@ours.network/fleet 0.17.6 → 0.17.7

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "0.17.6",
-  "buildId": "a2f7650e3a39",
-  "commit": "96df9112202bb3957d18d95bc4210c1cf49d867f",
+  "version": "0.17.7",
+  "buildId": "8afdf08c9c69",
+  "commit": "1a6243fe213281c0b82f5bfeaf97dfc4c697fcf7",
   "dirty": false,
-  "builtAt": "2026-08-17T11:51:49.146Z",
+  "builtAt": "2026-08-17T12:01:37.858Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/cli.js

@@ -648,7 +648,10 @@ function renderLoopRows(role, state, loop) {
     return Object.entries(state.loops).filter(([name]) => !loop || name === loop).map(([name, item]) => `${role}/${name} ${item.enabled && !item.operatorDisabled ? 'enabled' : 'disabled'} `
         + `${item.activeRunId ? 'running' : 'idle'} next=${item.nextDueAt} last=${item.lastOutcome ?? 'never'} `
         + `counts=${item.counts.started}/${item.counts.completed}/${item.counts.failed} `
-        + `skip=${item.counts.skipped}(busy=${item.counts.skippedBusy},missed=${item.counts.skippedMissed})`);
+        + `skip=${item.counts.skipped}(busy=${item.counts.skippedBusy},missed=${item.counts.skippedMissed})`
+        + (item.missedGap
+            ? ` gap=${item.missedGap.count}@${item.missedGap.fromAt}..${item.missedGap.throughAt}`
+            : ''));
 }
 cOpt(loopsCommand.command('status [role] [loop]').description('show live or stored loop state'))
     .option('--json', 'emit stable JSON')

package/dist/loops/manager.d.ts

@@ -68,8 +68,32 @@ export declare class ScheduledLoopManager implements ScheduledLoopManagerHandle
     private armAbandon;
     private finish;
     private advance;
+    /**
+     * Coalesce a backlog into one skip. The counters alone say how many
+     * occurrences were lost but never when or for how long, so the window is
+     * recorded too and carried on the state until a run is actually told about it
+     * — a dropped pass has to stay visible to the next one, not just to whoever
+     * was reading the log at the time.
+     */
     private skipMissed;
-    private skipRestartMisses;
+    /**
+     * Restart is not, by itself, a reason to lose an occurrence a running manager
+     * would still have run. `poll` tolerates lateness up to one full interval and
+     * runs the tick late; this path used to drop anything already due however
+     * recently, so a role restarted seconds after its own tick came due lost it
+     * outright. For an oversight role that is precisely the pass which would have
+     * recorded why it restarted, so the failure erased its own witness.
+     *
+     * The tolerance is the only thing shared with `poll`. A backlog at least one
+     * interval deep is still coalesced into a single skip and never replayed —
+     * after a long outage exactly one occurrence survives, and `schedule` then
+     * arms it through the ordinary path rather than firing a burst here.
+     *
+     * Running the survivor late cannot outpace the configured cadence: `advance`
+     * moves the cursor by exactly one `intervalMs` per occurrence from the nominal
+     * time, so a loop that keeps restarting still runs at most once per interval.
+     */
+    private skipRestartBacklog;
     /**
      * A run the store could not record is dropped, not retried: the cursor has
      * already moved, so this can never become a busy loop, and the outage is
@@ -86,5 +110,10 @@ export declare class ScheduledLoopManager implements ScheduledLoopManagerHandle
      * until the process was restarted.
      */
     private recover;
+    /**
+     * The envelope is the only channel a scheduled pass has for learning about
+     * the passes that did not happen. A gap stated here is what lets an oversight
+     * role report its own outage instead of resuming as if nothing was missed.
+     */
     private envelope;
 }

