@indigoai-us/hq-cli 5.345.7 → 5.345.8

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+## [5.345.8] — 2026-10-05
+- Prioritize due lead keep-alive retries and honor due next-check times ahead of later backoff deadlines behind an hq-flags gate.
+- Drain bot turns before replacing a running bot after a daemon plan change.
+
 ## [5.345.7] — 2026-10-05
 - Retry a just-published hq-cli version when npm briefly reports `notarget`.
 - Wait for an active sync pass to finish before restarting sync after a CLI update.

package/dist/commands/__fixtures__/make-tar.d.ts

@@ -22,7 +22,7 @@
  * lists whatever bytes we wrote, so the guard sees the real attack everywhere.
  */
 /** ustar typeflag values we use. */
-export type TarType = 'file' | 'symlink' | 'hardlink';
+type TarType = 'file' | 'symlink' | 'hardlink';
 export interface TarEntrySpec {
     /** Recorded entry name — written VERBATIM (may contain `..`, be absolute…). */
     name: string;
@@ -32,15 +32,7 @@ export interface TarEntrySpec {
     /** File content (regular files only). */
     content?: string | Buffer;
 }
-/**
- * Build one 512-byte ustar header (plus content blocks for regular files) for a
- * single entry. The header checksum is computed exactly per spec: sum every
- * header byte treating the 8 checksum bytes themselves as ASCII spaces, then
- * write that sum as 6 octal digits + NUL + space.
- */
-export declare function makeTarEntry(spec: TarEntrySpec): Buffer;
-/** Concatenate entries and append the two zero blocks that end every tar. */
-export declare function makeTar(entries: TarEntrySpec[]): Buffer;
 /** Build the tar, gzip it, and write it to `outPath`. Returns `outPath`. */
 export declare function writeMaliciousTarGz(outPath: string, entries: TarEntrySpec[]): string;
+export {};
 //# sourceMappingURL=make-tar.d.ts.map

package/dist/commands/__fixtures__/make-tar.js

@@ -50,7 +50,7 @@ function writeOctal(buf, offset, width, value) {
  * header byte treating the 8 checksum bytes themselves as ASCII spaces, then
  * write that sum as 6 octal digits + NUL + space.
  */
-export function makeTarEntry(spec) {
+function makeTarEntry(spec) {
     const type = spec.type ?? 'file';
     const content = type === 'file'
         ? Buffer.isBuffer(spec.content)
@@ -89,7 +89,7 @@ export function makeTarEntry(spec) {
     return Buffer.concat([header, content, Buffer.alloc(pad)]);
 }
 /** Concatenate entries and append the two zero blocks that end every tar. */
-export function makeTar(entries) {
+function makeTar(entries) {
     const blocks = entries.map(makeTarEntry);
     blocks.push(Buffer.alloc(BLOCK * 2)); // end-of-archive marker
     return Buffer.concat(blocks);

package/dist/commands/agent-enroll.d.ts

@@ -17,18 +17,16 @@
 import { Command } from "commander";
 import { generateHostKeyPair } from "../lib/agent-kit/creds.js";
 import { type AgentKitPaths } from "../lib/agent-kit/paths.js";
-export declare const ENROLL_PATH = "/v1/agents/enroll";
 /** Canonical code: un-grouped, uppercase (server hashes exactly this). */
 export declare function normalizeEnrollmentCode(raw: string): string;
 /** 24 chars of Crockford base32 (no I, L, O, U). */
 export declare function isWellFormedEnrollmentCode(code: string): boolean;
-export interface HostInfo {
+interface HostInfo {
     os: string;
     arch: string;
     hostname: string;
     cliVersion: string;
 }
-export declare function collectHostInfo(): HostInfo;
 export type ExistingIdentity = {
     kind: "none";
 } | {
@@ -143,4 +141,5 @@ export interface EnrollResult {
 /** Pure-ish orchestration so tests can drive it without a TTY or network. */
 export declare function enrollHost(opts: EnrollOptions, deps?: EnrollDeps): Promise<EnrollResult>;
 export declare function registerAgentEnrollCommand(agent: Command): void;
+export {};
 //# sourceMappingURL=agent-enroll.d.ts.map

package/dist/commands/agent-enroll.js

@@ -25,7 +25,7 @@ import { networkTransportErrorCode } from "../utils/network-transport-error.js";
 import { canOfferTeamUpgrade, formatUpgradeRefusal, isPlanGateError, offerUpgradeLink, planGateErrorFromPayload, } from "../utils/plan-gate-error.js";
 import { generateHostKeyPair, machineCredsFileExists, readExternalMachineCreds, writeHostKeyPair, writeMachineCreds, } from "../lib/agent-kit/creds.js";
 import { DEFAULT_LOCAL_AGENT_NAME, agentKitPaths, localAgentDir, } from "../lib/agent-kit/paths.js";
-export const ENROLL_PATH = "/v1/agents/enroll";
+const ENROLL_PATH = "/v1/agents/enroll";
 /** Canonical code: un-grouped, uppercase (server hashes exactly this). */
 export function normalizeEnrollmentCode(raw) {
     return raw.replace(/[\s-]+/g, "").toUpperCase();
@@ -34,7 +34,7 @@ export function normalizeEnrollmentCode(raw) {
 export function isWellFormedEnrollmentCode(code) {
     return /^[0-9A-HJKMNP-TV-Z]{24}$/.test(code);
 }
-export function collectHostInfo() {
+function collectHostInfo() {
     return {
         os: `${os.platform()} ${os.release()}`,
         arch: os.arch(),

package/dist/commands/mcp-status.d.ts

@@ -1,7 +1,7 @@
 import { Command } from 'commander';
 import { type SafeWriteEnv } from './mcp-registration.js';
 /** A server's presence on ONE runtime surface. */
-export type PresenceState = 
+type PresenceState = 
 /** The server def is present (and parsed) on this runtime. */
 'present'
 /** The runtime parsed fine but this server is not registered there. */
@@ -30,7 +30,7 @@ export interface RuntimeServerStatus {
     healthy?: boolean;
 }
 /** A single HQ-owned MCP server's cross-runtime status. */
-export interface McpServerStatus {
+interface McpServerStatus {
     /** The bare server name (the `mcpServers` / `mcp_servers` key). */
     server: string;
     /** The pack that owns it (`_hqPack` provenance). */
@@ -59,7 +59,7 @@ export interface McpServerStatus {
     drifted: boolean;
 }
 /** A runtime's top-level status. */
-export interface RuntimeStatus {
+interface RuntimeStatus {
     /** Whether the runtime is installed (Claude is always; Codex iff `~/.codex` exists). */
     installed: boolean;
     /** Whether the runtime's config parsed (false => unparseable). */
@@ -133,4 +133,5 @@ export declare function renderMcpCapabilities(caps: McpCapabilities): string;
  * {@link registerReindexCommand} and the subcommand-group pattern in index.ts.
  */
 export declare function registerMcpCommand(program: Command): void;
+export {};
 //# sourceMappingURL=mcp-status.d.ts.map

package/dist/commands/reindex.d.ts

@@ -5,12 +5,6 @@ import { Command } from 'commander';
  * layout scan and Git's status output rather than recursively walking trees.
  */
 export declare function removeStaleHqWorktrees(hqRoot: string, now?: number, deadline?: number): void;
-/**
- * Check hook health without relying on lifecycle hooks. A fully disabled
- * configuration is repaired only after a successful reindex; partial and
- * malformed configurations remain untouched and receive recovery guidance.
- */
-export declare function repairExtremeHookDrift(hqRoot: string, allowRepair?: boolean): void;
 /**
  * Stop the generated project settings from silently downgrading an operator who
  * chose Bypass mode globally.

