@indigoai-us/hq-cli 5.345.123 → 5.345.125

package/dist/lib/lanes/quota.d.ts

@@ -16,6 +16,14 @@
  * claude-fable-5-1 and still runs claude-opus-5). The record is therefore
  * per (account, model), plus an account-wide reset when the text is a
  * usage limit rather than a switch-model refusal.
+ *
+ * A single 429 is not trusted with a multi-day hold. When the provider names
+ * a reset more than a day away, the first 429 holds the account only for the
+ * short default hold and keeps the named reset as `unconfirmed_reset_at`. A
+ * second 429 from a lane that ran after that short hold expired confirms the
+ * reset; a successful turn drops it. (Measured 2026-10-13: account a returned
+ * "You've hit your weekly limit · resets Oct 16 at 1am (America/Denver)"
+ * while the owner's /usage showed the week at 43%.)
  */
 import type { LaneProvider } from "./types.js";
 export declare const QUOTA_STATE_REL: string;
@@ -26,7 +34,14 @@ export interface ModelQuota {
     /** Operator-facing marker, e.g. "needs credits for claude-fable-5-1". */
     marker?: string;
 }
-export type QuotaResetSource = "parsed" | "derived";
+/**
+ * `parsed`: the provider's own reset. `derived`: the default hold for a 429
+ * with no parseable reset. `unconfirmed`: a short hold standing in for a
+ * provider reset more than a day away that a second 429 has not confirmed.
+ */
+export type QuotaResetSource = "parsed" | "derived" | "unconfirmed";
+/** A provider reset further away than this needs a second 429 before it holds. */
+export declare const QUOTA_CONFIRM_HORIZON_MS: number;
 export interface AccountQuota {
     /** Set when the 429 is an account-wide usage limit with a reset time. */
     all_models_quota_reset_at?: string;
@@ -35,6 +50,13 @@ export interface AccountQuota {
      * the configured default hold applied to a 429 with no parseable reset.
      */
     reset_source?: QuotaResetSource;
+    /**
+     * The provider's named reset, held back until a second 429 on a fresh
+     * probe confirms it. Set only while `reset_source` is `unconfirmed`.
+     */
+    unconfirmed_reset_at?: string;
+    /** Raw provider text from the 429 that set the current hold. */
+    provider_text?: string;
     models: Record<string, ModelQuota>;
 }
 export interface QuotaState {
@@ -51,6 +73,8 @@ export interface QuotaSignal {
     account_wide?: boolean;
     /** Set by applyDefaultQuotaHold: whether the reset is the provider's or the default hold. */
     reset_source?: QuotaResetSource;
+    /** The provider's raw result text, kept so the hold can be shown to the senior. */
+    provider_text?: string;
 }
 /**
  * A 429 whose message names no reset time and no credits wording would
@@ -64,12 +88,18 @@ export declare function applyDefaultQuotaHold(signal: QuotaSignal, defaultHoldMs
 export declare function quotaStatePath(hqRoot: string): string;
 export declare function loadQuotaState(hqRoot: string): QuotaState;
 /**
- * Parse provider reset times such as "resets Sep 24, 2am (UTC)" and Codex's
- * "try again at Sep 14th, 2026 9:24 PM" into an ISO timestamp. Codex's
- * unzoned form is displayed in the provider CLI's local timezone, while the
- * provider `resets` form is UTC when it names `(UTC)`. The year is the current
- * UTC year for an unyear-tagged reset, rolled forward when it is already past.
- * An explicit provider year is kept as stated.
+ * Parse provider reset times into an ISO timestamp. Handled forms:
+ *
+ * - "resets 2am (UTC)" and "resets 1am (America/Denver)": the next such time.
+ * - "resets Sep 24, 2am (UTC)", "resets Oct 16 at 1am (America/Denver)",
+ *   "resets Sep 24, 2026 2am (UTC)": a dated reset.
+ * - Codex's "try again at Sep 14th, 2026 9:24 PM", shown in the provider
+ *   CLI's local timezone unless it names `(UTC)`.
+ *
+ * The zone is `UTC` or an IANA name; an unknown zone name fails the parse. A
+ * dated provider reset with no zone is read as UTC. The year is the zone's
+ * current year for an unyear-tagged reset, rolled forward when it is already
+ * past. An explicit provider year is kept as stated.
