@indigoai-us/hq-cli 5.345.38 → 5.345.39

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.345.39] — 2026-10-07
+- Cap each `hq doctor --fix` invocation at two company journal refreshes and persist a rotating cursor so pending journals continue on later runs.
+- Add `hq db destroy --company <slug> --app <app>` to permanently delete an app's remote database. It requires typing the app id (or `--confirm <app>` when not interactive), offers `hq db dump` first (`--dump-first` / `--no-dump`), and only company owners and admins can run it.
+- Lane story ledger sync now clears resolved sync errors and reads the company's cached feature gate before registry startup finishes.
+- Keep quota-limited keep-alive resumes recoverable, preserve operator-triggered work while waiting for reset, and retry when an eligible account is available.
+- Allow terminal worker lanes to be reparented to a live senior in the same company, while refusing running workers.
+- Add request timeouts to native DM, file download, report deployment, and deploy API requests.
+
 ## [5.345.38] — 2026-10-07
 - Windows CI parity suites now derive their shell-subprocess time budget from a warm-up measured on the same runner instead of a fixed 7-second deadline.
 

package/dist/command-catalog.generated.d.ts

@@ -2050,6 +2050,49 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "destroy";
+        readonly description: "Permanently delete an app's remote database (owners and admins only; cannot be undone)";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [{
+            readonly position: "after";
+            readonly text: "\nThis deletes the app's database immediately. It cannot be undone.\nInteractive: you are asked to type the app id and whether to dump first.\nNon-interactive: pass --confirm <app> and either --dump-first or --no-dump.\nExample: hq db destroy --company acme --app todo --confirm todo --dump-first";
+        }];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--company <slug>";
+            readonly description: "Company slug";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--app <app>";
+            readonly description: "App id";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--confirm <app>";
+            readonly description: "Type the app id again to confirm (required when not interactive)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--yes";
+            readonly description: "Skip the dump question; the app id confirmation is still required";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--dump-first";
+            readonly description: "Run hq db dump before destroying (non-interactive)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--no-dump";
+            readonly description: "Do not dump before destroying (non-interactive)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--out <file>";
+            readonly description: "Dump output file (default: <app>.sql)";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }];
 }, {
     readonly name: "api-keys";

package/dist/command-catalog.generated.js

@@ -2459,6 +2459,60 @@ export const COMMAND_CATALOG = [
                     }
                 ],
                 "subcommands": []
+            },
+            {
+                "name": "destroy",
+                "description": "Permanently delete an app's remote database (owners and admins only; cannot be undone)",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [
+                    {
+                        "position": "after",
+                        "text": "\nThis deletes the app's database immediately. It cannot be undone.\nInteractive: you are asked to type the app id and whether to dump first.\nNon-interactive: pass --confirm <app> and either --dump-first or --no-dump.\nExample: hq db destroy --company acme --app todo --confirm todo --dump-first"
+                    }
+                ],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--company <slug>",
+                        "description": "Company slug",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--app <app>",
+                        "description": "App id",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--confirm <app>",
+                        "description": "Type the app id again to confirm (required when not interactive)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--yes",
+                        "description": "Skip the dump question; the app id confirmation is still required",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--dump-first",
+                        "description": "Run hq db dump before destroying (non-interactive)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--no-dump",
+                        "description": "Do not dump before destroying (non-interactive)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--out <file>",
+                        "description": "Dump output file (default: <app>.sql)",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
             }
         ]
     },

package/dist/commands/core-dm-bind-native.js

@@ -51,6 +51,7 @@ export const createDmBindDeps = (root, cwd, env, now, home = env.HOME || os.home
     }),
     sleep: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
 });
+const DM_BIND_API_TIMEOUT_MS = 15_000;
 const fail = (message, code = 2) => utilityError(`hq-dm-bind: ${message}`, code);
 const sessionDirectory = (d, sid) => path.join(d.root, "workspace/sessions", sid);
 const filePath = (d, sid, name) => path.join(sessionDirectory(d, sid), name);
@@ -192,13 +193,13 @@ async function fetchRoster(d, ch) {
         const config = JSON.parse(d.fs.readFileSync(path.join(d.home, ".hq/config.json"), "utf8"));
         const token = JSON.parse(d.fs.readFileSync(path.join(d.home, ".hq/cognito-tokens.json"), "utf8")).idToken;
         const headers = { Authorization: `Bearer ${token}` };
-        const response = await d.fetch(`${config.vaultApiUrl}/v1/notify/channels`, { headers });
+        const response = await d.fetch(`${config.vaultApiUrl}/v1/notify/channels`, { headers, signal: AbortSignal.timeout(DM_BIND_API_TIMEOUT_MS) });
         const channels = await response.json();
         const rows = Array.isArray(channels) ? channels : channels.channels ?? [];
         const hit = rows.find((entry) => entry.channelId === ch || slug(entry.name) === slug(ch) || entry.slug === slug(ch));
         if (!hit?.channelId)
             return { stdout: "", stderr: "" };
-        const membersResponse = await d.fetch(`${config.vaultApiUrl}/v1/notify/channels/${encodeURIComponent(String(hit.channelId))}/members`, { headers });
+        const membersResponse = await d.fetch(`${config.vaultApiUrl}/v1/notify/channels/${encodeURIComponent(String(hit.channelId))}/members`, { headers, signal: AbortSignal.timeout(DM_BIND_API_TIMEOUT_MS) });
         const members = await membersResponse.json();
         const list = Array.isArray(members) ? members : members.members ?? [];
         const lines = list.flatMap((member) => {
@@ -331,14 +332,14 @@ async function sendHuman(d, ch, payload) {
     const config = JSON.parse(d.fs.readFileSync(path.join(d.home, ".hq/config.json"), "utf8"));
     const token = JSON.parse(d.fs.readFileSync(path.join(d.home, ".hq/cognito-tokens.json"), "utf8")).idToken;
     const headers = { Authorization: `Bearer ${token}`, "Content-Type": "application/json" };
-    const channelsResponse = await d.fetch(`${config.vaultApiUrl}/v1/notify/channels`, { headers });
+    const channelsResponse = await d.fetch(`${config.vaultApiUrl}/v1/notify/channels`, { headers, signal: AbortSignal.timeout(DM_BIND_API_TIMEOUT_MS) });
     const channels = await channelsResponse.json();
     const rows = Array.isArray(channels) ? channels : channels.channels ?? [];
     const hit = rows.find((entry) => entry.channelId === ch || slug(entry.name) === slug(ch) || entry.slug === slug(ch));
     if (!hit?.channelId)
         throw new Error(`channel not found: ${ch}`);
     const response = await d.fetch(`${config.vaultApiUrl}/v1/notify/channels/${encodeURIComponent(String(hit.channelId))}/messages`, {
-        method: "POST", headers, body: JSON.stringify(payload),
+        method: "POST", headers, body: JSON.stringify(payload), signal: AbortSignal.timeout(DM_BIND_API_TIMEOUT_MS),
     });
     const text = await response.text();
     if (!response.ok)

package/dist/commands/db-destroy.d.ts

@@ -0,0 +1,15 @@
+/**
+ * hq db destroy — permanently delete one app's remote database.
+ */
+import { Command } from "commander";
+import { type DbRemoteCommandDeps } from "./db-remote-deps.js";
+export type DestroyRoleCheck = "allowed" | "denied" | "unknown";
+export interface DbDestroyIo {
+    isInteractive: () => boolean;
+    ask: (question: string) => Promise<string>;
+    checkRole: (deps: DbRemoteCommandDeps, companyUid: string) => Promise<DestroyRoleCheck>;
+}
+export declare function defaultDestroyIo(): DbDestroyIo;
+export declare function describeDestroyError(error: unknown): string | null;
+export declare function registerDbDestroyCommand(db: Command, depsFactory?: () => DbRemoteCommandDeps, ioFactory?: () => DbDestroyIo): void;
+//# sourceMappingURL=db-destroy.d.ts.map