package/dist/commands/reindex.js

@@ -491,7 +491,7 @@ function runSilently(operation) {
  * configuration is repaired only after a successful reindex; partial and
  * malformed configurations remain untouched and receive recovery guidance.
  */
-export function repairExtremeHookDrift(hqRoot, allowRepair = true) {
+function repairExtremeHookDrift(hqRoot, allowRepair = true) {
     // `hq reindex` can still be invoked from an arbitrary directory. Never turn
     // an absent settings file there into a rescue attempt.
     if (!isHqRoot(hqRoot))

package/dist/commands/safe-extract.d.ts

@@ -45,7 +45,7 @@ export declare const DEFAULT_CAPS: ExtractCaps;
 export declare class UnsafeArchiveError extends Error {
     constructor(message: string);
 }
-export type EntryType = 'file' | 'dir' | 'symlink' | 'hardlink' | 'other';
+type EntryType = 'file' | 'dir' | 'symlink' | 'hardlink' | 'other';
 export interface TarEntry {
     type: EntryType;
     /** Entry path as recorded in the archive (may contain `..`, be absolute…). */
@@ -108,14 +108,6 @@ export declare function resolveContainedPath(targetDir: string, entryName: strin
  * way the final location must be contained in the pack dir.
  */
 export declare function assertLinkTargetContained(packDir: string, entryAbs: string, linkTarget: string): void;
-/**
- * List a gzip-compressed tarball's entries via `tar -tvf` (no extraction).
- * argv form, never a shell string, keeps hostile filenames out of shell syntax.
- * Windows drive paths always use a basename relative to the archive directory.
- * GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows' bundled
- * bsdtar accepts the same relative argv without GNU-only `--force-local`.
- */
-export declare function listTarball(tarballPath: string, opts?: Pick<SafeExtractOptions, 'platform' | 'execFileSync'>): TarEntry[];
 /**
  * Pre-flight validation against the entry headers. Enforces (a) containment of
  * every entry name under `targetDir`, (b) containment of every link target
@@ -123,14 +115,6 @@ export declare function listTarball(tarballPath: string, opts?: Pick<SafeExtract
  * UnsafeArchiveError on the first violation — default-deny.
  */
 export declare function validateEntries(entries: TarEntry[], targetDir: string, caps?: ExtractCaps): void;
-/**
- * Walk everything actually written under `stagingDir` and assert that no entry
- * — and, for symlinks, no link target — escapes. This is the defense-in-depth
- * backstop: it does not trust the pre-flight scan OR the tar binary. Uses
- * realpath on the link's PARENT (which exists) plus lstat to inspect links
- * without following them off-tree.
- */
-export declare function assertExtractContained(stagingDir: string): void;
 export interface SafeExtractOptions {
     caps?: ExtractCaps;
     /** Test seam for platform-specific argv construction. */
@@ -158,4 +142,5 @@ export interface SafeExtractOptions {
  * so a half-extracted pack can never be wired.
  */
 export declare function safeExtractTarball(tarballPath: string, finalDir: string, opts?: SafeExtractOptions): void;
+export {};
 //# sourceMappingURL=safe-extract.d.ts.map

package/dist/commands/safe-extract.js

@@ -219,7 +219,7 @@ function tarballArgvLocation(tarballPath, platform) {
  * GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows' bundled
  * bsdtar accepts the same relative argv without GNU-only `--force-local`.
  */
-export function listTarball(tarballPath, opts = {}) {
+function listTarball(tarballPath, opts = {}) {
     const platform = opts.platform ?? process.platform;
     const location = tarballArgvLocation(tarballPath, platform);
     const out = (opts.execFileSync ?? execFileSync)('tar', ['-tvf', location.archiveArg], {
@@ -277,7 +277,7 @@ export function validateEntries(entries, targetDir, caps = DEFAULT_CAPS) {
  * realpath on the link's PARENT (which exists) plus lstat to inspect links
  * without following them off-tree.
  */
-export function assertExtractContained(stagingDir) {
+function assertExtractContained(stagingDir) {
     const realRoot = fs.realpathSync(stagingDir);
     const walk = (dir) => {
         for (const dirent of fs.readdirSync(dir, { withFileTypes: true })) {

package/dist/commands/search.d.ts

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-export type SearchMode = 'keyword' | 'semantic' | 'hybrid';
+type SearchMode = 'keyword' | 'semantic' | 'hybrid';
 export type SearchOptions = {
     mode?: SearchMode;
     collection?: string;
@@ -32,4 +32,5 @@ export declare function normalizeQueryForQmd(query: string): string;
 export declare function buildSearchArgs(query: string, options?: SearchOptions): string[];
 export declare function buildGetArgs(document: string, options?: Pick<SearchOptions, 'collection'>): string[];
 export declare function registerSearchCommand(program: Command): void;
+export {};
 //# sourceMappingURL=search.d.ts.map

package/dist/lazy-commands.d.ts

@@ -5,12 +5,6 @@ export type LazyCommand = {
     /** Registers every contributor for this root and no unrelated root. */
     register: (program: Command) => Promise<void>;
 };
-/**
- * One entry for every root, including groups that are assembled by several
- * registrar modules. The routing metadata itself is generated from the eager
- * command graph and checked in tests and the build.
- */
-export declare const LAZY_COMMANDS: readonly LazyCommand[];
 /**
  * Keep the registration seam at register-all.js. Besides making one place own
  * the graph, this lets the torn-install recovery wrap failures while an update

package/dist/lazy-commands.js

@@ -9,7 +9,7 @@ const commandCatalog = COMMAND_CATALOG;
  * registrar modules. The routing metadata itself is generated from the eager
  * command graph and checked in tests and the build.
  */
-export const LAZY_COMMANDS = commandCatalog.map((command) => ({
+const LAZY_COMMANDS = commandCatalog.map((command) => ({
     name: command.name,
     register: async (program) => {
         const registered = await registerCommandRoot(program, command.name);

package/dist/lib/daemon/supervisor.js

@@ -683,6 +683,7 @@ export function createSupervisor(deps) {
             existing.blockedReads = 0;
             const adopted = existing.adopted === true;
             existing.adopted = false;
+            const hadDrainSignal = existing.plan.drainSignal !== undefined;
             const key = planKey(plan, deps.cliVersion);
             const wasBlocked = existing.plan.blocked !== undefined;
             const changed = key !== existing.key;
@@ -746,7 +747,7 @@ export function createSupervisor(deps) {
                 if (cliRestartInProgress && plan.service === "sync")
                     terminate(existing);
                 else
-                    terminate(existing, () => activate(existing));
+                    terminate(existing, () => activate(existing), hadDrainSignal);
             }
         }
         slots = next;

