@indigoai-us/hq-cli 5.345.20 → 5.345.22

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.345.22] — 2026-10-06
+- Fix Claude quota holds so time-only reset messages keep accounts unavailable until the provider's stated UTC reset, and expose the hold state in host capacity output.
+
+## [5.345.21] — 2026-10-06
+- `hq sync push --personal <path>` now waits up to 500 ms for the startup flag registry snapshot before evaluating `cli.personal-targeted-push-paths`, while preserving the legacy refusal when the registry is unavailable.
+
+- Hook timeout reports now show elapsed time against the configured budget and include available phase and hook attribution.
+- Reconcile hire-grant carve accounting across resume, reparent and grant updates; decreases no longer fail because sibling grants exceed the senior allocation.
+- Route eligible Linux pull-request checks and local release guards through the registered ARM64 self-hosted runner. Keep the shared npm/OIDC publish job on its existing runner.
+- Gate `hq doctor --json --client-health-report` status reporting for sync FAIL/WARN results behind the separate, default-off `client-health-sync-check-status` hq-flag; reason-code eligibility remains independent.
+
 ## [5.345.20] — 2026-10-06
 - Keep bundled scaffold scripts and `hq core register-project` aligned with the shared source, including company UID lookup from `companies/manifest.yaml`.
 

package/dist/commands/cloud.js

@@ -840,7 +840,7 @@ export function registerCloudCommands(program) {
                     "to have already resolved entity + credentials. Pick one.");
             }
             // Closes hq-cli#25 — see `assertNoPersonalPositionalPaths` doc-block.
-            const targetedPersonalPathsEnabled = Boolean(options.personal && paths && paths.length > 0 && personalTargetedPushPathsEnabled());
+            const targetedPersonalPathsEnabled = Boolean(options.personal && paths && paths.length > 0 && await personalTargetedPushPathsEnabled());
             assertNoPersonalPositionalPaths(options, paths, targetedPersonalPathsEnabled);
             if (targetedPersonalPathsEnabled) {
                 explicitPersonalPaths = resolveExplicitPersonalPushPaths(options.hqRoot, paths);

package/dist/commands/doctor.d.ts

@@ -57,6 +57,8 @@ export interface RunDoctorOptions {
     json?: boolean;
     /** Resolve hq-flags independently for each company represented in sync results. */
     resolveClientHealthReasonCodesForCompany?: (companySlug: string | null) => Promise<boolean>;
+    /** Resolve the separate status-report flag per company in sync results. */
+    resolveClientHealthCheckStatusForCompany?: (companySlug: string | null) => Promise<boolean>;
     /** In text mode, also print every PASS result. Default: false. */
     verbose?: boolean;
     /** In text mode, emit ANSI colour. Default: false (no escape sequences). */
@@ -117,6 +119,7 @@ export interface RunDoctorResult {
  * read; all other default tiers remain local unless explicitly opted in.
  */
 export declare function runDoctor(options?: RunDoctorOptions): Promise<RunDoctorResult>;
+export declare function createClientHealthCheckStatusCompanyResolver(hqRoot: string): (companySlug: string | null) => Promise<boolean>;
 /** Register the top-level `hq doctor` command so it appears in `hq --help`. */
 export declare function registerDoctorCommand(program: Command): void;
 //# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.js

@@ -32,7 +32,7 @@ import { DEEP_FAMILY_ID, DEEP_FAMILY_TITLE, runDeepGuardTests, } from "../lib/do
 import { PARITY_FAMILY_ID, PARITY_FAMILY_TITLE, runParityReplay, } from "../lib/doctor/deep/parity.js";
 import { applyFixes } from "../lib/doctor/fix/apply.js";
 import { renderDoctorFixJson } from "../lib/doctor/fix/json-output.js";
-import { clientHealthReasonCodesEnabled as isActiveCompanyClientHealthReasonCodesEnabled, clientHealthReasonCodesEnabledForCompany, } from "../lib/doctor/client-health-reason-codes-flag.js";
+import { clientHealthCheckStatusEnabled as isActiveCompanyClientHealthCheckStatusEnabled, clientHealthCheckStatusEnabledForCompany, clientHealthReasonCodesEnabled as isActiveCompanyClientHealthReasonCodesEnabled, clientHealthReasonCodesEnabledForCompany, } from "../lib/doctor/client-health-reason-codes-flag.js";
 import { isCompanyJournalSlug } from "../lib/doctor/checks/sync-health.js";
 import { readCompaniesManifestMap } from "../lib/work-context/repo-remote.js";
 import * as readline from "node:readline";
@@ -166,15 +166,21 @@ export async function runDoctor(options = {}) {
         });
     }
     if (options.json) {
-        const clientHealthReasonCodesEnabledCheckIds = options.resolveClientHealthReasonCodesForCompany
-            ? await resolveClientHealthReasonCodesCheckIds(families, options.resolveClientHealthReasonCodesForCompany)
-            : undefined;
+        const [clientHealthReasonCodesEnabledCheckIds, clientHealthCheckStatusEnabledCheckIds] = await Promise.all([
+            options.resolveClientHealthReasonCodesForCompany
+                ? resolveClientHealthReasonCodesCheckIds(families, options.resolveClientHealthReasonCodesForCompany)
+                : undefined,
+            options.resolveClientHealthCheckStatusForCompany
+                ? resolveClientHealthCheckStatusCheckIds(families, options.resolveClientHealthCheckStatusForCompany)
+                : undefined,
+        ]);
         write(renderJson(buildDoctorJson({
             hqRoot: hqRoot ?? "",
             families,
             platform,
             scope,
             clientHealthReasonCodesEnabledCheckIds,
+            clientHealthCheckStatusEnabledCheckIds,
         })));
     }
     else {
@@ -220,6 +226,34 @@ async function resolveClientHealthReasonCodesCheckIds(families, resolveForCompan
     }
     return enabledChecks;
 }
+async function resolveClientHealthCheckStatusCheckIds(families, resolveForCompany) {
+    const checksByCompany = new Map();
+    for (const run of families) {
+        if (run.family.id !== "sync")
+            continue;
+        for (const result of run.results) {
+            if (result.status !== "FAIL" && result.status !== "WARN")
+                continue;
+            const scoped = /^sync\.(?:journal|manifest)\.(.+)$/.exec(result.checkId);
+            const companySlug = scoped && isCompanyJournalSlug(scoped[1]) ? scoped[1] : null;
+            const checkIds = checksByCompany.get(companySlug) ?? [];
+            checkIds.push(result.checkId);
+            checksByCompany.set(companySlug, checkIds);
+        }
+    }
+    const enabledChecks = new Set();
+    const decisions = await Promise.all([...checksByCompany.entries()].map(async ([companySlug, checkIds]) => ({
+        checkIds,
+        enabled: await resolveForCompany(companySlug),
+    })));
+    for (const decision of decisions) {
+        if (decision.enabled) {
+            for (const checkId of decision.checkIds)
+                enabledChecks.add(checkId);
+        }
+    }
+    return enabledChecks;
+}
 function createClientHealthReasonCodeCompanyResolver(hqRoot) {
     const companies = readCompaniesManifestMap(hqRoot);
     return async (companySlug) => {
@@ -245,6 +279,37 @@ function createClientHealthReasonCodeCompanyResolver(hqRoot) {
         });
     };
 }
+export function createClientHealthCheckStatusCompanyResolver(hqRoot) {
+    const companies = readCompaniesManifestMap(hqRoot);
+    return async (companySlug) => {
+        if (companySlug === null) {
+            return isActiveCompanyClientHealthCheckStatusEnabled();
+        }
+        const scopedCompanyUid = /^company:(cmp_[A-Za-z0-9]{3,128})$/.exec(companySlug);
+        if (scopedCompanyUid) {
+            return clientHealthCheckStatusEnabledForCompany({
+                companyUid: scopedCompanyUid[1],
+            });
+        }
+        if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(companySlug)) {
+            return false;
+        }
+        const manifestUid = companies?.[companySlug]?.cloud_uid;
+        const activeSlug = process.env.HQ_COMPANY_SLUG?.trim() || "";
+        const activeUid = process.env.HQ_COMPANY_UID?.trim() || "";
+        const companyUid = typeof manifestUid === "string" && manifestUid.trim()
+            ? manifestUid.trim()
+            : companySlug === activeSlug
+                ? activeUid
+                : "";
+        if (!/^cmp_[A-Za-z0-9]{3,128}$/.test(companyUid))
+            return false;
+        return clientHealthCheckStatusEnabledForCompany({
+            companyUid,
+            companySlug,
+        });
+    };
+}
 /** Register the top-level `hq doctor` command so it appears in `hq --help`. */
 export function registerDoctorCommand(program) {
     program
@@ -334,6 +399,14 @@ export function registerDoctorCommand(program) {
                     : undefined;
             })()
             : undefined;
+        const clientHealthCheckStatusResolver = json && opts.clientHealthReport === true
+            ? (() => {
+                const hqRoot = resolveHqRoot();
+                return hqRoot
+                    ? createClientHealthCheckStatusCompanyResolver(hqRoot)
+                    : undefined;
+            })()
+            : undefined;
         const result = await runDoctor({
             json,
             // `src/main.ts` also declares --verbose on the root program. When
@@ -350,6 +423,7 @@ export function registerDoctorCommand(program) {
             company: opts.company,
             only: parseOnly(opts.only),
             resolveClientHealthReasonCodesForCompany: clientHealthReasonCodesResolver,
+            resolveClientHealthCheckStatusForCompany: clientHealthCheckStatusResolver,
         });
         // Set the exit code rather than calling process.exit, so the CLI's
         // normal shutdown (telemetry flush) still runs. Non-zero means either an

