@indigoai-us/hq-cli 5.345.155 → 5.345.159

package/dist/lib/lanes/spawn.js

@@ -7,19 +7,22 @@
  * probed for existence and never read. Identity in the child is `HQ_LANE_ID`;
  * mutable fields are re-read from the lane record (spec §5.4).
  */
+import { accountMatchesCompany, accountMayRetainLane, companyMismatchError } from "./account-company.js";
 import { spawn, spawnSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { configureRemoteControlChildEnv, prepareRemoteControlLane, remoteControlSelectionConfig } from "./remote-control-lane.js";
-import { PROVIDER_HOME_ENV, accountStatus, isDefaultProviderHome, isLoggedOut, resolveAccount, selectBalancedAccount, } from "./accounts.js";
+import { PROVIDER_HOME_ENV, accountStatus, isDefaultProviderHome, isLoggedOut, isSignInExpired, resolveAccount, selectBalancedAccount, } from "./accounts.js";
+import { readLaneClaudeCredential } from "./claude-credential.js";
 import { effectiveAccountHome } from "./account-home.js";
 import { buildHostCapacitySnapshot } from "./host-capacity.js";
 import { selectClaudeAccount } from "./claude-balance.js";
 import { loadQuotaState } from "./quota.js";
 import { COMPACTION_PROMPT, compactionAfterUsage, compactionDue, compactLaneSession, } from "./compaction.js";
 import { installDrainHook } from "./hooks-install.js";
+import { liveNodeBinary } from "./node-binary.js";
 import { loadLanesConfig, providerAutoCompactTokens, providerCompactAfterMs, } from "./config.js";
 import { appendEffortFlag, resolveLaneEffort, } from "./effort.js";
 import { defaultProbe, validateLaneModel, validateProfileLaneModel, } from "./models.js";
@@ -252,9 +255,19 @@ function selectSpawnAccount(input) {
     };
     if (lane.account === undefined) {
         const modelSpecified = pinnedModel !== undefined || profileModel !== undefined;
-        const allowedAccounts = modelSpecified
-            ? Object.keys(config.providers[lane.provider].accounts).filter((id) => supportsSpawnModel(lane.provider, id, config, pinnedModel, profileModel, modelDeps, hostname))
-            : undefined;
+        const company = resolveLaneCompany(hqRoot, lane).company;
+        const allowedAccounts = Object.entries(config.providers[lane.provider].accounts)
+            .filter(([id, account]) => accountMatchesCompany(account, company, config.providers[lane.provider].accounts) &&
+            (!modelSpecified || supportsSpawnModel(lane.provider, id, config, pinnedModel, profileModel, modelDeps, hostname)))
+            .map(([id]) => id);
+        const mismatch = companyMismatchError({
+            provider: lane.provider,
+            providerAccounts: config.providers[lane.provider].accounts,
+            candidates: Object.keys(config.providers[lane.provider].accounts),
+            company,
+        });
+        if (mismatch !== undefined)
+            throw mismatch;
         return {
             account: selectBalancedAccount(lane.provider, config, {
                 ...context,
@@ -269,7 +282,13 @@ function selectSpawnAccount(input) {
     let refusal;
     const operatorMovePending = lane.pending_resume !== undefined &&
         lane.account_history?.at(-1)?.reason === "operator_move";
-    if (current === undefined || !current.enabled) {
+    if (current !== undefined && !accountMayRetainLane(current, resolveLaneCompany(hqRoot, lane).company, config.providers[lane.provider].accounts)) {
+        reason = "account_unavailable";
+        refusal = new LanesError("account_company_mismatch", `Account ${lane.account} belongs to another company`, {
+            provider: lane.provider, account: lane.account,
+        });
+    }
+    else if (current === undefined || !current.enabled) {
         reason = "account_unavailable";
         refusal = new AccountResolutionError(current === undefined ? "unknown_account" : "account_disabled", `Account ${JSON.stringify(lane.account)} is unavailable for ${lane.provider}`, { provider: lane.provider, account: lane.account });
     }
