@indigoai-us/hq-cli 5.345.47 → 5.345.49

package/dist/lib/daemon/flag.js

@@ -1,12 +1,13 @@
 /**
  * Feature flags read by the daemon. The daemon runs for weeks, so each read
  * asks the registry again instead of holding a per-process answer, and it
- * reads as off unless the registry itself says on (or a local override does).
+ * reads as each flag's fallback unless the registry or a local override decides it.
  */
 import { createFlagClient, readLocalOverride, } from "@indigoai-us/hq-flags-client";
 import { ensureCognitoIdToken } from "../../utils/cognito-session.js";
 import { resolveFlagRegistryEndpoint } from "../flag-registry-endpoint.js";
 import { resolveProcessFlagCompanyContext } from "../flag-registry.js";
+import { HQ_ANYWHERE_RUNTIME_FLAG, hqAnywhereRuntimeLocallyDisabled } from "../anywhere-runtime-flag-key.js";
 /** Outposts hand running services to the next daemon on a CLI update instead of restarting them all. */
 export const SUPERVISOR_HANDOFF_FLAG = "daemon.supervisor-handoff";
 /** Self-updates build the new CLI beside the running one and swap it in, so `hq` never disappears mid-update. */
@@ -14,6 +15,9 @@ export const STAGED_SELF_UPDATE_FLAG = "cli.staged-self-update";
 const READ_TIMEOUT_MS = 5_000;
 export async function readDaemonFlag(flagKey, options = {}) {
     const env = options.env ?? process.env;
+    if (flagKey === HQ_ANYWHERE_RUNTIME_FLAG && hqAnywhereRuntimeLocallyDisabled(env))
+        return false;
+    const fallback = flagKey === HQ_ANYWHERE_RUNTIME_FLAG;
     const override = readLocalOverride(flagKey, env);
     const localOverrideMode = options.localOverrideMode ?? "respect";
     if (override !== null && (localOverrideMode === "respect" || (localOverrideMode === "off-only" && !override)))
@@ -28,10 +32,10 @@ export async function readDaemonFlag(flagKey, options = {}) {
     let client;
     try {
         const company = resolveProcessFlagCompanyContext(env);
-        // Signed out reads as off without reaching the registry.
+        // Signed out reads as the flag fallback without reaching the registry.
         const token = await (options.getToken ?? (() => ensureCognitoIdToken({ interactive: false })))();
         if (typeof token !== "string" || token.trim() === "")
-            return false;
+            return fallback;
         client = (options.createClient ?? createFlagClient)({
             endpoint: resolveFlagRegistryEndpoint(undefined, env),
             getToken: () => token,
@@ -42,20 +46,27 @@ export async function readDaemonFlag(flagKey, options = {}) {
             ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
             onError,
         });
-        await client.ready();
-        const resolution = client.explain(flagKey, { fallback: false });
-        if (failed && options.throwOnError) {
+        try {
+            await client.ready();
+        }
+        catch (error) {
+            onError(error);
+        }
+        const resolution = client.explain(flagKey, { fallback });
+        if (failed && options.throwOnError && !fallback) {
             throw new Error("hq-flags registry read failed", { cause: reportedError });
         }
-        return !failed && resolution.source === "snapshot" && resolution.value === true;
+        if (resolution.source === "snapshot")
+            return resolution.value === true;
+        return fallback && resolution.value === true;
     }
     catch (error) {
         if (!failed)
             onError(error);
-        if (options.throwOnError && failed) {
+        if (options.throwOnError && failed && !fallback) {
             throw new Error("hq-flags registry read failed", { cause: reportedError ?? error });
         }
-        return false;
+        return fallback;
     }
     finally {
         try {