package/dist/commands/integrations-connect.js

@@ -19,6 +19,7 @@
 import chalk from "chalk";
 import open from "open";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
+import { safeCaughtError } from "../utils/safe-caught-error.js";
 import { runResidentCommandWithPackageLease, } from "../utils/resident-package-preload.js";
 import { consoleOrigin } from "../utils/console-origin.js";
 export { consoleOrigin };
@@ -29,6 +30,9 @@ import { completeOAuth, discoverDocs, installIntegration, listCatalog, pullBluep
 import { OAUTH_LOOPBACK_TIMEOUT_CODE, startLoopbackListener, } from "./integrations-oauth.js";
 /** hq-pro's machine code for "this endpoint needs a browser sign-in". */
 const OAUTH_REQUIRED_CODE = "INTEGRATION_FACTORY_OAUTH_REQUIRED";
+function warnBrowserOpenFailure(error) {
+    console.warn("[hq-cli:integrations-connect] browser open failed", safeCaughtError(error));
+}
 /**
  * A server-authoritative "this endpoint is OAuth-protected, run the browser
  * sign-in instead" signal, in EITHER of the two shapes hq-pro emits it:
@@ -679,7 +683,7 @@ async function consoleHandoff(target, opts) {
         console.error(chalk.yellow(`Note: --scopes cannot be carried into a console sign-in, so this connect will use ${target.label}'s default permissions.`));
     }
     if (url && opts.browser !== false)
-        await open(url).catch(() => { });
+        await open(url).catch((error) => warnBrowserOpenFailure(error));
     console.error(chalk.dim("When the browser says it connected, run `hq integrations list` to confirm."));
     return null;
 }
@@ -712,7 +716,7 @@ export async function bringYourOwnClientHandoff(target, opts, reason, redirectUr
     console.error("The console shows the callback URL to register and takes the credentials.");
     printConsoleDestination(target, opts, url);
     if (url && opts.browser !== false)
-        await open(url).catch(() => { });
+        await open(url).catch((error) => warnBrowserOpenFailure(error));
     return null;
 }
 /**
@@ -837,7 +841,7 @@ async function userClientSignIn(token, companyUid, target, opts, client, request
     if (googleHint)
         console.error(chalk.yellow(googleHint));
     if (opts.browser !== false)
-        await open(started.authorizationUrl).catch(() => { });
+        await open(started.authorizationUrl).catch((error) => warnBrowserOpenFailure(error));
     console.error(chalk.dim("The browser finishes on the HQ console. When it says connected, " +
         "run `hq integrations list` to confirm."));
     return null;

package/dist/commands/lanes.js

@@ -62,7 +62,7 @@ import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, lan
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { listLaneReviews } from "../lib/lanes/reviews.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
-import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, aliveDirectChildren, childrenHoldingHireGrantCarve, laneHoldsHireGrantCarve, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
 import { laneStories, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
 import { laneCompanyUidSource, resolveLaneCompany } from "../lib/lanes/lane-company.js";
@@ -507,7 +507,12 @@ function laneHireFields(lane, lanes, aliveChildrenByParent, finishedChildrenDoNo
     };
 }
 function hireGrantFinishedChildrenDoNotCount(ctx, lane) {
-    const resolution = resolveLaneCompany(ctx.hqRoot(), lane);
+    const resolution = resolveLaneCompany(ctx.hqRoot(), {
+        lane_id: lane.lane_id,
+        company: lane.company ?? null,
+        mesh_company: lane.mesh_company,
+        project_id: lane.project_id ?? "",
+    });
     const company = resolution.company ?? undefined;
     return readLanesRegistryFlagFailOff(LANE_HIRE_GRANT_FINISHED_LANES_FLAG, {
         company,
@@ -1036,9 +1041,15 @@ async function withResumeHireAdmission(ctx, lane, fn, grantContext) {
         !sameHireGrantSenior(lane.senior, grantContext.expected_senior))) {
         throw new LanesError("hire_grant_senior_changed", `Lane ${lane.lane_id}'s senior changed after the primary authorized its Outpost dispatch`, { lane_id: lane.lane_id, expected_senior: grantContext.expected_senior, current_senior: lane.senior });
     }
-    const finishedChildrenDoNotCount = isFinishedResumableHireChild(lane.state)
-        ? await hireGrantFinishedChildrenDoNotCount(ctx, lane)
-        : false;
+    let finishedChildrenDoNotCount = false;
+    if (isTerminalLaneState(lane.state) || isFinishedResumableHireChild(lane.state)) {
+        const seniorLaneId = lane.senior.kind === "lane" ? lane.senior.id : undefined;
+        const resumeSenior = seniorLaneId
+            ? grantContext?.hierarchy.find((entry) => entry.lane_id === seniorLaneId) ??
+                (listLaneIds(hqRoot).includes(seniorLaneId) ? readLane(hqRoot, seniorLaneId) : lane)
+            : lane;
+        finishedChildrenDoNotCount = await hireGrantFinishedChildrenDoNotCount(ctx, resumeSenior);
+    }
     const shouldCheckGrant = isTerminalLaneState(lane.state) ||
         (finishedChildrenDoNotCount && isFinishedResumableHireChild(lane.state));
     if (!shouldCheckGrant ||
@@ -5295,6 +5306,7 @@ async function runCapacity(ctx) {
         env: ctx.env,
         hostname: ctx.hostname(),
         now: ctx.now(),
+        quotaState: loadQuotaState(hqRoot),
     });
     printJson({
         ...snapshot,
@@ -5736,6 +5748,7 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
         initial.senior.kind === "lane" && initial.senior.id
         ? await readRemoteHireGrantSenior(ctx, hqRoot, initial.senior.id)
         : undefined;
+    const finishedChildrenDoNotCount = await hireGrantFinishedChildrenDoNotCount(ctx, initial);
     const updated = ctx.withGrantHireLocks(hqRoot, lockedLaneIds, () => {
         const current = readLane(hqRoot, laneId);
         const currentCallerAuthorization = authorization === "senior"
@@ -5779,11 +5792,11 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
             if (isTerminalLaneState(parent.state)) {
                 throw new LanesError("hire_grant_senior_inactive", `Senior lane ${parent.lane_id} is ${parent.state} and cannot change grants`, { senior_lane_id: parent.lane_id, state: parent.state });
             }
-            const siblings = aliveDirectChildren(hierarchy, parent.lane_id);
+            const siblings = childrenHoldingHireGrantCarve(hierarchy, parent.lane_id, finishedChildrenDoNotCount);
             const parentGrant = parent.hire_grant ?? 0;
             const assigned = assignedChildHireGrants(siblings, current.lane_id);
             const available = Math.max(0, parentGrant - assigned);
-            if (hireGrant > available) {
+            if (hireGrant > (current.hire_grant ?? 0) && hireGrant > available) {
                 throw new LanesError("hire_grant_carve_exceeded", `Senior lane ${parent.lane_id} has ${available} unassigned hire grant remaining for lane ${laneId}`, {
                     senior_lane_id: parent.lane_id,
                     parent_grant: parentGrant,
@@ -5794,7 +5807,7 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
                 });
             }
         }
-        const children = aliveDirectChildren(hierarchy, current.lane_id);
+        const children = childrenHoldingHireGrantCarve(hierarchy, current.lane_id, finishedChildrenDoNotCount);
         const allocated = assignedChildHireGrants(children);
         const minimumGrant = Math.max(allocated, children.length);
         if (hireGrant < minimumGrant) {
@@ -7063,6 +7076,7 @@ async function reparentOnOwner(ctx, laneId, opts) {
     const nextSenior = parseSeniorRef(opts.senior);
     assertSeniorExists(hqRoot, nextSenior, ctx);
     const initial = readLane(hqRoot, laneId);
+    const finishedChildrenDoNotCount = await hireGrantFinishedChildrenDoNotCount(ctx, initial);
     const refreshParents = new Set();
     if (initial.senior.kind === "lane" && initial.senior.id)
         refreshParents.add(initial.senior.id);
@@ -7074,7 +7088,7 @@ async function reparentOnOwner(ctx, laneId, opts) {
         ...(initial.senior.kind === "lane" && initial.senior.id ? [initial.senior.id] : []),
         ...(nextSenior.kind === "lane" && nextSenior.id ? [nextSenior.id] : []),
     ];
-    return withLaneHireLocks(hqRoot, lockIds, () => runReparentLocked(ctx, laneId, opts));
+    return withLaneHireLocks(hqRoot, lockIds, () => runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount));
 }
 async function runReparentOwnerTarget(ctx, laneId, opts) {
     if (!ctx.isSsmOwnerDispatch()) {
@@ -7094,7 +7108,7 @@ async function runReparentOwnerTarget(ctx, laneId, opts) {
         changed_descendant_ids: result.changedDescendantIds,
     });
 }
-function runReparentLocked(ctx, laneId, opts) {
+function runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount = false) {
     const hqRoot = ctx.hqRoot();
     if (!opts.senior) {
         throw new LanesError("missing_senior", "--senior is required", {});
@@ -7108,26 +7122,27 @@ function runReparentLocked(ctx, laneId, opts) {
     }
     const seniorCompany = companyOfSenior(hqRoot, nextSenior, ctx);
     assertSameTenant(lane.company, nextSenior, seniorCompany, { lane_id: laneId });
-    if (nextSenior.kind === "lane" &&
-        seniorKey(lane.senior) !== seniorKey(nextSenior)) {
+    if (nextSenior.kind === "lane" && seniorKey(lane.senior) !== seniorKey(nextSenior)) {
         const parent = readLane(hqRoot, nextSenior.id);
         if (isTerminalLaneState(parent.state)) {
             throw new LanesError("hire_grant_senior_inactive", `Senior lane ${parent.lane_id} is ${parent.state} and cannot accept lane children`, { senior_lane_id: parent.lane_id, state: parent.state });
         }
-        const children = aliveDirectChildren(loadAllLanes(hqRoot), parent.lane_id);
-        if (children.length >= (parent.hire_grant ?? 0)) {
-            throw hireGrantCapacityError(parent, children);
-        }
-        const available = Math.max(0, (parent.hire_grant ?? 0) - assignedChildHireGrants(children));
-        const requested = lane.hire_grant ?? 0;
-        if (requested > available) {
-            throw new LanesError("hire_grant_carve_exceeded", `Senior lane ${parent.lane_id} has ${available} unassigned hire grant remaining for lane ${laneId}`, {
-                senior_lane_id: parent.lane_id,
-                parent_grant: parent.hire_grant ?? 0,
-                assigned_child_grants: assignedChildHireGrants(children),
-                requested_hire_grant: requested,
-                available_hire_grant: available,
-            });
+        if (laneHoldsHireGrantCarve(lane, finishedChildrenDoNotCount)) {
+            const children = childrenHoldingHireGrantCarve(loadAllLanes(hqRoot), parent.lane_id, finishedChildrenDoNotCount);
+            if (children.length >= (parent.hire_grant ?? 0)) {
+                throw hireGrantCapacityError(parent, children);
+            }
+            const available = Math.max(0, (parent.hire_grant ?? 0) - assignedChildHireGrants(children));
+            const requested = lane.hire_grant ?? 0;
+            if (requested > available) {
+                throw new LanesError("hire_grant_carve_exceeded", `Senior lane ${parent.lane_id} has ${available} unassigned hire grant remaining for lane ${laneId}`, {
+                    senior_lane_id: parent.lane_id,
+                    parent_grant: parent.hire_grant ?? 0,
+                    assigned_child_grants: assignedChildHireGrants(children),
+                    requested_hire_grant: requested,
+                    available_hire_grant: available,
+                });
+            }
         }
     }
     if (walkHitsLane(hqRoot, nextSenior, laneId, ctx)) {