package/dist/loops/manager.js

@@ -39,7 +39,7 @@ export class ScheduledLoopManager {
     }
     start() {
         if (!this.store.fresh)
-            this.skipRestartMisses();
+            this.skipRestartBacklog();
         this.schedule();
     }
     async stop() {
@@ -143,10 +143,15 @@ export class ScheduledLoopManager {
     async attempt(definition, state, scheduledAt) {
         const runId = `sl_${randomUUID()}`;
         const origin = { kind: 'scheduled-loop', loop: definition.name, runId };
-        const prompt = this.envelope(definition, runId, scheduledAt);
+        // The gap is read here and cleared only if the turn is actually admitted:
+        // an attempt that ends `skipped_busy` or `unavailable` reported it to
+        // nobody, so it has to still be there for the attempt that succeeds.
+        const gap = state.missedGap;
+        const prompt = this.envelope(definition, runId, scheduledAt, gap);
         let claimed = false;
         const result = await this.arbiter.tryScheduled(prompt, origin, () => {
             claimed = true;
+            state.missedGap = null;
             state.activeRunId = runId;
             state.lastRunId = runId;
             state.lastStartedAt = new Date(this.deps.now()).toISOString();
@@ -265,7 +270,15 @@ export class ScheduledLoopManager {
         state.nextScheduledAt = new Date(next).toISOString();
         state.nextDueAt = new Date(next + deterministicJitter(this.role, definition.name, next, definition.jitterMs)).toISOString();
     }
+    /**
+     * Coalesce a backlog into one skip. The counters alone say how many
+     * occurrences were lost but never when or for how long, so the window is
+     * recorded too and carried on the state until a run is actually told about it
+     * — a dropped pass has to stay visible to the next one, not just to whoever
+     * was reading the log at the time.
+     */
     skipMissed(definition, state, now) {
+        const from = state.nextScheduledAt;
         let missed = 0;
         while (Date.parse(state.nextDueAt) <= now) {
             this.advance(definition, state);
@@ -275,14 +288,43 @@ export class ScheduledLoopManager {
         state.counts.skippedMissed = increment(state.counts.skippedMissed, missed);
         state.lastOutcome = 'skipped_missed';
         state.lastFinishedAt = new Date(now).toISOString();
+        // Successive outages before any run lands merge into one gap: the earliest
+        // start wins, so the window always spans the whole silence.
+        const previous = state.missedGap;
+        state.missedGap = {
+            count: increment(previous?.count ?? 0, missed),
+            fromAt: previous?.fromAt ?? from,
+            throughAt: state.lastScheduledAt ?? from,
+            detectedAt: new Date(now).toISOString(),
+        };
         this.store.persist();
-        this.deps.log(`[${this.role}] loop ${definition.name} skipped_missed count=${missed}`);
+        this.deps.log(`[${this.role}] loop ${definition.name} skipped_missed count=${missed} `
+            + `gap=${from}..${state.missedGap.throughAt} `
+            + `unreported=${state.missedGap.count}`);
     }
-    skipRestartMisses() {
+    /**
+     * Restart is not, by itself, a reason to lose an occurrence a running manager
+     * would still have run. `poll` tolerates lateness up to one full interval and
+     * runs the tick late; this path used to drop anything already due however
+     * recently, so a role restarted seconds after its own tick came due lost it
+     * outright. For an oversight role that is precisely the pass which would have
+     * recorded why it restarted, so the failure erased its own witness.
+     *
+     * The tolerance is the only thing shared with `poll`. A backlog at least one
+     * interval deep is still coalesced into a single skip and never replayed —
+     * after a long outage exactly one occurrence survives, and `schedule` then
+     * arms it through the ordinary path rather than firing a burst here.
+     *
+     * Running the survivor late cannot outpace the configured cadence: `advance`
+     * moves the cursor by exactly one `intervalMs` per occurrence from the nominal
+     * time, so a loop that keeps restarting still runs at most once per interval.
+     */
+    skipRestartBacklog() {
         const now = this.deps.now();
         for (const definition of this.definitions.values()) {
             const state = this.store.state.loops[definition.name];
-            if (definition.enabled && !state.operatorDisabled && Date.parse(state.nextDueAt) <= now)
+            if (definition.enabled && !state.operatorDisabled
+                && now >= Date.parse(state.nextDueAt) + definition.intervalMs)
                 this.skipMissed(definition, state, now);
         }
     }
@@ -340,17 +382,34 @@ export class ScheduledLoopManager {
             this.deps.clearTimer(this.timer);
         this.arm(backoffMs(this.pollFailures));
     }
-    envelope(definition, runId, scheduledAt) {
+    /**
+     * The envelope is the only channel a scheduled pass has for learning about
+     * the passes that did not happen. A gap stated here is what lets an oversight
+     * role report its own outage instead of resuming as if nothing was missed.
+     */
+    envelope(definition, runId, scheduledAt, gap) {
+        const lateBy = Math.max(0, this.deps.now() - scheduledAt);
         return [
             '[fleet-loop]',
             `loop: ${definition.name}`,
             `run: ${runId}`,
             `scheduled_at: ${new Date(scheduledAt).toISOString()}`,
+            ...(lateBy > 0 ? [`started_late_by_ms: ${lateBy}`] : []),
+            ...(gap ? [
+                `missed_occurrences: ${gap.count}`,
+                `missed_window: ${gap.fromAt}..${gap.throughAt}`,
+                `missed_gap_ms: ${Math.max(0, Date.parse(gap.detectedAt) - Date.parse(gap.fromAt))}`,
+            ] : []),
             'origin: local-trusted-config',
             '',
             'This is a scheduled internal maintenance turn, not an owner message and not ordinary ours mail.',
             'Perform one bounded pass. Do not wait for the next tick. Do not report to an owner unless your',
             'configured policy and an existing authenticated proactive-report route authorize a material report.',
+            ...(gap ? ['',
+                'This loop did not run for the window above: those occurrences were coalesced away while the role',
+                'was unavailable, and this pass is the first since. Treat the gap as part of what you are reporting',
+                'on — it is the record of your own outage, and no later pass will be told about it.',
+            ] : []),
             '',
             definition.prompt,
         ].join('\n');