package/dist/lib/daemon/lanes-reconcile-guard.d.ts

@@ -7,12 +7,13 @@
  * JSON reads, no child process) and tells the supervisor how urgent the next
  * pass is:
  *
- * - `spawn`: something the 15-second cadence exists for may be due — lane
- *   admission, a running lane's heartbeat, or a keep-alive resume (#1396).
+ * - `spawn`: something the desktop's 15-second cadence exists for may be due —
+ *   local lane admission/heartbeat, a local keep-alive resume (#1396), or a
+ *   pending question.
  * - `idle`: only work that ran on the pre-#1396 60-second cadence remains
- *   (terminal lanes, worker-profile resumes, question aging, Codex rollout
- *   retention, lead-autopilot registry). The supervisor runs it at most once
- *   per `idleIntervalSec`.
+ *   (terminal lanes, worker-profile resumes, question aging, outpost mirror
+ *   refresh, Codex retention, lead-autopilot registry). The supervisor runs it
+ *   at most once per `idleIntervalSec`.
  * - `skip`: the store holds no lane or question records, no lead registry and
  *   no lanes config, so a reconcile pass has no input to act on.
  *

package/dist/lib/daemon/lanes-reconcile-guard.js

@@ -7,12 +7,13 @@
  * JSON reads, no child process) and tells the supervisor how urgent the next
  * pass is:
  *
- * - `spawn`: something the 15-second cadence exists for may be due — lane
- *   admission, a running lane's heartbeat, or a keep-alive resume (#1396).
+ * - `spawn`: something the desktop's 15-second cadence exists for may be due —
+ *   local lane admission/heartbeat, a local keep-alive resume (#1396), or a
+ *   pending question.
  * - `idle`: only work that ran on the pre-#1396 60-second cadence remains
- *   (terminal lanes, worker-profile resumes, question aging, Codex rollout
- *   retention, lead-autopilot registry). The supervisor runs it at most once
- *   per `idleIntervalSec`.
+ *   (terminal lanes, worker-profile resumes, question aging, outpost mirror
+ *   refresh, Codex retention, lead-autopilot registry). The supervisor runs it
+ *   at most once per `idleIntervalSec`.
  * - `skip`: the store holds no lane or question records, no lead registry and
  *   no lanes config, so a reconcile pass has no input to act on.
  *
@@ -38,6 +39,9 @@ export const LEAD_REGISTRY_FILE = path.join("workspace", "lane-briefs", "juniors
  * keep-alive, which is checked separately.
  */
 const QUIET_LANE_STATES = new Set(["done", "failed", "interrupted", "cancelled", "killed", "blocked"]);
+const KNOWN_LANE_STATES = new Set([
+    "queued", "running", "awaiting_input", "blocked", "done", "failed", "interrupted", "cancelled", "killed",
+]);
 const realFs = {
     readdirSync: (dir) => fs.readdirSync(dir),
     readFileSync: (file, encoding) => fs.readFileSync(file, encoding),
@@ -63,9 +67,24 @@ function readRecord(fsDeps, file) {
     }
     return parsed;
 }
-/** A lane that may need the 15-second cadence. Unknown shapes count as urgent. */
+/** A lane that may need the desktop's 15-second cadence. Unknown shapes count as urgent. */
 function laneIsUrgent(lane) {
-    if (typeof lane.state !== "string" || !QUIET_LANE_STATES.has(lane.state))
+    if (typeof lane.state !== "string" || !KNOWN_LANE_STATES.has(lane.state))
+        return true;
+    const host = lane.host;
+    if (typeof host !== "object" || host === null || Array.isArray(host))
+        return true;
+    const hostRecord = host;
+    if (typeof hostRecord.id !== "string" || hostRecord.id.length === 0)
+        return true;
+    // This guard is installed only on desktops. The outpost's own daemon keeps
+    // its 15-second cadence; the desktop's outpost mirror/registry refresh can
+    // use the 60-second idle cadence. Pending questions remain urgent below.
+    if (hostRecord.kind === "outpost")
+        return false;
+    if (hostRecord.kind !== "local")
+        return true;
+    if (!QUIET_LANE_STATES.has(lane.state))
         return true;
     if (lane.keep_alive === true)
         return true;

package/dist/lib/daemon/run.d.ts

@@ -14,6 +14,12 @@ import { type HostApp } from "./supervisor.js";
 export declare const LOG_ROTATE_BYTES: number;
 /** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
 export declare const RESTART_EXIT_CODE = 75;
+/** A bounded shutdown deadline that can account for sync push persistence. */
+export declare function createShutdownCap(): {
+    promise: Promise<"timeout">;
+    extendForSyncRunnerPersist(): void;
+    clear(): void;
+};
 export interface DaemonLockConflictOutcome {
     exitCode: 0 | 1;
     stdout?: string;

