@indigoai-us/hq-cli 5.345.127 → 5.345.129

package/dist/lib/lanes/quota.js

@@ -17,55 +17,81 @@
  * per (account, model), plus an account-wide reset when the text is a
  * usage limit rather than a switch-model refusal.
  *
- * A single 429 is not trusted with a multi-day hold. When the provider names
- * a reset more than a day away, the first 429 holds the account only for the
- * short default hold and keeps the named reset as `unconfirmed_reset_at`. A
- * second 429 from a lane that ran after that short hold expired confirms the
- * reset; a successful turn drops it. (Measured 2026-10-13: account a returned
- * "You've hit your weekly limit · resets Oct 16 at 1am (America/Denver)"
- * while the owner's /usage showed the week at 43%.)
+ * A recorded 429 never holds the account (owner decision 2026-10-14, after
+ * the 2026-10-13 incident where one 429 on account a blocked every Claude
+ * lane until Friday). The reset times and provider text stay here as
+ * information for `hq lanes capacity`, `hq lanes accounts list` and the
+ * senior notice; only a needs-credits marker skips an account, for that model.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { withLaneRecordFileLock } from "./store.js";
 export const QUOTA_STATE_REL = path.join("personal", "lanes", "quota.json");
-/**
- * Claude quota holds are off. Removed by owner directive on 2026-10-14: a
- * false weekly-limit 429 held every Claude lane for days while the account
- * still had capacity. A Claude 429 still fails that lane over to another
- * account; it never blocks the account for later lanes, and stored Claude
- * holds are ignored on read. `HQ_LANES_CLAUDE_QUOTA_HOLDS=1` turns the old
- * behavior back on; the test suite sets it to keep the hold machinery covered.
- */
-export const CLAUDE_QUOTA_HOLDS_ENV = "HQ_LANES_CLAUDE_QUOTA_HOLDS";
-export function providerHasQuotaHolds(provider) {
-    if (provider !== "claude")
-        return true;
-    return process.env[CLAUDE_QUOTA_HOLDS_ENV] === "1";
-}
 export const QUOTA_SCHEMA_VERSION = "hq-lanes-quota.v1";
-/** A provider reset further away than this needs a second 429 before it holds. */
-export const QUOTA_CONFIRM_HORIZON_MS = 24 * 60 * 60 * 1000;
 /**
- * A 429 whose message names no reset time and no credits wording would
- * otherwise record no hold at all, and the next lane on the account would
- * hit the same 429. Give such a signal the provider's configured default
- * hold (`quota_default_hold_ms`, fifteen minutes unless set) as its reset,
- * marked `derived`; a signal that already carries a reset keeps it, marked
- * `parsed`. A per-model credits refusal is untouched.
+ * Decide the hold a 429 records (incident 2026-10-13: one 429 on the wrong
+ * subscription held the only Claude account for three days).
+ *
+ * - A per-model credits refusal is untouched.
+ * - A 429 with no reset gets the provider's configured default hold
+ *   (`quota_default_hold_ms`, fifteen minutes unless set), marked `derived`.
+ * - A 429 with a provider reset is capped to the same default hold on its
+ *   own. The provider reset is kept on the signal as `provider_reset_at`;
+ *   recordAccountQuota extends the hold to it only when a fresh probe hits a
+ *   repeat 429 before that reset. A reset nearer than the cap is used as is
+ *   and marked `parsed`.
  */
 export function applyDefaultQuotaHold(signal, defaultHoldMs, now) {
     if (signal.reason !== "account_quota_exhausted" || signal.needs_credits)
         return signal;
-    if (signal.quota_reset_at)
-        return { ...signal, reset_source: "parsed" };
+    const observed_at = now.toISOString();
+    const shortHoldMs = now.getTime() + defaultHoldMs;
+    const providerResetMs = signal.quota_reset_at ? Date.parse(signal.quota_reset_at) : Number.NaN;
+    if (Number.isFinite(providerResetMs)) {
+        const providerReset = new Date(providerResetMs).toISOString();
+        if (providerResetMs <= shortHoldMs) {
+            return { ...signal, quota_reset_at: providerReset, provider_reset_at: providerReset, observed_at, reset_source: "parsed" };
+        }
+        return {
+            ...signal,
+            quota_reset_at: new Date(shortHoldMs).toISOString(),
+            provider_reset_at: providerReset,
+            observed_at,
+            account_wide: true,
+            reset_source: "derived",
+        };
+    }
     return {
         ...signal,
-        quota_reset_at: new Date(now.getTime() + defaultHoldMs).toISOString(),
+        quota_reset_at: new Date(shortHoldMs).toISOString(),
+        observed_at,
         account_wide: true,
         reset_source: "derived",
     };
 }
+/**
+ * True when the signal is a fresh 429 on an account whose previous 429 named
+ * a provider reset that has not arrived yet: the short first-strike hold
+ * expired (or was cleared and re-recorded), a new probe ran, and the
+ * provider refused again. The provider's reset is then believed.