package/dist/loops/state.d.ts

@@ -8,11 +8,29 @@ export interface LoopCounts {
     skippedBusy: number;
     skippedMissed: number;
 }
+/**
+ * A coalesced run of occurrences that were never submitted, held until a run
+ * actually starts and can be told about it. Without it a dropped occurrence
+ * survives only as a counter, which says how many were lost but never when or
+ * for how long — and an oversight role cannot report an outage it cannot date.
+ */
+export interface LoopMissedGap {
+    /** Occurrences coalesced away, summed across every skip since the last run. */
+    count: number;
+    /** Nominal time of the earliest occurrence in the gap. */
+    fromAt: string;
+    /** Nominal time of the latest occurrence in the gap. */
+    throughAt: string;
+    /** When the manager noticed — the end of the outage, not of the last skip. */
+    detectedAt: string;
+}
 export interface LoopRuntimeState {
     definitionHash: string;
     promptHash: string;
     enabled: boolean;
     operatorDisabled: boolean;
+    /** Unreported gap, cleared by the first run that carries it. */
+    missedGap: LoopMissedGap | null;
     nextScheduledAt: string;
     nextDueAt: string;
     lastScheduledAt: string | null;

package/dist/loops/state.js

@@ -100,6 +100,9 @@ export class ScheduledLoopStateStore {
             if (old?.definitionHash === definition.definitionHash) {
                 next[definition.name] = {
                     ...old, promptHash: definition.promptHash, enabled: definition.enabled,
+                    // A file written before this field existed restores as undefined; an
+                    // unreported gap is absent, not lost, so normalize rather than trust.
+                    missedGap: old.missedGap ?? null,
                 };
             }
             else {
@@ -119,6 +122,7 @@ export class ScheduledLoopStateStore {
                     activeRunId: old?.activeRunId ?? null,
                     counts: old?.counts ?? zeroCounts(), lastError: old?.lastError ?? null,
                     operatorDisabled: old?.operatorDisabled ?? false,
+                    missedGap: old?.missedGap ?? null,
                 };
             }
             if (recoverActive && next[definition.name].activeRunId) {

package/dist/session/acp.d.ts

@@ -5,6 +5,21 @@ import type { ConversationSnapshot, PromptOrigin, PromptReceipt, SubmitPromptCom
 import type { ConversationHandlePage, ExitRecord, InterruptOutcome, QueuedPrompt, SessionEvent, RuntimeSelectorMetadata, SessionHandle, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnOutcome, TurnResult } from './types.js';
 /** Bound safe-boundary waiting without turning a hung tool into cancellation. */
 export declare const AFTER_TOOL_BOUNDARY_TIMEOUT_MS = 120000;
+/**
+ * How long a steering-started turn is presumed to still own the adapter after
+ * its last update. Such a turn has no prompt id, so it never reports a
+ * stopReason and there is no exact end to observe — silence is the only signal
+ * available, and this is the bound that turns it into a decision.
+ *
+ * Sized from the fleet's own scheduled-run history: across 1513 completed
+ * scheduled runs the longest silence WITHIN a working turn was 120.2 s (p99
+ * 41.0 s; 5 runs above 60 s). A shorter grace would release the lease while the
+ * adapter is still working and re-admit a prompt into a busy turn, which is the
+ * FLEET-003 failure itself. The costs are deliberately asymmetric: holding too
+ * long skips one best-effort maintenance tick, releasing too early SIGTERMs a
+ * live role.
+ */
+export declare const STEERING_OCCUPANCY_IDLE_MS = 150000;
 /** Server-generated typed provenance followed by the exact human-authored body. */
 export declare function promptContentBlocks(text: string, origin?: PromptOrigin): acp.ContentBlock[];
 export declare function runtimeSelector(options: acp.SessionConfigOption[] | null | undefined, category: string): RuntimeSelectorMetadata | undefined;
@@ -33,6 +48,8 @@ export interface AcpSessionOptions {
     controllerGraceMs?: number;
     /** Test seam; production uses AFTER_TOOL_BOUNDARY_TIMEOUT_MS. */
     afterToolBoundaryTimeoutMs?: number;
+    /** Test seam; production uses STEERING_OCCUPANCY_IDLE_MS. */
+    steeringOccupancyIdleMs?: number;
 }
 /**
  * Classify an ACP `stopReason` into a terminal outcome. A refusal and a
@@ -81,6 +98,13 @@ export declare class AcpSession implements SessionHandle {
     private cancelEscalation?;
     private cancelForceKill?;
     private cancelRecoveryReason?;
+    /**
+     * Held while a steering-started turn is believed to own the adapter. It is a
+     * lease, not a latch: `steeringRelease` always fires, so the role can never be
+     * stranded busy by a wake whose turn ended without telling anyone.
+     */
+    private steeringOccupied;
+    private steeringRelease?;
     /**
      * Rejects the moment the adapter process is gone. Every in-flight ACP request
      * races it, so a dead adapter can never leave a turn — and therefore a
@@ -102,6 +126,20 @@ export declare class AcpSession implements SessionHandle {
      */
     private recoverOpenPrompts;
     isAlive(): boolean;
+    /**
+     * Take the occupancy lease for a turn the adapter started on its own behalf.
+     * Refreshed by every adapter update, so it tracks work actually happening
+     * rather than a fixed guess at how long a wake takes.
+     */
+    private holdSteeringOccupancy;
+    private refreshSteeringOccupancy;
+    /**
+     * Every exit from occupancy comes through here, including the ones that are
+     * not the timer: a real turn boundary, close, and adapter exit. A lease that
+     * can leak is worse than the bug it fixes — it would leave the role reporting
+     * `running` forever and starve scheduled admission permanently.
+     */
+    private releaseSteeringOccupancy;
     snapshot(): SessionSnapshot;
     private toolCall;
     private reserveTool;

package/dist/session/acp.js

@@ -16,6 +16,21 @@ const PERMISSION_TIMEOUT_MS = 10 * 60_000;
 const CONTROLLER_GRACE_MS = 12_000;
 /** Bound safe-boundary waiting without turning a hung tool into cancellation. */
 export const AFTER_TOOL_BOUNDARY_TIMEOUT_MS = 120_000;
+/**
+ * How long a steering-started turn is presumed to still own the adapter after
+ * its last update. Such a turn has no prompt id, so it never reports a
+ * stopReason and there is no exact end to observe — silence is the only signal
+ * available, and this is the bound that turns it into a decision.
+ *
+ * Sized from the fleet's own scheduled-run history: across 1513 completed
+ * scheduled runs the longest silence WITHIN a working turn was 120.2 s (p99
+ * 41.0 s; 5 runs above 60 s). A shorter grace would release the lease while the
+ * adapter is still working and re-admit a prompt into a busy turn, which is the
+ * FLEET-003 failure itself. The costs are deliberately asymmetric: holding too
+ * long skips one best-effort maintenance tick, releasing too early SIGTERMs a
+ * live role.
+ */
+export const STEERING_OCCUPANCY_IDLE_MS = 150_000;
 const TERMINAL_TOOL_STATUSES = new Set(['completed', 'failed']);
 const SCHEDULED_LOOP_REDACTION = '[scheduled-loop content redacted]';
 const OWNER_COMMENTARY_REDACTION = '[assistant commentary redacted]';
@@ -223,6 +238,13 @@ export class AcpSession {
     cancelEscalation;
     cancelForceKill;
     cancelRecoveryReason;
+    /**
+     * Held while a steering-started turn is believed to own the adapter. It is a
+     * lease, not a latch: `steeringRelease` always fires, so the role can never be
+     * stranded busy by a wake whose turn ended without telling anyone.
+     */
+    steeringOccupied = false;
+    steeringRelease;
     /**
      * Rejects the moment the adapter process is gone. Every in-flight ACP request
      * races it, so a dead adapter can never leave a turn — and therefore a
@@ -253,6 +275,7 @@ export class AcpSession {
             if (this.cancelForceKill)
                 clearTimeout(this.cancelForceKill);
             this.cancelForceKill = undefined;
+            this.releaseSteeringOccupancy('adapter exited');
             // Record the child's real exit code/signal. The tmux path can only see a
             // shell's `$?`; here the truth is available, so keep it.
             const classified = classifyChildExit(code, signal);
@@ -353,11 +376,50 @@ export class AcpSession {
         // terminal fact (signal exits deliberately leave exitCode null).
         return this.child.exitCode === null && (this.child.signalCode ?? null) === null;
     }
+    /**
+     * Take the occupancy lease for a turn the adapter started on its own behalf.
+     * Refreshed by every adapter update, so it tracks work actually happening
+     * rather than a fixed guess at how long a wake takes.
+     */
+    holdSteeringOccupancy() {
+        if (this.closing || !this.isAlive())
+            return;
+        this.steeringOccupied = true;
+        this.refreshSteeringOccupancy();
+    }
+    refreshSteeringOccupancy() {
+        if (!this.steeringOccupied)
+            return;
+        if (this.steeringRelease)
+            clearTimeout(this.steeringRelease);
+        this.steeringRelease = setTimeout(() => this.releaseSteeringOccupancy('adapter silent'), this.options.steeringOccupancyIdleMs ?? STEERING_OCCUPANCY_IDLE_MS);
+        this.steeringRelease.unref?.();
+    }
+    /**
+     * Every exit from occupancy comes through here, including the ones that are
+     * not the timer: a real turn boundary, close, and adapter exit. A lease that
+     * can leak is worse than the bug it fixes — it would leave the role reporting
+     * `running` forever and starve scheduled admission permanently.
+     */
+    releaseSteeringOccupancy(reason) {
+        if (this.steeringRelease)
+            clearTimeout(this.steeringRelease);
+        this.steeringRelease = undefined;
+        if (!this.steeringOccupied)
+            return;
+        this.steeringOccupied = false;
+        this.options.log(`[${this.options.name}] steering-started turn no longer holds the adapter (${reason})`);
+    }
     snapshot() {
         return {
             backend: 'acp',
             alive: this.isAlive(),
-            readiness: this.readiness,
+            // A steering-started turn is real work with no prompt id. Reporting the
+            // session idle while it runs is what let the arbiter admit a scheduled
+            // prompt into a busy adapter, whose `session/prompt` then never returned
+            // a stopReason and ended in a cancellation deadline and a SIGTERM.
+            readiness: this.readiness === 'idle' && this.steeringOccupied
+                ? 'running' : this.readiness,
             sessionId: this.sessionId,
             lastError: this.lastError,
             pendingPermissionId: this.pendingPermissions.keys().next().value,
@@ -865,6 +927,7 @@ export class AcpSession {
         if (this.controllerGrace)
             clearTimeout(this.controllerGrace);
         this.controllerGrace = undefined;
+        this.releaseSteeringOccupancy('session closed');
         for (const [permissionId, pending] of [...this.pendingPermissions])
             this.settlePendingAutomatically(permissionId, pending, 'cancelled', undefined, 'the session closed while this request was pending');
         this.releaseAllTools();
@@ -1023,6 +1086,10 @@ export class AcpSession {
         }
         finally {
             this.releaseAllTools();
+            // A turn this client owned has ended, so the adapter has reported a
+            // boundary: whatever a steering call started before it is over too. This
+            // is the release path that does not depend on the silence timer.
+            this.releaseSteeringOccupancy('turn boundary');
             if (this.activeTurn?.id === turnId) {
                 this.activeTurn.settle();
                 if (this.cancelEscalation)
@@ -1045,6 +1112,12 @@ export class AcpSession {
             ]);
             if (response.outcome === 'failed')
                 return turnResult(false, 'failed', 'ACP steering failed');
+            // `injected` joined a turn this client already owns and will settle.
+            // `startedNewTurn` created one nobody owns: the adapter is working and
+            // will never answer for it, so admission has to learn about it here or
+            // not at all.
+            if (response.outcome === 'startedNewTurn')
+                this.holdSteeringOccupancy();
             return turnResult(true, 'inconclusive', response.outcome);
         }
         catch (error) {
@@ -1230,9 +1303,13 @@ export class AcpSession {
     }
     recordUpdate(update) {
         // Replayed history is not current activity: `session/load` would otherwise
-        // make a cold session look like it had just been working.
-        if (!this.replaying)
+        // make a cold session look like it had just been working. The same reason
+        // keeps it from extending the steering lease, which is evidence the adapter
+        // is working right now — for a steering-started turn, the only evidence.
+        if (!this.replaying) {
             this.lastUpdateAt = new Date().toISOString();
+            this.refreshSteeringOccupancy();
+        }
         const scheduled = this.activeTurn?.origin?.kind === 'scheduled-loop';
         const messagePhase = update.sessionUpdate === 'agent_message_chunk'
             ? this.codexMessagePhase(update) : undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.17.6",
+  "version": "0.17.7",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",