@@ -278,11 +297,18 @@ function selectSpawnAccount(input) {
             existsSync,
             hostname,
             ...(accountDeps?.probe ? { probe: accountDeps.probe } : {}),
+            ...(accountDeps?.readClaudeCredential ? { readClaudeCredential: accountDeps.readClaudeCredential } : {}),
             ...(accountDeps?.env ? { env: accountDeps.env } : {}),
         });
         if (isLoggedOut(status)) {
             reason = repairRecordedAccount ? "recorded_account_logged_out" : "account_unavailable";
-            refusal = new LanesError("account_not_logged_in", `Account ${lane.account} for ${lane.provider} is not logged in`, { provider: lane.provider, account: lane.account });
+            refusal = new LanesError("account_not_logged_in", isSignInExpired(status)
+                ? expiredSignInMessage(lane.provider, lane.account, status)
+                : `Account ${lane.account} for ${lane.provider} is not logged in`, {
+                provider: lane.provider,
+                account: lane.account,
+                ...(isSignInExpired(status) ? { sign_in_state: "expired", sign_in_expires_at: status.sign_in_expires_at ?? null } : {}),
+            });
         }
         else {
             try {
@@ -339,6 +365,7 @@ function selectSpawnAccount(input) {
             config,
             existsSync,
             probe: accountDeps?.probe,
+            readClaudeCredential: accountDeps?.readClaudeCredential,
             env: accountDeps?.env,
             hostname,
             now,
@@ -348,6 +375,7 @@ function selectSpawnAccount(input) {
             targetHost: lane.host,
             actualTargetHost: lane.host,
             requestedPlacement: null,
+            company: resolveLaneCompany(hqRoot, lane).company,
             config,
             quotaState: loadQuotaState(hqRoot),
             ...((recordedModel ?? pinnedModel ?? profileModel) !== undefined
@@ -366,11 +394,13 @@ function selectSpawnAccount(input) {
         };
     }
     const allowedAccounts = Object.entries(config.providers[lane.provider].accounts)
+        .filter(([, account]) => accountMatchesCompany(account, resolveLaneCompany(hqRoot, lane).company, config.providers[lane.provider].accounts))
         .filter(([id, account]) => id !== lane.account && account.enabled)
         .filter(([id]) => accountStatus(lane.provider, id, config, {
         existsSync,
         hostname,
         ...(accountDeps?.probe ? { probe: accountDeps.probe } : {}),
+        ...(accountDeps?.readClaudeCredential ? { readClaudeCredential: accountDeps.readClaudeCredential } : {}),
         ...(accountDeps?.env ? { env: accountDeps.env } : {}),
     }).logged_in === true)
         .filter(([id]) => supportsSpawnModel(lane.provider, id, config, pinnedModel, profileModel, modelDeps, hostname))
@@ -406,6 +436,11 @@ function selectSpawnAccount(input) {
                 account_reasons: accountReasons,
             });
         }
+        if (lane.company !== null && lane.state === "queued" && lane.pending_resume !== undefined && err instanceof AccountResolutionError) {
+            throw new LanesError("same_company_account_unavailable", "No eligible account assigned to the lane's company is available", {
+                provider: lane.provider, account: lane.account, company: lane.company,
+            });
+        }
         if (reason === "account_unavailable" || reason === "recorded_account_logged_out") {
             if (refusal instanceof Error)
                 throw refusal;
@@ -545,6 +580,7 @@ export async function retryLaneOnAlternateAccount(hqRoot, lane, reason, writer =
     const accountDeps = {
         probe: modelDeps.probe ?? defaultProbe,
         env,
+        ...spawnCredentialReader(deps, modelDeps),
     };
     const profile = lane.worker_profile ? loadWorkerProfile(hqRoot, lane.worker_profile) : undefined;
     let quotaFailoverEnabled = false;
@@ -572,6 +608,9 @@ export async function retryLaneOnAlternateAccount(hqRoot, lane, reason, writer =
         : undefined;