package/dist/lib/doctor/__testing__/fake-hq-tree.d.ts

@@ -25,7 +25,7 @@
  * which stands up a throwaway HQ tree with `mktemp -d` and stubbed hook scripts.
  */
 /** Claude/Codex lifecycle events a hook can be registered against. */
-export type HookEventName = "PreToolUse" | "PostToolUse" | "UserPromptSubmit" | "SessionStart" | "Stop" | "SubagentStop" | "PreCompact" | "Notification";
+type HookEventName = "PreToolUse" | "PostToolUse" | "UserPromptSubmit" | "SessionStart" | "Stop" | "SubagentStop" | "PreCompact" | "Notification";
 /** The three `hook-gate.sh` allowlist profiles. */
 export type GateProfile = "minimal" | "standard" | "strict";
 /** Canonical ordering of the gate profiles. */
@@ -35,7 +35,7 @@ export declare const GATE_PROFILES: readonly GateProfile[];
  * canonical `.claude/hooks/` scripts; only Codex runs duplicated copies, so the
  * Codex mirror is the entire drift surface the doctor has to watch.
  */
-export interface FakeCodexMirrorSpec {
+interface FakeCodexMirrorSpec {
     /** Whether the mirror file is written to `.codex/hooks/`. Default: true. */
     present?: boolean;
     /**
@@ -99,7 +99,7 @@ export interface FakeHookSpec {
  * written by default (declare a hook's `codex` spec explicitly, or set
  * `legacyHooksJson`, to model pre-adapter leftovers).
  */
-export interface FakeCodexAdapterSpec {
+interface FakeCodexAdapterSpec {
     /** Events wired to the adapter in config.toml. Default: the shipped eight. */
     events?: string[];
     /** Whether the adapter script is written. Default: true. */
@@ -111,10 +111,8 @@ export interface FakeCodexAdapterSpec {
     /** Whether a leftover `.codex/hooks.json` is still written. Default: false. */
     legacyHooksJson?: boolean;
 }
-/** The lifecycle events the shipped `.codex/config.toml` wires. */
-export declare const ADAPTER_DEFAULT_EVENTS: readonly string[];
 /** Declares the `.grok/hooks/` state. */
-export interface FakeGrokSpec {
+interface FakeGrokSpec {
     /** Whether the `.grok/hooks/` scaffold is created at all. Default: true. */
     present?: boolean;
     /** Whether `hq-grok-hook-adapter.sh` carries the executable bit. Default: true. */
@@ -147,7 +145,7 @@ export interface FakeHqTreeSpec {
     prefix?: string;
 }
 /** Manifest entry describing a materialised Codex mirror. */
-export interface FakeCodexManifestEntry {
+interface FakeCodexManifestEntry {
     /** Absolute path where the mirror lives (whether or not it was written). */
     scriptPath: string;
     /** Whether the mirror file exists on disk. */
@@ -162,7 +160,7 @@ export interface FakeCodexManifestEntry {
     drifted: boolean;
 }
 /** Manifest entry describing a materialised hook across all platforms. */
-export interface FakeHookManifestEntry {
+interface FakeHookManifestEntry {
     id: string;
     /** Absolute path of the Claude script (whether or not it was written). */
     scriptPath: string;
@@ -184,7 +182,7 @@ export interface FakeHookManifestEntry {
     codex: FakeCodexManifestEntry | null;
 }
 /** A structured description of everything {@link buildFakeHqTree} wrote. */
-export interface FakeHqTreeManifest {
+interface FakeHqTreeManifest {
     root: string;
     claudeSettingsPath: string;
     claudeHooksDir: string;
@@ -224,4 +222,5 @@ export declare function trackedFakeHqTreeRoots(): string[];
  * when the process exits.
  */
 export declare function buildFakeHqTree(spec?: FakeHqTreeSpec): FakeHqTree;
+export {};
 //# sourceMappingURL=fake-hq-tree.d.ts.map

package/dist/lib/doctor/__testing__/fake-hq-tree.js

@@ -39,7 +39,7 @@ const EXECUTABLE_MODE = 0o755;
 const NON_EXECUTABLE_MODE = 0o644;
 const DEFAULT_PREFIX = "hq-doctor-fake-";
 /** The lifecycle events the shipped `.codex/config.toml` wires. */
-export const ADAPTER_DEFAULT_EVENTS = [
+const ADAPTER_DEFAULT_EVENTS = [
     "SessionStart",
     "UserPromptSubmit",
     "PreToolUse",

package/dist/lib/doctor/checks/runtime-probe.d.ts

@@ -47,27 +47,6 @@ export declare const RUNTIME_PROBE_PREFIX = "hooks.runtime";
  * `check-hq-hooks.sh` (`LEDGER_DIR="$HQ_ROOT/workspace/orchestrator/policy-trigger-state"`).
  */
 export declare const POLICY_TRIGGER_LEDGER_RELPATH = "workspace/orchestrator/policy-trigger-state";
-/** The two lifecycle events `check-hq-hooks.sh` requires a command hook on. */
-export declare const REQUIRED_HOOK_EVENTS: readonly ["SessionStart", "PreToolUse"];
-/**
- * Default runtime marker path an agents-v2 (hq-fleet) box writes its runtime mode
- * to. Overridable via `HQ_RUNTIME_MARKER_FILE`, exactly as the shell reads
- * `${HQ_RUNTIME_MARKER_FILE:-/var/lib/hq-agent/runtime.json}`.
- */
-export declare const HQ_RUNTIME_MARKER_DEFAULT = "/var/lib/hq-agent/runtime.json";
-/**
- * Path (relative to the HQ root) of the on-box agents-v2 hook adapter. Its
- * presence under the tree is one of the two signals that the runtime is
- * agents-v2, mirroring `hq_runtime_mode` in `check-hq-hooks.sh`.
- */
-export declare const AGENTS_V2_ADAPTER_RELPATH = ".agents-v2-hooks/hq-agents-v2-hook-adapter.sh";
-/**
- * Default hours a policy-trigger ledger may age and still evidence a live
- * agents-v2 turn when no exact session id is given. Overridable via
- * `HQ_V2_LEDGER_MAX_AGE_HOURS`, matching the shell's
- * `HQ_V2_LEDGER_MAX_AGE_HOURS="${HQ_V2_LEDGER_MAX_AGE_HOURS:-24}"`.
- */
-export declare const HQ_V2_LEDGER_MAX_AGE_HOURS_DEFAULT = 24;
 /** Whether the ledger was found. Mirrors the script's `present`/`missing`. */
 export type LedgerState = "present" | "missing";
 /** Options for {@link reproduceCheckHqHooks}. */

package/dist/lib/doctor/checks/runtime-probe.js

@@ -51,26 +51,26 @@ export const RUNTIME_PROBE_PREFIX = "hooks.runtime";
  */
 export const POLICY_TRIGGER_LEDGER_RELPATH = "workspace/orchestrator/policy-trigger-state";
 /** The two lifecycle events `check-hq-hooks.sh` requires a command hook on. */
-export const REQUIRED_HOOK_EVENTS = ["SessionStart", "PreToolUse"];
+const REQUIRED_HOOK_EVENTS = ["SessionStart", "PreToolUse"];
 /**
  * Default runtime marker path an agents-v2 (hq-fleet) box writes its runtime mode
  * to. Overridable via `HQ_RUNTIME_MARKER_FILE`, exactly as the shell reads
  * `${HQ_RUNTIME_MARKER_FILE:-/var/lib/hq-agent/runtime.json}`.
  */
-export const HQ_RUNTIME_MARKER_DEFAULT = "/var/lib/hq-agent/runtime.json";
+const HQ_RUNTIME_MARKER_DEFAULT = "/var/lib/hq-agent/runtime.json";
 /**
  * Path (relative to the HQ root) of the on-box agents-v2 hook adapter. Its
  * presence under the tree is one of the two signals that the runtime is
  * agents-v2, mirroring `hq_runtime_mode` in `check-hq-hooks.sh`.
  */
-export const AGENTS_V2_ADAPTER_RELPATH = ".agents-v2-hooks/hq-agents-v2-hook-adapter.sh";
+const AGENTS_V2_ADAPTER_RELPATH = ".agents-v2-hooks/hq-agents-v2-hook-adapter.sh";
 /**
  * Default hours a policy-trigger ledger may age and still evidence a live
  * agents-v2 turn when no exact session id is given. Overridable via
  * `HQ_V2_LEDGER_MAX_AGE_HOURS`, matching the shell's
  * `HQ_V2_LEDGER_MAX_AGE_HOURS="${HQ_V2_LEDGER_MAX_AGE_HOURS:-24}"`.
  */
-export const HQ_V2_LEDGER_MAX_AGE_HOURS_DEFAULT = 24;
+const HQ_V2_LEDGER_MAX_AGE_HOURS_DEFAULT = 24;
 /**
  * Faithfully reproduce `core/scripts/check-hq-hooks.sh --require-ledger` in
  * TypeScript. The checks, in the script's order:

package/dist/lib/doctor/checks/sync-health.d.ts

@@ -26,8 +26,6 @@
 import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
 /** The id of the versions/sync family. */
 export declare const SYNC_FAMILY_ID = "sync";
-/** Human title for grouped output. */
-export declare const SYNC_FAMILY_TITLE = "Versions & sync";
 /**
  * A journal shard older than this is reported stale. Seven days: long enough
  * that a laptop shut over a weekend never warns, short enough that a silently
@@ -45,7 +43,7 @@ export interface SyncJournalSummary {
     };
 }
 /** The component versions this family reports. */
-export interface SyncVersionInfo {
+interface SyncVersionInfo {
     cli: string;
     core: string | null;
     desktop: string | null;
@@ -128,4 +126,5 @@ export declare function semverGt(a: string, b: string): boolean;
  * something — the daemon, the network, the kill switch — is not running.
  */
 export declare const STALE_MANIFEST_THRESHOLD_MS: number;
+export {};
 //# sourceMappingURL=sync-health.d.ts.map