package/dist/commands/db-destroy.js

@@ -0,0 +1,143 @@
+/**
+ * hq db destroy — permanently delete one app's remote database.
+ */
+import chalk from "chalk";
+import * as readline from "node:readline";
+import { safeErrorMessage } from "../lib/db/redact.js";
+import { isPlanGateError } from "../utils/plan-gate-error.js";
+import { dumpAppDatabase, describeSessionGap } from "./db-dump.js";
+import { controlPlaneClient, defaultRemoteDeps, describeRemoteError, } from "./db-remote-deps.js";
+const NOT_ADMIN = "Only company owners and admins can destroy an app database.";
+async function defaultCheckRole(deps, companyUid) {
+    if (process.env.HQ_DB_MOCK_CONTROL_PLANE === "1")
+        return "unknown";
+    try {
+        const [{ listActiveMembers }, { resolveCallerPersonUid }] = await Promise.all([
+            import("./members.js"),
+            import("../utils/vault-api.js"),
+        ]);
+        const token = await deps.getAccessToken();
+        const [personUid, members] = await Promise.all([
+            resolveCallerPersonUid(token),
+            listActiveMembers(token, companyUid),
+        ]);
+        const me = members.find((m) => m.personUid === personUid);
+        if (!me)
+            return "unknown";
+        return me.role === "owner" || me.role === "admin" ? "allowed" : "denied";
+    }
+    catch {
+        return "unknown";
+    }
+}
+export function defaultDestroyIo() {
+    return {
+        isInteractive: () => Boolean(process.stdin.isTTY && process.stdout.isTTY),
+        ask: (question) => new Promise((resolve) => {
+            const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+            rl.question(question, (answer) => {
+                rl.close();
+                resolve(answer);
+            });
+        }),
+        checkRole: defaultCheckRole,
+    };
+}
+export function describeDestroyError(error) {
+    const status = error.status;
+    if (status === 403)
+        return NOT_ADMIN;
+    if (status === 404)
+        return "This app has no database attached, so there is nothing to destroy.";
+    return describeRemoteError(error);
+}
+function fail(message) {
+    console.error(chalk.red("Error:"), message);
+    process.exitCode = 1;
+}
+export function registerDbDestroyCommand(db, depsFactory = defaultRemoteDeps, ioFactory = defaultDestroyIo) {
+    db.command("destroy")
+        .description("Permanently delete an app's remote database (owners and admins only; cannot be undone)")
+        .requiredOption("--company <slug>", "Company slug")
+        .requiredOption("--app <app>", "App id")
+        .option("--confirm <app>", "Type the app id again to confirm (required when not interactive)")
+        .option("--yes", "Skip the dump question; the app id confirmation is still required")
+        .option("--dump-first", "Run hq db dump before destroying (non-interactive)")
+        .option("--no-dump", "Do not dump before destroying (non-interactive)")
+        .option("--out <file>", "Dump output file (default: <app>.sql)")
+        .addHelpText("after", "\nThis deletes the app's database immediately. It cannot be undone.\n" +
+        "Interactive: you are asked to type the app id and whether to dump first.\n" +
+        "Non-interactive: pass --confirm <app> and either --dump-first or --no-dump.\n" +
+        "Example: hq db destroy --company acme --app todo --confirm todo --dump-first")
+        .action(async (opts) => {
+        try {
+            const io = ioFactory();
+            const app = String(opts.app ?? "").trim();
+            const interactive = io.isInteractive();
+            const dumpFlagGiven = opts.dumpFirst === true || opts.dump === false;
+            if (opts.dumpFirst && opts.dump === false) {
+                fail("Use either --dump-first or --no-dump, not both.");
+                return;
+            }
+            const deps = depsFactory();
+            const resolved = await deps.resolveCompany(String(opts.company ?? "").trim());
+            if ((await io.checkRole(deps, resolved.companyUid)) === "denied") {
+                fail(NOT_ADMIN);
+                return;
+            }
+            console.error(chalk.yellow(`Warning: this deletes the database for app ${app} in ${resolved.companySlug} immediately. It cannot be undone.`));
+            let confirmed = opts.confirm;
+            if (confirmed === undefined) {
+                if (!interactive) {
+                    fail(`Confirmation required. Re-run with --confirm ${app}.`);
+                    return;
+                }
+                confirmed = await io.ask(`Type the app id (${app}) to confirm: `);
+            }
+            if (confirmed.trim() !== app) {
+                fail("The confirmation did not match the app id. Nothing was deleted.");
+                return;
+            }
+            let dumpFirst = opts.dumpFirst === true;
+            if (!dumpFlagGiven) {
+                if (interactive && !opts.yes) {
+                    const answer = (await io.ask(`Dump the database to ${opts.out ?? `${app}.sql`} first? [Y/n] `))
+                        .trim()
+                        .toLowerCase();
+                    dumpFirst = answer === "" || answer === "y" || answer === "yes";
+                }
+                else {
+                    console.error("No dump was taken. Pass --dump-first to save a copy before destroying.");
+                }
+            }
+            if (dumpFirst) {
+                try {
+                    const summary = await dumpAppDatabase(deps, {
+                        companyUid: resolved.companyUid,
+                        appId: app,
+                        out: opts.out,
+                    });
+                    console.log(`Wrote ${summary.tables} table(s) and ${summary.rows} row(s) to ${summary.outPath}.`);
+                }
+                catch (error) {
+                    if (isPlanGateError(error))
+                        throw error;
+                    fail(`The dump failed, so the database was not destroyed. ${describeSessionGap(error) ?? describeRemoteError(error) ?? safeErrorMessage(error)}`);
+                    return;
+                }
+            }
+            const result = await controlPlaneClient(deps).destroyApp({
+                companyUid: resolved.companyUid,
+                appId: app,
+            });
+            const what = result.mode === "schema" ? "schema and roles dropped" : "database cluster deleted";
+            console.log(`Destroyed the database for app ${app}: ${what}.`);
+        }
+        catch (error) {
+            if (isPlanGateError(error))
+                throw error;
+            fail(describeDestroyError(error) ?? safeErrorMessage(error));
+        }
+    });
+}
+//# sourceMappingURL=db-destroy.js.map

package/dist/commands/db-dump.d.ts

@@ -4,5 +4,14 @@
 import { Command } from "commander";
 import { type DbRemoteCommandDeps } from "./db-remote-deps.js";
 export declare function describeSessionGap(error: unknown): string | null;
+export declare function dumpAppDatabase(deps: DbRemoteCommandDeps, input: {
+    companyUid: string;
+    appId: string;
+    out?: string;
+}): Promise<{
+    tables: number;
+    rows: number;
+    outPath: string;
+}>;
 export declare function registerDbDumpCommand(db: Command, depsFactory?: () => DbRemoteCommandDeps): void;
 //# sourceMappingURL=db-dump.d.ts.map

package/dist/commands/db-dump.js

@@ -14,6 +14,22 @@ export function describeSessionGap(error) {
     }
     return null;
 }
+export async function dumpAppDatabase(deps, input) {
+    const conn = await openRemoteAppConnection(remoteEngineDeps(deps), {
+        companyUid: input.companyUid,
+        appId: input.appId,
+    });
+    const outPath = input.out ?? `${input.appId}.sql`;
+    const fd = fs.openSync(outPath, "w");
+    try {
+        const summary = await dumpRemoteSchema(conn, (text) => fs.writeSync(fd, text));
+        return { tables: summary.tables, rows: summary.rows, outPath };
+    }
+    finally {
+        fs.closeSync(fd);
+        await conn.close();
+    }
+}
 export function registerDbDumpCommand(db, depsFactory = defaultRemoteDeps) {
     db.command("dump")
         .description("Export an app's remote database schema and data to a SQL file")
@@ -24,20 +40,12 @@ export function registerDbDumpCommand(db, depsFactory = defaultRemoteDeps) {
         try {
             const deps = depsFactory();
             const resolved = await deps.resolveCompany(String(opts.company ?? "").trim());
-            const conn = await openRemoteAppConnection(remoteEngineDeps(deps), {
+            const summary = await dumpAppDatabase(deps, {
                 companyUid: resolved.companyUid,
                 appId: opts.app,
+                out: opts.out,
             });
-            const outPath = opts.out ?? `${opts.app}.sql`;
-            const fd = fs.openSync(outPath, "w");
-            try {
-                const summary = await dumpRemoteSchema(conn, (text) => fs.writeSync(fd, text));
-                console.log(`Wrote ${summary.tables} table(s) and ${summary.rows} row(s) to ${outPath}.`);
-            }
-            finally {
-                fs.closeSync(fd);
-                await conn.close();
-            }
+            console.log(`Wrote ${summary.tables} table(s) and ${summary.rows} row(s) to ${summary.outPath}.`);
         }
         catch (error) {
             if (isPlanGateError(error))