  */
 export declare function parseProviderResetTime(text: string, now: Date): string | null;
 /**
@@ -77,18 +107,28 @@ export declare function parseProviderResetTime(text: string, now: Date): string
  * `type: "result"` object. Nothing else from the payload is returned, and
  * this function does not log.
  */
-export declare function quotaFieldsFromOutput(text: string): {
+export interface QuotaResultFields {
     api_error_status: unknown;
     is_error: unknown;
     result: unknown;
-} | null;
-export declare function quotaSignalFromFields(fields: {
-    api_error_status: unknown;
-    is_error: unknown;
-    result: unknown;
-}, model: string | undefined, now: Date): QuotaSignal | null;
+    /**
+     * The provider's structured reset (`resetsAt`, epoch seconds or ISO) when
+     * the result carries one; it beats the wording in `result`.
+     */
+    resets_at?: unknown;
+}
+/** Epoch seconds, epoch milliseconds, or an ISO string, to ISO; null otherwise. */
+export declare function normalizeStructuredReset(value: unknown): string | null;
+export declare function quotaFieldsFromOutput(text: string): QuotaResultFields | null;
+export declare function quotaSignalFromFields(fields: QuotaResultFields, model: string | undefined, now: Date): QuotaSignal | null;
 export declare function readQuotaSignal(runDir: string, model: string | undefined, now: Date, workerOutOffset?: number): QuotaSignal | null;
-export declare function recordAccountQuota(hqRoot: string, provider: LaneProvider, accountId: string, signal: QuotaSignal): QuotaState;
+export interface RecordAccountQuotaOptions {
+    /** When the 429 was observed. Enables the far-reset confirmation gate. */
+    now: Date;
+    /** Hold applied while a far provider reset is unconfirmed (the default hold). */
+    unconfirmedHoldMs: number;
+}
+export declare function recordAccountQuota(hqRoot: string, provider: LaneProvider, accountId: string, incoming: QuotaSignal, options?: RecordAccountQuotaOptions): QuotaState;
 export interface ClearedModelQuotaReset {
     model: string;
     quota_reset_at: string;

package/dist/lib/lanes/quota.js

@@ -16,12 +16,22 @@
  * claude-fable-5-1 and still runs claude-opus-5). The record is therefore
  * per (account, model), plus an account-wide reset when the text is a
  * usage limit rather than a switch-model refusal.
+ *
+ * A single 429 is not trusted with a multi-day hold. When the provider names
+ * a reset more than a day away, the first 429 holds the account only for the
+ * short default hold and keeps the named reset as `unconfirmed_reset_at`. A
+ * second 429 from a lane that ran after that short hold expired confirms the
+ * reset; a successful turn drops it. (Measured 2026-10-13: account a returned
+ * "You've hit your weekly limit · resets Oct 16 at 1am (America/Denver)"
+ * while the owner's /usage showed the week at 43%.)
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { withLaneRecordFileLock } from "./store.js";
 export const QUOTA_STATE_REL = path.join("personal", "lanes", "quota.json");
 export const QUOTA_SCHEMA_VERSION = "hq-lanes-quota.v1";
+/** A provider reset further away than this needs a second 429 before it holds. */
+export const QUOTA_CONFIRM_HORIZON_MS = 24 * 60 * 60 * 1000;
 /**
  * A 429 whose message names no reset time and no credits wording would
  * otherwise record no hold at all, and the next lane on the account would
@@ -127,6 +137,15 @@ export function loadQuotaState(hqRoot) {
                 else if (raw.reset_source === "default_hold" || raw.reset_source === "derived") {
                     account.reset_source = "derived";
                 }
+                else if (raw.reset_source === "unconfirmed") {
+                    account.reset_source = "unconfirmed";
+                }
+            }
+            if (typeof raw.unconfirmed_reset_at === "string" && raw.unconfirmed_reset_at.length > 0) {
+                account.unconfirmed_reset_at = raw.unconfirmed_reset_at;
+            }
+            if (typeof raw.provider_text === "string" && raw.provider_text.length > 0) {
+                account.provider_text = raw.provider_text;
             }
             accounts[id] = account;
         }
@@ -141,37 +160,113 @@ function writeQuotaState(hqRoot, state) {
     fs.writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`, "utf8");
     fs.renameSync(tmp, filePath);
 }
+/** True when `zone` is a timezone name the runtime's Intl data knows. */
+function isKnownTimeZone(zone) {
+    try {
+        new Intl.DateTimeFormat("en-US", { timeZone: zone });
+        return true;
+    }
+    catch (err) {
+        if (err instanceof RangeError)
+            return false;
+        throw err;
+    }
+}
+/** Offset of `zone` from UTC at instant `ms`, in milliseconds. */
+function zoneOffsetMs(zone, ms) {
+    const parts = new Intl.DateTimeFormat("en-US", {
+        timeZone: zone,
+        hourCycle: "h23",
+        year: "numeric",
+        month: "numeric",
+        day: "numeric",
+        hour: "numeric",
+        minute: "numeric",
+        second: "numeric",
+    }).formatToParts(new Date(ms));
+    const get = (type) => Number(parts.find((p) => p.type === type)?.value ?? 0);
+    const asUtc = Date.UTC(get("year"), get("month") - 1, get("day"), get("hour"), get("minute"), get("second"));
+    return asUtc - Math.floor(ms / 1000) * 1000;
+}
 /**
- * Parse provider reset times such as "resets Sep 24, 2am (UTC)" and Codex's
- * "try again at Sep 14th, 2026 9:24 PM" into an ISO timestamp. Codex's
- * unzoned form is displayed in the provider CLI's local timezone, while the
- * provider `resets` form is UTC when it names `(UTC)`. The year is the current
- * UTC year for an unyear-tagged reset, rolled forward when it is already past.
- * An explicit provider year is kept as stated.
+ * The UTC instant of a wall-clock time in `zone`, or null when that wall time
+ * does not exist there (a spring-forward gap) or a field is out of range.
+ */
+function zonedWallTimeToUtc(zone, year, month, day, hour, minute) {
+    const wall = Date.UTC(year, month, day, hour, minute, 0, 0);
+    const check = new Date(wall);
+    if (check.getUTCFullYear() !== year ||
+        check.getUTCMonth() !== month ||
+        check.getUTCDate() !== day ||
+        check.getUTCHours() !== hour ||
+        check.getUTCMinutes() !== minute) {
+        return null;
+    }
+    if (zone.toUpperCase() === "UTC")
+        return wall;
+    let guess = wall - zoneOffsetMs(zone, wall);
+    guess = wall - zoneOffsetMs(zone, guess);
+    return guess + zoneOffsetMs(zone, guess) === wall ? guess : null;
+}
+function zonedDateParts(zone, ms) {
+    const offset = zone.toUpperCase() === "UTC" ? 0 : zoneOffsetMs(zone, ms);
+    const local = new Date(ms + offset);
+    return { year: local.getUTCFullYear(), month: local.getUTCMonth(), day: local.getUTCDate() };
+}
+function to24Hour(hourText, minuteText, meridiem) {
+    let hour = Number(hourText);
+    const minute = Number(minuteText ?? 0);
+    if (!Number.isInteger(hour) || hour < 1 || hour > 12 || !Number.isInteger(minute) || minute > 59)
+        return null;
+    const ap = meridiem.toLowerCase();
+    if (ap === "pm" && hour < 12)
+        hour += 12;
+    if (ap === "am" && hour === 12)
+        hour = 0;
+    return { hour, minute };
+}
+const ZONE_PATTERN = String.raw `\(\s*(UTC|[A-Za-z][A-Za-z0-9_+-]*(?:\/[A-Za-z0-9_+-]+)+)\s*\)`;
+/**
+ * Parse provider reset times into an ISO timestamp. Handled forms:
+ *
+ * - "resets 2am (UTC)" and "resets 1am (America/Denver)": the next such time.
+ * - "resets Sep 24, 2am (UTC)", "resets Oct 16 at 1am (America/Denver)",
+ *   "resets Sep 24, 2026 2am (UTC)": a dated reset.
