@ours.network/fleet 0.15.0 → 0.15.3

package/dist/owner-channel/binder.js

@@ -0,0 +1,224 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { replaceFileAtomically } from '../atomic-file.js';
+export const OWNER_BIND_HANDOFF_TIMEOUT_MS = 5_000;
+const OWNER_BIND_POLL_MS = 50;
+const LOCK_DIR = '.owner-channel-binder.lock';
+const RECLAIM_DIR = '.owner-channel-binder.reclaim.lock';
+const LAST_OWNER_FILE = '.owner-channel-binder.json';
+export class OwnerBinderConflictError extends Error {
+}
+export class OwnerBinderHandoffTimeoutError extends Error {
+}
+const defaultAlive = (pid) => {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+/** Linux PID-reuse fence. Other platforms return undefined and stay conservative. */
+const defaultProcessMarker = (pid) => {
+    try {
+        const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+        const end = stat.lastIndexOf(')');
+        return stat.slice(end + 2).split(/\s+/)[19];
+    }
+    catch {
+        return undefined;
+    }
+};
+function parseOwner(path) {
+    let value;
+    try {
+        value = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        throw new OwnerBinderConflictError('owner-channel binder ownership cannot be verified safely');
+    }
+    const owner = value;
+    if (owner.version !== 1 || typeof owner.role !== 'string' || typeof owner.identity !== 'string'
+        || !Number.isSafeInteger(owner.pid) || Number(owner.pid) < 2
+        || typeof owner.instance !== 'string' || !owner.instance
+        || !Number.isFinite(owner.acquiredAt))
+        throw new OwnerBinderConflictError('owner-channel binder ownership cannot be verified safely');
+    return owner;
+}
+function sameOwner(a, b) {
+    return a.instance === b.instance && a.pid === b.pid && a.role === b.role
+        && a.identity === b.identity;
+}
+/**
+ * Serialize the one supervisor-owned binder for a role. A live matching holder
+ * is an overlapping predecessor and gets a bounded handoff window. A holder
+ * for any other role/identity, or unverifiable metadata, remains fail-closed.
+ */
+export async function acquireOwnerBinderLease(stateDir, role, identity, deps = {}, timeoutMs = OWNER_BIND_HANDOFF_TIMEOUT_MS) {
+    const now = deps.now ?? (() => Date.now());
+    const sleep = deps.sleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms)));
+    const alive = deps.alive ?? defaultAlive;
+    const processMarker = deps.processMarker ?? defaultProcessMarker;
+    const lockDir = join(stateDir, LOCK_DIR);
+    const reclaimDir = join(stateDir, RECLAIM_DIR);
+    const ownerPath = join(lockDir, 'owner.json');
+    const releasedPath = join(stateDir, LAST_OWNER_FILE);
+    const startedAt = now();
+    let inherited = false;
+    const ours = {
+        version: 1, role, identity, pid: process.pid,
+        ...(processMarker(process.pid) ? { marker: processMarker(process.pid) } : {}),
+        instance: randomUUID(), acquiredAt: startedAt,
+    };
+    mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    for (;;) {
+        try {
+            mkdirSync(lockDir, { mode: 0o700 });
+            writeFileSync(ownerPath, JSON.stringify(ours) + '\n', { mode: 0o600 });
+            // A reclaimer may have installed its gate after our mkdir. It will
+            // re-check the canonical owner before claiming, while we withdraw our
+            // own raced acquisition before returning.
+            if (existsSync(reclaimDir)) {
+                const check = parseOwner(ownerPath);
+                if (!sameOwner(check, ours))
+                    throw new OwnerBinderConflictError('owner-channel binder ownership changed during acquisition');
+                rmSync(lockDir, { recursive: true, force: true });
+                if (now() - startedAt >= timeoutMs)
+                    throw new OwnerBinderHandoffTimeoutError(`owner-channel binder reclaim did not complete within ${timeoutMs}ms`);
+                await sleep(Math.min(OWNER_BIND_POLL_MS, Math.max(1, timeoutMs - (now() - startedAt))));
+                continue;
+            }
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            let current;
+            try {
+                current = parseOwner(ownerPath);
+            }
+            catch (readError) {
+                // The winning process may be between atomic mkdir and its tiny metadata write.
+                if (now() - startedAt < OWNER_BIND_POLL_MS * 2) {
+                    await sleep(OWNER_BIND_POLL_MS);
+                    continue;
+                }
+                throw readError;
+            }
+            if (current.role !== role || current.identity !== identity)
+                throw new OwnerBinderConflictError(`owner-channel identity '${identity}' is reserved by foreign binder `
+                    + `'${current.role}' for '${current.identity}'`);
+            inherited = true;
+            const currentMarker = processMarker(current.pid);
+            const stale = !alive(current.pid)
+                || Boolean(current.marker && currentMarker && current.marker !== currentMarker);
+            if (stale) {
+                await deps.beforeReclaim?.();
+                try {
+                    mkdirSync(reclaimDir, { mode: 0o700 });
+                }
+                catch (gateError) {
+                    if (gateError.code === 'EEXIST') {
+                        await sleep(OWNER_BIND_POLL_MS);
+                        continue;
+                    }
+                    throw gateError;
+                }
+                const tombstone = `${lockDir}.reclaim-${ours.instance}`;
+                let acquiredFromClaim = false;
+                try {
+                    const check = parseOwner(ownerPath);
+                    if (!sameOwner(current, check))
+                        continue;
+                    try {
+                        renameSync(lockDir, tombstone);
+                    }
+                    catch (claimError) {
+                        if (claimError.code === 'ENOENT')
+                            continue;
+                        throw claimError;
+                    }
+                    let claimed;
+                    try {
+                        claimed = parseOwner(join(tombstone, 'owner.json'));
+                    }
+                    catch (claimError) {
+                        // Preserve an unverifiable claim. Restore it only if nobody has
+                        // already acquired the canonical path; otherwise fail closed.
+                        try {
+                            renameSync(tombstone, lockDir);
+                        }
+                        catch { /* keep the claim quarantined */ }
+                        throw claimError;
+                    }
+                    if (!sameOwner(current, claimed)) {
+                        // Never delete a replacement: put it back when possible, otherwise
+                        // retain the unique tombstone as the fail-closed claimed record.
+                        try {
+                            renameSync(tombstone, lockDir);
+                        }
+                        catch { /* keep the claim quarantined */ }
+                        throw new OwnerBinderConflictError('owner-channel binder changed while stale ownership was being claimed');
+                    }
+                    rmSync(tombstone, { recursive: true, force: true });
+                    // Keep the gate until our replacement is durable. Any acquisition
+                    // that raced the rename observes the gate and withdraws itself.
+                    for (;;) {
+                        try {
+                            mkdirSync(lockDir, { mode: 0o700 });
+                            writeFileSync(ownerPath, JSON.stringify(ours) + '\n', { mode: 0o600 });
+                            acquiredFromClaim = true;
+                            break;
+                        }
+                        catch (replacementError) {
+                            if (replacementError.code !== 'EEXIST')
+                                throw replacementError;
+                            if (now() - startedAt >= timeoutMs)
+                                throw new OwnerBinderHandoffTimeoutError(`could not complete stale owner-channel binder claim within ${timeoutMs}ms`);
+                            await sleep(1);
+                        }
+                    }
+                }
+                finally {
+                    rmSync(reclaimDir, { recursive: true, force: true });
+                }
+                if (acquiredFromClaim)
+                    break;
+                continue;
+            }
+            if (now() - startedAt >= timeoutMs)
+                throw new OwnerBinderHandoffTimeoutError(`previous '${role}' supervisor still owns owner-channel identity '${identity}' `
+                    + `after ${timeoutMs}ms bounded handoff`);
+            await sleep(Math.min(OWNER_BIND_POLL_MS, Math.max(1, timeoutMs - (now() - startedAt))));
+        }
+    }
+    try {
+        const released = JSON.parse(readFileSync(releasedPath, 'utf8'));
+        if (released.version === 1 && released.role === role && released.identity === identity
+            && Number.isFinite(released.releasedAt)
+            && now() - Number(released.releasedAt) <= timeoutMs * 2)
+            inherited = true;
+    }
+    catch { /* absence/corruption cannot grant recovery authority */ }
+    let released = false;
+    return {
+        inherited,
+        release() {
+            if (released)
+                return;
+            released = true;
+            try {
+                const current = parseOwner(ownerPath);
+                if (!sameOwner(current, ours))
+                    return;
+                replaceFileAtomically(releasedPath, JSON.stringify({
+                    ...ours, releasedAt: now(),
+                }) + '\n', 0o600);
+                rmSync(lockDir, { recursive: true, force: true });
+            }
+            catch { /* never remove ownership which cannot be proven to be ours */ }
+        },
+    };
+}

package/dist/owner-channel/channel.d.ts

@@ -2,10 +2,12 @@ import { type ChildProcessWithoutNullStreams } from 'node:child_process';
 import { type OwnerChannelConfig } from '../config.js';
 import type { SessionHandle } from '../session/types.js';
 import { type OwnerFleetOps } from './commands.js';
+import type { ManagedFleetSpawnResult } from '../fleet-proxy.js';
 import { type OursToolClient } from './mcp.js';
 import { type OwnerUpdatePhase } from './notices.js';
 import { type OwnerEntry } from './state.js';
 import { type OwnerTaskPhase } from './tasks.js';
+import { type OwnerBinderDeps, type OwnerBinderLease } from './binder.js';
 export interface OwnerChannelOptions {
     role: string;
     /** Harness id of the role (e.g. 'claude-code', 'codex'); gates which slash commands may be forwarded. */
@@ -23,12 +25,18 @@ export interface OwnerChannelOptions {
     fleet?: OwnerFleetOps;
     /** Forwarded to fleet CLI invocations spawned for owner commands. */
     configPath?: string;
+    /** Deterministic clock/process seams for binder handoff tests. */
+    binderDeps?: OwnerBinderDeps;
+    /** Pre-acquired by the runner so the predecessor control socket remains reachable while waiting. */
+    binderLease?: OwnerBinderLease;
 }
 export interface OwnerChannelHandle {
     start(): Promise<void>;
     drain(): Promise<void>;
     close(): Promise<void>;
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
+    /** Fleet-owned deterministic lifecycle notice; absent on legacy test doubles. */
+    notifyFleetSpawn?(event: ManagedFleetSpawnResult): Promise<void>;
 }
 export type OwnerChannelManagementRequest = {
     action: 'contact_list';
@@ -60,6 +68,8 @@ export type OwnerChannelManagementRequest = {
     taskId: string;
     phase: OwnerTaskPhase;
     message: string;
+} | {
+    action: 'startup_failure';
 };
 export type OwnerChannelManagementResult = {
     action: 'contact_list';
@@ -95,6 +105,9 @@ export type OwnerChannelManagementResult = {
     phase: OwnerTaskPhase;
     sequence: number;
     state: 'open' | 'closed';
+} | {
+    action: 'startup_failure';
+    status: 'delivered' | 'duplicate';
 };
 export type { OwnerUpdatePhase } from './notices.js';
 export interface OwnerContact {
@@ -137,12 +150,15 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private readonly activeRequests;
     private managementTail;
     private ready;
+    private binder?;
+    private binderOwnedInternally;
     private readonly fleetOps;
     constructor(options: OwnerChannelOptions);
     start(): Promise<void>;
     drain(): Promise<void>;
     close(): Promise<void>;
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
+    notifyFleetSpawn(event: ManagedFleetSpawnResult): Promise<void>;
     private manageNow;
     private contacts;
     private contact;
@@ -183,6 +199,15 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private isAgentSender;
     private isEffectiveOwner;
     private relayManagedAgentMessage;
+    /**
+     * Caption and files are admitted as one relay transaction. The authenticated
+     * route and optional source wire are fixed before bytes are retrieved, and no
+     * outbound part is emitted until every file passes admission. A transport
+     * failure after emission starts is durably uncertain and never blind-retried;
+     * the managed agent receives one bounded NACK for the whole transaction.
+     */
+    private handleManagedAgentAttachmentGroup;
+    private managedAttachmentReplyWire;
     /**
      * One bounded NACK per wire: an unroutable or refused relay must be visible
      * to the authenticated agent, while its deferred replays stay quiet. NACK

package/dist/owner-channel/channel.js

@@ -11,6 +11,7 @@ import { ownerNotices } from './notices.js';
 import { DuplicateSendError, OwnerAuthorizationState, OwnerChannelState, OwnerConversationState, } from './state.js';
 import { OwnerTaskState, ownerTaskAuditId, ownerTaskDigest, } from './tasks.js';
 import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, } from './attachments.js';
+import { acquireOwnerBinderLease, OWNER_BIND_HANDOFF_TIMEOUT_MS, } from './binder.js';
 const OWNER_UPDATE_MIN_INTERVAL_MS = 5_000;
 const OWNER_UPDATE_MAX_COUNT = 20;
 const OWNER_UPDATE_MAX_CHARS = 280;
@@ -51,6 +52,8 @@ export class OwnerChannel {
     activeRequests = new Map();
     managementTail = Promise.resolve();
     ready = false;
+    binder;
+    binderOwnedInternally = false;
     fleetOps;
     constructor(options) {
         this.options = options;
@@ -79,8 +82,36 @@ export class OwnerChannel {
     }
     async start() {
         this.stopping = false;
-        await this.client.start();
-        await this.client.callTool('choose_identity', { name: this.options.config.identity });
+        this.binderOwnedInternally = !this.options.binderLease;
+        this.binder = this.options.binderLease ?? await acquireOwnerBinderLease(this.options.stateDir, this.options.role, this.options.config.identity, this.options.binderDeps);
+        try {
+            await this.client.start();
+            const now = this.options.binderDeps?.now ?? (() => Date.now());
+            const sleep = this.options.binderDeps?.sleep
+                ?? (ms => new Promise(resolve => setTimeout(resolve, ms)));
+            const bindStartedAt = now();
+            for (;;) {
+                try {
+                    await this.client.callTool('choose_identity', { name: this.options.config.identity });
+                    break;
+                }
+                catch (error) {
+                    const message = error?.message ?? String(error);
+                    const liveConflict = /currently bound to another live session/i.test(message);
+                    if (!this.binder.inherited || !liveConflict
+                        || now() - bindStartedAt >= OWNER_BIND_HANDOFF_TIMEOUT_MS)
+                        throw error;
+                    await sleep(Math.min(50, Math.max(1, OWNER_BIND_HANDOFF_TIMEOUT_MS - (now() - bindStartedAt))));
+                }
+            }
+        }
+        catch (error) {
+            await this.client.close().catch(closeError => this.logError('startup client close failed', closeError));
+            if (this.binderOwnedInternally)
+                this.binder.release();
+            this.binder = undefined;
+            throw error;
+        }
         if (this.authorizationIntegrity().ok && this.tasks.integrity().ok)
             this.tasks.cleanup(Date.now(), this.effectiveOwners());
         if (this.attachmentRecovery.integrity()) {
@@ -112,13 +143,34 @@ export class OwnerChannel {
         if (watch && watch.exitCode === null)
             watch.kill('SIGTERM');
         await this.managementTail;
-        await this.client.close();
+        try {
+            await this.client.close();
+        }
+        finally {
+            if (this.binderOwnedInternally)
+                this.binder?.release();
+            this.binder = undefined;
+        }
     }
     manage(request) {
         const run = this.managementTail.then(() => this.manageNow(request));
         this.managementTail = run.then(() => undefined, () => undefined);
         return run;
     }
+    notifyFleetSpawn(event) {
+        const run = this.managementTail.then(async () => {
+            if (!this.ready || this.stopping)
+                throw new Error('owner-channel MCP client is unavailable');
+            const model = event.model ? `, model ${event.model}` : '';
+            const monitor = `${event.monitor.mode} monitor${event.monitor.interrupt ? ' with interruption' : ''}`;
+            const inherited = event.inherited.length
+                ? ` Supervisor inherited omitted defaults: ${event.inherited.join(', ')}.` : '';
+            await this.sendProactiveMessage(`🧑‍💻 ${event.caller} spawned ${event.lifetime} agent ${event.role} `
+                + `(${event.harness}/${event.session}${model}; ${monitor}).${inherited}`, `fleet-spawn\0${event.creationActionId}`, 0);
+        });
+        this.managementTail = run.then(() => undefined, () => undefined);
+        return run;
+    }
     async manageNow(request) {
         if (!this.ready || this.stopping)
             throw new Error('owner-channel MCP client is unavailable');
@@ -208,6 +260,18 @@ export class OwnerChannel {
                 if (this.options.config.agent)
                     throw new Error('direct task reports are disabled; the managed agent must message its owner-channel identity');
                 return this.sendOwnerTaskReport(request);
+            case 'startup_failure': {
+                const message = ownerNotices.startupHandoffFailed(this.options.role, this.options.config.identity);
+                try {
+                    await this.sendProactiveMessage(message);
+                }
+                catch (error) {
+                    if (error instanceof DuplicateSendError)
+                        return { action: request.action, status: 'duplicate' };
+                    throw error;
+                }
+                return { action: request.action, status: 'delivered' };
+            }
             default:
                 throw new Error('unknown owner-channel management action');
         }
@@ -287,13 +351,15 @@ export class OwnerChannel {
         await send;
         return { action: request.action, requestId: request.requestId, sequence };
     }
-    async sendProactiveMessage(messageValue) {
+    async sendProactiveMessage(messageValue, digestValue = messageValue, minIntervalMs) {
         if (!this.authorizationIntegrity().ok)
             throw new Error('owner authorization state is corrupt; proactive messages are disabled');
         const message = this.safeProactiveMessage(messageValue);
         const route = this.conversations.route(this.effectiveOwners());
-        const digest = createHash('sha256').update(message).digest('hex');
-        const sending = this.conversations.beginSend(route.contact, digest);
+        const digest = createHash('sha256').update(digestValue).digest('hex');
+        const sending = minIntervalMs === undefined
+            ? this.conversations.beginSend(route.contact, digest)
+            : this.conversations.beginSend(route.contact, digest, Date.now(), minIntervalMs);
         try {
             if (!this.isEffectiveOwner(route.contact))
                 throw new Error('selected proactive owner is no longer authorized');
@@ -492,7 +558,18 @@ export class OwnerChannel {
             if (exact.some(file => file.senderId !== recovery.contact))
                 continue;
             exact.forEach(file => used.add(file.wireId));
-            groups.push({ files: exact, recovery });
+            const caption = recovery.originWireId === recovery.fileWireIds[0]
+                ? undefined : messageByWire.get(recovery.originWireId);
+            if (caption && this.sender(caption).id !== recovery.contact)
+                continue;
+            // A managed-agent caption is deferred before retrieval. If recovery sees
+            // the processed file before that body is replayed, keep the file reserved
+            // by the journal until both halves are present again.
+            if (!caption && !recovery.fileWireIds.includes(recovery.originWireId))
+                continue;
+            if (caption)
+                consumed.add(caption);
+            groups.push({ files: exact, recovery, ...(caption ? { caption } : {}) });
         }
         for (const file of files) {
             if (used.has(file.wireId))
@@ -528,6 +605,9 @@ export class OwnerChannel {
         if (handledWireIds.some(wire => this.inFlight.has(wire)))
             return false;
         const sender = { id: group.files[0].senderId, name: group.files[0].senderName };
+        if (group.files.every(file => this.isAgentSender(file.senderId))
+            && (!group.caption || this.isAgentSender(this.sender(group.caption).id)))
+            return this.handleManagedAgentAttachmentGroup(group, handledWireIds, sender.id);
         if (group.files.some(file => file.senderId !== sender.id)
             || !this.isEffectiveOwner(sender.id)) {
             this.options.log(`[${this.options.role}] owner channel ignored unauthorized attachment sender ${sender.id}`);
@@ -540,6 +620,14 @@ export class OwnerChannel {
                 catch { }
             return true;
         }
+        // Owner files are requests too: retain their authenticated source wire so
+        // a later managed-agent attachment reply cannot drift to a newer owner.
+        try {
+            this.conversations.recordInbound(sender.id, originWireId);
+        }
+        catch (error) {
+            this.logError('owner attachment route update failed', error);
+        }
         const rejection = !this.attachmentRecovery.integrity()
             ? 'attachment recovery state is unavailable'
             : validateAttachmentSelection(group.files, this.attachmentConfig);
@@ -886,6 +974,149 @@ export class OwnerChannel {
             + `wire=${createHash('sha256').update(wireId).digest('hex').slice(0, 12)} `
             + `basis=${route.basis} chars=${Array.from(text).length} bytes=${Buffer.byteLength(text)}`);
     }
+    /**
+     * Caption and files are admitted as one relay transaction. The authenticated
+     * route and optional source wire are fixed before bytes are retrieved, and no
+     * outbound part is emitted until every file passes admission. A transport
+     * failure after emission starts is durably uncertain and never blind-retried;
+     * the managed agent receives one bounded NACK for the whole transaction.
+     */
+    async handleManagedAgentAttachmentGroup(group, handledWireIds, agent) {
+        const captionWire = group.caption ? this.wireId(group.caption) : undefined;
+        const nackWire = captionWire ?? group.files[0].wireId;
+        const nackMessage = group.caption ?? { wire_id: nackWire };
+        let requestDir;
+        let recovery;
+        try {
+            if (!this.authorizationIntegrity().ok)
+                throw new Error('owner authorization state is corrupt; managed-agent relay is disabled');
+            const caption = group.caption ? this.safeRelayMessage(group.caption.text) : undefined;
+            const replyTo = this.managedAttachmentReplyWire(group, captionWire);
+            let route;
+            try {
+                route = replyTo
+                    ? this.conversations.routeForWire(replyTo, this.effectiveOwners())
+                    : this.conversations.route(this.effectiveOwners());
+            }
+            catch (error) {
+                throw new RelayUnroutableError(this.errorText(error));
+            }
+            if (!this.isEffectiveOwner(route.contact))
+                throw new Error('selected attachment relay owner is no longer authorized');
+            const contact = await this.routableContact(route);
+            const rejection = !this.attachmentRecovery.integrity()
+                ? 'attachment recovery state is unavailable'
+                : validateAttachmentSelection(group.files, this.attachmentConfig);
+            if (rejection)
+                throw new Error(rejection);
+            const transactionId = this.requestId(`managed-agent-attachment:${handledWireIds.slice().sort().join(':')}`);
+            recovery = group.recovery ?? {
+                id: transactionId, contact: agent, originWireId: captionWire ?? group.files[0].wireId,
+                fileWireIds: group.files.map(file => file.wireId), createdAt: Date.now(),
+            };
+            if (!group.recovery)
+                this.attachmentRecovery.add(recovery);
+            requestDir = await prepareAttachmentDirectory(this.attachmentRoot, transactionId);
+            const unread = group.files.filter(file => file.status === 'unread');
+            const processed = group.files.filter(file => file.status !== 'unread');
+            const retrieved = unread.length
+                ? parseRetrievedAttachments(await this.client.callTool('get_files', {
+                    wire_ids: unread.map(file => file.wireId),
+                }), unread)
+                : [];
+            for (const file of processed) {
+                if (!group.recovery)
+                    throw new Error('unexpected processed attachment without recovery route');
+                const recoveryPath = join(requestDir, `.recovered-${file.wireId}-${randomUUID()}`);
+                await this.client.callTool('save_file', { wire_id: file.wireId, dest_path: recoveryPath });
+                retrieved.push(await recoveredAttachment(file, recoveryPath));
+            }
+            const order = new Map(group.files.map((file, index) => [file.wireId, index]));
+            retrieved.sort((a, b) => order.get(a.wireId) - order.get(b.wireId));
+            const admitted = await admitAttachments(retrieved, requestDir, this.attachmentConfig);
+            const digest = createHash('sha256').update(`managed-agent-attachment\0${handledWireIds.slice().sort().join('\0')}`).digest('hex');
+            const sending = this.conversations.beginSend(route.contact, digest, Date.now(), 0, 'all');
+            try {
+                if (caption)
+                    await this.send(contact, caption, replyTo);
+                for (const file of admitted) {
+                    await this.client.callTool('send_file', {
+                        contact, path: file.path, filename: file.filename,
+                        ...(replyTo ? { reply_to_wire_id: replyTo } : {}),
+                    });
+                }
+            }
+            catch {
+                try {
+                    this.conversations.finishSend(sending.id, 'uncertain');
+                }
+                catch (error) {
+                    this.logError('managed-agent attachment uncertainty persist failed', error);
+                }
+                throw new Error('caption/file relay delivery outcome is uncertain; it was not retried');
+            }
+            this.conversations.finishSend(sending.id, 'delivered');
+            for (const wire of handledWireIds)
+                this.state.remember(wire);
+            this.attachmentRecovery.remove(recovery.id);
+            this.options.log(`[${this.options.role}] managed-agent attachment transaction relayed `
+                + `wires=${handledWireIds.length} basis=${route.basis} files=${admitted.length} `
+                + `bytes=${admitted.reduce((total, file) => total + file.size, 0)}`);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof DuplicateSendError) {
+                this.options.log(`[${this.options.role}] managed-agent attachment replay consumed`);
+                for (const wire of handledWireIds)
+                    this.state.remember(wire);
+                if (recovery)
+                    try {
+                        this.attachmentRecovery.remove(recovery.id);
+                    }
+                    catch { }
+                return true;
+            }
+            if (error instanceof RelayUnroutableError) {
+                this.options.log(`[${this.options.role}] managed-agent attachment has no owner route; `
+                    + `transaction stays queued: ${this.errorText(error)}`);
+                await this.nackManagedAgent(agent, nackMessage, nackWire, ownerNotices.relayQueued());
+                return false;
+            }
+            this.logError('managed-agent caption/file relay refused', error);
+            await this.nackManagedAgent(agent, nackMessage, nackWire, ownerNotices.relayRefused(this.errorText(error)));
+            // Rejection/admission failure and uncertain transport are terminal and
+            // visible. Consuming every correlated wire prevents a later partial replay.
+            for (const wire of handledWireIds)
+                this.state.remember(wire);
+            if (recovery)
+                try {
+                    this.attachmentRecovery.remove(recovery.id);
+                }
+                catch { }
+            return true;
+        }
+        finally {
+            if (requestDir)
+                await removeRequestDirectory(requestDir).catch(error => {
+                    this.logError('managed-agent attachment cleanup failed', error);
+                });
+        }
+    }
+    managedAttachmentReplyWire(group, captionWire) {
+        const captionReply = group.caption?.reply_to?.wire_id;
+        const candidates = new Set();
+        if (captionReply)
+            candidates.add(captionReply);
+        for (const file of group.files) {
+            const wire = file.replyTo?.wire_id;
+            if (!wire || wire === captionWire)
+                continue;
+            candidates.add(wire);
+        }
+        if (candidates.size > 1)
+            throw new Error('managed-agent caption/file group has conflicting owner reply wires');
+        return candidates.values().next().value;
+    }
     /**
      * One bounded NACK per wire: an unroutable or refused relay must be visible
      * to the authenticated agent, while its deferred replays stay quiet. NACK

package/dist/owner-channel/mcp.js

@@ -70,6 +70,16 @@ export class OursMcpClient {
         this.child = undefined;
         if (!child || child.exitCode !== null)
             return;
+        // EOF lets the proxy close its HTTP MCP transport and release the daemon
+        // lease explicitly. SIGTERM used to leave that release racing the next
+        // supervised start, which is the owner-channel collision this path guards.
+        child.stdin.end();
+        const exited = await new Promise(resolve => {
+            const timer = setTimeout(() => resolve(false), 1_000);
+            child.once('exit', () => { clearTimeout(timer); resolve(true); });
+        });
+        if (exited || child.exitCode !== null)
+            return;
         child.kill('SIGTERM');
         await new Promise(resolve => {
             const timer = setTimeout(() => { child.kill('SIGKILL'); resolve(); }, 5_000);

package/dist/owner-channel/notices.d.ts

@@ -14,6 +14,7 @@ export declare const ownerNotices: {
     commandFailed: (command: string) => string;
     commandUnsupported: (command: string, harness: string) => string;
     restarting: (role: string, command: string, mode: "keep" | "fresh") => string;
+    startupHandoffFailed: (role: string, identity: string) => string;
     attachmentRejected: (reason: string) => string;
     attachmentFailed: () => string;
     deliveryFailed: (role: string) => string;

package/dist/owner-channel/notices.js

@@ -39,6 +39,9 @@ export const ownerNotices = {
     restarting: (role, command, mode) => `ℹ️ ${command} accepted — restarting ${role} ${mode === 'fresh'
         ? 'FRESH (context wiped)' : '(context resumes)'}. `
         + 'The channel goes quiet during the restart and resumes when the agent is back.',
+    startupHandoffFailed: (role, identity) => `⚠️ ${role} owner channel could not take over '${identity}' from its previous supervisor. `
+        + `Recovery: send /restart to retry the supervised handoff; if this repeats, inspect the web `
+        + `console or run ours-fleet logs ${role}.`,
     attachmentRejected: (reason) => `⚠️ Attachment rejected: ${reason}.`,
     attachmentFailed: () => '⚠️ Could not securely retrieve or admit this attachment request.',
     deliveryFailed: (role) => `⚠️ Could not deliver this request to ${role}.`,