+ */
+export function isRepeatQuotaHit(current, signal, now) {
+    if (!current?.provider_reset_at || !current.last_quota_hit_at)
+        return false;
+    const priorResetMs = Date.parse(current.provider_reset_at);
+    const priorHitMs = Date.parse(current.last_quota_hit_at);
+    if (!Number.isFinite(priorResetMs) || !Number.isFinite(priorHitMs))
+        return false;
+    const observedMs = signal.observed_at ? Date.parse(signal.observed_at) : now.getTime();
+    if (!Number.isFinite(observedMs) || observedMs <= priorHitMs)
+        return false;
+    // A second lane that was already running when the first hold was written
+    // is the same strike, not a fresh probe: the hold must have lapsed first.
+    const priorHoldMs = current.all_models_quota_reset_at ? Date.parse(current.all_models_quota_reset_at) : Number.NaN;
+    if (Number.isFinite(priorHoldMs) && observedMs < priorHoldMs)
+        return false;
+    return observedMs < priorResetMs;
+}
 const MONTHS = {
     jan: 0,
     feb: 1,
@@ -80,6 +106,34 @@ const MONTHS = {
     nov: 10,
     dec: 11,
 };
+const zoneFormatters = new Map();
+function zoneFormatter(zone) {
+    const cached = zoneFormatters.get(zone);
+    if (cached !== undefined)
+        return cached;
+    let formatter;
+    try {
+        formatter = new Intl.DateTimeFormat("en-US", {
+            timeZone: zone,
+            hourCycle: "h23",
+            year: "numeric",
+            month: "numeric",
+            day: "numeric",
+            hour: "numeric",
+            minute: "numeric",
+            second: "numeric",
+        });
+    }
+    catch {
+        formatter = null;
+    }
+    zoneFormatters.set(zone, formatter);
+    return formatter;
+}
+/** "UTC" or an IANA zone the runtime knows, e.g. America/Denver. */
+export function isKnownTimeZone(zone) {
+    return zoneFormatter(zone) !== null;
+}
 function emptyState() {
     return { schema_version: QUOTA_SCHEMA_VERSION, providers: {} };
 }
@@ -113,8 +167,6 @@ export function loadQuotaState(hqRoot) {
     const providers = {};
     const rawProviders = isPlainObject(parsed.providers) ? parsed.providers : {};
     for (const provider of ["claude", "codex", "grok"]) {
-        if (!providerHasQuotaHolds(provider))
-            continue;
         const rawAccounts = rawProviders[provider];
         if (!isPlainObject(rawAccounts))
             continue;
@@ -157,8 +209,11 @@ export function loadQuotaState(hqRoot) {
                     account.reset_source = "unconfirmed";
                 }
             }
-            if (typeof raw.unconfirmed_reset_at === "string" && raw.unconfirmed_reset_at.length > 0) {
-                account.unconfirmed_reset_at = raw.unconfirmed_reset_at;
+            if (typeof raw.provider_reset_at === "string" && raw.provider_reset_at.length > 0) {
+                account.provider_reset_at = raw.provider_reset_at;
+            }
+            if (typeof raw.last_quota_hit_at === "string" && raw.last_quota_hit_at.length > 0) {
+                account.last_quota_hit_at = raw.last_quota_hit_at;
             }
             if (typeof raw.provider_text === "string" && raw.provider_text.length > 0) {
                 account.provider_text = raw.provider_text;
@@ -176,18 +231,6 @@ function writeQuotaState(hqRoot, state) {
     fs.writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`, "utf8");
     fs.renameSync(tmp, filePath);
 }
-/** True when `zone` is a timezone name the runtime's Intl data knows. */
-function isKnownTimeZone(zone) {
-    try {
-        new Intl.DateTimeFormat("en-US", { timeZone: zone });
-        return true;
-    }
-    catch (err) {
-        if (err instanceof RangeError)
-            return false;
-        throw err;
-    }
-}
 /** Offset of `zone` from UTC at instant `ms`, in milliseconds. */
 function zoneOffsetMs(zone, ms) {
     const parts = new Intl.DateTimeFormat("en-US", {
@@ -377,6 +420,11 @@ export function normalizeStructuredReset(value) {
         return null;
     return new Date(ms).toISOString();
 }
+/**
+ * Read only `api_error_status`, `is_error`, `result`, and a structured
+ * reset off the last `type: "result"` object. Nothing else from the payload
+ * is returned, and this function does not log.
+ */
 export function quotaFieldsFromOutput(text) {
     const lines = text.split("\n");
     for (let i = lines.length - 1; i >= 0; i -= 1) {
@@ -462,48 +510,25 @@ export function readQuotaSignal(runDir, model, now, workerOutOffset = 0) {
     const observedAt = Number.isFinite(outputAt.getTime()) ? outputAt : now;
     return quotaSignalFromFields(fields, model, observedAt);
 }
-/**
- * Hold a provider reset more than a day away to a short hold until a second
- * 429 confirms it. The second 429 counts only when its lane ran after the
- * short hold expired, so lanes that failed together on one 429 burst do not
- * confirm each other.
- */
-function gateFarReset(current, signal, options) {
-    if (!signal.account_wide ||
-        !signal.quota_reset_at ||
-        signal.needs_credits ||
-        signal.reset_source === "derived") {
-        return { signal };
-    }
-    const resetMs = Date.parse(signal.quota_reset_at);
-    const nowMs = options.now.getTime();
-    if (!Number.isFinite(resetMs) || resetMs - nowMs <= QUOTA_CONFIRM_HORIZON_MS)
-        return { signal };
-    const pending = current.unconfirmed_reset_at;
-    const shortHoldActive = resetStillAhead(current.all_models_quota_reset_at, options.now);
-    if (pending !== undefined && !shortHoldActive) {
-        return { signal: { ...signal, reset_source: "parsed" } };
-    }
-    return {
-        signal: {
-            ...signal,
-            quota_reset_at: new Date(nowMs + options.unconfirmedHoldMs).toISOString(),
-            reset_source: "unconfirmed",
-        },
-        unconfirmed_reset_at: pending !== undefined && !shouldReplaceReset(pending, signal.quota_reset_at)
-            ? pending
-            : signal.quota_reset_at,
-    };
-}
-export function recordAccountQuota(hqRoot, provider, accountId, incoming, options) {
-    if (!providerHasQuotaHolds(provider))
-        return loadQuotaState(hqRoot);
+export function recordAccountQuota(hqRoot, provider, accountId, incoming, now = new Date()) {
     return withLaneRecordFileLock(quotaStatePath(hqRoot), () => {
         const state = loadQuotaState(hqRoot);
         const accounts = state.providers[provider] ?? {};
         const current = accounts[accountId] ?? { models: {} };
-        const gated = options ? gateFarReset(current, incoming, options) : { signal: incoming };
-        const signal = gated.signal;
+        // A repeat 429 before the provider's reset promotes the capped hold to
+        // the provider's own reset (see applyDefaultQuotaHold).
+        let signal = incoming;
+        if (incoming.reason === "account_quota_exhausted" &&
+            !incoming.needs_credits &&
+            isRepeatQuotaHit(current, incoming, now)) {
+            const candidates = [incoming.provider_reset_at, current.provider_reset_at, incoming.quota_reset_at]
+                .map((value) => (value ? Date.parse(value) : Number.NaN))
+                .filter((ms) => Number.isFinite(ms));
+            if (candidates.length > 0) {
+                const promoted = new Date(Math.max(...candidates)).toISOString();
+                signal = { ...incoming, quota_reset_at: promoted, provider_reset_at: promoted, account_wide: true, reset_source: "parsed" };
+            }
+        }
         const models = { ...current.models };
         if (signal.model) {
             const prior = models[signal.model] ?? {};
@@ -525,19 +550,18 @@ export function recordAccountQuota(hqRoot, provider, accountId, incoming, option
             if (shouldReplaceReset(current.all_models_quota_reset_at, signal.quota_reset_at)) {
                 account.all_models_quota_reset_at = signal.quota_reset_at;
                 account.reset_source = signal.reset_source ?? "parsed";
-                if (signal.provider_text)
-                    account.provider_text = signal.provider_text;
-                if (gated.unconfirmed_reset_at) {
-                    account.unconfirmed_reset_at = gated.unconfirmed_reset_at;
-                }
-                else {
-                    delete account.unconfirmed_reset_at;
-                }
             }
             else if (current.all_models_quota_reset_at) {
                 account.all_models_quota_reset_at = current.all_models_quota_reset_at;
                 account.reset_source = current.reset_source ?? "parsed";
             }
+            if (signal.provider_text)
+                account.provider_text = signal.provider_text;
+            if (signal.provider_reset_at)
+                account.provider_reset_at = signal.provider_reset_at;
+            else
+                delete account.provider_reset_at;
+            account.last_quota_hit_at = signal.observed_at ?? now.toISOString();
         }
         accounts[accountId] = account;
         state.providers[provider] = accounts;
@@ -560,16 +584,13 @@ export function clearAccountQuota(hqRoot, provider, accountId, options = {}) {
         const shouldClear = (reset) => reset !== undefined &&
             (!options.futureOnly || resetStillAhead(reset, now));
         let changed = false;
-        // A successful turn or an operator clear disproves a pending far reset.
-        if (account.unconfirmed_reset_at !== undefined) {
-            delete account.unconfirmed_reset_at;
-            changed = true;
-        }
         const accountWideReset = account.all_models_quota_reset_at;
         if (shouldClear(accountWideReset)) {
             cleared.all_models_quota_reset_at = accountWideReset;
             delete account.all_models_quota_reset_at;
             delete account.reset_source;
+            delete account.provider_reset_at;
+            delete account.last_quota_hit_at;
             delete account.provider_text;
             changed = true;
         }
@@ -644,30 +665,20 @@ function resetStillAhead(iso, now) {
     return Number.isFinite(ts) && ts > now.getTime();
 }
 /**
- * Skip an account only for the models it cannot run. An account-wide reset
- * blocks every model. A needs-credits marker blocks only that model, with
- * no expiry. A past reset does not block.
+ * Skip an account only for a model it cannot run at all: a needs-credits
+ * marker blocks that model, with no expiry.
+ *
+ * A recorded 429 never blocks (owner decision, incident 2026-10-13). The
+ * lane that hit it ends resumable and its senior decides; other lanes keep
+ * using the account. The reset times stay in quota.json as information
+ * (`accountQuotaView`, `quotaHitInfo`).
  */
-export function quotaBlockFor(state, provider, accountId, model, now) {
-    if (!providerHasQuotaHolds(provider))
-        return { blocked: false };
+export function quotaBlockFor(state, provider, accountId, model, _now) {
     const account = state.providers[provider]?.[accountId];
-    if (!account)
-        return { blocked: false };
-    if (resetStillAhead(account.all_models_quota_reset_at, now)) {
-        return {
-            blocked: true,
-            reason: "account_quota_exhausted",
-            quota_reset_at: account.all_models_quota_reset_at,
-            model,
-        };
-    }
-    if (!model)
+    if (!account || !model)
         return { blocked: false };
     const entry = account.models[model];
-    if (!entry)
-        return { blocked: false };
-    if (entry.needs_credits) {
+    if (entry?.needs_credits) {
         return {
             blocked: true,
             reason: "account_model_unavailable",
@@ -675,16 +686,21 @@ export function quotaBlockFor(state, provider, accountId, model, now) {
             model,
         };
     }
-    if (resetStillAhead(entry.quota_reset_at, now)) {
-        return {
-            blocked: true,
-            reason: "account_quota_exhausted",
-            quota_reset_at: entry.quota_reset_at,
-            model,
-        };
-    }
     return { blocked: false };
 }
+export function quotaHitInfo(state, provider, accountId, now) {
+    const account = state.providers[provider]?.[accountId];
+    if (!account || (!account.last_quota_hit_at && !account.provider_reset_at && !account.all_models_quota_reset_at)) {
+        return undefined;
+    }
+    const providerReset = account.provider_reset_at ??
+        (account.reset_source === "parsed" ? account.all_models_quota_reset_at : undefined);
+    return {
+        ...(account.last_quota_hit_at ? { last_quota_hit_at: account.last_quota_hit_at } : {}),
+        ...(providerReset ? { provider_reset_at: providerReset } : {}),
+        provider_reset_pending: resetStillAhead(providerReset, now),
+    };
+}
 export function accountQuotaView(state, provider, accountId) {
     const account = state.providers[provider]?.[accountId];
     if (!account)
@@ -703,6 +719,9 @@ export function accountQuotaView(state, provider, accountId) {
     });
     return {
         quota_reset_at: account.all_models_quota_reset_at ?? null,
+        ...(account.reset_source ? { quota_reset_source: account.reset_source } : {}),
+        ...(account.provider_reset_at ? { provider_reset_at: account.provider_reset_at } : {}),
+        ...(account.last_quota_hit_at ? { last_quota_hit_at: account.last_quota_hit_at } : {}),
         model_quota,
     };
 }

package/dist/lib/lanes/reconcile-result.d.ts

@@ -0,0 +1,10 @@
+export interface ReconcilePassResult {
+    ok: boolean;
+    errors?: readonly {
+        code?: string;
+        message: string;
+    }[];
+}
+/** Preserve CLI exit semantics while letting the daemon report failures to its watcher. */
+export declare function finishReconcilePass(summary: ReconcilePassResult, mode: "cli" | "daemon", exit?: (code: number) => void): void;
+//# sourceMappingURL=reconcile-result.d.ts.map

package/dist/lib/lanes/reconcile-result.js

@@ -0,0 +1,11 @@
+/** Preserve CLI exit semantics while letting the daemon report failures to its watcher. */
+export function finishReconcilePass(summary, mode, exit = (code) => process.exit(code)) {
+    if (summary.ok)
+        return;
+    if (mode === "daemon") {
+        const detail = summary.errors?.map((error) => `${error.code ?? "unknown"}: ${error.message}`).join("; ") ?? "unknown reconcile error";
+        throw new Error(`In-process lanes reconcile failed: ${detail}`);
+    }
+    exit(1);
+}
+//# sourceMappingURL=reconcile-result.js.map

package/dist/lib/lanes/reconcile.d.ts

@@ -178,4 +178,18 @@ export interface AnsweredLaneWakeResult {
 }
 /** Run the reconcile answer-resume path for one lane before questions answer returns. */
 export declare function wakeAnsweredLaneNow(hqRoot: string, laneId: string, deps: ReconcileDeps): Promise<AnsweredLaneWakeResult>;
+export interface AdmitQueuedNowResult {
+    admitted: ReconcileChange[];
+    errors: ReconcileSummary["errors"];
+}
+/**
+ * Run queue admission in-process, without the rest of a reconcile pass.
+ *
+ * Commands that change capacity (create, stop, cancel, clear-quota, a lane
+ * exit) call this so queued lanes start without `hq daemon`. It takes the
+ * reconcile lock and every provider admission lock, so it is safe to run
+ * while a daemon is also reconciling: whichever runs second sees the lanes
+ * the first one already admitted.
+ */
+export declare function admitQueuedNow(hqRoot: string, deps: ReconcileDeps): Promise<AdmitQueuedNowResult>;
 //# sourceMappingURL=reconcile.d.ts.map

package/dist/lib/lanes/reconcile.js

@@ -8,7 +8,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { parseUserYaml } from "../../utils/user-yaml-error.js";
-import { compareLaneQueueOrder, compareLaneQueueOrderWithLeads, freeClaudeAccountSlots, leadLaneIds, hasActiveAdmissionReservation, hasActivePendingResume, laneAdmissionCapReason, laneRunsOnHost, withAllLaneAdmissionLocks, } from "./admission.js";
+import { compareLaneQueueOrder, compareLaneQueueOrderWithLeads, freeClaudeAccountSlots, leadLaneIds, hasActiveAdmissionReservation, hasActivePendingResume, laneAdmissionCapReason, laneOccupiesRunningSlot, laneRunsOnHost, withAllLaneAdmissionLocks, } from "./admission.js";
 import { accountStatus, isCredentialProven, resolveAccount } from "./accounts.js";
 import { effectiveAccountHome } from "./account-home.js";
 import { enforceRegistryApprovalGate } from "./approval-gate.js";
@@ -34,7 +34,7 @@ import { LEAD_LANE_KEEP_ALIVE_FLAG, LEAD_LANE_KEEP_ALIVE_RESUME_BLOCKED_FLAG, LE
 import { isFailedQuotaKeepAliveLane, providerSupportsSessionResume } from "./delivery.js";
 import { LANE_PROVIDERS, isIsoDateTime, isTerminalLaneState } from "./types.js";
 import { applyDefaultQuotaHold, clearAccountQuotaAfterSuccessfulTurnBestEffort, loadQuotaState, readQuotaSignal, recordAccountQuota, } from "./quota.js";
-import { deliverQuotaHoldNotice, quotaHoldNotice } from "./quota-notice.js";
+import { deliverQuotaNotice, quotaLaneNotice } from "./quota-notice.js";
 import { answeredQuestionEntries, questionRecordRefusalCode, raiseEnvelopeQuestions, resolveQuestionCompanyWithFallback, } from "./questions.js";
 import { SILENCE_MS, appendWatcherEvent, classifyLaneExit, isPidAlive, missingExpectedEnvelopeFile, readLatestEnvelopeFile, readLatestEnvelopeRecord, watcherEventsPath, watcherOutLogPath, writeWatcherDecision, } from "./watcher.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshCompany, } from "./mesh-events.js";
@@ -1724,32 +1724,16 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                     ? classifyLaneExit({ envelope: null, hasPartialOutput: false, invalidEnvelope })
                     : classification;
                 let questionRefusalCode = null;
-                const accountRetryReason = quota
-                    ? "usage_limit"
-                    : providerRejection && classification.reason === "account_not_logged_in"
-                        ? "account_unavailable"
-                        : null;
+                // A usage limit fails only this lane; the senior decides on resume.
+                const accountRetryReason = !quota && providerRejection && classification.reason === "account_not_logged_in"
+                    ? "account_unavailable"
+                    : null;
                 if (!deps.dryRun &&
                     quota &&
                     classified.account &&
                     (classification.reason === "account_quota_exhausted" ||
                         classification.reason === "account_model_unavailable")) {
-                    const quotaState = recordAccountQuota(hqRoot, classified.provider, classified.account, quota, {
-                        now,
-                        unconfirmedHoldMs: providerQuotaDefaultHoldMs(loadLanesConfig(hqRoot).providers[classified.provider]),
-                    });
-                    if (classification.reason === "account_quota_exhausted") {
-                        const notice = quotaHoldNotice(quotaState, classified.provider, classified.account, lane.lane_id);
-                        if (notice) {
-                            try {
-                                deliverQuotaHoldNotice(hqRoot, lane, notice, now.toISOString());
-                            }
-                            catch (err) {
-                                const message = err instanceof Error ? err.message : String(err);
-                                process.stderr.write(`hq lanes reconcile: quota hold notice failed for ${lane.lane_id}: ${message}\n`);
-                            }
-                        }
-                    }
+                    recordAccountQuota(hqRoot, classified.provider, classified.account, quota, now);
                 }
                 if (!deps.dryRun &&
                     accountRetryReason &&
@@ -1886,6 +1870,22 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                     result.record.model) {
                     clearAccountQuotaAfterSuccessfulTurnBestEffort(hqRoot, result.record.provider, result.record.account, result.record.model, new Date(nowIso));
                 }
+                if (!deps.dryRun &&
+                    result.changed &&
+                    quota &&
+                    (result.record.terminal_reason === "account_quota_exhausted" ||
+                        result.record.terminal_reason === "account_model_unavailable")) {
+                    // The dead worker's exit is classified here, not in its watcher, so
+                    // the senior notice goes out here, once, after the terminal write and
+                    // keyed to the new version. No account hold is set.
+                    try {
+                        deliverQuotaNotice(hqRoot, result.record, quotaLaneNotice(result.record, quota), nowIso);
+                    }
+                    catch (err) {
+                        const message = err instanceof Error ? err.message : String(err);
+                        process.stderr.write(`hq lanes reconcile: quota notice failed for ${lane.lane_id}: ${message}\n`);
+                    }
+                }
                 if (result.changed) {
                     summary.dead_host.push({
                         id: lane.lane_id,
@@ -3875,4 +3875,58 @@ export async function wakeAnsweredLaneNow(hqRoot, laneId, deps) {
         error: failure?.why ?? `Lane ${laneId} did not leave awaiting_input after its questions were answered`,
     };
 }
+/**
+ * Run queue admission in-process, without the rest of a reconcile pass.
+ *
+ * Commands that change capacity (create, stop, cancel, clear-quota, a lane
+ * exit) call this so queued lanes start without `hq daemon`. It takes the
+ * reconcile lock and every provider admission lock, so it is safe to run
+ * while a daemon is also reconciling: whichever runs second sees the lanes
+ * the first one already admitted.
+ */
+export async function admitQueuedNow(hqRoot, deps) {
+    const summary = emptySummary(deps.dryRun);
+    const now = deps.now();
+    // A queued lane is worth an admission attempt only while its provider has
+    // a free running slot here. Account and profile caps are left to
+    // admitQueued, which can move a lane to another free account.
+    const hasAdmittableQueued = (lanes) => {
+        const queued = lanes.filter((lane) => lane.state === "queued" && laneRunsHere(lane, deps.host));
+        if (queued.length === 0)
+            return false;
+        const config = loadLanesConfig(hqRoot);
+        const nowMs = now.getTime();
+        return queued.some((lane) => {
+            const providerRunning = lanes.filter((other) => other.lane_id !== lane.lane_id && other.provider === lane.provider &&
+                laneOccupiesRunningSlot(other, nowMs) && laneRunsHere(other, deps.host)).length;
+            return providerRunning < config.providers[lane.provider].max_running;
+        });
+    };
+    // Skip the lock and the CPU sample when nothing can start here.
+    if (!hasAdmittableQueued(loadLaneRecords(hqRoot, emptySummary(deps.dryRun)))) {
+        return { admitted: [], errors: [] };
+    }
+    const throttleDeps = deps.throttleDeps ?? defaultThrottleDeps(deps.env ?? process.env);
+    await withReconcileLock(hqRoot, async () => {
+        const previousState = readThrottleState(throttleStatePath(hqRoot), throttleDeps);
+        const previousSnapshot = previousState === "missing" || previousState === "unreadable"
+            ? undefined
+            : previousState.cpu_snapshot;
+        const cpuObservation = deps.cpuBusyFraction !== undefined
+            ? undefined
+            : await sampleCpuBusyObservation(throttleDeps, previousSnapshot);
+        const admissionDeps = {
+            ...deps,
+            ...(cpuObservation ? { cpuBusyFraction: cpuObservation.busy, cpuObservation } : {}),
+            skipAdmissionWithoutCpuSample: false,
+        };
+        await withAllLaneAdmissionLocks(hqRoot, async () => {
+            const lanes = loadLaneRecords(hqRoot, summary);
+            if (!hasAdmittableQueued(lanes))
+                return;
+            await admitQueued(hqRoot, lanes, summary, admissionDeps, now);
+        });
+    });
+    return { admitted: summary.admitted, errors: summary.errors };
+}
 //# sourceMappingURL=reconcile.js.map

package/dist/lib/lanes/watcher.d.ts

@@ -211,6 +211,14 @@ export interface WatcherLoopDeps {
     retrySpawnDeps?: Omit<SpawnLaneDeps, "admissionHost">;
     /** Active-company fallback when an unscoped lane asks from its envelope. */
     resolveQuestionActiveCompany?: () => Promise<LaneCompanyRef>;
+    /**
+     * Admit queued lanes after this lane's exit frees its slot. Default: the
+     * in-process admitter (`admitQueuedNow`), so the queue drains without a
+     * daemon. Returns the admitted lane ids.
+     */
+    admitQueued?: (hqRoot: string) => Promise<string[]>;
+    /** Test seam: deliver the one-time usage-limit notice to the lane's senior. */
+    deliverQuotaNotice?: (lane: LaneRecord, text: string) => Promise<void>;
     /** Resume an atomically queued inbox after this watcher wins terminal CAS. */
     recoverQueuedMessages?: (lane: LaneRecord) => Promise<void>;
     /** Deliver a lane-senior escalation through the normal lane-message router. */