package/dist/lib/daemon/run.js

@@ -45,12 +45,36 @@ import { stageHqChildBootstrap } from "./hq-child-bootstrap-stage.js";
 import { runnerSessionName } from "./remote-control.js";
 import { adoptChild, createChildTracker, finishSuccession, handoffEligible, readProcStart, stopOrphans, successionPaths, systemdKillMode, takeSuccession, writeHandoff, } from "./succession.js";
 import { listSyncRunnerProcesses, readWatchRunnerOwnerStatus, syncHeartbeatTimeoutMs, syncRunnerNodeOptions, watchRunnerOwnerStatusPath, } from "./sync-runner.js";
-import { STOP_ESCALATION_MS, createSupervisor, } from "./supervisor.js";
+import { STOP_ESCALATION_MS, SYNC_RUNNER_PERSIST_GRACE_MS, createSupervisor, } from "./supervisor.js";
 import { userToolDirs } from "./tools.js";
 import { daemonRunGuard } from "./lanes-reconcile-guard.js";
 export const LOG_ROTATE_BYTES = 5 * 1024 * 1024;
 /** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
 export const RESTART_EXIT_CODE = 75;
+const NON_SYNC_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + 5_000;
+const SYNC_RUNNER_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + SYNC_RUNNER_PERSIST_GRACE_MS + 5_000;
+/** A bounded shutdown deadline that can account for sync push persistence. */
+export function createShutdownCap() {
+    const startedAt = Date.now();
+    let deadline = startedAt + NON_SYNC_SHUTDOWN_CAP_MS;
+    let resolveCap;
+    let timer;
+    const promise = new Promise((resolve) => { resolveCap = resolve; });
+    const arm = () => {
+        if (timer)
+            clearTimeout(timer);
+        timer = setTimeout(() => resolveCap("timeout"), Math.max(0, deadline - Date.now()));
+    };
+    arm();
+    return {
+        promise,
+        extendForSyncRunnerPersist() {
+            deadline = Math.max(deadline, startedAt + SYNC_RUNNER_SHUTDOWN_CAP_MS);
+            arm();
+        },
+        clear() { clearTimeout(timer); },
+    };
+}
 /** Preserve the legacy lock failure unless Anywhere explicitly enables the no-op behavior. */
 export function daemonLockConflictOutcome(lock, anywhereEnabled) {
     if (lock.ok)
@@ -772,6 +796,7 @@ export async function runDaemon(opts) {
     };
     // Set once the shutdown path exists below; a restart request before then is dropped.
     let restartDaemon = () => false;
+    let extendSyncShutdownCap;
     const supervisor = createSupervisor({
         machineType,
         host: opts.host,
@@ -794,6 +819,7 @@ export async function runDaemon(opts) {
         runGuard: daemonRunGuard,
         writeState: (state) => writeJsonAtomic(paths.statePath, state),
         log,
+        onSyncRunnerStopping: () => extendSyncShutdownCap?.(),
         syncOwnerBlockReason: () => {
             const config = readDaemonConfig(paths.configPath);
             const hqRoot = config.hqRoot ?? env.HQ_ROOT?.trim();
@@ -891,14 +917,15 @@ export async function runDaemon(opts) {
             stopping = true;
             log("info", `${why}; stopping services`);
             closeHqd();
-            // The supervisor escalates to SIGKILL after STOP_ESCALATION_MS; the extra
-            // margin only covers a child that survives even that.
-            let capTimer;
-            const cap = new Promise((r) => {
-                capTimer = setTimeout(() => r("timeout"), STOP_ESCALATION_MS + 5_000);
-            });
-            void Promise.race([supervisor.stop(), cap]).then((result) => {
-                clearTimeout(capTimer);
+            // Keep shutdown bounded, but let a stopping sync runner reach its persist deadline.
+            const cap = createShutdownCap();
+            extendSyncShutdownCap = cap.extendForSyncRunnerPersist;
+            if (supervisor.hasStoppingSyncRunner())
+                cap.extendForSyncRunnerPersist();
+            const servicesStopped = supervisor.stop();
+            void Promise.race([servicesStopped, cap.promise]).then((result) => {
+                cap.clear();
+                extendSyncShutdownCap = undefined;
                 if (result === "timeout")
                     log("error", "some services did not exit after SIGKILL; releasing the lock anyway");
                 else

package/dist/lib/daemon/server.d.ts

@@ -39,7 +39,7 @@ export interface HqdServerOptions {
     env?: NodeJS.ProcessEnv;
     /** Work-mesh root override for mesh.presence (tests). */
     workMeshRoot?: string;
-    /** Test seam for the hq-anywhere-runtime default-off gate. */
+    /** Test seam for the hq-anywhere-runtime fail-safe gate. */
     mcpEnabled?: () => boolean | Promise<boolean>;
     /** Test seam for the live hq-flags read used by the daemon's bounded runtime monitor. */
     runtimeFlagReader?: (options: ReadDaemonFlagOptions) => Promise<boolean>;

package/dist/lib/daemon/supervisor.d.ts

@@ -13,7 +13,8 @@
  * - restart/trigger/stop requests from the CLI are polled and applied; a
  *   request for a unit that is not planned yet re-reads the plan first;
  * - stop() sends SIGTERM to every child, escalates to SIGKILL after
- *   STOP_ESCALATION_MS, and resolves once every child has exited;
+ *   STOP_ESCALATION_MS except for a sync runner already stopping, which it lets
+ *   finish persisting pending pushes before resolving;
  * - release() instead leaves every child running and reports the long-running
  *   ones, so the next daemon can adopt them (`adopt`). Adopted units whose
  *   command is unchanged keep running; changed ones are replaced one at a
@@ -26,6 +27,7 @@ import type { MachineType } from "./machine-type.js";
 import type { ControlRequest } from "./requests.js";
 import { syncPassResult } from "./sync-runner.js";
 export declare const STOP_ESCALATION_MS = 10000;
+export declare const SYNC_RUNNER_PERSIST_GRACE_MS = 60000;
 export declare const CLI_UPDATE_SYNC_IDLE_KILL_GRACE_MS = 60000;
 /** After a handoff, how long a replaced unit must stay up before the next one is replaced. */
 export declare const HANDOFF_STAGGER_MS = 15000;
@@ -98,6 +100,8 @@ export interface SupervisorDeps {
     restartDaemon?: () => void | boolean | Promise<boolean | void>;
     writeState: (state: DaemonState) => void;
     log: (level: "info" | "warn" | "error", msg: string) => void;
+    /** Extend the daemon shutdown deadline when a sync runner reports stopping. */
+    onSyncRunnerStopping?: () => void;
     now?: () => number;
     setTimeout?: (fn: () => void, ms: number) => unknown;
     clearTimeout?: (handle: unknown) => void;
@@ -120,6 +124,8 @@ export interface Supervisor {
     stop(): Promise<void>;
     reconcile(): void;
     state(): DaemonState;
+    /** True while a live sync runner has reported that it is persisting pushes. */
+    hasStoppingSyncRunner(): boolean;
     /** Stop supervising without signalling any child; returns the long-running units left running. */
     release(): ReleasedUnit[];
 }

package/dist/lib/daemon/supervisor.js

@@ -13,7 +13,8 @@
  * - restart/trigger/stop requests from the CLI are polled and applied; a
  *   request for a unit that is not planned yet re-reads the plan first;
  * - stop() sends SIGTERM to every child, escalates to SIGKILL after
- *   STOP_ESCALATION_MS, and resolves once every child has exited;
+ *   STOP_ESCALATION_MS except for a sync runner already stopping, which it lets
+ *   finish persisting pending pushes before resolving;
  * - release() instead leaves every child running and reports the long-running
  *   ones, so the next daemon can adopt them (`adopt`). Adopted units whose
  *   command is unchanged keep running; changed ones are replaced one at a
@@ -27,6 +28,7 @@ const BACKOFF_BASE_MS = 1_000;
 const BACKOFF_MAX_MS = 60_000;
 const HEALTHY_RUN_MS = 60_000;
 export const STOP_ESCALATION_MS = 10_000;
+export const SYNC_RUNNER_PERSIST_GRACE_MS = 60_000;
 const CLI_UPDATE_SYNC_IDLE_MAX_MS = 10 * 60_000;
 export const CLI_UPDATE_SYNC_IDLE_KILL_GRACE_MS = 60_000;
 const MESH_OWNER_RECHECK_MS = 15_000;
@@ -91,6 +93,7 @@ export function createSupervisor(deps) {
     let handoffTimer;
     /** Every child process not yet known to have exited, including ones the slots have let go of. */
     const live = new Set();
+    const liveOwners = new Map();
     let drained = null;
     let onDrained = null;
     let deferredCliRestart = false;
@@ -247,6 +250,16 @@ export function createSupervisor(deps) {
             deps.log("error", `could not send ${signal} to ${slot.plan.id}: ${errorMessage(err)}`);
         }
     };
+    const syncRunnerIsStopping = (slot) => slot?.plan.service === "sync" && slot.lastProtocolStatus === "stopping";
+    const scheduleSyncRunnerPersistEscalation = (slot, child) => {
+        slot.killTimer = setT(() => {
+            slot.killTimer = undefined;
+            if (slot.child !== child)
+                return;
+            deps.log("warn", `${slot.plan.id} did not finish persisting pending pushes within ${SYNC_RUNNER_PERSIST_GRACE_MS / 1_000} s; sending SIGKILL${lastProtocolHint(slot)}`);
+            signalChild(slot, child, "SIGKILL");
+        }, SYNC_RUNNER_PERSIST_GRACE_MS);
+    };
     /**
      * Stop the slot's child (if any), then run `then` once it has exited. With
      * `drain`, a unit that has a drain signal gets it first and SIGTERM only
@@ -276,6 +289,11 @@ export function createSupervisor(deps) {
                 slot.killTimer = undefined;
                 if (slot.child !== child)
                     return;
+                if (syncRunnerIsStopping(slot)) {
+                    deps.log("info", `${slot.plan.id} is stopping; allowing ${SYNC_RUNNER_PERSIST_GRACE_MS / 1_000} s for pending pushes to persist`);
+                    scheduleSyncRunnerPersistEscalation(slot, child);
+                    return;
+                }
                 deps.log("warn", `${slot.plan.id} did not exit within ${killGraceMs / 1_000} s of SIGTERM; sending SIGKILL${lastProtocolHint(slot)}`);
                 signalChild(slot, child, "SIGKILL");
             }, killGraceMs);
@@ -313,6 +331,7 @@ export function createSupervisor(deps) {
     };
     const watch = (slot, child) => {
         live.add(child);
+        liveOwners.set(child, slot);
         let ended = false;
         const timeoutMs = slot.plan.heartbeatTimeoutMs;
         const decoder = timeoutMs ? new StringDecoder("utf8") : null;
@@ -350,6 +369,8 @@ export function createSupervisor(deps) {
                     slot.syncPassActive = false;
                 else if (event.type === "status" && typeof event.state === "string") {
                     slot.lastProtocolStatus = event.state;
+                    if (event.state === "stopping")
+                        deps.onSyncRunnerStopping?.();
                     if (event.state === "stopped" || event.state === "waiting-for-lock")
                         slot.syncPassActive = false;
                     else if (slot.syncPassActive === undefined && (event.state === "starting" || event.state === "running")) {
@@ -405,6 +426,7 @@ export function createSupervisor(deps) {
                 return;
             ended = true;
             live.delete(child);
+            liveOwners.delete(child);
             if (live.size === 0)
                 onDrained?.();
             if (slot.child !== child)
@@ -991,10 +1013,8 @@ export function createSupervisor(deps) {
                 clearT(handoffTimer);
             clearDeferredCliRestart();
             clearPendingSyncCommandRestart();
-            const childOwners = new Map();
+            const childOwners = new Map(liveOwners);
             for (const slot of slots.values()) {
-                if (slot.child)
-                    childOwners.set(slot.child, slot);
                 clearTimer(slot);
                 clearHeartbeatTimer(slot);
                 slot.child = undefined;
@@ -1020,9 +1040,16 @@ export function createSupervisor(deps) {
                     resolve();
                     return;
                 }
+                const persistingSyncRunners = new Set();
+                let persistEscalation;
                 const escalation = setT(() => {
                     for (const child of live) {
                         const owner = childOwners.get(child);
+                        if (owner && syncRunnerIsStopping(owner)) {
+                            deps.log("info", `${owner.plan.id} is stopping; allowing ${SYNC_RUNNER_PERSIST_GRACE_MS / 1_000} s for pending pushes to persist`);
+                            persistingSyncRunners.add(child);
+                            continue;
+                        }
                         deps.log("warn", `${owner?.plan.id ?? `pid ${child.pid ?? "?"}`} did not exit within ${STOP_ESCALATION_MS / 1_000} s of SIGTERM; sending SIGKILL${owner ? lastProtocolHint(owner) : ""}`);
                         try {
                             child.kill("SIGKILL");
@@ -1031,10 +1058,28 @@ export function createSupervisor(deps) {
                             deps.log("error", `could not SIGKILL pid ${child.pid ?? "?"}: ${errorMessage(err)}`);
                         }
                     }
+                    if (persistingSyncRunners.size > 0) {
+                        persistEscalation = setT(() => {
+                            for (const child of persistingSyncRunners) {
+                                if (!live.has(child))
+                                    continue;
+                                const owner = childOwners.get(child);
+                                deps.log("warn", `${owner?.plan.id ?? `pid ${child.pid ?? "?"}`} did not finish persisting pending pushes within ${SYNC_RUNNER_PERSIST_GRACE_MS / 1_000} s; sending SIGKILL${owner ? lastProtocolHint(owner) : ""}`);
+                                try {
+                                    child.kill("SIGKILL");
+                                }
+                                catch (err) {
+                                    deps.log("error", `could not SIGKILL pid ${child.pid ?? "?"}: ${errorMessage(err)}`);
+                                }
+                            }
+                        }, SYNC_RUNNER_PERSIST_GRACE_MS);
+                    }
                 }, STOP_ESCALATION_MS);
                 onDrained = () => {
                     onDrained = null;
                     clearT(escalation);
+                    if (persistEscalation !== undefined)
+                        clearT(persistEscalation);
                     resolve();
                 };
             });
@@ -1042,6 +1087,7 @@ export function createSupervisor(deps) {
         },
         reconcile,
         state: snapshot,
+        hasStoppingSyncRunner: () => [...liveOwners.values()].some(syncRunnerIsStopping),
         release() {
             const released = [];
             for (const slot of slots.values()) {

package/dist/lib/lanes/reconcile.js

@@ -22,7 +22,7 @@ import { classifySessionLiveness, defaultLivenessDeps, loadLivenessIndex, readDa
 import { ANSWERED_QUESTIONS_FILE, armLaneWatcher, envelopeRepairMode, isPidRecordAlive, laneRunDir, nextEnvelopePath, readPidRecord, readProcStarttime, readSpawnManifest, markSpawnFailure, stopLaneProcesses, spawnEnvelopeRepair, spawnLaneWorker, retryLaneOnAlternateAccount, } from "./spawn.js";
 import { appendCappedHistory, lanesStoreRoot, parseLaneRecord, parseQuestionRecord, readLane, readQuestion, listQuestionIds, updateLane, updateQuestion, } from "./store.js";
 import { applyThrottleDecision, decideAdmission, defaultThrottleDeps, emptyThrottleState, evaluateThrottle, isCpuCheckEnabled, readAvailableMemMb, readThrottleState, resolveCpuBusyFraction, sampleCpuBusyObservation, recordCpuBusyObservation, throttleStatePath, writeThrottleState, } from "./throttle.js";
-import { readLanesRegistryFlag, readLanesRegistryFlagFailOff } from "./registry-flag.js";
+import { readLanesRegistryFlag, readLanesRegistryFlagFailOff, readLanesRegistryFlagFailOpen } from "./registry-flag.js";
 import { LANE_HIRE_GRANT_FINISHED_LANES_FLAG, LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG, LANE_LEAD_ADMISSION_PRIORITY_FLAG, LANE_QUOTA_ACCOUNT_FAILOVER_FLAG, } from "./flag-keys.js";
 import { checkLaneDiskSpace, configuredCodexRolloutHomes, laneDiskAccount, retainCodexRollouts } from "./disk-guard.js";
 import { laneCompanyUidSource, resolveLaneCompany } from "./lane-company.js";
@@ -1216,6 +1216,7 @@ export async function runPassBody(hqRoot, deps) {
         }
     }
     const readRegistryFlag = deps.readRegistryFlag ?? readLanesRegistryFlag;
+    const readRegistryFlagFailOpen = deps.readRegistryFlag ?? readLanesRegistryFlagFailOpen;
     const storyCloseCompanies = new Map();
     for (const lane of lanes) {
         if (lane.depth < 1 || lane.state !== "interrupted" || lane.keep_alive === true ||
@@ -1303,10 +1304,10 @@ export async function runPassBody(hqRoot, deps) {
             readRegistryFlag(LEAD_LANE_KEEP_ALIVE_FLAG, options),
             readRegistryFlag(LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, options),
             hasBlockedKeepAliveLane
-                ? readRegistryFlag(LEAD_LANE_KEEP_ALIVE_RESUME_BLOCKED_FLAG, options)
+                ? readRegistryFlagFailOpen(LEAD_LANE_KEEP_ALIVE_RESUME_BLOCKED_FLAG, options)
                 : Promise.resolve(false),
             readRegistryFlag(LEAD_LANE_KEEP_ALIVE_IMMEDIATE_FIRST_RESUME_FLAG, options),
-            readRegistryFlag(LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG, options),
+            readRegistryFlagFailOpen(LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG, options),
         ]);
         keepAliveFlagByCompany.set(key, keepAliveEnabled);
         blockedResumeFlagByCompany.set(key, blockedResumeEnabled);
@@ -3585,6 +3586,7 @@ async function runTerminalKeepAliveCandidatePass(hqRoot, lanes, summary, deps, n
     if (company === null)
         return summary;
     const readFlag = deps.readRegistryFlag ?? readLanesRegistryFlag;
+    const readFlagFailOpen = deps.readRegistryFlag ?? readLanesRegistryFlagFailOpen;
     const options = { company, env: deps.env ?? process.env };
     let keepAliveEnabled;
     let lineageAware;
@@ -3595,7 +3597,7 @@ async function runTerminalKeepAliveCandidatePass(hqRoot, lanes, summary, deps, n
             readFlag(LEAD_LANE_KEEP_ALIVE_FLAG, options),
             readFlag(LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, options),
             readFlag(LEAD_LANE_KEEP_ALIVE_IMMEDIATE_FIRST_RESUME_FLAG, options),
-            readFlag(LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG, options),
+            readFlagFailOpen(LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG, options),
         ]);
     }
     catch (err) {

package/dist/lib/lanes/registry-flag.d.ts

@@ -19,12 +19,22 @@ export interface ReadLanesFlagOptions {
     reportFailure?: (error: unknown) => void;
 }
 export declare function readLanesFlagLocalOverride(flagKey: string, env?: NodeJS.ProcessEnv): boolean | null;
+export type LanesRegistryFlagResult = {
+    state: "resolved";
+    value: boolean;
+} | {
+    state: "unknown";
+};
 /**
  * Read a lanes flag once for each company identity in this CLI process. The
- * cache contains only an in-flight or settled boolean promise; it is never
+ * cache contains only an in-flight or settled decision result; it is never
  * written to disk. A local override is checked on every call and wins first.
  */
 export declare function readLanesRegistryFlag(flagKey: string, options?: ReadLanesFlagOptions): Promise<boolean>;
+/** Read a lanes flag while preserving registry failure as an explicit unknown state. */
+export declare function readLanesRegistryFlagResult(flagKey: string, options?: ReadLanesFlagOptions): Promise<LanesRegistryFlagResult>;
+/** Delivery and wake call sites opt in to availability when the registry is unreadable. */
+export declare function readLanesRegistryFlagFailOpen(flagKey: string, options?: ReadLanesFlagOptions): Promise<boolean>;
 /**
  * Flag readers normally report their own failures and return the safe default.
  * Keep enforcement callers safe if an injected or unexpected reader rejects.