package/dist/commands/personal-targeted-push-flag.d.ts

@@ -1,4 +1,4 @@
 export declare const CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG = "cli.personal-targeted-push-paths";
 /** The established full-scope behavior remains in force until an explicit hq-flags enablement. */
-export declare function personalTargetedPushPathsEnabled(): boolean;
+export declare function personalTargetedPushPathsEnabled(): Promise<boolean>;
 //# sourceMappingURL=personal-targeted-push-flag.d.ts.map

package/dist/commands/personal-targeted-push-flag.js

@@ -1,7 +1,11 @@
-import { resolveProcessFlagGate } from "../lib/flag-registry.js";
+import { resolveProcessFlagGate, waitForFlagRegistryRefresh, } from "../lib/flag-registry.js";
 export const CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG = "cli.personal-targeted-push-paths";
 /** The established full-scope behavior remains in force until an explicit hq-flags enablement. */
-export function personalTargetedPushPathsEnabled() {
+export async function personalTargetedPushPathsEnabled() {
+    // This command reads the gate immediately after startup. Give the existing
+    // unref'd registry worker one bounded window to publish its company snapshot.
+    // An unavailable registry leaves resolveProcessFlagGate on the legacy false.
+    await waitForFlagRegistryRefresh(500);
     return resolveProcessFlagGate(CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG, { fallback: false }, () => false);
 }
 //# sourceMappingURL=personal-targeted-push-flag.js.map

package/dist/lib/bot/continuity-download.js

@@ -4,6 +4,7 @@ import * as path from "node:path";
 import { ensureCognitoIdToken } from "../../utils/cognito-session.js";
 import { S3Client, GetObjectCommand } from "@aws-sdk/client-s3";
 import { vaultApiFetch } from "../../utils/vault-api.js";
+import { safeCaughtError } from "../../utils/safe-caught-error.js";
 async function readOwnVault(input) {
     const client = new S3Client({ region: "us-east-1", credentials: input.credentials });
     try {
@@ -52,7 +53,9 @@ export async function downloadContinuitySnapshot(input, deps = { credential: ens
         }
     }
     finally {
-        await reader.cancel().catch(() => { });
+        await reader.cancel().catch((error) => {
+            console.warn("[hq-cli:bot/continuity-download] reader.cancel failed", safeCaughtError(error));
+        });
         download.close();
     }
     const bytes = Buffer.concat(chunks);

package/dist/lib/core-utils/sentry-report.js

@@ -48,6 +48,7 @@ const SENTRY_REPORT_LEVELS = new Set([
 const HOOK_TIMEOUT_WARNING_TYPE = "hook_timeout_warning";
 const HOOK_TIMEOUT_EXCEEDED_TYPE = "hook_timeout_exceeded";
 const HOOK_LATE_FINISH_TYPE = "hook_late_finish";
+const HOOK_TIMEOUT_FINGERPRINT = "hook-timeout";
 const HOOK_TIMEOUT_WARNING_METRIC = "hq.hook_timeout_warning";
 const HOOK_TIMEOUT_EXCEEDED_METRIC = "hq.hook_timeout_exceeded";
 const MAX_HOOK_SEQUENCE_ENTRIES = 20;
@@ -275,6 +276,17 @@ function safeSlowPhase(value) {
         return "unknown";
     return SAFE_SLOW_PHASES.has(value) ? value : "other";
 }
+function resolvedSlowPhase(metadata) {
+    const reported = safeSlowPhase(metadata.slow_phase);
+    if (reported !== "unknown" && reported !== "other")
+        return reported;
+    // Which measured master-hook phase consumed the most time when the caller's
+    // active-phase field was absent or unusable?
+    const debugContext = metadata.hook_timeout_debug_context;
+    const slowestPhase = debugContext?.phase_timings
+        .reduce((slowest, timing) => slowest === undefined || timing.elapsed_ms > slowest.elapsed_ms ? timing : slowest, undefined);
+    return slowestPhase ? safeSlowPhase(slowestPhase.phase) : reported;
+}
 function boundedDebugHookEvent(value) {
     return typeof value === "string" && DEBUG_CONTEXT_HOOK_EVENTS.has(value) ? value : "other";
 }
@@ -534,6 +546,28 @@ function timeoutElapsedMs(metadata) {
 function formatNumber(value) {
     return value.toFixed(2).replace(/\.00$|(?<=\.[0-9])0$/, "");
 }
+function formatSeconds(milliseconds) {
+    return `${formatNumber(milliseconds / 1_000)}s`;
+}
+// How much of the declared timeout has elapsed, and how much remains?
+function hookTimeoutMessage(event) {
+    if (event.type !== HOOK_TIMEOUT_WARNING_TYPE)
+        return event.message;
+    const elapsedMs = timeoutElapsedMs(event.metadata);
+    const declaredTimeoutMs = event.metadata.declared_timeout_ms;
+    if (elapsedMs === undefined ||
+        typeof declaredTimeoutMs !== "number" ||
+        !Number.isFinite(declaredTimeoutMs) ||
+        declaredTimeoutMs <= 0) {
+        return event.message;
+    }
+    const elapsed = formatSeconds(elapsedMs);
+    const budget = formatSeconds(declaredTimeoutMs);
+    if (elapsedMs >= declaredTimeoutMs) {
+        return `HQ hook used ${elapsed} of its ${budget} configured timeout (${formatSeconds(elapsedMs - declaredTimeoutMs)} over budget).`;
+    }
+    return `HQ hook used ${elapsed} of its ${budget} configured timeout (${formatSeconds(declaredTimeoutMs - elapsedMs)} remaining).`;
+}
 function elapsedBucket(elapsedMs) {
     if (elapsedMs === undefined)
         return "unknown";
@@ -672,9 +706,33 @@ function safeSlowChild(metadata) {
         (typeof value !== "string" || value.length === 0 || value === "other")) {
         return "entry-bash-startup";
     }
-    if (typeof value !== "string" || !SAFE_HOOK_SCRIPT.test(value))
-        return "other";
-    return value;
+    return typeof value === "string" && SAFE_HOOK_SCRIPT.test(value) ? value : "other";
+}
+function resolvedSlowChild(metadata) {
+    const directName = safeSlowChild(metadata);
+    const directDuration = metadata.slow_child_ms;
+    const hasDirectDuration = typeof directDuration === "number" && Number.isFinite(directDuration) && directDuration >= 0;
+    if (directName !== "other") {
+        return { name: directName, ...(hasDirectDuration ? { durationMs: directDuration } : {}) };
+    }
+    const currentScript = hookScript(metadata);
+    const currentEvent = stringMetadata(metadata, "hook_event", "");
+    const sequence = metadata.hook_sequence;
+    if (Array.isArray(sequence)) {
+        // Which named hook from this event's serialized sequence took longest
+        // when dispatch could not directly name its slow child?
+        const slowestNamedHook = sequence
+            .filter((entry) => entry.event === currentEvent &&
+            entry.script !== currentScript &&
+            SAFE_HOOK_SCRIPT.test(entry.script) &&
+            Number.isFinite(entry.ms) &&
+            entry.ms >= 0)
+            .reduce((slowest, entry) => (slowest === undefined || entry.ms > slowest.ms ? entry : slowest), undefined);
+        if (slowestNamedHook) {
+            return { name: slowestNamedHook.script, durationMs: slowestNamedHook.ms };
+        }
+    }
+    return { name: directName, ...(hasDirectDuration ? { durationMs: directDuration } : {}) };
 }
 function isMachineWideHookSlowness(metadata) {
     const spawnMs = metadata.spawn_ms;
@@ -717,7 +775,7 @@ function hookTimeoutTags(event) {
     const shell = stringMetadata(metadata, "shell");
     const nproc = metadata.nproc;
     const loadAverage = parsedLoadAverage(metadata);
-    const slowChildMs = metadata.slow_child_ms;
+    const slowChild = resolvedSlowChild(metadata);
     return {
         hook_timeout_kind: hookTimeoutKind(event),
         hook_event: hookEvent(metadata),
@@ -738,11 +796,9 @@ function hookTimeoutTags(event) {
         load_bucket: typeof loadAverage === "string" ? loadAverage : loadBucket(loadAverage),
         root_storage_class: rootStorageClassTag(metadata),
         spawn_ms_bucket: spawnMsBucket(metadata),
-        slow_child: safeSlowChild(metadata),
-        slow_phase: safeSlowPhase(metadata.slow_phase),
-        slow_child_ms_bucket: typeof slowChildMs === "number" && Number.isFinite(slowChildMs)
-            ? elapsedBucket(slowChildMs)
-            : "unknown",
+        slow_child: slowChild.name,
+        slow_phase: resolvedSlowPhase(metadata),
+        slow_child_ms_bucket: elapsedBucket(slowChild.durationMs),
         machine_wide: isMachineWideHookSlowness(metadata) ? "true" : "false",
         nproc: typeof nproc === "number" || typeof nproc === "string"
             ? safeTagValue(String(nproc), SAFE_NPROC)
@@ -777,7 +833,7 @@ function sentryEnvelope(event, overrides, additionalTags = {}) {
 /** Build the same scrubbed event projection that the live SDK path uses. */
 function scrubbedSentryEnvelope(event, overrides, additionalTags = {}) {
     return beforeSend({
-        message: event.message,
+        message: hookTimeoutMessage(event),
         ...sentryEnvelope(event, overrides, additionalTags),
     }, {});
 }
@@ -787,7 +843,7 @@ function hookTimeoutExceededOverrides(event) {
         return undefined;
     return {
         level: "warning",
-        fingerprint: ["hook-timeout", hookTimeoutKind(event)],
+        fingerprint: [HOOK_TIMEOUT_FINGERPRINT, hookTimeoutKind(event)],
     };
 }
 /**
@@ -1090,7 +1146,7 @@ export async function reportSentryEvent(stdin, options = {}, dependencies = defa
             : {};
         const envelope = sentryEnvelope(event, overrides, { ...debugContextTags, ...tags });
         try {
-            dependencies.sentry.captureMessage(event.message, envelope);
+            dependencies.sentry.captureMessage(hookTimeoutMessage(event), envelope);
             rateLimit.commitCapture();
             if (await flushWithin(dependencies.sentry, timeoutMs))
                 return result;
@@ -1104,7 +1160,7 @@ export async function reportSentryEvent(stdin, options = {}, dependencies = defa
     }
     const envelope = sentryEnvelope(event, overrides, debugContextTags);
     try {
-        dependencies.sentry.captureMessage(event.message, envelope);
+        dependencies.sentry.captureMessage(hookTimeoutMessage(event), envelope);
         if (await flushWithin(dependencies.sentry, timeoutMs))
             return result;
     }

package/dist/lib/doctor/client-health-reason-codes-flag.d.ts

@@ -2,6 +2,8 @@ import { type FlagClient, type FlagClientOptions } from "@indigoai-us/hq-flags-c
 export declare const CLIENT_HEALTH_REASON_CODES_FLAG = "client-health-sync-reason-codes";
 export declare const CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK = false;
 export declare const CLIENT_HEALTH_REASON_CODES_FLAG_TIMEOUT_MS = 150;
+export declare const CLIENT_HEALTH_CHECK_STATUS_FLAG = "client-health-sync-check-status";
+export declare const CLIENT_HEALTH_CHECK_STATUS_FLAG_FALLBACK = false;
 type ClientHealthFlagClient = Pick<FlagClient, "ready" | "isEnabled" | "close">;
 export interface ClientHealthReasonCodesFlagDependencies {
     env?: NodeJS.ProcessEnv;
@@ -21,7 +23,11 @@ export interface ClientHealthReasonCodesCompany {
  * off so a flag outage cannot delay the doctor's health result.
  */
 export declare function clientHealthReasonCodesEnabled(dependencies?: ClientHealthReasonCodesFlagDependencies, callerSignal?: AbortSignal): Promise<boolean>;
+/** Resolve the separate status-report gate for the active company. */
+export declare function clientHealthCheckStatusEnabled(dependencies?: ClientHealthReasonCodesFlagDependencies, callerSignal?: AbortSignal): Promise<boolean>;
 /** Resolve the same default-off gate for one explicitly identified company. */
 export declare function clientHealthReasonCodesEnabledForCompany(company: ClientHealthReasonCodesCompany, dependencies?: ClientHealthReasonCodesFlagDependencies, callerSignal?: AbortSignal): Promise<boolean>;
+/** Resolve the separate default-off check-status gate for one company. */
+export declare function clientHealthCheckStatusEnabledForCompany(company: ClientHealthReasonCodesCompany, dependencies?: ClientHealthReasonCodesFlagDependencies, callerSignal?: AbortSignal): Promise<boolean>;
 export {};
 //# sourceMappingURL=client-health-reason-codes-flag.d.ts.map

package/dist/lib/doctor/client-health-reason-codes-flag.js

@@ -4,12 +4,14 @@ import { getClientHealthFlagToken } from "./client-health-flag-token.js";
 export const CLIENT_HEALTH_REASON_CODES_FLAG = "client-health-sync-reason-codes";
 export const CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK = false;
 export const CLIENT_HEALTH_REASON_CODES_FLAG_TIMEOUT_MS = 150;
+export const CLIENT_HEALTH_CHECK_STATUS_FLAG = "client-health-sync-check-status";
+export const CLIENT_HEALTH_CHECK_STATUS_FLAG_FALLBACK = false;
 function safeErrorClass(error) {
     const name = error instanceof Error ? error.name : "UnknownError";
     return /^[A-Za-z][A-Za-z0-9]{0,63}$/.test(name) ? name : "UnknownError";
 }
 function reportFlagFailure(error) {
-    process.stderr.write(`HQ client-health reason-code flag lookup failed (${safeErrorClass(error)}); using default off.\n`);
+    process.stderr.write(`HQ client-health flag lookup failed (${safeErrorClass(error)}); using default off.\n`);
 }
 function combineSignals(first, second) {
     return first ? AbortSignal.any([first, second]) : second;
@@ -30,13 +32,32 @@ export async function clientHealthReasonCodesEnabled(dependencies = {}, callerSi
         companySlug: env.HQ_COMPANY_SLUG?.trim() || undefined,
     }, dependencies, callerSignal);
 }
+/** Resolve the separate status-report gate for the active company. */
+export async function clientHealthCheckStatusEnabled(dependencies = {}, callerSignal) {
+    const env = dependencies.env ?? process.env;
+    const companyUid = env.HQ_COMPANY_UID?.trim() || "";
+    if (!/^cmp_[A-Za-z0-9]{3,128}$/.test(companyUid)) {
+        return CLIENT_HEALTH_CHECK_STATUS_FLAG_FALLBACK;
+    }
+    return clientHealthCheckStatusEnabledForCompany({
+        companyUid,
+        companySlug: env.HQ_COMPANY_SLUG?.trim() || undefined,
+    }, dependencies, callerSignal);
+}
 /** Resolve the same default-off gate for one explicitly identified company. */
 export async function clientHealthReasonCodesEnabledForCompany(company, dependencies = {}, callerSignal) {
+    return clientHealthFlagEnabledForCompany(CLIENT_HEALTH_REASON_CODES_FLAG, CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK, company, dependencies, callerSignal);
+}
+/** Resolve the separate default-off check-status gate for one company. */
+export async function clientHealthCheckStatusEnabledForCompany(company, dependencies = {}, callerSignal) {
+    return clientHealthFlagEnabledForCompany(CLIENT_HEALTH_CHECK_STATUS_FLAG, CLIENT_HEALTH_CHECK_STATUS_FLAG_FALLBACK, company, dependencies, callerSignal);
+}
+async function clientHealthFlagEnabledForCompany(flagKey, fallback, company, dependencies, callerSignal) {
     const env = dependencies.env ?? process.env;
     const endpoint = resolveFlagRegistryEndpoint(undefined, env);
     const companyUid = company.companyUid.trim();
-    if (!/^cmp_[A-Za-z0-9]{3,128}$/.test(companyUid)) {
-        return CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK;
+    if (!endpoint || !/^cmp_[A-Za-z0-9]{3,128}$/.test(companyUid)) {
+        return fallback;
     }
     const companySlug = company.companySlug?.trim() || "";
     if (callerSignal?.aborted)
@@ -44,7 +65,7 @@ export async function clientHealthReasonCodesEnabledForCompany(company, dependen
     let client;
     let failed = false;
     let failureReported = false;
-    let enabled = CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK;
+    let enabled = fallback;
     const reportFailureOnce = (error) => {
         failed = true;
         if (failureReported)
@@ -83,8 +104,8 @@ export async function clientHealthReasonCodesEnabledForCompany(company, dependen
         });
         await client.ready();
         if (!failed && !signal.aborted) {
-            enabled = client.isEnabled(CLIENT_HEALTH_REASON_CODES_FLAG, {
-                fallback: CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK,
+            enabled = client.isEnabled(flagKey, {
+                fallback,
             });
         }
     }
@@ -100,7 +121,7 @@ export async function clientHealthReasonCodesEnabledForCompany(company, dependen
         }
     }
     return failed || signal.aborted
-        ? CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK
+        ? fallback
         : enabled;
 }
 //# sourceMappingURL=client-health-reason-codes-flag.js.map

package/dist/lib/doctor/json-output.d.ts

@@ -54,6 +54,8 @@ export interface DoctorJsonResult {
     reasonCode?: SyncReasonCode;
     /** Present only when this result's company opted in through hq-flags. */
     clientHealthReasonCodesEnabled?: true;
+    /** Present only when this result's company opted in to status reporting through hq-flags. */
+    clientHealthCheckStatusEnabled?: true;
     /** What was inspected. Present only when the result carries one. */
     target?: string;
     /** Human-readable explanation. */
@@ -100,6 +102,8 @@ export interface BuildDoctorJsonInput {
     scope?: readonly string[];
     /** Check ids whose own company enabled diagnostic reason codes in hq-flags. */
     clientHealthReasonCodesEnabledCheckIds?: ReadonlySet<string>;
+    /** Check ids whose own company enabled per-check status reporting in hq-flags. */
+    clientHealthCheckStatusEnabledCheckIds?: ReadonlySet<string>;
 }
 /** Assemble the machine-readable document from a completed run. */
 export declare function buildDoctorJson(input: BuildDoctorJsonInput): DoctorJsonDocument;

package/dist/lib/doctor/json-output.js

@@ -34,7 +34,7 @@ export function buildDoctorJson(input) {
     const results = [];
     for (const run of input.families) {
         for (const result of run.results) {
-            results.push(toJsonResult(run.family.id, result, input.clientHealthReasonCodesEnabledCheckIds));
+            results.push(toJsonResult(run.family.id, result, input.clientHealthReasonCodesEnabledCheckIds, input.clientHealthCheckStatusEnabledCheckIds));
         }
     }
     return {
@@ -48,7 +48,7 @@ export function buildDoctorJson(input) {
     };
 }
 /** Convert one {@link CheckResult} into its JSON form, omitting empty optionals. */
-function toJsonResult(familyId, result, clientHealthReasonCodesEnabledCheckIds) {
+function toJsonResult(familyId, result, clientHealthReasonCodesEnabledCheckIds, clientHealthCheckStatusEnabledCheckIds) {
     const remediation = deriveRemediation(result);
     return {
         status: result.status,
@@ -58,6 +58,9 @@ function toJsonResult(familyId, result, clientHealthReasonCodesEnabledCheckIds)
         ...(clientHealthReasonCodesEnabledCheckIds?.has(result.checkId)
             ? { clientHealthReasonCodesEnabled: true }
             : {}),
+        ...(clientHealthCheckStatusEnabledCheckIds?.has(result.checkId)
+            ? { clientHealthCheckStatusEnabled: true }
+            : {}),
         ...(result.target !== undefined ? { target: result.target } : {}),
         message: result.message,
         ...(result.details !== undefined ? { details: result.details } : {}),

package/dist/lib/lanes/autopilot.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { safeCaughtError } from "../../utils/safe-caught-error.js";
 import { laneRunsOnHost } from "./admission.js";
 import { isControllerAliasOutpostId } from "./admission-host.js";
 import { LEAD_REGISTRY_REL, validateOutpostLeadRegistry } from "./autopilot-registry.js";
@@ -783,7 +784,10 @@ async function runLeadAutopilotPassUnlocked(input) {
             input.outpostId === registered.host &&
             lead.host.kind === "local" &&
             lead.host.id === input.hostname &&
-            await (input.readFlag ?? readLanesRegistryFlag)(LEAD_AUTOPILOT_OUTPOST_NATIVE_LEADS_FLAG, { company }).catch(() => false);
+            await (input.readFlag ?? readLanesRegistryFlag)(LEAD_AUTOPILOT_OUTPOST_NATIVE_LEADS_FLAG, { company }).catch((error) => {
+                console.warn("[hq-cli:lanes/autopilot] outpost-native lead flag read failed", safeCaughtError(error));
+                return false;
+            });
         const hostMatchesRegistry = registeredLocalHost
             ? lead.host.kind === "local"
             : outpostNativeLead ||

package/dist/lib/lanes/grants.d.ts

@@ -2,7 +2,10 @@ import { type LaneRecord } from "./types.js";
 import { LanesError } from "./errors.js";
 export type LaneHireGrantRow = Pick<LaneRecord, "lane_id" | "state" | "senior" | "hire_grant">;
 export declare function isFinishedResumableHireChild(state: LaneRecord["state"]): boolean;
+export declare function laneHoldsHireGrantCarve(lane: Pick<LaneHireGrantRow, "state">, finishedChildrenDoNotCount?: boolean): boolean;
 export declare function aliveDirectChildren<T extends LaneHireGrantRow>(lanes: readonly T[], parentLaneId: string, finishedChildrenDoNotCount?: boolean): T[];
+/** Children whose existing hire grants occupy their senior's carve. */
+export declare function childrenHoldingHireGrantCarve<T extends LaneHireGrantRow>(lanes: readonly T[], parentLaneId: string, finishedChildrenDoNotCount?: boolean): T[];
 export declare function assignedChildHireGrants(children: readonly LaneHireGrantRow[], exceptLaneId?: string): number;
 export interface HireGrantAdmissionSnapshot {
     parent: LaneHireGrantRow;

package/dist/lib/lanes/grants.js

@@ -4,11 +4,18 @@ import { LanesError } from "./errors.js";
 export function isFinishedResumableHireChild(state) {
     return state === "awaiting_input" || state === "blocked" || state === "done";
 }
+export function laneHoldsHireGrantCarve(lane, finishedChildrenDoNotCount = false) {
+    return !isTerminalLaneState(lane.state) &&
+        !(finishedChildrenDoNotCount && isFinishedResumableHireChild(lane.state));
+}
 export function aliveDirectChildren(lanes, parentLaneId, finishedChildrenDoNotCount = false) {
+    return childrenHoldingHireGrantCarve(lanes, parentLaneId, finishedChildrenDoNotCount);
+}
+/** Children whose existing hire grants occupy their senior's carve. */
+export function childrenHoldingHireGrantCarve(lanes, parentLaneId, finishedChildrenDoNotCount = false) {
     return lanes.filter((lane) => lane.senior.kind === "lane" &&
         lane.senior.id === parentLaneId &&
-        !isTerminalLaneState(lane.state) &&
-        !(finishedChildrenDoNotCount && isFinishedResumableHireChild(lane.state)));
+        laneHoldsHireGrantCarve(lane, finishedChildrenDoNotCount));
 }
 export function assignedChildHireGrants(children, exceptLaneId) {
     return children.reduce((sum, child) => child.lane_id === exceptLaneId ? sum : sum + (child.hire_grant ?? 0), 0);
@@ -101,7 +108,7 @@ export function withHireGrantAdmission(hqRoot, parentLaneId, fn, suppliedHierarc
             }
             parent = suppliedParent;
         }
-        const children = aliveDirectChildren(allLanes, parentLaneId, finishedChildrenDoNotCount);
+        const children = childrenHoldingHireGrantCarve(allLanes, parentLaneId, finishedChildrenDoNotCount);
         const parentGrant = parent.hire_grant ?? 0;
         const availableChildGrant = Math.max(0, parentGrant - assignedChildHireGrants(children));
         return fn({ parent, children, parentGrant, availableChildGrant });

package/dist/lib/lanes/host-capacity.d.ts

@@ -1,4 +1,5 @@
 import { type AuthState } from "./accounts.js";
+import { type QuotaState } from "./quota.js";
 import type { LaneHost, LaneProvider, LaneRecord, LanesConfig } from "./types.js";
 export interface HostCapacityAccount {
     enabled: boolean;
@@ -8,6 +9,9 @@ export interface HostCapacityAccount {
     max_running: number;
     running: number;
     queued: number;
+    /** Account-wide quota status when this snapshot is produced on its host. */
+    quota_held?: boolean;
+    quota_reset_at?: string;
     /** Exact lane states used for Claude account balancing; absent on older Outposts. */
     lane_counts?: {
         running: number;
@@ -54,6 +58,7 @@ export declare function buildHostCapacitySnapshot(input: {
     env?: NodeJS.ProcessEnv;
     hostname?: string;
     now: Date;
+    quotaState?: QuotaState;
 }): HostCapacitySnapshot;
 /** Reject malformed remote snapshots before they can influence host selection. */
 export declare function parseHostCapacitySnapshot(raw: unknown): HostCapacitySnapshot;

package/dist/lib/lanes/host-capacity.js

@@ -2,6 +2,7 @@ import { accountStatus } from "./accounts.js";
 import { accountMaxRunning } from "./config.js";
 import { laneOccupiesRunningSlot, laneRunsOnHost, } from "./admission.js";
 import { LanesError } from "./errors.js";
+import { quotaBlockFor } from "./quota.js";
 function admissionHost(host) {
     return host.kind === "outpost"
         ? { hostname: "", outpostId: host.id }
@@ -33,6 +34,10 @@ export function buildHostCapacitySnapshot(input) {
             });
             const accountLanes = providerLanes.filter((lane) => lane.account === id);
             const liveLanes = accountLanes.filter((lane) => lane.state === "running" || lane.state === "queued" || lane.state === "awaiting_input");
+            const quotaBlock = input.quotaState
+                ? quotaBlockFor(input.quotaState, provider, id, undefined, input.now)
+                : undefined;
+            const quotaResetAt = input.quotaState?.providers[provider]?.[id]?.all_models_quota_reset_at;
             accounts[id] = {
                 enabled: account.enabled,
                 logged_in: status.logged_in,
@@ -40,6 +45,12 @@ export function buildHostCapacitySnapshot(input) {
                 max_running: accountMaxRunning(providerConfig, id),
                 running: running.filter((lane) => lane.account === id).length,
                 queued: queued.filter((lane) => lane.account === id).length,
+                ...(quotaBlock !== undefined
+                    ? {
+                        quota_held: quotaBlock.blocked,
+                        ...(quotaResetAt ? { quota_reset_at: quotaResetAt } : {}),
+                    }
+                    : {}),
                 lane_counts: {
                     running: liveLanes.filter((lane) => lane.state === "running").length,
                     queued: liveLanes.filter((lane) => lane.state === "queued").length,
@@ -108,6 +119,9 @@ export function parseHostCapacitySnapshot(raw) {
             if (id.trim() === "" || account === undefined ||
                 typeof account.enabled !== "boolean" ||
                 !(account.logged_in === null || typeof account.logged_in === "boolean") ||
+                (account.quota_held !== undefined && typeof account.quota_held !== "boolean") ||
+                (account.quota_reset_at !== undefined &&
+                    (typeof account.quota_reset_at !== "string" || !Number.isFinite(Date.parse(account.quota_reset_at)))) ||
                 (account.auth_state !== undefined &&
                     !["file", "status", "absent", "unknown", "home_missing"].includes(account.auth_state))) {
                 throw new LanesError("host_capacity_invalid", `Malformed ${provider} account capacity`, {
@@ -124,6 +138,10 @@ export function parseHostCapacitySnapshot(raw) {
                 max_running: requireCount(account.max_running, `${provider}.${id}.max_running`, true),
                 running: requireCount(account.running, `${provider}.${id}.running`),
                 queued: requireCount(account.queued, `${provider}.${id}.queued`),
+                ...(account.quota_held !== undefined ? { quota_held: account.quota_held } : {}),
+                ...(account.quota_reset_at !== undefined
+                    ? { quota_reset_at: account.quota_reset_at }
+                    : {}),
                 ...(account.lane_counts !== undefined
                     ? { lane_counts: parseLaneCounts(account.lane_counts, `${provider}.${id}.lane_counts`) }
                     : {}),

package/dist/lib/lanes/index.d.ts

@@ -3,7 +3,7 @@
  */
 export { AccountResolutionError, LaneNotFoundError, LaneSchemaError, LaneVersionConflict, LanesConfigError, LanesError, WorkerResolutionError, isLaneVersionConflict, isLanesError, } from "./errors.js";
 export { MAX_LANE_DEPTH } from "./constants.js";
-export { assignedChildHireGrants, aliveDirectChildren, isFinishedResumableHireChild, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, } from "./grants.js";
+export { assignedChildHireGrants, aliveDirectChildren, childrenHoldingHireGrantCarve, isFinishedResumableHireChild, laneHoldsHireGrantCarve, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, } from "./grants.js";
 export type { HireGrantBackfillRow } from "./grants.js";
 export { compareLaneQueueOrder, hasActiveAdmissionReservation, hasActivePendingResume, hasEarlierEligibleQueuedLane, laneOccupiesRunningSlot, laneAdmissionCapReason, laneRunsOnHost, withAllLaneAdmissionLocks, withLaneAdmissionLock, } from "./admission.js";
 export type { AdmissionCapReason, AdmissionHost } from "./admission.js";

package/dist/lib/lanes/index.js

@@ -3,7 +3,7 @@
  */
 export { AccountResolutionError, LaneNotFoundError, LaneSchemaError, LaneVersionConflict, LanesConfigError, LanesError, WorkerResolutionError, isLaneVersionConflict, isLanesError, } from "./errors.js";
 export { MAX_LANE_DEPTH } from "./constants.js";
-export { assignedChildHireGrants, aliveDirectChildren, isFinishedResumableHireChild, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, } from "./grants.js";
+export { assignedChildHireGrants, aliveDirectChildren, childrenHoldingHireGrantCarve, isFinishedResumableHireChild, laneHoldsHireGrantCarve, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, } from "./grants.js";
 export { compareLaneQueueOrder, hasActiveAdmissionReservation, hasActivePendingResume, hasEarlierEligibleQueuedLane, laneOccupiesRunningSlot, laneAdmissionCapReason, laneRunsOnHost, withAllLaneAdmissionLocks, withLaneAdmissionLock, } from "./admission.js";
 export { buildHostCapacitySnapshot, chooseHostForLane, parseHostCapacitySnapshot, } from "./host-capacity.js";
 export { CONFIG_SCHEMA_VERSION, ENVELOPE_DECISIONS, ENVELOPE_SCHEMA_VERSION, HISTORY_CAP, HOST_KINDS, LANE_PROVIDERS, LANE_SCHEMA_VERSION, LANE_STORY_STATUSES, LANE_STATES, LIVENESS_STATES, QUESTION_BODY_STORES, QUESTION_SCHEMA_VERSION, QUESTION_STATUSES, QUEUED_REASONS, RAISED_VIA, ROUTING_REASONS, SENIOR_KINDS, STORY_STATUSES, TERMINAL_LANE_STATES, isEnvelopeDecision, isHostKind, isLaneProvider, isLaneState, isLivenessState, isQuestionStatus, isSeniorKind, isTerminalLaneState, parseLaneEnvelope, parseLaneProvider, parseLaneState, parseLivenessState, parseMajorSchema, parseQuestionStatus, parseSeniorKind, } from "./types.js";

package/dist/lib/lanes/provider-rejection.d.ts

@@ -36,6 +36,8 @@ export interface ProviderRejection {
     retryable: boolean;
     /** Which event on the stream carried the failure. */
     event: "codex.turn.failed" | "claude.result.is_error" | "claude.result.login_failure" | "grok.error";
+    /** Filesystem time when the provider output was appended, when read from worker.out. */
+    output_at?: string;
 }
 export declare function isProviderLoginFailure(failure: ProviderRejection | null): boolean;
 /**

package/dist/lib/lanes/provider-rejection.js

@@ -271,9 +271,21 @@ export function parseProviderRejection(provider, text) {
 export function readProviderRejection(runDir, provider, workerOutOffset = 0) {
     const outPath = path.join(runDir, "logs", "worker.out");
     let text;
+    let outputAt;
     try {
         const bytes = fs.readFileSync(outPath);
         text = bytes.subarray(Math.min(workerOutOffset, bytes.length)).toString("utf8");
+        const outputMtime = fs.statSync(outPath).mtime;
+        let spawnMtime;
+        try {
+            spawnMtime = fs.statSync(path.join(runDir, "spawn.json")).mtime;
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+        if (!spawnMtime || outputMtime >= spawnMtime)
+            outputAt = outputMtime.toISOString();
     }
     catch (err) {
         const code = err.code;
@@ -281,6 +293,9 @@ export function readProviderRejection(runDir, provider, workerOutOffset = 0) {
             return null;
         throw err;
     }
-    return parseProviderRejection(provider, text);
+    const failure = parseProviderRejection(provider, text);
+    return failure
+        ? { ...failure, ...(outputAt ? { output_at: outputAt } : {}) }
+        : null;
 }
 //# sourceMappingURL=provider-rejection.js.map

package/dist/lib/lanes/quota.d.ts

@@ -26,13 +26,13 @@ export interface ModelQuota {
     /** Operator-facing marker, e.g. "needs credits for claude-fable-5-1". */
     marker?: string;
 }
-export type QuotaResetSource = "provider" | "default_hold";
+export type QuotaResetSource = "parsed" | "derived";
 export interface AccountQuota {
     /** Set when the 429 is an account-wide usage limit with a reset time. */
     all_models_quota_reset_at?: string;
     /**
-     * Where `all_models_quota_reset_at` came from: the provider's own message,
-     * or the configured default hold applied to a 429 that named no reset.
+     * Whether `all_models_quota_reset_at` came from a parsed provider reset or
+     * the configured default hold applied to a 429 with no parseable reset.
      */
     reset_source?: QuotaResetSource;
     models: Record<string, ModelQuota>;
@@ -57,8 +57,8 @@ export interface QuotaSignal {
  * otherwise record no hold at all, and the next lane on the account would
  * hit the same 429. Give such a signal the provider's configured default
  * hold (`quota_default_hold_ms`, fifteen minutes unless set) as its reset,
- * marked `default_hold`; a signal that already carries a reset keeps it,
- * marked `provider`. A per-model credits refusal is untouched.
+ * marked `derived`; a signal that already carries a reset keeps it, marked
+ * `parsed`. A per-model credits refusal is untouched.
  */
 export declare function applyDefaultQuotaHold(signal: QuotaSignal, defaultHoldMs: number, now: Date): QuotaSignal;
 export declare function quotaStatePath(hqRoot: string): string;

package/dist/lib/lanes/quota.js

@@ -27,19 +27,19 @@ export const QUOTA_SCHEMA_VERSION = "hq-lanes-quota.v1";
  * otherwise record no hold at all, and the next lane on the account would
  * hit the same 429. Give such a signal the provider's configured default
  * hold (`quota_default_hold_ms`, fifteen minutes unless set) as its reset,
- * marked `default_hold`; a signal that already carries a reset keeps it,
- * marked `provider`. A per-model credits refusal is untouched.
+ * marked `derived`; a signal that already carries a reset keeps it, marked
+ * `parsed`. A per-model credits refusal is untouched.
  */
 export function applyDefaultQuotaHold(signal, defaultHoldMs, now) {
     if (signal.reason !== "account_quota_exhausted" || signal.needs_credits)
         return signal;
     if (signal.quota_reset_at)
-        return { ...signal, reset_source: "provider" };
+        return { ...signal, reset_source: "parsed" };
     return {
         ...signal,
         quota_reset_at: new Date(now.getTime() + defaultHoldMs).toISOString(),
         account_wide: true,
-        reset_source: "default_hold",
+        reset_source: "derived",
     };
 }
 const MONTHS = {
@@ -119,8 +119,13 @@ export function loadQuotaState(hqRoot) {
             if (typeof raw.all_models_quota_reset_at === "string" &&
                 raw.all_models_quota_reset_at.length > 0) {
                 account.all_models_quota_reset_at = raw.all_models_quota_reset_at;
-                if (raw.reset_source === "provider" || raw.reset_source === "default_hold") {
-                    account.reset_source = raw.reset_source;
+                // Normalize values written by older CLI versions while preserving the
+                // distinction between provider-parsed and configured fallback times.
+                if (raw.reset_source === "provider" || raw.reset_source === "parsed") {
+                    account.reset_source = "parsed";
+                }
+                else if (raw.reset_source === "default_hold" || raw.reset_source === "derived") {
+                    account.reset_source = "derived";
                 }
             }
             accounts[id] = account;
@@ -145,6 +150,22 @@ function writeQuotaState(hqRoot, state) {
  * An explicit provider year is kept as stated.
  */
 export function parseProviderResetTime(text, now) {
+    const timeOnlyMatch = /\bresets\s+(\d{1,2})(?::(\d{2}))?\s*(am|pm)\s*\(UTC\)/i.exec(text);
+    if (timeOnlyMatch) {
+        let hour = Number(timeOnlyMatch[1]);
+        const minute = Number(timeOnlyMatch[2] ?? 0);
+        const meridiem = (timeOnlyMatch[3] ?? "").toLowerCase();
+        if (!Number.isInteger(hour) || hour < 1 || hour > 12 || minute < 0 || minute > 59)
+            return null;
+        if (meridiem === "pm" && hour < 12)
+            hour += 12;
+        if (meridiem === "am" && hour === 12)
+            hour = 0;
+        const candidate = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), hour, minute, 0, 0));
+        if (candidate.getTime() <= now.getTime())
+            candidate.setUTCDate(candidate.getUTCDate() + 1);
+        return candidate.toISOString();
+    }
     const resetMatch = /\bresets\s+([A-Za-z]+)\s+(\d{1,2})(?:st|nd|rd|th)?(?:,\s*(?:(\d{4})\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm))?(?:\s*\((UTC)\))?/i.exec(text);
     const codexMatch = /\btry\s+again\s+at\s+([A-Za-z]+)\s+(\d{1,2})(?:st|nd|rd|th)?,\s*(\d{4})\s+(\d{1,2})(?::(\d{2}))?\s*(am|pm)(?:\s*\((UTC)\))?/i.exec(text);
     const match = resetMatch ?? codexMatch;
@@ -263,9 +284,23 @@ export function quotaSignalFromFields(fields, model, now) {
 export function readQuotaSignal(runDir, model, now, workerOutOffset = 0) {
     const outPath = path.join(runDir, "logs", "worker.out");
     let text;
+    let outputAt;
     try {
         const bytes = fs.readFileSync(outPath);
         text = bytes.subarray(Math.min(workerOutOffset, bytes.length)).toString("utf8");
+        // worker.out is appended as provider output arrives. Its mtime anchors a
+        // time-only reset to the output event, not to a later reconcile pass.
+        outputAt = fs.statSync(outPath).mtime;
+        let spawnAt;
+        try {
+            spawnAt = fs.statSync(path.join(runDir, "spawn.json")).mtime;
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+        if (outputAt > now || (spawnAt && outputAt < spawnAt))
+            outputAt = now;
     }
     catch (err) {
         const code = err.code;
@@ -276,7 +311,8 @@ export function readQuotaSignal(runDir, model, now, workerOutOffset = 0) {
     const fields = quotaFieldsFromOutput(text);
     if (!fields)
         return null;
-    return quotaSignalFromFields(fields, model, now);
+    const observedAt = Number.isFinite(outputAt.getTime()) ? outputAt : now;
+    return quotaSignalFromFields(fields, model, observedAt);
 }
 export function recordAccountQuota(hqRoot, provider, accountId, signal) {
     return withLaneRecordFileLock(quotaStatePath(hqRoot), () => {
@@ -303,11 +339,11 @@ export function recordAccountQuota(hqRoot, provider, accountId, signal) {
         if (signal.account_wide && signal.quota_reset_at) {
             if (shouldReplaceReset(current.all_models_quota_reset_at, signal.quota_reset_at)) {
                 account.all_models_quota_reset_at = signal.quota_reset_at;
-                account.reset_source = signal.reset_source ?? "provider";
+                account.reset_source = signal.reset_source ?? "parsed";
             }
             else if (current.all_models_quota_reset_at) {
                 account.all_models_quota_reset_at = current.all_models_quota_reset_at;
-                account.reset_source = current.reset_source ?? "provider";
+                account.reset_source = current.reset_source ?? "parsed";
             }
         }
         accounts[accountId] = account;

package/dist/lib/lanes/spawn.d.ts

@@ -19,7 +19,7 @@ import { type LaneCompanyRef, type LaneProvider, type LaneRecord, type AccountHi
 export declare const LANES_RUNS_REL: string;
 /** Written by reconcile before a resume spawn; the worker prompt names this path. */
 export declare const ANSWERED_QUESTIONS_FILE = "answered-questions.json";
-export declare const SPAWN_TERMINAL_REASONS: readonly ["account_not_logged_in", "unknown_account", "account_disabled", "no_enabled_account", "spawn_failed", "not_detached", "watcher_not_armed", "model_unsupported"];
+export declare const SPAWN_TERMINAL_REASONS: readonly ["account_not_logged_in", "unknown_account", "account_disabled", "no_enabled_account", "spawn_failed", "not_detached", "watcher_not_armed", "model_unsupported", "account_quota_exhausted"];
 export type SpawnTerminalReason = (typeof SPAWN_TERMINAL_REASONS)[number];
 declare const PROVIDER_COMMAND: Record<LaneProvider, string>;
 export declare function providerCommandOnPath(command: string, pathEnv: string | undefined): boolean;

package/dist/lib/lanes/spawn.js

@@ -50,6 +50,7 @@ export const SPAWN_TERMINAL_REASONS = [
     "not_detached",
     "watcher_not_armed",
     "model_unsupported",
+    "account_quota_exhausted",
 ];
 const PROVIDER_COMMAND = {
     claude: "claude",

package/dist/lib/lanes/watcher.d.ts

@@ -108,18 +108,6 @@ export declare function classifyLaneExit(input: {
      */
     providerRejection?: ProviderRejection | null;
 }): TerminalClassification;
-/**
- * One decision for an exited worker's output. An explicit provider status
- * wins over the quota text heuristics: a 429 from any provider (including
- * codex `turn.failed` and grok error objects, which the claude-shaped quota
- * reader never sees) becomes a quota signal; any other explicit status is a
- * rejection even when its text sounds like a quota message (a 402 "requires
- * usage credits" is a rejection, not a hold). A failure with no status at
- * all is matched against the quota text heuristics first: a status-less
- * "usage limit" / "rate limit" turn.failed still creates the account hold;
- * any other status-less message is a rejection. Only when the stream
- * carries no failure object does the quota reader's own read apply.
- */
 export declare function routeProviderFailure(failure: ProviderRejection | null, readQuota: () => QuotaSignal | null, model: string | undefined, now: Date): {
     quota: QuotaSignal | null;
     rejection: ProviderRejection | null;

package/dist/lib/lanes/watcher.js

@@ -139,15 +139,21 @@ export function classifyLaneExit(input) {
  * any other status-less message is a rejection. Only when the stream
  * carries no failure object does the quota reader's own read apply.
  */
+function validFailureOutputTime(value, fallback) {
+    const parsed = new Date(value);
+    return Number.isFinite(parsed.getTime()) && parsed.getTime() <= fallback.getTime()
+        ? parsed
+        : fallback;
+}
 export function routeProviderFailure(failure, readQuota, model, now) {
     if (failure && failure.status === QUOTA_STATUS) {
         return {
-            quota: quotaSignalFromFields({ api_error_status: QUOTA_STATUS, is_error: true, result: failure.message }, model, now),
+            quota: quotaSignalFromFields({ api_error_status: QUOTA_STATUS, is_error: true, result: failure.message }, model, failure.output_at ? validFailureOutputTime(failure.output_at, now) : now),
             rejection: null,
         };
     }
     if (failure && failure.status === null) {
-        const quota = quotaSignalFromFields({ api_error_status: undefined, is_error: true, result: failure.message }, model, now);
+        const quota = quotaSignalFromFields({ api_error_status: undefined, is_error: true, result: failure.message }, model, failure.output_at ? validFailureOutputTime(failure.output_at, now) : now);
         if (quota)
             return { quota, rejection: null };
     }

package/dist/utils/safe-caught-error.d.ts

@@ -0,0 +1,3 @@
+/** Render an unknown rejection safely for a concise diagnostic log. */
+export declare function safeCaughtError(error: unknown): string;
+//# sourceMappingURL=safe-caught-error.d.ts.map

package/dist/utils/safe-caught-error.js

@@ -0,0 +1,16 @@
+import { redactErrorText } from "./redact-error-text.js";
+/** Render an unknown rejection safely for a concise diagnostic log. */
+export function safeCaughtError(error) {
+    const rawName = error instanceof Error ? error.name : "UnknownError";
+    // A writable `name` can carry arbitrary text, so only class-shaped names are logged.
+    const name = /^[A-Za-z]{1,64}(?:Error|Exception)$/.test(rawName) ? rawName : "Error";
+    const rawMessage = error instanceof Error ? error.message : "non-Error rejection";
+    const message = redactErrorText(rawMessage)
+        .replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s"<>]+/gi, "[URL]")
+        .replace(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "[EMAIL]")
+        .replace(/\b(?:agt|cmp|prs|prj|session|sess|usr|user|acct|fin|st|e)_[A-Za-z0-9_-]+\b/gi, "[ID]")
+        .replace(/\b[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\b/gi, "[ID]")
+        .slice(0, 160);
+    return `${name}: ${message || "[empty]"}`;
+}
+//# sourceMappingURL=safe-caught-error.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.20",
+  "version": "5.345.22",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {