@ours.network/fleet 0.18.0-nightly.6 → 0.18.1

package/dist/loops/manager.js

@@ -39,7 +39,7 @@ export class ScheduledLoopManager {
     }
     start() {
         if (!this.store.fresh)
-            this.skipRestartMisses();
+            this.skipRestartBacklog();
         this.schedule();
     }
     async stop() {
@@ -143,10 +143,15 @@ export class ScheduledLoopManager {
     async attempt(definition, state, scheduledAt) {
         const runId = `sl_${randomUUID()}`;
         const origin = { kind: 'scheduled-loop', loop: definition.name, runId };
-        const prompt = this.envelope(definition, runId, scheduledAt);
+        // The gap is read here and cleared only if the turn is actually admitted:
+        // an attempt that ends `skipped_busy` or `unavailable` reported it to
+        // nobody, so it has to still be there for the attempt that succeeds.
+        const gap = state.missedGap;
+        const prompt = this.envelope(definition, runId, scheduledAt, gap);
         let claimed = false;
         const result = await this.arbiter.tryScheduled(prompt, origin, () => {
             claimed = true;
+            state.missedGap = null;
             state.activeRunId = runId;
             state.lastRunId = runId;
             state.lastStartedAt = new Date(this.deps.now()).toISOString();
@@ -265,7 +270,15 @@ export class ScheduledLoopManager {
         state.nextScheduledAt = new Date(next).toISOString();
         state.nextDueAt = new Date(next + deterministicJitter(this.role, definition.name, next, definition.jitterMs)).toISOString();
     }
+    /**
+     * Coalesce a backlog into one skip. The counters alone say how many
+     * occurrences were lost but never when or for how long, so the window is
+     * recorded too and carried on the state until a run is actually told about it
+     * — a dropped pass has to stay visible to the next one, not just to whoever
+     * was reading the log at the time.
+     */
     skipMissed(definition, state, now) {
+        const from = state.nextScheduledAt;
         let missed = 0;
         while (Date.parse(state.nextDueAt) <= now) {
             this.advance(definition, state);
@@ -275,14 +288,43 @@ export class ScheduledLoopManager {
         state.counts.skippedMissed = increment(state.counts.skippedMissed, missed);
         state.lastOutcome = 'skipped_missed';
         state.lastFinishedAt = new Date(now).toISOString();
+        // Successive outages before any run lands merge into one gap: the earliest
+        // start wins, so the window always spans the whole silence.
+        const previous = state.missedGap;
+        state.missedGap = {
+            count: increment(previous?.count ?? 0, missed),
+            fromAt: previous?.fromAt ?? from,
+            throughAt: state.lastScheduledAt ?? from,
+            detectedAt: new Date(now).toISOString(),
+        };
         this.store.persist();
-        this.deps.log(`[${this.role}] loop ${definition.name} skipped_missed count=${missed}`);
+        this.deps.log(`[${this.role}] loop ${definition.name} skipped_missed count=${missed} `
+            + `gap=${from}..${state.missedGap.throughAt} `
+            + `unreported=${state.missedGap.count}`);
     }
-    skipRestartMisses() {
+    /**
+     * Restart is not, by itself, a reason to lose an occurrence a running manager
+     * would still have run. `poll` tolerates lateness up to one full interval and
+     * runs the tick late; this path used to drop anything already due however
+     * recently, so a role restarted seconds after its own tick came due lost it
+     * outright. For an oversight role that is precisely the pass which would have
+     * recorded why it restarted, so the failure erased its own witness.
+     *
+     * The tolerance is the only thing shared with `poll`. A backlog at least one
+     * interval deep is still coalesced into a single skip and never replayed —
+     * after a long outage exactly one occurrence survives, and `schedule` then
+     * arms it through the ordinary path rather than firing a burst here.
+     *
+     * Running the survivor late cannot outpace the configured cadence: `advance`
+     * moves the cursor by exactly one `intervalMs` per occurrence from the nominal
+     * time, so a loop that keeps restarting still runs at most once per interval.
+     */
+    skipRestartBacklog() {
         const now = this.deps.now();
         for (const definition of this.definitions.values()) {
             const state = this.store.state.loops[definition.name];
-            if (definition.enabled && !state.operatorDisabled && Date.parse(state.nextDueAt) <= now)
+            if (definition.enabled && !state.operatorDisabled
+                && now >= Date.parse(state.nextDueAt) + definition.intervalMs)
                 this.skipMissed(definition, state, now);
         }
     }
@@ -340,17 +382,38 @@ export class ScheduledLoopManager {
             this.deps.clearTimer(this.timer);
         this.arm(backoffMs(this.pollFailures));
     }
-    envelope(definition, runId, scheduledAt) {
+    /**
+     * The envelope is the only channel a scheduled pass has for learning about
+     * the passes that did not happen. A gap stated here is what lets an oversight
+     * role report its own outage instead of resuming as if nothing was missed.
+     */
+    envelope(definition, runId, scheduledAt, gap) {
+        const lateBy = Math.max(0, this.deps.now() - scheduledAt);
         return [
             '[fleet-loop]',
             `loop: ${definition.name}`,
             `run: ${runId}`,
             `scheduled_at: ${new Date(scheduledAt).toISOString()}`,
+            ...(lateBy > 0 ? [`started_late_by_ms: ${lateBy}`] : []),
+            ...(gap ? [
+                `missed_occurrences: ${gap.count}`,
+                `missed_window: ${gap.fromAt}..${gap.throughAt}`,
+                `missed_gap_ms: ${Math.max(0, Date.parse(gap.detectedAt) - Date.parse(gap.fromAt))}`,
+            ] : []),
             'origin: local-trusted-config',
             '',
             'This is a scheduled internal maintenance turn, not an owner message and not ordinary ours mail.',
             'Perform one bounded pass. Do not wait for the next tick. Do not report to an owner unless your',
             'configured policy and an existing authenticated proactive-report route authorize a material report.',
+            // Same single route as the owner-request prompt, and for the same reason.
+            'To send a file, call ours `send_file` with the recipient and the path — to your owner-channel',
+            'identity if this role has one, otherwise directly to the contact who should receive it.',
+            'A file written anywhere else is not delivered and nothing will report that it was not.',
+            ...(gap ? ['',
+                'This loop did not run for the window above: those occurrences were coalesced away while the role',
+                'was unavailable, and this pass is the first since. Treat the gap as part of what you are reporting',
+                'on — it is the record of your own outage, and no later pass will be told about it.',
+            ] : []),
             '',
             definition.prompt,
         ].join('\n');

package/dist/loops/state.d.ts

@@ -8,11 +8,29 @@ export interface LoopCounts {
     skippedBusy: number;
     skippedMissed: number;
 }
+/**
+ * A coalesced run of occurrences that were never submitted, held until a run
+ * actually starts and can be told about it. Without it a dropped occurrence
+ * survives only as a counter, which says how many were lost but never when or
+ * for how long — and an oversight role cannot report an outage it cannot date.
+ */
+export interface LoopMissedGap {
+    /** Occurrences coalesced away, summed across every skip since the last run. */
+    count: number;
+    /** Nominal time of the earliest occurrence in the gap. */
+    fromAt: string;
+    /** Nominal time of the latest occurrence in the gap. */
+    throughAt: string;
+    /** When the manager noticed — the end of the outage, not of the last skip. */
+    detectedAt: string;
+}
 export interface LoopRuntimeState {
     definitionHash: string;
     promptHash: string;
     enabled: boolean;
     operatorDisabled: boolean;
+    /** Unreported gap, cleared by the first run that carries it. */
+    missedGap: LoopMissedGap | null;
     nextScheduledAt: string;
     nextDueAt: string;
     lastScheduledAt: string | null;

package/dist/loops/state.js

@@ -100,6 +100,9 @@ export class ScheduledLoopStateStore {
             if (old?.definitionHash === definition.definitionHash) {
                 next[definition.name] = {
                     ...old, promptHash: definition.promptHash, enabled: definition.enabled,
+                    // A file written before this field existed restores as undefined; an
+                    // unreported gap is absent, not lost, so normalize rather than trust.
+                    missedGap: old.missedGap ?? null,
                 };
             }
             else {
@@ -119,6 +122,7 @@ export class ScheduledLoopStateStore {
                     activeRunId: old?.activeRunId ?? null,
                     counts: old?.counts ?? zeroCounts(), lastError: old?.lastError ?? null,
                     operatorDisabled: old?.operatorDisabled ?? false,
+                    missedGap: old?.missedGap ?? null,
                 };
             }
             if (recoverActive && next[definition.name].activeRunId) {

package/dist/model-env.d.ts

@@ -0,0 +1,71 @@
+import type { ResolvedRole } from './config.js';
+/**
+ * Which environment variable a harness reads to pin the model it RUNS.
+ *
+ * This is not a convenience: for `claude-code` it is the only channel that
+ * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
+ * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
+ * adapter resolves its model in this order — ANTHROPIC_MODEL, then
+ * `settings.model`, then a resumed session's live model, then its first
+ * catalogue entry. A role's declared model was therefore invisible to every
+ * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
+ * an explicitly requested one.
+ */
+export declare const MODEL_ENV_BY_HARNESS: Readonly<Record<string, string>>;
+/** The model-pin variable for a harness, or undefined if it pins no model by env. */
+export declare function modelEnvVar(harness: string | undefined): string | undefined;
+export interface RoleModelEnvInput {
+    harness: string;
+    /** Already resolved by `resolveRoleModel` — may come from the fleet default. */
+    model: string | undefined;
+    /** True when the role (or `--model`) named a model, including `model: null`. */
+    modelWasExplicit: boolean;
+    defaultsEnv?: Record<string, string>;
+    roleEnv?: Record<string, string>;
+    authProxyBaseUrl?: string;
+}
+export interface RoleModelEnv {
+    env: Record<string, string>;
+    /**
+     * The model the harness will actually run. Equal to `env[pin]` for a harness
+     * that pins by env, so anything reporting this value reports the runtime.
+     */
+    model: string | undefined;
+}
+/**
+ * Resolve a role's environment and its runtime model TOGETHER, so the two can
+ * never disagree.
+ *
+ * Precedence, highest first:
+ *   1. an explicit `model:` / `--model` on the role
+ *   2. the role's own `env:` pin
+ *   3. the fleet `defaults.model`
+ *   4. the fleet `defaults.env` pin
+ *
+ * Inheriting the fleet default remains correct when the role names no model
+ * (2, 3, 4); an explicitly named one wins (1). Where both are explicit and they
+ * disagree, there is no defensible winner, so this refuses rather than picking
+ * one silently — the silence is what let a day of "Fable" work run on Opus.
+ *
+ * `model: null` explicitly asks for no fleet-chosen model, so it also clears an
+ * inherited pin instead of leaving one in place to act as a hidden default.
+ */
+export declare function resolveRoleModelEnv(input: RoleModelEnvInput, describe?: (message: string) => Error): RoleModelEnv;
+/**
+ * The model a role will actually run, read back from the environment it was
+ * resolved with. Use this wherever a model is reported to a human.
+ */
+export declare function effectiveRoleModel(role: ResolvedRole): string | undefined;
+/**
+ * Move a role's env pin onto a new model. Anything that changes the model a
+ * role runs after resolution — model-chain recovery is the live example — must
+ * go through this, or it changes only the label.
+ */
+export declare function repinModelEnv(role: ResolvedRole, model: string | undefined): Record<string, string> | undefined;
+/**
+ * Last line of defence, at the exact point a child's environment is composed:
+ * refuse to launch a role whose child would run a model other than the one the
+ * role declares and the banner reports. A spawn that cannot keep those two in
+ * agreement must fail loudly, not start and be believed.
+ */
+export declare function assertModelPinReachesChild(role: ResolvedRole, childEnv: Record<string, string | undefined>): void;

package/dist/model-env.js

@@ -0,0 +1,106 @@
+/**
+ * Which environment variable a harness reads to pin the model it RUNS.
+ *
+ * This is not a convenience: for `claude-code` it is the only channel that
+ * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
+ * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
+ * adapter resolves its model in this order — ANTHROPIC_MODEL, then
+ * `settings.model`, then a resumed session's live model, then its first
+ * catalogue entry. A role's declared model was therefore invisible to every
+ * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
+ * an explicitly requested one.
+ */
+export const MODEL_ENV_BY_HARNESS = {
+    'claude-code': 'ANTHROPIC_MODEL',
+};
+/** The model-pin variable for a harness, or undefined if it pins no model by env. */
+export function modelEnvVar(harness) {
+    return harness === undefined ? undefined : MODEL_ENV_BY_HARNESS[harness];
+}
+/**
+ * Resolve a role's environment and its runtime model TOGETHER, so the two can
+ * never disagree.
+ *
+ * Precedence, highest first:
+ *   1. an explicit `model:` / `--model` on the role
+ *   2. the role's own `env:` pin
+ *   3. the fleet `defaults.model`
+ *   4. the fleet `defaults.env` pin
+ *
+ * Inheriting the fleet default remains correct when the role names no model
+ * (2, 3, 4); an explicitly named one wins (1). Where both are explicit and they
+ * disagree, there is no defensible winner, so this refuses rather than picking
+ * one silently — the silence is what let a day of "Fable" work run on Opus.
+ *
+ * `model: null` explicitly asks for no fleet-chosen model, so it also clears an
+ * inherited pin instead of leaving one in place to act as a hidden default.
+ */
+export function resolveRoleModelEnv(input, describe = message => new Error(message)) {
+    const env = {
+        ...(input.defaultsEnv ?? {}),
+        ...(input.roleEnv ?? {}),
+        ...(input.authProxyBaseUrl ? { ANTHROPIC_BASE_URL: input.authProxyBaseUrl } : {}),
+    };
+    const pin = modelEnvVar(input.harness);
+    if (!pin)
+        return { env, model: input.model };
+    const rolePin = input.roleEnv?.[pin];
+    if (input.modelWasExplicit) {
+        if (rolePin !== undefined && rolePin !== input.model)
+            throw describe(`model '${input.model ?? '(none)'}' contradicts env.${pin} '${rolePin}'; `
+                + `remove one — ${pin} is what the harness actually runs`);
+        if (input.model === undefined)
+            delete env[pin];
+        else
+            env[pin] = input.model;
+        return { env, model: input.model };
+    }
+    // Not explicit: a role-level pin is the most specific thing said about this
+    // role, so it decides — and the reported model follows it.
+    if (rolePin !== undefined)
+        return { env, model: rolePin };
+    if (input.model !== undefined)
+        env[pin] = input.model;
+    return { env, model: input.model ?? env[pin] };
+}
+/**
+ * The model a role will actually run, read back from the environment it was
+ * resolved with. Use this wherever a model is reported to a human.
+ */
+export function effectiveRoleModel(role) {
+    const pin = modelEnvVar(role.harness);
+    return (pin ? role.env?.[pin] : undefined) ?? role.model;
+}
+/**
+ * Move a role's env pin onto a new model. Anything that changes the model a
+ * role runs after resolution — model-chain recovery is the live example — must
+ * go through this, or it changes only the label.
+ */
+export function repinModelEnv(role, model) {
+    const pin = modelEnvVar(role.harness);
+    if (!pin)
+        return role.env;
+    const env = { ...(role.env ?? {}) };
+    if (model === undefined)
+        delete env[pin];
+    else
+        env[pin] = model;
+    return Object.keys(env).length ? env : undefined;
+}
+/**
+ * Last line of defence, at the exact point a child's environment is composed:
+ * refuse to launch a role whose child would run a model other than the one the
+ * role declares and the banner reports. A spawn that cannot keep those two in
+ * agreement must fail loudly, not start and be believed.
+ */
+export function assertModelPinReachesChild(role, childEnv) {
+    const pin = modelEnvVar(role.harness);
+    if (!pin || role.model === undefined)
+        return;
+    const actual = childEnv[pin];
+    if (actual === role.model)
+        return;
+    throw new Error(`[${role.name}] refusing to launch: role model is '${role.model}' but the child's `
+        + `${pin} is ${actual === undefined ? 'unset' : `'${actual}'`} — the session would run a `
+        + 'different model than the one reported');
+}