+ * - Codex's "try again at Sep 14th, 2026 9:24 PM", shown in the provider
+ *   CLI's local timezone unless it names `(UTC)`.
+ *
+ * The zone is `UTC` or an IANA name; an unknown zone name fails the parse. A
+ * dated provider reset with no zone is read as UTC. The year is the zone's
+ * current year for an unyear-tagged reset, rolled forward when it is already
+ * past. An explicit provider year is kept as stated.
  */
 export function parseProviderResetTime(text, now) {
-    const timeOnlyMatch = /\bresets\s+(\d{1,2})(?::(\d{2}))?\s*(am|pm)\s*\(UTC\)/i.exec(text);
+    const timeOnlyMatch = new RegExp(String.raw `\bresets\s+(?:at\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)\s*${ZONE_PATTERN}`, "i").exec(text);
     if (timeOnlyMatch) {
-        let hour = Number(timeOnlyMatch[1]);
-        const minute = Number(timeOnlyMatch[2] ?? 0);
-        const meridiem = (timeOnlyMatch[3] ?? "").toLowerCase();
-        if (!Number.isInteger(hour) || hour < 1 || hour > 12 || minute < 0 || minute > 59)
+        const zone = timeOnlyMatch[4] ?? "UTC";
+        if (!isKnownTimeZone(zone))
             return null;
-        if (meridiem === "pm" && hour < 12)
-            hour += 12;
-        if (meridiem === "am" && hour === 12)
-            hour = 0;
-        const candidate = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), hour, minute, 0, 0));
-        if (candidate.getTime() <= now.getTime())
-            candidate.setUTCDate(candidate.getUTCDate() + 1);
-        return candidate.toISOString();
+        const time = to24Hour(timeOnlyMatch[1] ?? "", timeOnlyMatch[2], timeOnlyMatch[3] ?? "");
+        if (!time)
+            return null;
+        const today = zonedDateParts(zone, now.getTime());
+        for (let offsetDays = 0; offsetDays <= 2; offsetDays += 1) {
+            const date = new Date(Date.UTC(today.year, today.month, today.day + offsetDays));
+            const ts = zonedWallTimeToUtc(zone, date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate(), time.hour, time.minute);
+            if (ts !== null && ts > now.getTime())
+                return new Date(ts).toISOString();
+        }
+        return null;
     }
-    const resetMatch = /\bresets\s+([A-Za-z]+)\s+(\d{1,2})(?:st|nd|rd|th)?(?:,\s*(?:(\d{4})\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm))?(?:\s*\((UTC)\))?/i.exec(text);
+    const resetMatch = new RegExp(String.raw `\bresets\s+([A-Za-z]+)\s+(\d{1,2})(?:st|nd|rd|th)?(?:(?:,\s*(?:(\d{4})(?:,|\s+at)?\s+)?|\s+at\s+)(?:at\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm))?(?:\s*${ZONE_PATTERN})?`, "i").exec(text);
     const codexMatch = /\btry\s+again\s+at\s+([A-Za-z]+)\s+(\d{1,2})(?:st|nd|rd|th)?,\s*(\d{4})\s+(\d{1,2})(?::(\d{2}))?\s*(am|pm)(?:\s*\((UTC)\))?/i.exec(text);
     const match = resetMatch ?? codexMatch;
     if (!match)
         return null;
-    const codexLocalTime = codexMatch !== null && (match[7] ?? "").toLowerCase() !== "utc";
+    const codexLocalTime = resetMatch === null && (match[7] ?? "").toLowerCase() !== "utc";
+    const zone = match[7] ?? "UTC";
+    if (!codexLocalTime && !isKnownTimeZone(zone))
+        return null;
     const month = MONTHS[(match[1] ?? "").slice(0, 3).toLowerCase()];
     if (month === undefined)
         return null;
@@ -179,37 +274,31 @@ export function parseProviderResetTime(text, now) {
     if (!Number.isInteger(day) || day < 1 || day > 31)
         return null;
     const explicitYear = match[3] !== undefined;
-    const parsedYear = explicitYear ? Number(match[3]) : now.getUTCFullYear();
+    const parsedYear = explicitYear
+        ? Number(match[3])
+        : codexLocalTime
+            ? now.getFullYear()
+            : zonedDateParts(zone, now.getTime()).year;
     if (!Number.isInteger(parsedYear) || parsedYear < 1970)
         return null;
     let hour = 0;
     let minute = 0;
     if (match[4] !== undefined) {
-        hour = Number(match[4]);
-        minute = match[5] !== undefined ? Number(match[5]) : 0;
-        const ap = (match[6] ?? "").toLowerCase();
-        if (ap === "pm" && hour < 12)
-            hour += 12;
-        if (ap === "am" && hour === 12)
-            hour = 0;
-        if (hour > 23 || minute > 59)
+        const time = to24Hour(match[4], match[5], match[6] ?? "");
+        if (!time)
             return null;
+        hour = time.hour;
+        minute = time.minute;
     }
     const timestampForYear = (targetYear) => {
-        const candidate = codexLocalTime
-            ? new Date(targetYear, month, day, hour, minute, 0, 0)
-            : new Date(Date.UTC(targetYear, month, day, hour, minute, 0, 0));
-        const valid = codexLocalTime
-            ? candidate.getFullYear() === targetYear &&
-                candidate.getMonth() === month &&
-                candidate.getDate() === day &&
-                candidate.getHours() === hour &&
-                candidate.getMinutes() === minute
-            : candidate.getUTCFullYear() === targetYear &&
-                candidate.getUTCMonth() === month &&
-                candidate.getUTCDate() === day &&
-                candidate.getUTCHours() === hour &&
-                candidate.getUTCMinutes() === minute;
+        if (!codexLocalTime)
+            return zonedWallTimeToUtc(zone, targetYear, month, day, hour, minute);
+        const candidate = new Date(targetYear, month, day, hour, minute, 0, 0);
+        const valid = candidate.getFullYear() === targetYear &&
+            candidate.getMonth() === month &&
+            candidate.getDate() === day &&
+            candidate.getHours() === hour &&
+            candidate.getMinutes() === minute;
         return valid ? candidate.getTime() : null;
     };
     let year = parsedYear;
@@ -231,10 +320,47 @@ function isUsageLimitShape(text) {
     return /weekly limit|usage limit|rate limit|quota|usage credits|hit your .+ limit/i.test(text);
 }
 /**
- * Read only `api_error_status`, `is_error`, and `result` off the last
- * `type: "result"` object. Nothing else from the payload is returned, and
- * this function does not log.
+ * A structured reset from a result object: `resets_at` / `resetsAt` at the
+ * top level, or `rate_limit_info.resetsAt` directly or under
+ * `api_error_params` / `apiErrorParams`. Undefined when none is present.
  */
+function structuredResetFrom(rec) {
+    const direct = rec.resets_at ?? rec.resetsAt;
+    if (direct !== undefined)
+        return direct;
+    const holders = [rec, rec.api_error_params, rec.apiErrorParams];
+    for (const holder of holders) {
+        if (!isPlainObject(holder))
+            continue;
+        const info = holder.rate_limit_info ?? holder.rateLimitInfo;
+        if (isPlainObject(info) && info.resetsAt !== undefined)
+            return info.resetsAt;
+    }
+    return undefined;
+}
+/** Epoch seconds, epoch milliseconds, or an ISO string, to ISO; null otherwise. */
+export function normalizeStructuredReset(value) {
+    let ms;
+    if (typeof value === "number" && Number.isFinite(value)) {
+        ms = value < 1e12 ? value * 1000 : value;
+    }
+    else if (typeof value === "string" && value.trim().length > 0) {
+        const trimmed = value.trim();
+        if (/^\d+(?:\.\d+)?$/.test(trimmed)) {
+            const n = Number(trimmed);
+            ms = n < 1e12 ? n * 1000 : n;
+        }
+        else {
+            ms = Date.parse(trimmed);
+        }
+    }
+    else {
+        return null;
+    }
+    if (!Number.isFinite(ms) || ms <= 0)
+        return null;
+    return new Date(ms).toISOString();
+}
 export function quotaFieldsFromOutput(text) {
     const lines = text.split("\n");
     for (let i = lines.length - 1; i >= 0; i -= 1) {
@@ -250,10 +376,12 @@ export function quotaFieldsFromOutput(text) {
         }
         if (!isPlainObject(parsed) || parsed.type !== "result")
             continue;
+        const resets_at = structuredResetFrom(parsed);
         return {
             api_error_status: parsed.api_error_status,
             is_error: parsed.is_error,
             result: parsed.result,
+            ...(resets_at !== undefined ? { resets_at } : {}),
         };
     }
     return null;
@@ -273,12 +401,16 @@ export function quotaSignalFromFields(fields, model, now) {
             marker,
         };
     }
-    const quota_reset_at = text.length > 0 ? parseProviderResetTime(text, now) ?? undefined : undefined;
+    const structured = normalizeStructuredReset(fields.resets_at) ?? undefined;
+    const quota_reset_at = structured ?? (text.length > 0 ? parseProviderResetTime(text, now) ?? undefined : undefined);
     return {
         reason: "account_quota_exhausted",
         quota_reset_at,
         model,
         account_wide: true,
+        // Kept only when it reads as a provider quota message, so the senior can
+        // see the provider's own words next to the hold.
+        ...(isUsageLimitShape(text) && text.length <= 300 ? { provider_text: text } : {}),
     };
 }
 export function readQuotaSignal(runDir, model, now, workerOutOffset = 0) {
@@ -314,11 +446,46 @@ export function readQuotaSignal(runDir, model, now, workerOutOffset = 0) {
     const observedAt = Number.isFinite(outputAt.getTime()) ? outputAt : now;
     return quotaSignalFromFields(fields, model, observedAt);
 }
-export function recordAccountQuota(hqRoot, provider, accountId, signal) {
+/**
+ * Hold a provider reset more than a day away to a short hold until a second
+ * 429 confirms it. The second 429 counts only when its lane ran after the
+ * short hold expired, so lanes that failed together on one 429 burst do not
+ * confirm each other.
+ */
+function gateFarReset(current, signal, options) {
+    if (!signal.account_wide ||
+        !signal.quota_reset_at ||
+        signal.needs_credits ||
+        signal.reset_source === "derived") {
+        return { signal };
+    }
+    const resetMs = Date.parse(signal.quota_reset_at);
+    const nowMs = options.now.getTime();
+    if (!Number.isFinite(resetMs) || resetMs - nowMs <= QUOTA_CONFIRM_HORIZON_MS)
+        return { signal };
+    const pending = current.unconfirmed_reset_at;
+    const shortHoldActive = resetStillAhead(current.all_models_quota_reset_at, options.now);
+    if (pending !== undefined && !shortHoldActive) {
+        return { signal: { ...signal, reset_source: "parsed" } };
+    }
+    return {
+        signal: {
+            ...signal,
+            quota_reset_at: new Date(nowMs + options.unconfirmedHoldMs).toISOString(),
+            reset_source: "unconfirmed",
+        },
+        unconfirmed_reset_at: pending !== undefined && !shouldReplaceReset(pending, signal.quota_reset_at)
+            ? pending
+            : signal.quota_reset_at,
+    };
+}
+export function recordAccountQuota(hqRoot, provider, accountId, incoming, options) {
     return withLaneRecordFileLock(quotaStatePath(hqRoot), () => {
         const state = loadQuotaState(hqRoot);
         const accounts = state.providers[provider] ?? {};
         const current = accounts[accountId] ?? { models: {} };
+        const gated = options ? gateFarReset(current, incoming, options) : { signal: incoming };
+        const signal = gated.signal;
         const models = { ...current.models };
         if (signal.model) {
             const prior = models[signal.model] ?? {};
@@ -340,6 +507,14 @@ export function recordAccountQuota(hqRoot, provider, accountId, signal) {
             if (shouldReplaceReset(current.all_models_quota_reset_at, signal.quota_reset_at)) {
                 account.all_models_quota_reset_at = signal.quota_reset_at;
                 account.reset_source = signal.reset_source ?? "parsed";
+                if (signal.provider_text)
+                    account.provider_text = signal.provider_text;
+                if (gated.unconfirmed_reset_at) {
+                    account.unconfirmed_reset_at = gated.unconfirmed_reset_at;
+                }
+                else {
+                    delete account.unconfirmed_reset_at;
+                }
             }
             else if (current.all_models_quota_reset_at) {
                 account.all_models_quota_reset_at = current.all_models_quota_reset_at;
@@ -367,11 +542,17 @@ export function clearAccountQuota(hqRoot, provider, accountId, options = {}) {
         const shouldClear = (reset) => reset !== undefined &&
             (!options.futureOnly || resetStillAhead(reset, now));
         let changed = false;
+        // A successful turn or an operator clear disproves a pending far reset.
+        if (account.unconfirmed_reset_at !== undefined) {
+            delete account.unconfirmed_reset_at;
+            changed = true;
+        }
         const accountWideReset = account.all_models_quota_reset_at;
         if (shouldClear(accountWideReset)) {
             cleared.all_models_quota_reset_at = accountWideReset;
             delete account.all_models_quota_reset_at;
             delete account.reset_source;
+            delete account.provider_text;
             changed = true;
         }
         const modelNames = options.model === undefined
@@ -395,6 +576,7 @@ export function clearAccountQuota(hqRoot, provider, accountId, options = {}) {
             return cleared;
         if (account.all_models_quota_reset_at === undefined) {
             delete account.reset_source;
+            delete account.provider_text;
         }
         const accounts = state.providers[provider];
         if (account.all_models_quota_reset_at === undefined &&

package/dist/lib/lanes/reconcile.js

@@ -34,6 +34,7 @@ import { LEAD_LANE_KEEP_ALIVE_FLAG, LEAD_LANE_KEEP_ALIVE_RESUME_BLOCKED_FLAG, LE
 import { isFailedQuotaKeepAliveLane, providerSupportsSessionResume } from "./delivery.js";
 import { LANE_PROVIDERS, isIsoDateTime, isTerminalLaneState } from "./types.js";
 import { applyDefaultQuotaHold, clearAccountQuotaAfterSuccessfulTurnBestEffort, loadQuotaState, readQuotaSignal, recordAccountQuota, } from "./quota.js";
+import { deliverQuotaHoldNotice, quotaHoldNotice } from "./quota-notice.js";
 import { answeredQuestionEntries, questionRecordRefusalCode, raiseEnvelopeQuestions, resolveQuestionCompanyWithFallback, } from "./questions.js";
 import { SILENCE_MS, appendWatcherEvent, classifyLaneExit, isPidAlive, missingExpectedEnvelopeFile, readLatestEnvelopeFile, readLatestEnvelopeRecord, watcherEventsPath, watcherOutLogPath, writeWatcherDecision, } from "./watcher.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshCompany, } from "./mesh-events.js";
@@ -1733,7 +1734,22 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                     classified.account &&
                     (classification.reason === "account_quota_exhausted" ||
                         classification.reason === "account_model_unavailable")) {
-                    recordAccountQuota(hqRoot, classified.provider, classified.account, quota);
+                    const quotaState = recordAccountQuota(hqRoot, classified.provider, classified.account, quota, {
+                        now,
+                        unconfirmedHoldMs: providerQuotaDefaultHoldMs(loadLanesConfig(hqRoot).providers[classified.provider]),
+                    });
+                    if (classification.reason === "account_quota_exhausted") {
+                        const notice = quotaHoldNotice(quotaState, classified.provider, classified.account, lane.lane_id);
+                        if (notice) {
+                            try {
+                                deliverQuotaHoldNotice(hqRoot, lane, notice, now.toISOString());
+                            }
+                            catch (err) {
+                                const message = err instanceof Error ? err.message : String(err);
+                                process.stderr.write(`hq lanes reconcile: quota hold notice failed for ${lane.lane_id}: ${message}\n`);
+                            }
+                        }
+                    }
                 }
                 if (!deps.dryRun &&
                     accountRetryReason &&

package/dist/lib/lanes/session-relink.d.ts

@@ -12,6 +12,8 @@ export interface EnsureSessionHomeResult extends SessionCopyResult {
     source_home: string;
     transcript_path: string;
     homes_searched: string[];
+    /** Set when the transcript was found outside the expected project directory. */
+    found_outside_cwd?: true;
 }
 /**
  * Older Claude account homes can share a registered `account-N/.claude`