package/dist/lib/doctor/checks/sync-health.js

@@ -38,7 +38,7 @@ import { readHqVersion } from "../../../utils/pack-contributions.js";
 /** The id of the versions/sync family. */
 export const SYNC_FAMILY_ID = "sync";
 /** Human title for grouped output. */
-export const SYNC_FAMILY_TITLE = "Versions & sync";
+const SYNC_FAMILY_TITLE = "Versions & sync";
 /**
  * A journal shard older than this is reported stale. Seven days: long enough
  * that a laptop shut over a weekend never warns, short enough that a silently

package/dist/lib/doctor/compat.d.ts

@@ -36,7 +36,7 @@ export declare const CHECK_HQ_HOOKS_FAIL_EXIT = 2;
  * `HQ runtime enforcement: …` line. `NOT CHECKED` is the default when
  * `--require-ledger` was not passed (the wrapper prints "ledger: not checked").
  */
-export type RuntimeObservation = "OBSERVED" | "NOT OBSERVED" | "NOT CHECKED";
+type RuntimeObservation = "OBSERVED" | "NOT OBSERVED" | "NOT CHECKED";
 /** The verdict the wrapper renders, derived from a scoped `hq doctor` run. */
 export interface CheckHqHooksVerdict {
     /** True iff the wrapper exits 0 (no in-scope failure, ledger observed when required). */
@@ -82,4 +82,5 @@ export interface DeriveVerdictOptions {
  * what lets `compat.test.ts` prove the wrapper and `hq doctor` agree.
  */
 export declare function deriveCheckHqHooksVerdict(doc: DoctorJsonDocument, options?: DeriveVerdictOptions): CheckHqHooksVerdict;
+export {};
 //# sourceMappingURL=compat.d.ts.map

package/dist/lib/doctor/deep/classify.d.ts

@@ -25,7 +25,7 @@
  */
 import type { HookFixture } from "../fixtures/schema.js";
 /** A hook's deep-test class: verifiable by verdict, or effect-bearing. */
-export type HookClass = "pure-guard" | "side-effecting";
+type HookClass = "pure-guard" | "side-effecting";
 /**
  * Substrings that mark a hook id as belonging to a side-effecting family. This
  * is the seed set US-009 names — autocommit, checkpoint, journal, reindex — and
@@ -58,4 +58,5 @@ export declare function classifyFixture(fixture: HookFixture): Classification;
 export declare function isPureGuard(fixture: HookFixture): boolean;
 /** Whether a hook id names a side-effecting hook (US-009's execution surface). */
 export declare function isSideEffectingHookId(hookId: string): boolean;
+export {};
 //# sourceMappingURL=classify.d.ts.map

package/dist/lib/doctor/fix/backup.d.ts

@@ -11,8 +11,6 @@
  * The module is pure filesystem work with an injectable clock, so the applier's
  * tests get a deterministic backup directory name without racing the wall clock.
  */
-/** Where backups live under the resolved HQ root. */
-export declare const BACKUP_RELDIR: string;
 /** The result of a backup pass. */
 export interface BackupResult {
     /** Absolute path of the timestamped backup directory. */
@@ -22,12 +20,6 @@ export interface BackupResult {
     /** A single shell command that restores every backed-up file in place. */
     restoreCommand: string;
 }
-/**
- * A filesystem-safe backup directory name derived from an instant, e.g.
- * `2026-08-11T08-30-00-000Z`. Colons and dots — illegal or awkward in paths —
- * are replaced with dashes; the value stays sortable and unique per millisecond.
- */
-export declare function backupTimestamp(now?: Date): string;
 /**
  * Copy each of `relpaths` (relative to `hqRoot`) into a fresh timestamped backup
  * directory, preserving both the relative path structure and the file mode.

package/dist/lib/doctor/fix/backup.js

@@ -14,13 +14,13 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 /** Where backups live under the resolved HQ root. */
-export const BACKUP_RELDIR = path.join("workspace", "doctor", "backups");
+const BACKUP_RELDIR = path.join("workspace", "doctor", "backups");
 /**
  * A filesystem-safe backup directory name derived from an instant, e.g.
  * `2026-08-11T08-30-00-000Z`. Colons and dots — illegal or awkward in paths —
  * are replaced with dashes; the value stays sortable and unique per millisecond.
  */
-export function backupTimestamp(now = new Date()) {
+function backupTimestamp(now = new Date()) {
     return now.toISOString().replace(/[:.]/g, "-");
 }
 /**

package/dist/lib/doctor/fixtures/discover.d.ts

@@ -28,8 +28,6 @@ import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
 import { type ParsedFixture } from "./schema.js";
 /** Directory, relative to the HQ root, fixtures are discovered from. */
 export declare const HOOK_TESTS_RELDIR: string;
-/** The id of the fixture-coverage family. */
-export declare const FIXTURES_FAMILY_ID = "fixtures";
 /** checkId of the single coverage-ratio result the report surfaces in its summary. */
 export declare const FIXTURE_COVERAGE_CHECK_ID = "hooks.fixtures.coverage";
 /**
@@ -45,7 +43,7 @@ export declare const FIXTURE_COVERAGE_CHECK_ID = "hooks.fixtures.coverage";
  */
 export declare function registeredHookIds(hqRoot: string): string[];
 /** A fixture file located on disk and validated (or a YAML-load failure). */
-export interface DiscoveredFixture {
+interface DiscoveredFixture {
     /** Path relative to the HQ root, e.g. `core/hook-tests/block-core-writes.yaml`. */
     relpath: string;
     /** Absolute path on disk. */
@@ -74,13 +72,6 @@ export interface FixtureDiscovery {
  * looksLikeFixture} are validated and reported.
  */
 export declare function discoverFixtures(hqRoot: string): FixtureDiscovery;
-/** The coverage tally: how many registered hooks have a usable fixture. */
-export interface FixtureCoverage {
-    /** Registered hooks with a valid, recognised-version fixture. */
-    tested: number;
-    /** Registered hooks in total. */
-    total: number;
-}
 /**
  * Run the fixture-coverage tier against the resolved tree: enumerate registered
  * hooks, discover fixtures, and emit UNTESTED / WARN / UNKNOWN results plus the
@@ -93,4 +84,5 @@ export declare function checkFixtureCoverage(context: CheckContext): CheckResult
  * registry contract).
  */
 export declare const fixtureCoverageFamily: CheckFamily;
+export {};
 //# sourceMappingURL=discover.d.ts.map

package/dist/lib/doctor/fixtures/discover.js

@@ -32,7 +32,7 @@ import { looksLikeFixture, parseFixture, SUPPORTED_FIXTURE_SCHEMA_VERSIONS, } fr
 /** Directory, relative to the HQ root, fixtures are discovered from. */
 export const HOOK_TESTS_RELDIR = path.join("core", "hook-tests");
 /** The id of the fixture-coverage family. */
-export const FIXTURES_FAMILY_ID = "fixtures";
+const FIXTURES_FAMILY_ID = "fixtures";
 /** checkId of the single coverage-ratio result the report surfaces in its summary. */
 export const FIXTURE_COVERAGE_CHECK_ID = "hooks.fixtures.coverage";
 /** A `*.yaml` file in `core/hook-tests/` that is not a fixture and must be skipped. */