     const unavailableAccounts = previouslyUnavailableAccounts(lane);
     const allowedAccounts = Object.entries(config.providers[lane.provider].accounts)
+        .filter(([id, account]) => id === lane.account
+        ? accountMayRetainLane(account, resolveLaneCompany(hqRoot, lane).company, config.providers[lane.provider].accounts)
+        : accountMatchesCompany(account, resolveLaneCompany(hqRoot, lane).company, config.providers[lane.provider].accounts))
         .filter(([id, account]) => (id !== lane.account || (quotaFailoverEnabled && reason === "usage_limit" && retryingExpiredQuota)) &&
         !unavailableAccounts.has(id) && account.enabled)
         .filter(([id]) => !quotaFailoverEnabled ||
@@ -583,6 +622,7 @@ export async function retryLaneOnAlternateAccount(hqRoot, lane, reason, writer =
         existsSync,
         hostname,
         ...(accountDeps?.probe ? { probe: accountDeps.probe } : {}),
+        ...(accountDeps?.readClaudeCredential ? { readClaudeCredential: accountDeps.readClaudeCredential } : {}),
         ...(accountDeps?.env ? { env: accountDeps.env } : {}),
     }).logged_in === true)
         .filter(([id]) => supportsSpawnModel(lane.provider, id, config, pinnedModel, profileModel, modelDeps, hostname))
@@ -635,6 +675,7 @@ export async function retryLaneOnAlternateAccount(hqRoot, lane, reason, writer =
                         existsSync,
                         hostname,
                         ...(accountDeps?.probe ? { probe: accountDeps.probe } : {}),
+                        ...(accountDeps?.readClaudeCredential ? { readClaudeCredential: accountDeps.readClaudeCredential } : {}),
                         ...(accountDeps?.env ? { env: accountDeps.env } : {}),
                     }).logged_in !== true)
                         return { account: id, reason: "login_required" };
@@ -666,6 +707,22 @@ export async function retryLaneOnAlternateAccount(hqRoot, lane, reason, writer =
                 return retryUpdateLane(hqRoot, lane.lane_id, writer, holdLane);
             }
         }
+        if (resolveLaneCompany(hqRoot, lane).company !== null && err instanceof AccountResolutionError) {
+            const waitForAccount = (current) => {
+                if (current.state !== retryFromState || current.account !== lane.account || current.provider_session_id !== lane.provider_session_id) {
+                    throw new LanesError("account_retry_conflict", "Lane changed while company account recovery was prepared", { lane_id: lane.lane_id });
+                }
+                return {
+                    ...current, state: "queued", queued_reason: "account_retry", queued_details: undefined,
+                    queued_at: at, admission_reserved_at: undefined, terminal_reason: undefined,
+                    terminal_details: undefined, interrupted_at: undefined,
+                    pending_resume: current.provider_session_id
+                        ? pendingResumeForRetry(hqRoot, current, current.provider_session_id, at)
+                        : undefined,
+                };
+            };
+            return deps.dryRun ? waitForAccount(lane) : retryUpdateLane(hqRoot, lane.lane_id, writer, waitForAccount);
+        }
         if (reason === "account_unavailable" || unavailableAccounts.size > 0) {
             throw new LanesError("account_not_logged_in", `Account ${lane.account ?? "(none)"} for ${lane.provider} is unavailable and no other logged-in account can serve this lane`, { provider: lane.provider, account: lane.account ?? null });
         }
@@ -845,6 +902,21 @@ function appendCodexWorkerPolicyDirFlag(provider, args, workerPolicyDir) {
         return [...args, "-c", setting];
     return [...args.slice(0, separator), "-c", setting, ...args.slice(separator)];
 }
+/**
+ * The Claude credential expiry check rides with the real provider probe: a
+ * caller on the production probe also gets the real Keychain/file read, and a
+ * test that injects a fake probe gets no credential read unless it passes one.
+ */
+function spawnCredentialReader(deps, modelDeps) {
+    if (deps.readClaudeCredential !== undefined)
+        return { readClaudeCredential: deps.readClaudeCredential };
+    return modelDeps.probe === defaultProbe ? { readClaudeCredential: readLaneClaudeCredential } : {};
+}
+function expiredSignInMessage(provider, account, status) {
+    const at = status.sign_in_expires_at ? ` at ${status.sign_in_expires_at}` : "";
+    return `Account ${account} for ${provider} has an expired Claude sign-in (access token expired${at}). ` +
+        `Open Claude Code on this account and run /login, then retry.`;
+}
 function accountHomeHostname(deps) {
     return (deps.hostname?.trim() ||
         deps.admissionHost?.hostname.trim() ||
@@ -1958,7 +2030,7 @@ function spawnTrackedWorker(spawnProcess, command, args, env, cwd, stdoutPath, s
             throw error;
     }
     const runnerPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../../dist/lib/lanes/worker-process.js");
-    return spawnDetached(spawnProcess, process.execPath, [runnerPath, command, ...args], { ...env, [LANE_WORKER_EXIT_PATH_ENV]: exitPath }, cwd, stdoutPath, stderrPath);
+    return spawnDetached(spawnProcess, liveNodeBinary(), [runnerPath, command, ...args], { ...env, [LANE_WORKER_EXIT_PATH_ENV]: exitPath }, cwd, stdoutPath, stderrPath);
 }
 function requireDetached(proveDetached, pid, kind) {
     const proof = proveDetached(pid);
@@ -2093,7 +2165,7 @@ export function armLaneWatcher(hqRoot, laneId, deps = {}) {
     if (!cliEntry) {
         throw new LanesError("watcher_cli_entry_unavailable", "Cannot arm the lane watcher without the current hq CLI entrypoint", { lane_id: laneId });
     }
-    const watcherPid = spawnDetached(spawnProcess, process.execPath, [watcherMainPath(), laneId], {
+    const watcherPid = spawnDetached(spawnProcess, liveNodeBinary(), [watcherMainPath(), laneId], {
         ...env,
         HQ_ROOT: hqRoot,
         HQ_LANE_ID: laneId,
@@ -2332,6 +2404,7 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
     const accountDeps = {
         probe: modelDeps.probe ?? defaultProbe,
         env,
+        ...spawnCredentialReader(deps, modelDeps),
     };
     const diskAccount = laneDiskAccount(config, existing.provider, existing.account);
     if (diskAccount !== undefined) {
@@ -2342,6 +2415,22 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
                 ...current,
                 state: "queued",
                 queued_reason: "low_disk",
+                // Commit an explicit resume's instruction together with the hold. A
+                // later admission must continue that turn, not start the old brief.
+                pending_resume: trigger.kind === "resume" ? {
+                    ...(existing.provider_session_id !== undefined ? { session_id: existing.provider_session_id } : {}),
+                    trigger: "resume",
+                    caller: typeof env.HQ_LANE_ID === "string" ? env.HQ_LANE_ID.trim() || "user" : "user",
+                    resumed_from: trigger.from,
+                    ...(trigger.fromFailed === true ? { from_failed: true } : {}),
+                    ...(trigger.expectedSenior !== undefined ? { expected_senior: trigger.expectedSenior } : {}),
+                    ...(trigger.text !== undefined ? { text: trigger.text } : {}),
+                    ...(trigger.message_id !== undefined ? { message_id: trigger.message_id } : {}),
+                    ...(trigger.fresh === true ? { fresh_thread: true } : {}),
+                    ...(deps.workingDirectory !== undefined ? { working_directory: deps.workingDirectory } : {}),
+                    compact: launch.compact !== false,
+                    at: measuredAt,
+                } : current.pending_resume,
                 queued_details: {
                     reason: "low_disk",
                     hq_free_bytes: free.hq.free_bytes,
@@ -2422,7 +2511,28 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
     if (preservedAccountModel !== undefined)
         pinnedModel = preservedAccountModel;
     const resolved = selection.account;
-    const status = accountStatus(lane.provider, resolved.id, config, { existsSync, hostname });
+    const status = accountStatus(lane.provider, resolved.id, config, {
+        existsSync,
+        hostname,
+        ...(accountDeps?.readClaudeCredential ? { readClaudeCredential: accountDeps.readClaudeCredential } : {}),
+    });
+    if (isSignInExpired(status)) {
+        const failed = markPreSpawnFailure
+            ? markSpawnFailure(hqRoot, lane.lane_id, "account_not_logged_in", {
+                provider: lane.provider,
+                account: resolved.id,
+                sign_in_state: "expired",
+            })
+            : existing;
+        throw new LanesError("account_not_logged_in", expiredSignInMessage(lane.provider, resolved.id, status), {
+            provider: lane.provider,
+            account: resolved.id,
+            lane_id: lane.lane_id,
+            sign_in_state: "expired",
+            sign_in_expires_at: status.sign_in_expires_at ?? null,
+            lane: failed,
+        });
+    }
     if (isLoggedOut(status)) {
         const failed = markPreSpawnFailure
             ? markSpawnFailure(hqRoot, lane.lane_id, "account_not_logged_in", {

package/dist/lib/lanes/store.d.ts

@@ -24,6 +24,10 @@ export interface StoreDeps {
     closeSync: typeof fs.closeSync;
     fsyncSync: typeof fs.fsyncSync;
     chmodSync: typeof fs.chmodSync;
+    /** Optional so existing fakes keep working; defaults to node:fs. */
+    statSync?: (p: string) => fs.Stats;
+    fstatSync?: (fd: number) => fs.Stats;
+    linkSync?: typeof fs.linkSync;
 }
 export declare function resolveStoreHqRoot(hqRoot?: string, env?: NodeJS.ProcessEnv, cwd?: string): string;
 export declare function lanesStoreRoot(hqRoot?: string): string;
@@ -35,6 +39,8 @@ export declare function sanitizeHostComponent(hostname: string): string;
 export declare function mintLaneId(deps?: Pick<StoreDeps, "now" | "hostname"> & Partial<Pick<StoreDeps, "generateLaneUlid">>): string;
 export declare function mintQuestionId(deps?: Pick<StoreDeps, "now" | "hostname">): string;
 export declare function appendCappedHistory<T>(history: readonly T[], entry: T, cap?: number): T[];
+/** Test seam: run withRecordLock with overridden deps and a shorter timeout. */
+export declare function withRecordLockForTests<T>(recordPath: string, overrides: Partial<StoreDeps>, fn: () => T, timeoutMs?: number): T;
 /** Run a lane-owned file read/modify/write transaction under its sidecar lock. */
 export declare function withLaneRecordFileLock<T>(recordPath: string, fn: () => T): T;
 export declare function parseLaneRecord(raw: unknown, filePath?: string): LaneRecord;

package/dist/lib/lanes/store.js

@@ -24,7 +24,13 @@ export const LANES_STORE_REL = path.join("workspace", "lanes");
 export const LANE_RECORDS_DIR = "lanes";
 export const QUESTION_RECORDS_DIR = "questions";
 export const PENDING_INDEX_DIR = path.join("questions", "index", "pending");
-const LOCK_STALE_MS = 30_000;
+const DEFAULT_LOCK_STALE_MS = 30_000;
+/** Lock age after which any holder is presumed gone. HQ_LANES_LOCK_STALE_MS overrides it. */
+function lockStaleMs(env = process.env) {
+    const raw = env.HQ_LANES_LOCK_STALE_MS;
+    const parsed = raw === undefined ? NaN : Number(raw);
+    return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : DEFAULT_LOCK_STALE_MS;
+}
 const LOCK_RETRY_MS = 10;
 const LOCK_TIMEOUT_MS = 5_000;
 function defaultStoreDeps() {
@@ -153,16 +159,104 @@ function wait(ms) {
 function lockPathFor(recordPath) {
     return `${recordPath}.lock`;
 }
-function withRecordLock(recordPath, deps, fn) {
+function lockOwnerAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code !== "ESRCH";
+    }
+}
+function sameFile(a, b) {
+    return a.ino === b.ino && a.dev === b.dev;
+}
+/**
+ * Remove a record lock that no live process holds, and report whether it was
+ * removed. A lock is stale when it was written on this host and its owner pid
+ * no longer exists, or when it is older than the stale window. Age is the
+ * larger of the timestamp age and the file mtime age, so a future or
+ * unparseable timestamp still ages out through mtime.
+ *
+ * Removal is atomic: the lock is renamed to a unique name, which only one
+ * reclaimer can win. If the renamed file is not the lock that was inspected
+ * (another process reclaimed it and took a fresh lock in between), the fresh
+ * lock is linked back into place and nothing is reclaimed.
+ */
+function recordLockIsStale(lockPath, deps) {
+    const statSync = deps.statSync ?? ((p) => fs.statSync(p));
+    const linkSync = deps.linkSync ?? fs.linkSync.bind(fs);
+    const before = statSync(lockPath);
+    const raw = deps.readFileSync(lockPath, "utf8");
+    const [pidLine, tsLine, hostLine] = raw.split("\n");
+    const pid = pidLine ? Number(pidLine) : NaN;
+    const ts = tsLine ? Number(tsLine) : NaN;
+    const pidKnown = Number.isSafeInteger(pid) && pid > 0;
+    // A pid is only meaningful on the host that wrote it. A lock with a foreign
+    // or missing host falls back to the age rule.
+    const sameHost = hostLine !== undefined && hostLine.trim() !== "" && hostLine.trim() === deps.hostname();
+    const now = Date.now();
+    const mtimeAge = now - before.mtimeMs;
+    const age = Number.isFinite(ts) ? Math.max(now - ts, mtimeAge) : mtimeAge;
+    const stale = (pidKnown && sameHost && pid !== process.pid && !lockOwnerAlive(pid)) ||
+        age > lockStaleMs();
+    if (!stale)
+        return false;
+    const parked = `${lockPath}.stale.${process.pid}.${randomBytes(6).toString("hex")}`;
+    try {
+        deps.renameSync(lockPath, parked);
+    }
+    catch (renameErr) {
+        // Another reclaimer won the rename, or the holder released it.
+        if (renameErr.code === "ENOENT")
+            return false;
+        throw renameErr;
+    }
+    const removeParked = () => {
+        try {
+            deps.unlinkSync(parked);
+        }
+        catch (unlinkErr) {
+            if (unlinkErr.code !== "ENOENT")
+                throw unlinkErr;
+        }
+    };
+    let reclaimed;
+    try {
+        reclaimed = sameFile(statSync(parked), before) && deps.readFileSync(parked, "utf8") === raw;
+        if (!reclaimed) {
+            // The parked file is a live holder's fresh lock. Put it back.
+            try {
+                linkSync(parked, lockPath);
+            }
+            catch (linkErr) {
+                if (linkErr.code !== "EEXIST")
+                    throw linkErr;
+                process.stderr.write(`lanes store: could not restore displaced lock ${lockPath}; a newer lock already exists\n`);
+            }
+        }
+    }
+    catch (err) {
+        removeParked();
+        throw err;
+    }
+    removeParked();
+    return reclaimed;
+}
+function withRecordLock(recordPath, deps, fn, timeoutMs = LOCK_TIMEOUT_MS) {
     const lockPath = lockPathFor(recordPath);
+    const statSync = deps.statSync ?? ((p) => fs.statSync(p));
+    const fstatSync = deps.fstatSync ?? ((fd) => fs.fstatSync(fd));
     ensureDir(path.dirname(recordPath), deps);
     const started = Date.now();
     while (true) {
         let fd;
         try {
             fd = deps.openSync(lockPath, "wx");
+            let held;
             try {
-                fs.writeSync(fd, Buffer.from(`${process.pid}\n${Date.now()}\n`, "utf8"));
+                fs.writeSync(fd, Buffer.from(`${process.pid}\n${Date.now()}\n${deps.hostname()}\n`, "utf8"));
+                held = fstatSync(fd);
             }
             catch (err) {
                 deps.closeSync(fd);
@@ -180,7 +274,10 @@ function withRecordLock(recordPath, deps, fn) {
                     process.stderr.write(`lanes store: lock close failed for ${lockPath}: ${err instanceof Error ? err.message : String(err)}\n`);
                 }
                 try {
-                    deps.unlinkSync(lockPath);
+                    // Unlink only our own lock. If it was reclaimed and replaced while
+                    // fn ran, the file at lockPath belongs to the successor.
+                    if (sameFile(statSync(lockPath), held))
+                        deps.unlinkSync(lockPath);
                 }
                 catch (err) {
                     const code = err.code;
@@ -194,24 +291,12 @@ function withRecordLock(recordPath, deps, fn) {
             const code = err.code;
             if (code !== "EEXIST")
                 throw err;
-            if (Date.now() - started > LOCK_TIMEOUT_MS) {
+            if (Date.now() - started > timeoutMs) {
                 throw new LanesError("store_lock_timeout", `Timed out waiting for lock ${lockPath}`, { path: lockPath });
             }
             try {
-                const raw = deps.readFileSync(lockPath, "utf8");
-                const tsLine = raw.split("\n")[1];
-                const ts = tsLine ? Number(tsLine) : NaN;
-                if (Number.isFinite(ts) && Date.now() - ts > LOCK_STALE_MS) {
-                    try {
-                        deps.unlinkSync(lockPath);
-                    }
-                    catch (unlinkErr) {
-                        const unlinkCode = unlinkErr.code;
-                        if (unlinkCode !== "ENOENT")
-                            throw unlinkErr;
-                    }
+                if (recordLockIsStale(lockPath, deps))
                     continue;
-                }
             }
             catch (statErr) {
                 const statCode = statErr.code;
@@ -223,6 +308,10 @@ function withRecordLock(recordPath, deps, fn) {
         }
     }
 }
+/** Test seam: run withRecordLock with overridden deps and a shorter timeout. */
+export function withRecordLockForTests(recordPath, overrides, fn, timeoutMs) {
+    return withRecordLock(recordPath, { ...defaultStoreDeps(), ...overrides }, fn, timeoutMs);
+}
 /** Run a lane-owned file read/modify/write transaction under its sidecar lock. */
 export function withLaneRecordFileLock(recordPath, fn) {
     return withRecordLock(recordPath, defaultStoreDeps(), fn);

package/dist/lib/lanes/types.d.ts

@@ -1029,6 +1029,8 @@ export interface LaneEnvelope {
     fingerprint?: string | null;
 }
 export interface AccountConfig {
+    /** Company slug or UID owning this account. Untagged accounts are personal. */
+    company?: string;
     home: string;
     /** Optional account home overrides keyed by the owning host's hostname. */
     hosts?: Record<string, AccountHostHome>;

package/dist/lib/lanes/watch.js

@@ -1,3 +1,7 @@
+import * as path from "node:path";
+import * as fs from "node:fs";
+import { loopControllerIsAlive, loopStatus } from "./loop.js";
+import { laneRunDir } from "./spawn.js";
 import { expandLocalLaneIdPrefix, listQuestionIds, readLane, readQuestion, } from "./store.js";
 import { LaneNotFoundError, LanesError } from "./errors.js";
 import { providerSupportsSessionResume } from "./delivery.js";
@@ -118,6 +122,7 @@ export async function runLaneWatch(hqRoot, laneIds, deps = {}) {
     while (true) {
         polls += 1;
         const records = [];
+        const activeLoops = new Set();
         for (const laneId of watchedIds) {
             let record = null;
             try {
@@ -131,9 +136,27 @@ export async function runLaneWatch(hqRoot, laneIds, deps = {}) {
                 continue;
             }
             records.push(record);
-            if (previousStates.get(laneId) !== record.state) {
-                emit(`lane ${record.lane_id}: state=${record.state}${isTerminalLaneState(record.state) ? " (terminal)" : ""}`);
-                previousStates.set(laneId, record.state);
+            if (record.loop_mode === true) {
+                try {
+                    const runDir = laneRunDir(hqRoot, record.lane_id);
+                    // loopStatus defaults missing metadata to waiting; that is not
+                    // evidence of a controller after a failed admission or launch.
+                    if (fs.existsSync(path.join(runDir, "loop", "loop.json"))) {
+                        const status = loopStatus(runDir, record.lane_id);
+                        if (status.state !== "stopped" && status.state !== "failed" && loopControllerIsAlive(runDir))
+                            activeLoops.add(record.lane_id);
+                    }
+                }
+                catch (err) {
+                    unreadable("loop", laneId, err);
+                }
+            }
+            // A phase can be done while its loop controller awaits more work.
+            const terminal = isTerminalLaneState(record.state) && !activeLoops.has(record.lane_id);
+            const stateKey = `${record.state}:${terminal}`;
+            if (previousStates.get(laneId) !== stateKey) {
+                emit(`lane ${record.lane_id}: state=${record.state}${terminal ? " (terminal)" : ""}`);
+                previousStates.set(laneId, stateKey);
             }
         }
         const keepAliveWaiting = new Set();
@@ -175,7 +198,7 @@ export async function runLaneWatch(hqRoot, laneIds, deps = {}) {
         }
         if (deps.readAccountStatuses !== undefined) {
             const accountLanes = records.filter((record) => record.account !== undefined &&
-                (!isTerminalLaneState(record.state) || keepAliveWaiting.has(record.lane_id)));
+                (!isTerminalLaneState(record.state) || activeLoops.has(record.lane_id) || keepAliveWaiting.has(record.lane_id)));
             let statuses;
             try {
                 statuses = await deps.readAccountStatuses(accountLanes);
@@ -242,7 +265,7 @@ export async function runLaneWatch(hqRoot, laneIds, deps = {}) {
                     previousAccountLogin.set(key, status.logged_in);
             }
         }
-        if (records.every((record) => isTerminalLaneState(record.state) && !keepAliveWaiting.has(record.lane_id))) {
+        if (records.every((record) => isTerminalLaneState(record.state) && !activeLoops.has(record.lane_id) && !keepAliveWaiting.has(record.lane_id))) {
             return { polls, lines, suppressed };
         }
         await sleep(intervalMs);

package/dist/lib/lanes/watcher-main.js

@@ -12,6 +12,7 @@ import { isMainModule } from "../../utils/is-main-module.js";
 import { runWatcherLoop } from "./watcher.js";
 import { spawnEnvelopeRepairViaCurrentCli, } from "./envelope-repair-dispatch.js";
 import { LanesError } from "./errors.js";
+import { liveNodeBinary } from "./node-binary.js";
 import { openMeshTransport } from "../mesh/client.js";
 import { CompanySelectionError } from "../../utils/company-selection-error.js";
 export function watcherMainDeps(hqRoot, laneId, env = process.env, repairDispatchDeps = {}) {
@@ -21,7 +22,7 @@ export function watcherMainDeps(hqRoot, laneId, env = process.env, repairDispatc
         spawnRepair: (root, lane, input) => spawnEnvelopeRepairViaCurrentCli(root, lane, input, { ...repairDispatchDeps, env }),
         deliverLaneSeniorMessage: async (seniorLaneId, text) => deliverLaneSeniorMessage(cliEntry, seniorLaneId, text),
         recoverQueuedMessages: async () => {
-            const result = spawnSync(process.execPath, [cliEntry, "lanes", "_recover-queued-messages", laneId], {
+            const result = spawnSync(liveNodeBinary(), [cliEntry, "lanes", "_recover-queued-messages", laneId], {
                 env,
                 encoding: "utf8",
                 timeout: 120_000,
@@ -34,7 +35,7 @@ export function watcherMainDeps(hqRoot, laneId, env = process.env, repairDispatc
         },
         scheduleTerminalKeepAlive: async ({ laneId: scheduledLaneId, version, dueAt }) => {
             await new Promise((resolve, reject) => {
-                const child = spawn(process.execPath, [
+                const child = spawn(liveNodeBinary(), [
                     cliEntry,
                     "lanes",
                     "_keep-alive-terminal-trigger",
@@ -54,7 +55,7 @@ export function watcherMainDeps(hqRoot, laneId, env = process.env, repairDispatc
     };
 }
 function deliverLaneSeniorMessage(cliEntry, laneId, text) {
-    const result = spawnSync(process.execPath, [cliEntry, "lanes", "message", laneId, "--text", text], {
+    const result = spawnSync(liveNodeBinary(), [cliEntry, "lanes", "message", laneId, "--text", text], {
         env: process.env,
         encoding: "utf8",
         timeout: 120_000,

package/dist/lib/lanes/watcher.d.ts

@@ -201,6 +201,8 @@ export interface WatcherLoopDeps {
     progressEventMinIntervalMs?: number;
     /** Bound a hung mesh request so watcher liveness polling continues. */
     meshRequestTimeoutMs?: number;
+    /** Bound on waiting for an older run's watcher to release the claim. */
+    claimWaitMs?: number;
     /** Spec §4 repair spawn. Default: `spawnEnvelopeRepair`. */
     spawnRepair?: (hqRoot: string, lane: LaneRecord, input: EnvelopeRepairSpawnInput) => number;
     /** Rebind and respawn after a provider quota or authentication refusal. */
@@ -247,6 +249,8 @@ export interface WatcherLoopDeps {
 export declare function emitMeshSoft(event: string, logDecision: (record: Record<string, unknown>) => void, at: string, fn: (signal: AbortSignal) => Promise<void>, timeoutMs?: number): Promise<boolean>;
 /** Question ids an ask envelope raised, as `raiseEnvelopeQuestions` mints them. */
 export declare function envelopeQuestionIds(laneId: string, envelopeRef: string, envelope: LaneEnvelope, questionIndexes?: readonly number[]): string[];
+/** How long a new phase watcher waits for an older phase's watcher to let go. */
+export declare const WATCHER_CLAIM_WAIT_MS = 60000;
 /** Detached and synchronous classifiers share one process-identity claim. */
 export declare function runWatcherLoop(hqRoot: string, laneId: string, deps?: WatcherLoopDeps): Promise<void>;
 export type EnvelopeRepairDecision = {