package/dist/commands/db.js

@@ -1,6 +1,7 @@
 /**
  * hq db — vault database commands (local + remote tiers).
  */
+import { registerDbDestroyCommand } from "./db-destroy.js";
 import { registerDbDumpCommand } from "./db-dump.js";
 import { registerDbMigrateCommand } from "./db-migrate.js";
 import { registerDbProvisionCommand } from "./db-provision.js";
@@ -20,5 +21,6 @@ export function registerDbCommand(program) {
     registerDbProvisionCommand(db);
     registerDbUsageCommand(db);
     registerDbDumpCommand(db);
+    registerDbDestroyCommand(db);
 }
 //# sourceMappingURL=db.js.map

package/dist/commands/files-browse.js

@@ -778,7 +778,7 @@ export function createCompanyPresignClient(input) {
             }
             throw new Error(message);
         }
-        const dl = await fetch(first.url);
+        const dl = await fetch(first.url, { signal: AbortSignal.timeout(120_000) });
         if (!dl.ok) {
             throw new Error(`Failed to download '${key}' (HTTP ${dl.status})`);
         }

package/dist/commands/lanes-message.js

@@ -426,7 +426,7 @@ export function createLaneMessageHandlers(deps) {
                 // This invocation won the race to classify the dead worker, so the
                 // watcher callback did not own recovery. Fold any earlier queued
                 // messages into this resume to keep one provider turn and one delivery.
-                if (laneDeliveryMechanism(lane) === "resume" && dropboxInboxHasMessages(hqRoot, laneId)) {
+                if (laneDeliveryMechanism(lane, { forMessage: true }) === "resume" && dropboxInboxHasMessages(hqRoot, laneId)) {
                     const queuedMessages = drainDropbox(hqRoot, laneId);
                     if (queuedMessages.length > 0) {
                         claimedMessages = queuedMessages;
@@ -496,7 +496,7 @@ export function createLaneMessageHandlers(deps) {
             const awaitingInputFallback = lane.state === "awaiting_input";
             // One decision point for how a follow-up reaches this lane (delivery.ts).
             // `none` refuses before anything is written: no inbox append, no spawn.
-            const mechanism = laneDeliveryMechanism(lane);
+            const mechanism = laneDeliveryMechanism(lane, { forMessage: true });
             if (mechanism === "none") {
                 const message = deliveryRefusalReason(lane);
                 throw new LanesError("lane_not_accepting_messages", message, {
@@ -542,8 +542,10 @@ export function createLaneMessageHandlers(deps) {
                         .map((reason) => reason.quota_reset_at)
                         .filter((value) => typeof value === "string" && Number.isFinite(Date.parse(value)))
                         .sort((a, b) => Date.parse(a) - Date.parse(b));
+                    if (resetTimes.length === 0)
+                        throw err;
                     quotaHoldDeferred = {
-                        ...(resetTimes[0] !== undefined ? { quota_reset_at: resetTimes[0] } : {}),
+                        quota_reset_at: resetTimes[0],
                         ...(lane.model !== undefined ? { model: lane.model } : {}),
                     };
                     automaticAccountSelection = undefined;
@@ -674,6 +676,13 @@ export function createLaneMessageHandlers(deps) {
                         queued_details: undefined,
                         queued_at: at,
                         admission_reserved_at: undefined,
+                        ...(quotaHoldDeferred?.quota_reset_at !== undefined ? {
+                            quota_reset_at: quotaHoldDeferred.quota_reset_at,
+                            keep_alive_next_eligible_at: quotaHoldDeferred.quota_reset_at,
+                            keep_alive_resume_count: 0,
+                            keep_alive_last_resume_at: undefined,
+                            keep_alive_exhausted_at: undefined,
+                        } : {}),
                         pending_resume: {
                             session_id: sessionId,
                             trigger: "message",
@@ -925,7 +934,7 @@ export function createLaneMessageHandlers(deps) {
             }
             // Every accepted message moves the compaction reference forward.
             const next = casUpdateLane(hqRoot, laneId, (current) => ({
-                ...resetKeepAliveProgress(current),
+                ...(queuedOnQuotaHold ? current : resetKeepAliveProgress(current)),
                 last_message_at: at,
             }));
             // What this command can claim when it returns: the message is durably
@@ -1050,7 +1059,7 @@ export function createLaneMessageHandlers(deps) {
             ? "done_before_envelope"
             : lane.state === "awaiting_input"
                 ? "awaiting_input_requires_question_answer"
-                : laneDeliveryMechanism(lane) !== "resume"
+                : laneDeliveryMechanism(lane, { forMessage: true }) !== "resume"
                     ? `no_resume_path_for_${lane.state}`
                     : undefined);
         if (refusal !== undefined) {

package/dist/commands/lanes-resume.js

@@ -1,12 +1,12 @@
 import { BALANCE_MOVABLE_STATES } from "../lib/lanes/claude-balance.js";
 import { LanesError } from "../lib/lanes/errors.js";
-import { appendCappedHistory, providerSessionPortable, providerSupportsSessionResume, readLane, resumeCommandRefusal, sessionNotPortableMessage, validateProjectStories, withLaneAdmissionLock } from "../lib/lanes/index.js";
+import { appendCappedHistory, isFailedQuotaKeepAliveLane, providerSessionPortable, providerSupportsSessionResume, readLane, resumeCommandRefusal, sessionNotPortableMessage, validateProjectStories, withLaneAdmissionLock } from "../lib/lanes/index.js";
 import { parseCliEffort } from "../lib/lanes/effort.js";
 import { parseOutpostHireGrantContext } from "../lib/lanes/hire-grant-dispatch.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { laneStories, laneStory, storyWarning } from "../lib/lanes/stories.js";
 import { artifactIdentityKeys, rollbackStorySwitchAttribution, storySwitchNotice } from "../lib/lanes/story-switch.js";
-import { spawnLaneWorker } from "../lib/lanes/spawn.js";
+import { markSpawnFailure, spawnLaneWorker } from "../lib/lanes/spawn.js";
 import { accountMoveSummary, accountRequestKeepsCurrentLane, assertCurrentResumeAccountAvailable, hasKeepAliveProgress, recordedResumeEffort, resetKeepAliveProgress, resolveResumeEffort } from "./lanes-shared.js";
 export function createLaneResumeHandlers(deps) {
     const { archiveResumeMessage, assertLaneRunsHereForAdmission, assertLaneRunsHereForOperatorMutation, assessLaneAdmission, automaticBalanceMoveHistoryReason, authorizeFailedResume, authorizeResumeProfileRepin, casUpdateLane, dispatchOutpostLaneCommand, laneIsHostedHere, laneWithRecoveredProviderSession, mintMessageId, persistClaudeAccountSelection, prepareAccountMove, printJson, recordResumeSetup, resolveResumeProfile, selectAutomaticClaudeResumeAccount, validateResumeProfileModel, withResumeHireAdmission } = deps;
@@ -219,7 +219,7 @@ export function createLaneResumeHandlers(deps) {
         }
         const refusal = queuedProfileRecovery || lane.state === "awaiting_input"
             ? null
-            : resumeCommandRefusal(lane, { allowFailed: opts.fromFailed === true });
+            : resumeCommandRefusal(lane, { allowFailed: opts.fromFailed === true || isFailedQuotaKeepAliveLane(lane) });
         if (refusal !== null) {
             throw new LanesError(refusal.error, refusal.message, {
                 lane_id: laneId,
@@ -284,12 +284,29 @@ export function createLaneResumeHandlers(deps) {
             });
             return;
         }
-        const automaticAccountSelection = opts.account === undefined
-            ? await selectAutomaticClaudeResumeAccount(ctx, lane, resumeProfile, {
-                repairUnavailableAccount: true,
-                ...(refreshProfileSettings ? { refreshProfileSettings: true } : {}),
-            })
-            : undefined;
+        let quotaHoldDeferred;
+        let automaticAccountSelection = undefined;
+        if (opts.account === undefined) {
+            try {
+                automaticAccountSelection = await selectAutomaticClaudeResumeAccount(ctx, lane, resumeProfile, {
+                    repairUnavailableAccount: true,
+                    ...(refreshProfileSettings ? { refreshProfileSettings: true } : {}),
+                });
+            }
+            catch (err) {
+                const reasons = err instanceof LanesError && err.error === "claude_account_balance_no_eligible_account" &&
+                    Array.isArray(err.details.account_reasons)
+                    ? err.details.account_reasons.filter((reason) => reason !== null && typeof reason === "object" && !Array.isArray(reason))
+                    : [];
+                const resets = reasons.filter((reason) => reason.reason === "quota_held")
+                    .map((reason) => reason.quota_reset_at)
+                    .filter((value) => typeof value === "string" && Number.isFinite(Date.parse(value)))
+                    .sort((a, b) => Date.parse(a) - Date.parse(b));
+                if (resets.length === 0)
+                    throw err;
+                quotaHoldDeferred = { quota_reset_at: resets[0], account_reasons: reasons };
+            }
+        }
         const profileRefreshAccount = opts.account === undefined && refreshProfileSettings && resumeProfile !== undefined &&
             lane.account_source !== undefined && lane.account_source !== "cli" &&
             resumeProfile.profile.meta.provider === lane.provider
@@ -451,8 +468,37 @@ export function createLaneResumeHandlers(deps) {
                     : {}),
             });
             let queuedOnAdmission = false;
+            let queuedOnQuotaHold = false;
             let resumed;
-            if (move?.queued) {
+            if (quotaHoldDeferred !== undefined) {
+                const sessionId = lane.provider_session_id;
+                if (!sessionId)
+                    throw new LanesError("no_provider_session", `Lane ${laneId} has no provider session id to queue this resume`, {
+                        lane_id: laneId,
+                        provider: lane.provider,
+                    });
+                const quotaHoldAt = new Date(Date.parse(at) + 1).toISOString();
+                const pendingResume = {
+                    session_id: sessionId,
+                    trigger: "resume",
+                    caller: ctx.env.HQ_LANE_ID?.trim() || "user",
+                    resumed_from: resumedFrom,
+                    ...(opts.fromFailed === true ? { from_failed: true } : {}),
+                    ...(failedResumeExpectedSenior !== undefined ? { expected_senior: failedResumeExpectedSenior } : {}),
+                    ...(deliveryText !== undefined ? { text: deliveryText } : {}),
+                    ...(messageId !== undefined ? { message_id: messageId } : {}),
+                    compact: opts.compact !== false,
+                    at: quotaHoldAt,
+                };
+                resumed = markSpawnFailure(hqRoot, laneId, "account_quota_exhausted", {
+                    provider: lane.provider,
+                    account: lane.account ?? null,
+                    quota_reset_at: quotaHoldDeferred.quota_reset_at,
+                    account_reasons: quotaHoldDeferred.account_reasons,
+                }, { resumeTrigger: "resume", pendingResume, at: quotaHoldAt });
+                queuedOnQuotaHold = true;
+            }
+            else if (move?.queued) {
                 resumed = lane;
             }
             else {
@@ -570,7 +616,7 @@ export function createLaneResumeHandlers(deps) {
             if (deliveryText !== undefined) {
                 // An operator text moves the compaction reference forward, as a message does.
                 next = casUpdateLane(hqRoot, laneId, (current) => ({
-                    ...resetKeepAliveProgress(current),
+                    ...(queuedOnQuotaHold ? current : resetKeepAliveProgress(current)),
                     last_message_at: at,
                 }));
             }
@@ -587,9 +633,11 @@ export function createLaneResumeHandlers(deps) {
                 delivery: "resume",
                 delivery_status: move?.queued
                     ? "queued_on_target_account"
-                    : queuedOnAdmission
-                        ? "queued_on_admission"
-                        : "worker_spawned",
+                    : queuedOnQuotaHold
+                        ? "queued_on_quota_hold"
+                        : queuedOnAdmission
+                            ? "queued_on_admission"
+                            : "worker_spawned",
                 account_move: move ? accountMoveSummary(move) : null,
                 resumed_session_id: resumed.last_resume?.session_id ?? null,
                 last_resume: next.last_resume ?? null,