package/dist/lib/lanes/autopilot.d.ts

@@ -2,22 +2,7 @@ import { readLanesRegistryFlag } from "./registry-flag.js";
 import type { LaneRecord } from "./types.js";
 export declare const LEAD_AUTOPILOT_FLAG = "lanes.lead-autopilot";
 export declare const LEAD_AUTOPILOT_MISSED_DEADLINE_ESCALATION_FLAG = "lanes.autopilot-missed-deadline-escalation";
-export declare const LEAD_AUTOPILOT_MISSED_DEADLINE_ESCALATION_DELAY_MS: number;
-export declare const LEAD_AUTOPILOT_NUDGE_REDELIVERY_DELAY_MS: number;
-export declare const LEAD_AUTOPILOT_NUDGE_STATE_RETENTION_MS: number;
-export declare const LEAD_AUTOPILOT_REVIEW_DELAY_MS: number;
-export declare const LEAD_AUTOPILOT_FILL_DELAY_MS: number;
-export declare const LEAD_AUTOPILOT_PROMPT_LOOP = "personal/knowledge/team-lead-operating-loop.md";
-export declare const LEAD_AUTOPILOT_KPI_STALE_AFTER_MINUTES = 55;
-export declare const LEAD_AUTOPILOT_HEADLINE_STALE_AFTER_MINUTES = 55;
-export interface RegisteredLead {
-    team: string;
-    lane: string;
-    host: string;
-    status: string;
-    prd: string;
-}
-export type AutopilotCondition = "review_finished_worker" | "fill_grant" | "plan_free_slots" | "flat_kpi" | "stale_kpi" | "stale_headline" | "blocker_record_needs_update" | "project_ready_to_close" | "stale_worker_ledger" | "story_without_live_lane" | "missed_deadline";
+type AutopilotCondition = "review_finished_worker" | "fill_grant" | "plan_free_slots" | "flat_kpi" | "stale_kpi" | "stale_headline" | "blocker_record_needs_update" | "project_ready_to_close" | "stale_worker_ledger" | "story_without_live_lane" | "missed_deadline";
 export interface AutopilotWake {
     condition: AutopilotCondition;
     lead_lane: string;
@@ -29,7 +14,7 @@ export interface AutopilotWake {
     /** Headline episode represented inside the KPI batch notice, if any. */
     headline_fingerprint?: string;
 }
-export interface AutopilotKpiStatus {
+interface AutopilotKpiStatus {
     lead_lane: string;
     team: string;
     kpi: string;

package/dist/lib/lanes/autopilot.js

@@ -12,15 +12,15 @@ import { readLanesRegistryFlag } from "./registry-flag.js";
 import { readAllLanes } from "./store.js";
 export const LEAD_AUTOPILOT_FLAG = "lanes.lead-autopilot";
 export const LEAD_AUTOPILOT_MISSED_DEADLINE_ESCALATION_FLAG = LANE_AUTOPILOT_MISSED_DEADLINE_ESCALATION_FLAG;
-export const LEAD_AUTOPILOT_MISSED_DEADLINE_ESCALATION_DELAY_MS = 60 * 60_000;
-export const LEAD_AUTOPILOT_NUDGE_REDELIVERY_DELAY_MS = 30 * 60_000;
-export const LEAD_AUTOPILOT_NUDGE_STATE_RETENTION_MS = 24 * 60 * 60_000;
+const LEAD_AUTOPILOT_MISSED_DEADLINE_ESCALATION_DELAY_MS = 60 * 60_000;
+const LEAD_AUTOPILOT_NUDGE_REDELIVERY_DELAY_MS = 30 * 60_000;
+const LEAD_AUTOPILOT_NUDGE_STATE_RETENTION_MS = 24 * 60 * 60_000;
 const LEAD_AUTOPILOT_DELIVERED_ID_RETENTION_MS = 7 * 24 * 60 * 60_000;
-export const LEAD_AUTOPILOT_REVIEW_DELAY_MS = 15 * 60_000;
-export const LEAD_AUTOPILOT_FILL_DELAY_MS = 15 * 60_000;
-export const LEAD_AUTOPILOT_PROMPT_LOOP = "personal/knowledge/team-lead-operating-loop.md";
-export const LEAD_AUTOPILOT_KPI_STALE_AFTER_MINUTES = 55;
-export const LEAD_AUTOPILOT_HEADLINE_STALE_AFTER_MINUTES = 55;
+const LEAD_AUTOPILOT_REVIEW_DELAY_MS = 15 * 60_000;
+const LEAD_AUTOPILOT_FILL_DELAY_MS = 15 * 60_000;
+const LEAD_AUTOPILOT_PROMPT_LOOP = "personal/knowledge/team-lead-operating-loop.md";
+const LEAD_AUTOPILOT_KPI_STALE_AFTER_MINUTES = 55;
+const LEAD_AUTOPILOT_HEADLINE_STALE_AFTER_MINUTES = 55;
 const LIVE_STATES = new Set(["running", "queued", "awaiting_input", "blocked"]);
 const OPEN_STORY_STATES = new Set(["todo", "queued", "in_progress", "review", "blocked"]);
 function isOpenProjectStory(story) {

package/dist/lib/lanes/flag-keys.d.ts

@@ -16,6 +16,8 @@ export declare const LANE_AUTOPILOT_MISSED_DEADLINE_ESCALATION_FLAG = "lanes.aut
 export declare const LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG = "lanes.message-route-owner-host";
 /** Enables stale manager-status KPI reporting and one-time lead nudges. */
 export declare const LEAD_AUTOPILOT_KPI_STALENESS_FLAG = "lanes.autopilot-kpi-staleness";
+/** Enables precise scheduling and priority admission for due lead keep-alive wakes. */
+export declare const LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG = "lanes.keep-alive-due-wake-precise";
 /** Enables staleness notices for a registered lead's dashboard headline. */
 export declare const LEAD_AUTOPILOT_HEADLINE_STALENESS_FLAG = "lanes.autopilot-headline-staleness";
 /** Lets an Outpost's autopilot wake leads created on that Outpost, which record a local host. */

package/dist/lib/lanes/flag-keys.js

@@ -16,6 +16,8 @@ export const LANE_AUTOPILOT_MISSED_DEADLINE_ESCALATION_FLAG = "lanes.autopilot-m
 export const LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG = "lanes.message-route-owner-host";
 /** Enables stale manager-status KPI reporting and one-time lead nudges. */
 export const LEAD_AUTOPILOT_KPI_STALENESS_FLAG = "lanes.autopilot-kpi-staleness";
+/** Enables precise scheduling and priority admission for due lead keep-alive wakes. */
+export const LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG = "lanes.keep-alive-due-wake-precise";
 /** Enables staleness notices for a registered lead's dashboard headline. */
 export const LEAD_AUTOPILOT_HEADLINE_STALENESS_FLAG = "lanes.autopilot-headline-staleness";
 /** Lets an Outpost's autopilot wake leads created on that Outpost, which record a local host. */

package/dist/lib/lanes/keep-alive.d.ts

@@ -44,6 +44,8 @@ export interface KeepAliveDoneEnvelope {
 }
 export type DoneKeepAliveVerdict = "eligible" | "standing_idle" | "story_complete" | "next_check_at";
 export declare function keepAliveNextCheckAtMs(value: unknown, nowMs: number, anchorMs?: number): number | undefined;
+/** Shared due-time decision for pre-admission ordering and the resume path. */
+export declare function dueKeepAliveNextCheckMs(nextCheckMs: number, nowMs: number, anchorMs: number, preciseDueWakeEnabled: boolean): number | undefined;
 /** Shared done-state policy used by watch, reconcile, and the show command. */
 export declare function doneKeepAliveVerdict(lane: Pick<LaneRecord, "keep_alive_standing">, envelope: KeepAliveDoneEnvelope, hasQueuedWork: boolean, options?: {
     hasPendingWork?: boolean;

package/dist/lib/lanes/keep-alive.js

@@ -113,6 +113,15 @@ export function keepAliveNextCheckAtMs(value, nowMs, anchorMs = nowMs) {
     const capped = Math.min(parsed, stableAnchorMs + LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_MAX_DELAY_MS);
     return capped > nowMs ? capped : undefined;
 }
+/** Shared due-time decision for pre-admission ordering and the resume path. */
+export function dueKeepAliveNextCheckMs(nextCheckMs, nowMs, anchorMs, preciseDueWakeEnabled) {
+    if (!Number.isFinite(nextCheckMs) || !Number.isFinite(nowMs) || !Number.isFinite(anchorMs))
+        return undefined;
+    const capped = Math.min(nextCheckMs, anchorMs + LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_MAX_DELAY_MS);
+    if (capped > nowMs || (preciseDueWakeEnabled && capped <= anchorMs))
+        return undefined;
+    return capped;
+}
 /** Shared done-state policy used by watch, reconcile, and the show command. */
 export function doneKeepAliveVerdict(lane, envelope, hasQueuedWork, options = {}) {
     if (envelope.decision !== "done")

package/dist/lib/lanes/reconcile.js

@@ -22,12 +22,12 @@ import { ANSWERED_QUESTIONS_FILE, armLaneWatcher, envelopeRepairMode, isPidRecor
 import { appendCappedHistory, lanesStoreRoot, parseLaneRecord, parseQuestionRecord, readLane, readQuestion, listQuestionIds, updateLane, updateQuestion, } from "./store.js";
 import { applyThrottleDecision, decideAdmission, defaultThrottleDeps, emptyThrottleState, evaluateThrottle, isCpuCheckEnabled, readAvailableMemMb, readThrottleState, resolveCpuBusyFraction, sampleCpuBusyObservation, recordCpuBusyObservation, throttleStatePath, writeThrottleState, } from "./throttle.js";
 import { readLanesRegistryFlag, readLanesRegistryFlagFailOff } from "./registry-flag.js";
-import { LANE_HIRE_GRANT_FINISHED_LANES_FLAG, LANE_LEAD_ADMISSION_PRIORITY_FLAG } from "./flag-keys.js";
+import { LANE_HIRE_GRANT_FINISHED_LANES_FLAG, LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG, LANE_LEAD_ADMISSION_PRIORITY_FLAG, } from "./flag-keys.js";
 import { checkLaneDiskSpace, configuredCodexRolloutHomes, laneDiskAccount, retainCodexRollouts } from "./disk-guard.js";
 import { laneCompanyUidSource, resolveLaneCompany } from "./lane-company.js";
 import { appendDropboxMessage } from "./dropbox.js";
 import { DEFAULT_RUNAWAY_SEARCH_GUARD_CONFIG, listHostProcesses, runRunawayToolGuard, RUNAWAY_TOOL_GUARD_FLAG, } from "./runaway-tool-guard.js";
-import { LEAD_LANE_KEEP_ALIVE_FLAG, LEAD_LANE_KEEP_ALIVE_RESUME_BLOCKED_FLAG, LEAD_LANE_KEEP_ALIVE_IMMEDIATE_FIRST_RESUME_FLAG, LEAD_LANE_KEEP_ALIVE_FIRST_RESUME_SETTLE_MS, LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_MAX_DELAY_MS, LEAD_LANE_KEEP_ALIVE_BLOCKED_GRACE_MS, LEAD_LANE_KEEP_ALIVE_BLOCKED_RESUME_TEXT, queueLaneTerminalResume, LEAD_LANE_KEEP_ALIVE_INTERRUPTED_RESUME_TEXT, LEAD_LANE_KEEP_ALIVE_MAX_RESUMES, LEAD_LANE_KEEP_ALIVE_RESUME_TEXT, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, doneKeepAliveVerdict, hasPendingKeepAliveWork, keepAliveNextCheckAtMs, keepAliveExclusion, loadRetiredLaneIds, leadLaneKeepAliveBackoffMs, undeliveredAnsweredQuestions, } from "./keep-alive.js";
+import { LEAD_LANE_KEEP_ALIVE_FLAG, LEAD_LANE_KEEP_ALIVE_RESUME_BLOCKED_FLAG, LEAD_LANE_KEEP_ALIVE_IMMEDIATE_FIRST_RESUME_FLAG, LEAD_LANE_KEEP_ALIVE_FIRST_RESUME_SETTLE_MS, LEAD_LANE_KEEP_ALIVE_BLOCKED_GRACE_MS, LEAD_LANE_KEEP_ALIVE_BLOCKED_RESUME_TEXT, queueLaneTerminalResume, LEAD_LANE_KEEP_ALIVE_INTERRUPTED_RESUME_TEXT, LEAD_LANE_KEEP_ALIVE_MAX_RESUMES, LEAD_LANE_KEEP_ALIVE_RESUME_TEXT, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, doneKeepAliveVerdict, dueKeepAliveNextCheckMs, hasPendingKeepAliveWork, keepAliveNextCheckAtMs, keepAliveExclusion, loadRetiredLaneIds, leadLaneKeepAliveBackoffMs, undeliveredAnsweredQuestions, } from "./keep-alive.js";
 import { providerSupportsSessionResume } from "./delivery.js";
 import { isIsoDateTime } from "./types.js";
 import { applyDefaultQuotaHold, clearAccountQuotaAfterSuccessfulTurnBestEffort, loadQuotaState, readQuotaSignal, recordAccountQuota, } from "./quota.js";
@@ -1236,6 +1236,7 @@ export async function runPassBody(hqRoot, deps) {
     const keepAliveFlagByCompany = new Map();
     const blockedResumeFlagByCompany = new Map();
     const immediateFirstResumeFlagByCompany = new Map();
+    const preciseDueWakeFlagByCompany = new Map();
     const supersessionLineageAwareByCompany = new Map();
     await Promise.all([...keepAliveFlagCompanies.entries()].map(async ([key, company]) => {
         const options = {
@@ -1246,17 +1247,19 @@ export async function runPassBody(hqRoot, deps) {
             lane.keep_alive === true &&
             laneRunsHere(lane, startDeps.host) &&
             keepAliveCompanyKey(resolveLaneCompany(hqRoot, lane).company) === key);
-        const [keepAliveEnabled, lineageAware, blockedResumeEnabled, immediateFirstResumeEnabled] = await Promise.all([
+        const [keepAliveEnabled, lineageAware, blockedResumeEnabled, immediateFirstResumeEnabled, preciseDueWakeEnabled] = await Promise.all([
             readRegistryFlag(LEAD_LANE_KEEP_ALIVE_FLAG, options),
             readRegistryFlag(LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, options),
             hasBlockedKeepAliveLane
                 ? readRegistryFlag(LEAD_LANE_KEEP_ALIVE_RESUME_BLOCKED_FLAG, options)
                 : Promise.resolve(false),
             readRegistryFlag(LEAD_LANE_KEEP_ALIVE_IMMEDIATE_FIRST_RESUME_FLAG, options),
+            readRegistryFlag(LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG, options),
         ]);
         keepAliveFlagByCompany.set(key, keepAliveEnabled);
         blockedResumeFlagByCompany.set(key, blockedResumeEnabled);
         immediateFirstResumeFlagByCompany.set(key, immediateFirstResumeEnabled);
+        preciseDueWakeFlagByCompany.set(key, preciseDueWakeEnabled);
         supersessionLineageAwareByCompany.set(key, lineageAware);
     }));
     const admissionThrottleDeps = startDeps.throttleDeps ?? defaultThrottleDeps(startDeps.env ?? process.env);
@@ -1278,7 +1281,7 @@ export async function runPassBody(hqRoot, deps) {
         const freshLanes = loadLaneRecords(hqRoot, summary);
         const freshQuestions = loadQuestionRecords(hqRoot, summary);
         await closeInterruptedDoneStoryWorkers(hqRoot, freshLanes, freshQuestions, summary, admissionDeps, now, storyCloseEnabledByCompany);
-        const dueKeepAlivesAdmitted = await resumeKeepAlive(hqRoot, freshLanes, freshQuestions, summary, admissionDeps, now, keepAliveFlagByCompany, supersessionLineageAwareByCompany, blockedResumeFlagByCompany, immediateFirstResumeFlagByCompany, deps.terminalKeepAliveCandidate, async (laneIds) => {
+        const dueKeepAlivesAdmitted = await resumeKeepAlive(hqRoot, freshLanes, freshQuestions, summary, admissionDeps, now, keepAliveFlagByCompany, supersessionLineageAwareByCompany, blockedResumeFlagByCompany, immediateFirstResumeFlagByCompany, preciseDueWakeFlagByCompany, deps.terminalKeepAliveCandidate, async (laneIds) => {
             dueKeepAliveLaneIds = new Set(laneIds);
             await admitQueued(hqRoot, loadLaneRecords(hqRoot, summary), summary, admissionDeps, now, laneIds);
         });
@@ -2513,7 +2516,7 @@ function appendBlockedKeepAliveHistory(hqRoot, lane, terminalAt, at, reason, dep
         }),
     }), false);
 }
-async function resumeKeepAlive(hqRoot, lanes, questions, summary, deps, now, flagByCompany, supersessionLineageAwareByCompany, blockedResumeFlagByCompany, immediateFirstResumeFlagByCompany, terminalKeepAliveCandidate, admitDueCandidates) {
+async function resumeKeepAlive(hqRoot, lanes, questions, summary, deps, now, flagByCompany, supersessionLineageAwareByCompany, blockedResumeFlagByCompany, immediateFirstResumeFlagByCompany, preciseDueWakeFlagByCompany, terminalKeepAliveCandidate, admitDueCandidates) {
     const nowMs = now.getTime();
     const nowIso = now.toISOString();
     const config = loadLanesConfig(hqRoot);
@@ -2546,10 +2549,14 @@ async function resumeKeepAlive(hqRoot, lanes, questions, summary, deps, now, fla
                 continue;
             const anchorMs = Date.parse(lane.last_envelope?.at ?? lane.updated_at);
             const nextCheckMs = Date.parse(envelope.next_check_at ?? "");
-            if (!Number.isFinite(anchorMs) || !Number.isFinite(nextCheckMs))
+            if (!Number.isFinite(anchorMs))
                 continue;
-            const cappedNextCheckMs = Math.min(nextCheckMs, anchorMs + LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_MAX_DELAY_MS);
-            if (cappedNextCheckMs <= nowMs &&
+            const companyKey = keepAliveCompanyKey(resolveLaneCompany(hqRoot, lane).company);
+            const preciseDueWakeEnabled = preciseDueWakeFlagByCompany.get(companyKey) === true;
+            // This set only accelerates lanes with an explicit due next-check. Retry
+            // backoff is decided once in the resume path and queuedDueCandidateIds.
+            const dueNextCheckMs = dueKeepAliveNextCheckMs(nextCheckMs, nowMs, anchorMs, preciseDueWakeEnabled);
+            if (dueNextCheckMs !== undefined &&
                 doneKeepAliveVerdict(lane, envelope, false, { nowMs, nextCheckAnchorMs: anchorMs }) === "eligible")
                 dueCandidateIds.add(lane.lane_id);
         }
@@ -2939,23 +2946,13 @@ async function resumeKeepAlive(hqRoot, lanes, questions, summary, deps, now, fla
         const storedNextMs = resetByHuman
             ? Number.NaN
             : Date.parse(current.keep_alive_next_eligible_at ?? "");
-        const nextEligibleMs = Number.isFinite(storedNextMs)
+        let nextEligibleMs = Number.isFinite(storedNextMs)
             ? Math.max(attemptEligibleMs, storedNextMs)
             : attemptEligibleMs;
-        if (nowMs < nextEligibleMs) {
-            let skipLane = current;
-            if (resetByHuman && hasKeepAliveProgress(current)) {
-                const clearedProgress = casLaneIf(hqRoot, current.lane_id, (latestLane) => latestLane.version === current.version &&
-                    latestLane.state === current.state &&
-                    latestLane.keep_alive === true &&
-                    latestLane.keep_alive_opted_in_at === current.keep_alive_opted_in_at, (latestLane) => clearedKeepAliveProgress(latestLane), deps.dryRun);
-                skipLane = clearedProgress.record;
-            }
-            recordKeepAliveSkipEvent(hqRoot, skipLane, "backoff", skipLane.version, summary, deps, new Date(nextEligibleMs).toISOString());
-            continue;
-        }
-        const nextEligibleAt = new Date(nowMs + leadLaneKeepAliveBackoffMs(immediateFirstResumeEnabled ? attempt : attempt + 1)).toISOString();
         let resumeReason = "backoff";
+        let dueNextCheckMs;
+        const preciseDueWakeEnabled = initialState === "done" &&
+            preciseDueWakeFlagByCompany.get(keepAliveCompanyKey(companyForLane(current))) === true;
         if (initialState === "done") {
             if (hasPendingKeepAliveWork(hqRoot, current, questions)) {
                 resumeReason = "pending_work";
@@ -2965,13 +2962,30 @@ async function resumeKeepAlive(hqRoot, lanes, questions, summary, deps, now, fla
                 const nextCheckMs = Date.parse(finalEnvelope?.next_check_at ?? "");
                 const anchorMs = Date.parse(current.last_envelope?.at ?? current.updated_at);
                 if (Number.isFinite(nextCheckMs) && Number.isFinite(anchorMs)) {
-                    const cappedNextCheckMs = Math.min(nextCheckMs, anchorMs + LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_MAX_DELAY_MS);
-                    if (cappedNextCheckMs > nextEligibleMs && cappedNextCheckMs <= nowMs) {
+                    const eligibleNextCheckMs = dueKeepAliveNextCheckMs(nextCheckMs, nowMs, anchorMs, preciseDueWakeEnabled);
+                    if (eligibleNextCheckMs !== undefined &&
+                        (preciseDueWakeEnabled || eligibleNextCheckMs > nextEligibleMs)) {
                         resumeReason = "next_check_at_due";
+                        dueNextCheckMs = eligibleNextCheckMs;
+                        if (preciseDueWakeEnabled)
+                            nextEligibleMs = Math.min(nextEligibleMs, eligibleNextCheckMs);
                     }
                 }
             }
         }
+        if (nowMs < nextEligibleMs) {
+            let skipLane = current;
+            if (resetByHuman && hasKeepAliveProgress(current)) {
+                const clearedProgress = casLaneIf(hqRoot, current.lane_id, (latestLane) => latestLane.version === current.version &&
+                    latestLane.state === current.state &&
+                    latestLane.keep_alive === true &&
+                    latestLane.keep_alive_opted_in_at === current.keep_alive_opted_in_at, (latestLane) => clearedKeepAliveProgress(latestLane), deps.dryRun);
+                skipLane = clearedProgress.record;
+            }
+            recordKeepAliveSkipEvent(hqRoot, skipLane, "backoff", skipLane.version, summary, deps, new Date(nextEligibleMs).toISOString());
+            continue;
+        }
+        const nextEligibleAt = new Date(nowMs + leadLaneKeepAliveBackoffMs(immediateFirstResumeEnabled ? attempt : attempt + 1)).toISOString();
         const queuedCount = loadLaneRecords(hqRoot, summary).filter((queuedLane) => queuedLane.state === "queued" &&
             queuedLane.provider === current.provider &&
             laneRunsHere(queuedLane, deps.host) &&
@@ -3233,7 +3247,8 @@ async function resumeKeepAlive(hqRoot, lanes, questions, summary, deps, now, fla
         }
         if (!queued.changed)
             continue;
-        if (resumeReason === "next_check_at_due")
+        if (resumeReason === "next_check_at_due" ||
+            (preciseDueWakeEnabled && initialState === "done" && nowMs >= nextEligibleMs && dueNextCheckMs === undefined))
             queuedDueCandidateIds.add(current.lane_id);
         summary.resumed.push({
             id: current.lane_id,
@@ -3478,11 +3493,13 @@ async function runTerminalKeepAliveCandidatePass(hqRoot, lanes, summary, deps, n
     let keepAliveEnabled;
     let lineageAware;
     let immediateFirstResumeEnabled;
+    let preciseDueWakeEnabled;
     try {
-        [keepAliveEnabled, lineageAware, immediateFirstResumeEnabled] = await Promise.all([
+        [keepAliveEnabled, lineageAware, immediateFirstResumeEnabled, preciseDueWakeEnabled] = await Promise.all([
             readFlag(LEAD_LANE_KEEP_ALIVE_FLAG, options),
             readFlag(LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, options),
             readFlag(LEAD_LANE_KEEP_ALIVE_IMMEDIATE_FIRST_RESUME_FLAG, options),
+            readFlag(LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG, options),
         ]);
     }
     catch (err) {
@@ -3497,7 +3514,7 @@ async function runTerminalKeepAliveCandidatePass(hqRoot, lanes, summary, deps, n
         const current = freshLanes.find((row) => row.lane_id === candidate.laneId);
         if (!current || current.version !== candidate.version || current.state !== "done")
             return;
-        await resumeKeepAlive(hqRoot, freshLanes, freshQuestions, summary, deps, now, new Map([[keepAliveCompanyKey(company), true]]), new Map([[keepAliveCompanyKey(company), lineageAware]]), new Map(), new Map([[keepAliveCompanyKey(company), immediateFirstResumeEnabled]]), candidate);
+        await resumeKeepAlive(hqRoot, freshLanes, freshQuestions, summary, deps, now, new Map([[keepAliveCompanyKey(company), true]]), new Map([[keepAliveCompanyKey(company), lineageAware]]), new Map(), new Map([[keepAliveCompanyKey(company), immediateFirstResumeEnabled]]), new Map([[keepAliveCompanyKey(company), preciseDueWakeEnabled]]), candidate);
         await admitQueued(hqRoot, loadLaneRecords(hqRoot, summary), summary, deps, now, new Set([candidate.laneId]));
     });
     return summary;

package/dist/lib/lanes/tracker-report.d.ts

@@ -3,12 +3,12 @@ import type { QuestionRecord } from "./types.js";
 import type { TrackerRecord } from "./tracker-store.js";
 export type ReportStoryStatus = "queued" | "in_progress" | "review" | "done" | "dropped";
 export type ReportAudience = "owner" | "operator" | "lane";
-export type ApprovalState = "proposal" | "approved";
+type ApprovalState = "proposal" | "approved";
 export interface TrackerReportRecord extends TrackerRecord {
     /** Absolute path of the validated on-disk record; used only in errors. */
     source_path: string;
 }
-export interface TrackerReportStory {
+interface TrackerReportStory {
     id: string;
     title: string;
     status: ReportStoryStatus;
@@ -24,18 +24,18 @@ export interface TrackerReportIssue {
     record_id?: string;
     question_id?: string;
 }
-export interface TrackerReportPullRequest {
+interface TrackerReportPullRequest {
     number: string;
     title: string;
     merged_at: string;
     source_path: string;
 }
-export interface TrackerReportRelease {
+interface TrackerReportRelease {
     version: string;
     released_at: string;
     source_path: string;
 }
-export interface TrackerReportQuestion {
+interface TrackerReportQuestion {
     record: QuestionRecord;
     /** Loaded through the existing company-checked question body reader. */
     body: QuestionBody;
@@ -63,22 +63,22 @@ export interface TrackerReportInput {
     since_source: "explicit" | "previous_report" | "first_run";
     teams: readonly TrackerReportTeamInput[];
 }
-export interface ReportTimedStory {
+interface ReportTimedStory {
     id: string;
     title: string;
     at: string;
     references: string[];
 }
-export interface ReportPullRequest {
+interface ReportPullRequest {
     number: string;
     title: string;
     merged_at: string;
 }
-export interface ReportRelease {
+interface ReportRelease {
     version: string;
     released_at: string;
 }
-export interface ReportKpiValue {
+interface ReportKpiValue {
     kpi_id: string;
     name: string;
     at: string;
@@ -86,7 +86,7 @@ export interface ReportKpiValue {
     unit: string;
     source: string;
 }
-export interface ReportQuestion {
+interface ReportQuestion {
     question_id: string;
     question: string;
     asked_at: string;
@@ -99,7 +99,7 @@ export interface ReportQuestion {
         answered_by: string;
     };
 }
-export interface ReportBlocker {
+interface ReportBlocker {
     id: string;
     story_id: string;
     what: string;
@@ -107,7 +107,7 @@ export interface ReportBlocker {
     next_step: string;
     opened_at: string;
 }
-export interface ReportDirective {
+interface ReportDirective {
     id: string;
     text: string;
     date: string;
@@ -117,7 +117,7 @@ export interface ReportDirective {
         at: string;
     }>;
 }
-export interface TrackerOwnerTeamReport {
+interface TrackerOwnerTeamReport {
     team: string;
     project_id: string;
     errors: TrackerReportIssue[];
@@ -142,7 +142,7 @@ export interface TrackerOwnerReport {
     since_source: TrackerReportInput["since_source"];
     teams: TrackerOwnerTeamReport[];
 }
-export interface TrackerTeamKpi {
+interface TrackerTeamKpi {
     id: string;
     name: string;
     definition: string;
@@ -162,7 +162,7 @@ export interface TrackerTeamKpi {
     }>;
     trend: "improving" | "regressing" | "flat" | "insufficient_data";
 }
-export interface TrackerTeamOkr {
+interface TrackerTeamOkr {
     id: string;
     objective: string;
     period: string;
@@ -200,4 +200,5 @@ export declare function buildTrackerTeamPage(team: TrackerReportTeamInput, compa
 export declare function renderTrackerOwnerReportText(report: TrackerOwnerReport): string;
 /** Human-readable team page, with proposal status visible beside each objective and KPI. */
 export declare function renderTrackerTeamPageText(page: TrackerTeamPage): string;
+export {};
 //# sourceMappingURL=tracker-report.d.ts.map

package/dist/lib/lanes/wait.d.ts

@@ -1,11 +1,7 @@
 import type { LaneRecord, QuestionRecord } from "./types.js";
-export declare const LANE_WAIT_POLL_INTERVAL_MS = 2000;
-export declare const LANE_WAIT_MAX_LANES = 64;
 export declare const LANE_WAIT_TIMEOUT_EXIT_CODE = 4;
 export declare const LANE_WAIT_INVALID_INPUT_EXIT_CODE = 2;
-export declare const LANE_WAIT_CHANGE_TYPES: readonly ["envelope", "question", "state"];
-export type LaneWaitChangeType = (typeof LANE_WAIT_CHANGE_TYPES)[number];
-export type LaneWaitChange = {
+type LaneWaitChange = {
     type: "envelope";
     ref: string;
     decision: "done" | "ask" | "blocked";
@@ -36,4 +32,5 @@ export interface LaneWaitDeps {
  * lock. Question records are scanned in one pass when question changes matter.
  */
 export declare function runLaneWait(hqRoot: string, laneIds: readonly string[], changeTypes: readonly string[], timeoutMs: number, deps?: LaneWaitDeps): Promise<LaneWaitResult | null>;
+export {};
 //# sourceMappingURL=wait.d.ts.map

package/dist/lib/lanes/wait.js

@@ -1,10 +1,10 @@
 import { listQuestionIds, readLane, readQuestion } from "./store.js";
 import { LanesError } from "./errors.js";
-export const LANE_WAIT_POLL_INTERVAL_MS = 2_000;
-export const LANE_WAIT_MAX_LANES = 64;
+const LANE_WAIT_POLL_INTERVAL_MS = 2_000;
+const LANE_WAIT_MAX_LANES = 64;
 export const LANE_WAIT_TIMEOUT_EXIT_CODE = 4;
 export const LANE_WAIT_INVALID_INPUT_EXIT_CODE = 2;
-export const LANE_WAIT_CHANGE_TYPES = ["envelope", "question", "state"];
+const LANE_WAIT_CHANGE_TYPES = ["envelope", "question", "state"];
 function defaultSleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.7",
+  "version": "5.345.8",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {