disabled for ${lane.lane_id}; failed to reset turn state: ${err instanceof Error ? err.message : String(err)}\n`);
-    }
-    const workerOutPath = path.join(logsDir, "worker.out");
-    const workerOutOffset = fileSizeOrZero(workerOutPath);
-    let workerPid;
-    let watcherPid;
-    try {
-        workerPid = spawnDetached(spawnProcess, command.command, command.args, childEnv, hqRoot, path.join(logsDir, "worker.out"), path.join(logsDir, "worker.err"));
-        writePidRecord(path.join(runDir, "worker.pid"), {
-            pid: workerPid,
-            starttime: readProcStarttime(workerPid) ?? undefined,
-        });
-        requireDetached(proveDetached, workerPid, "worker");
-        if (answeredLines && answeredLines.length > 0) {
-            markAnsweredQuestionsDelivered(hqRoot, lane.lane_id, answeredLines.map(({ question_id }) => question_id), (deps.now ?? (() => new Date()))().toISOString());
-        }
-        watcherPid = armLaneWatcher(hqRoot, lane.lane_id, deps);
-        writeSpawnManifest(runDir, {
-            command: command.command,
-            args: command.args,
-            envVar: resolved.envVar,
-            account: resolved.id,
-            workerPid,
-            watcherPid,
-            envelopePath,
-            turnId: laneTurnId,
-            resume: resume ? { session_id: resume.session_id } : null,
-            workerOutOffset,
-            fastMode,
-            ...(profile
-                ? {
-                    profile: {
-                        id: profile.id,
-                        hash: profile.contentHash,
-                        ignoredFields: ignoredProfileFields,
-                        policyDelivery: policyDelivery ?? "prompt",
-                        ...(workerPolicyDir !== undefined ? { policyDir: workerPolicyDir } : {}),
-                        ...(profileRuntime?.settingsPath !== undefined
-                            ? { settingsPath: profileRuntime.settingsPath }
-                            : {}),
-                    },
-                }
-                : {}),
-        });
-        if (profile !== undefined) {
-            appendWorkerProfileEvent(runDir, {
-                profile_id: profile.id,
-                profile_hash: profile.contentHash,
-                changed: profileChanged,
-                provider: lane.provider,
-                ignored_fields: ignoredProfileFields,
-            });
-        }
-    }
-    catch (err) {
-        if (workerPid !== undefined)
-            killQuietly(killProcess, workerPid, "worker");
-        if (watcherPid !== undefined)
-            killQuietly(killProcess, watcherPid, "watcher");
-        const reason = err instanceof LanesError &&
-            SPAWN_TERMINAL_REASONS.includes(err.error)
-            ? err.error
-            : "spawn_failed";
-        const failed = markSpawnFailure(hqRoot, lane.lane_id, reason, {
-            message: err instanceof Error ? err.message : String(err),
-            ...(err instanceof LanesError ? err.details : {}),
-        });
-        if (err instanceof LanesError) {
-            throw new LanesError(err.error, err.message, {
-                ...err.details,
-                lane_id: lane.lane_id,
-                lane: failed,
-            });
-        }
-        throw err;
-    }
-    if (priorStartRecorded) {
-        retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => ({
-            ...current,
-            resume_history: appendCappedHistory(current.resume_history ?? [], {
-                at: nowIso,
-                trigger: resumeHistoryTrigger,
-                ...(resumeHistoryCaller ? { caller: resumeHistoryCaller } : {}),
-            }),
-        }));
-    }
-    return laneLaunchResult(readLane(hqRoot, lane.lane_id));
-}
-/**
- * Handle the private request sent by an older, long-running watcher to the
- * currently installed `hq` executable. The persisted repair attempt is the
- * authorization for this one-shot spawn; the request cannot select an
- * arbitrary lane or write outside that lane's envelope directory.
- */
-export function spawnEnvelopeRepairRequest(hqRoot, rawRequest, deps = {}) {
-    const invalid = (message) => {
-        throw new LanesError("repair_request_invalid", message, {});
-    };
-    if (!rawRequest || typeof rawRequest !== "object" || Array.isArray(rawRequest)) {
-        return invalid("Envelope repair request must be an object");
-    }
-    const request = rawRequest;
-    if (Object.keys(request).some((key) => key !== "lane_id" && key !== "input")) {
-        return invalid("Envelope repair request has unknown fields");
-    }
-    if (typeof request.lane_id !== "string" ||
-        !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(request.lane_id)) {
-        return invalid("Envelope repair request must include a lane_id");
-    }
-    if (!request.input || typeof request.input !== "object" || Array.isArray(request.input)) {
-        return invalid("Envelope repair request input must be an object");
-    }
-    const rawInput = request.input;
-    const allowedInputFields = new Set([
-        "session_id",
-        "envelopePath",
-        "error",
-        "rawText",
-        "missing",
-    ]);
-    if (Object.keys(rawInput).some((key) => !allowedInputFields.has(key))) {
-        return invalid("Envelope repair request input has unknown fields");
-    }
-    if (typeof rawInput.envelopePath !== "string" ||
-        !path.isAbsolute(rawInput.envelopePath) ||
-        path.resolve(rawInput.envelopePath) !== rawInput.envelopePath ||
-        typeof rawInput.error !== "string" ||
-        !rawInput.error.trim() ||
-        typeof rawInput.rawText !== "string" ||
-        (rawInput.session_id !== undefined &&
-            rawInput.session_id !== null &&
-            (typeof rawInput.session_id !== "string" || !rawInput.session_id.trim())) ||
-        (rawInput.missing !== undefined && typeof rawInput.missing !== "boolean")) {
-        return invalid("Envelope repair request input has invalid fields");
-    }
-    const lane = readLane(hqRoot, request.lane_id);
-    const repair = lane.envelope_repair;
-    if (lane.state !== "running" || !repair?.attempted || repair.succeeded) {
-        throw new LanesError("repair_request_not_authorized", `Lane ${lane.lane_id} has no pending envelope repair attempt`, { lane_id: lane.lane_id });
-    }
-    if (repair.first_error !== rawInput.error) {
-        throw new LanesError("repair_request_stale", `Lane ${lane.lane_id} envelope repair request no longer matches its recorded error`, { lane_id: lane.lane_id });
-    }
-    const envelopeDir = path.resolve(laneRunDir(hqRoot, lane.lane_id), "envelopes");
-    const envelopePath = path.resolve(rawInput.envelopePath);
-    if (path.dirname(envelopePath) !== envelopeDir ||
-        !path.basename(envelopePath).endsWith(".json") ||
-        typeof repair.envelope_ref !== "string" ||
-        path.posix.dirname(repair.envelope_ref) !== "envelopes" ||
-        !path.posix.basename(repair.envelope_ref).endsWith(".json")) {
-        throw new LanesError("repair_request_path_invalid", `Lane ${lane.lane_id} envelope repair request does not name a lane envelope`, { lane_id: lane.lane_id });
-    }
-    const recordedEnvelopePath = path.resolve(laneRunDir(hqRoot, lane.lane_id), repair.envelope_ref);
-    if (envelopePath !== recordedEnvelopePath) {
-        throw new LanesError("repair_request_envelope_mismatch", `Lane ${lane.lane_id} envelope repair request does not match the recorded repair slot`, { lane_id: lane.lane_id, envelope_ref: repair.envelope_ref });
-    }
-    const warnings = [];
-    const input = {
-        envelopePath,
-        error: rawInput.error,
-        rawText: rawInput.rawText,
-        ...(typeof rawInput.session_id === "string" || rawInput.session_id === null
-            ? { session_id: rawInput.session_id }
-            : {}),
-        ...(typeof rawInput.missing === "boolean" ? { missing: rawInput.missing } : {}),
-        onProfileWarning: (fields) => warnings.push([...fields]),
-    };
-    const pid = spawnEnvelopeRepair(hqRoot, lane, input, deps);
-    return { pid, profile_warnings: warnings };
-}
-/**
- * `resume`: claude and codex continue the recorded session with the repair
- * prompt. `fresh_turn`: grok gets a new single-turn invocation on the same
- * account, whose prompt carries the schema, the parser error and the raw
- * failed output. Grok can resume a session (operator messages and
- * `hq lanes resume` use it), but its repair turn stays a fresh turn: that
- * path was built and proven that way, and a repair by resume has not been.
- */
-export function envelopeRepairMode(provider) {
-    return providerSupportsSessionResume(provider) && provider !== "grok" ? "resume" : "fresh_turn";
-}
-/**
- * Spec §4 repair turn. The lane is still `running` (the watcher has not
- * written a terminal state), so this does not claim or transition the
- * record. It resumes the recorded provider session with the repair prompt
- * (`resume` mode), or for a provider with no session resume runs the repair
- * prompt as a fresh single turn on the same account (`fresh_turn` mode). It
- * replaces `worker.pid` and rewrites `spawn.json` so the watcher's next tick
- * follows the new process. The account is the one already bound on the record.
- * Fast-mode evidence is updated after the replacement is proven detached.
- */
-export function spawnEnvelopeRepair(hqRoot, lane, input, deps = {}) {
-    const env = deps.env ?? process.env;
-    const hostname = accountHomeHostname(deps);
-    const existsSync = deps.existsSync ?? ((p) => fs.existsSync(p));
-    const spawnProcess = deps.spawnProcess ?? defaultSpawnProcess;
-    const proveDetached = deps.proveDetached ?? defaultProveDetached;
-    const killProcess = deps.killProcess ?? defaultKillProcess;
-    const mode = envelopeRepairMode(lane.provider);
-    const sessionId = input.session_id ?? null;
-    if (mode === "resume" && sessionId === null) {
-        throw new LanesError("repair_session_missing", `Provider ${lane.provider} repairs by resuming its session, but no session id was given`, { provider: lane.provider });
-    }
-    const runDir = laneRunDir(hqRoot, lane.lane_id);
-    const logsDir = path.join(runDir, "logs");
-    ensureDir(logsDir);
-    const config = loadLanesConfig(hqRoot);
-    const profile = lane.worker_profile
-        ? loadWorkerProfileWithRegistry(hqRoot, lane.worker_profile, {
-            laneCompany: lane.company?.slug ?? lane.mesh_company?.slug,
-            ...(lane.registry_worker !== undefined
-                ? { registryWorkerRecord: lane.registry_worker }
-                : {}),
-            onUnknownMetaFields: (fields) => {
-                process.stderr.write(`hq lanes watcher: envelope repair ignored unknown worker profile meta field(s) for ${lane.worker_profile}: ${fields.join(", ")}\n`);
-                input.onProfileWarning?.(fields);
-            },
-        })
-        : undefined;
-    const profileDefaultsApply = profile !== undefined && profile.meta.provider === lane.provider;
-    const profileModel = profileDefaultsApply ? profile.meta.model : undefined;
-    const profileEffort = profileDefaultsApply ? profile.meta.effort : undefined;
-    const ignoredProfileFields = profile
-        ? ignoredWorkerProfileFields(lane.provider)
-        : [];
-    const policyDelivery = profile
-        ? workerPolicyDeliveryMode(hqRoot, lane.provider)
-        : undefined;
-    const workerPolicyDir = profile !== undefined && lane.provider !== "grok"
-        ? path.relative(hqRoot, profile.dir).split(path.sep).join("/")
-        : undefined;
-    const profileRuntime = profile
-        ? materializeWorkerProfile(profile, runDir)
-        : undefined;
-    const profileLaunch = profile
-        ? {
-            systemPrompt: workerProfilePrompt(profile, policyDelivery ?? "prompt"),
-            ...(profileRuntime?.settingsPath !== undefined
-                ? { settingsPath: profileRuntime.settingsPath }
-                : {}),
-            ignoredFields: ignoredProfileFields,
-        }
-        : undefined;
-    const pinnedModel = lane.model_source === undefined || lane.model_source === "cli" || lane.model_source === "preserved"
-        ? lane.model
-        : undefined;
-    const resolved = resolveAccount(lane.provider, lane.account, config, {
-        hqRoot,
-        existsSync,
-        hostname,
-        model: pinnedModel ?? profileModel,
-    });
-    if (profileDefaultsApply && profileModel !== undefined && pinnedModel === undefined) {
-        validateProfileLaneModel(lane.provider, profileModel, resolved.home, profile.id, {
-            ...deps.modelDeps,
-            env: deps.modelDeps?.env ?? env,
-        });
-    }
-    const autoCompactTokens = lane.provider === "claude"
-        ? providerAutoCompactTokens(config.providers.claude)
-        : undefined;
-    const childEnv = workerEnv(env, { envVar: resolved.envVar, home: resolved.home }, lane.lane_id, hqRoot, autoCompactTokens, lane.mesh_company ?? lane.company ?? undefined, workerPolicyDir, lane.registry_worker);
-    const accountCfg = config.providers[lane.provider].accounts[resolved.id];
-    const model = resolveLaneModel({
-        cliModel: pinnedModel,
-        profileModel,
-        accountModel: accountCfg?.model,
-        providerModel: config.providers[lane.provider].model,
-    });
-    const effort = resolveLaneEffort({
-        cliEffort: lane.effort_source === "cli" ? lane.effort : undefined,
-        profileEffort,
-        accountEffort: accountCfg?.effort,
-        providerEffort: config.providers[lane.provider].effort,
-        model,
-    });
-    const fastMode = lane.provider === "codex"
-        ? (profileDefaultsApply ? profile?.meta.fast_mode : undefined) ??
-            (model !== undefined && (config.providers.codex.fast_mode_models ?? []).includes(model))
-        : false;
-    const repairPrompt = envelopeRepairPrompt({
-        envelopePath: input.envelopePath,
-        error: input.error,
-        rawText: input.rawText,
-        missing: input.missing,
-    });
-    const command = buildProviderCommand(lane.provider, {
-        hqRoot,
-        briefPath: path.join(runDir, "brief.md"),
-        envelopePath: input.envelopePath,
-        lastMessagePath: path.join(logsDir, "last-message.txt"),
-        model,
-        effort: effort.effort,
-        fastMode,
-        profile: profileLaunch,
-        workerPolicyDir,
-        ...(mode === "resume" && sessionId !== null
-            ? { resume: { session_id: sessionId, prompt: repairPrompt } }
-            : { freshTurnPrompt: repairPrompt }),
-    });
-    const workerOutOffset = fileSizeOrZero(path.join(logsDir, "worker.out"));
-    const previous = readSpawnManifest(runDir);
-    let workerPid;
-    try {
-        workerPid = spawnDetached(spawnProcess, command.command, command.args, childEnv, hqRoot, path.join(logsDir, "worker.out"), path.join(logsDir, "worker.err"));
-        writePidRecord(path.join(runDir, "worker.pid"), {
-            pid: workerPid,
-            starttime: readProcStarttime(workerPid) ?? undefined,
-        });
-        requireDetached(proveDetached, workerPid, "worker");
-        const watcherPid = readPidRecord(path.join(runDir, "watcher.pid"))?.pid ?? 0;
-        writeSpawnManifest(runDir, {
-            command: command.command,
-            args: command.args,
-            envVar: resolved.envVar,
-            account: resolved.id,
-            workerPid,
-            watcherPid,
-            envelopePath: previous.envelope_path ?? input.envelopePath,
-            resume: mode === "resume" && sessionId !== null ? { session_id: sessionId } : null,
-            workerOutOffset,
-            fastMode,
-            ...(profile
-                ? {
-                    profile: {
-                        id: profile.id,
-                        hash: profile.contentHash,
-                        ignoredFields: ignoredProfileFields,
-                        policyDelivery: policyDelivery ?? "prompt",
-                        ...(workerPolicyDir !== undefined ? { policyDir: workerPolicyDir } : {}),
-                        ...(profileRuntime?.settingsPath !== undefined
-                            ? { settingsPath: profileRuntime.settingsPath }
-                            : {}),
-                    },
-                }
-                : {}),
-        });
-        if (profile !== undefined) {
-            appendWorkerProfileEvent(runDir, {
-                profile_id: profile.id,
-                profile_hash: profile.contentHash,
-                changed: lane.worker_profile_hash !== profile.contentHash,
-                provider: lane.provider,
-                ignored_fields: ignoredProfileFields,
-            });
-        }
-        retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => {
-            const next = { ...current };
-            if (profile !== undefined) {
-                next.worker_profile_hash = profile.contentHash;
-                next.worker_profile_ignored = [...ignoredProfileFields];
-                next.worker_policy_delivery = policyDelivery;
-                if (model !== undefined) {
-                    next.model = model;
-                    next.model_source = pinnedModel !== undefined
-                        ? lane.model_source === "preserved" ? "preserved" : "cli"
-                        : profileModel !== undefined
-                            ? "profile"
-                            : accountCfg?.model !== undefined
-                                ? "account"
-                                : config.providers[lane.provider].model !== undefined
-                                    ? "provider"
-                                    : "none";
-                }
-                else {
-                    next.model = undefined;
-                    next.model_source = "none";
-                }
-                next.effort_source = effort.source;
-                if (effort.effort !== undefined)
-                    next.effort = effort.effort;
-                else
-                    delete next.effort;
-            }
-            else {
-                next.worker_policy_delivery = undefined;
-            }
-            if (fastMode)
-                next.fast_mode = true;
-            else
-                delete next.fast_mode;
-            return next;
-        });
-    }
-    catch (err) {
-        if (workerPid !== undefined)
-            killQuietly(killProcess, workerPid, "worker");
-        throw err;
-    }
-    const startedAt = (deps.now ?? (() => new Date()))().toISOString();
-    const callerLaneId = typeof env.HQ_LANE_ID === "string" ? env.HQ_LANE_ID.trim() : "";
-    retryUpdateLane(hqRoot, lane.lane_id, "spawn", (current) => ({
-        ...current,
-        resume_history: appendCappedHistory(current.resume_history ?? [], {
-            at: startedAt,
-            trigger: "envelope_repair",
-            ...(callerLaneId ? { caller: callerLaneId } : {}),
-        }),
-    }));
-    return workerPid;
-}
-export { PROVIDER_HOME_ENV, PROVIDER_COMMAND };
-//# sourceMappingURL=spawn.js.map