package/dist/monitor.js

@@ -42,7 +42,7 @@ class AuthError extends Error {
 }
 /** Path to the daemon config the MCP client uses: OURS_CONFIG ?? real ~/.ours/config.json. */
 const daemonConfigPath = (env) => env.OURS_CONFIG ?? join(homedir(), '.ours', 'config.json');
-/** Preserve the daemon's legacy env integer semantics: parseInt, invalid → absent. */
+/** Match ours-mcp's env integer semantics: parseInt, invalid → absent. */
 function envInt(env, name) {
     const raw = env[name];
     if (raw === undefined)

package/dist/ops.js

@@ -16,7 +16,7 @@ import { realExec } from './exec.js';
 /** Materialize a role's state dir from config: briefing + markers. Returns the dir. */
 export function applyRole(role, opts = {}) {
     const adapter = getAdapter(role.harness);
-    const errs = adapter.validateOptions(role.harness_options);
+    const errs = adapter.validateOptions(role.harness_options, role);
     if (errs.length)
         throw new Error(`role '${role.name}': ` + errs.map(e => `${e.path}: ${e.message}`).join('; '));
     const dir = agentDir(role.name, opts.temp === true);

package/dist/owner-channel/attachments.d.ts

@@ -1,6 +1,4 @@
-import { type FileHandle } from 'node:fs/promises';
 import type { OwnerAttachmentConfig } from '../config.js';
-import type { OursIncomingFile, OursRetrievedFiles } from './ours-client.js';
 export interface AttachmentReplyRef {
     wire_id: string;
     sentence?: number;
@@ -44,14 +42,8 @@ export interface AdmittedAttachment {
     kind: 'file' | 'voice_message';
     transcription?: Omit<VoiceTranscription, 'audioPath'>;
 }
-/**
- * Admit the daemon's file listing. The rows are typed now, but every field is
- * still re-validated here: sender CID, wire id, sizes and ids all cross the
- * trust boundary and decide routing, so a daemon-side shape change must drop a
- * row rather than produce a half-built attachment.
- */
-export declare function parseIncomingAttachments(raw: OursIncomingFile[] | undefined): IncomingAttachment[];
-export declare function parseRetrievedAttachments(raw: OursRetrievedFiles | undefined, expected: IncomingAttachment[], recovered?: boolean): RetrievedAttachment[];
+export declare function parseIncomingAttachments(raw: unknown): IncomingAttachment[];
+export declare function parseRetrievedAttachments(raw: unknown, expected: IncomingAttachment[], recovered?: boolean): RetrievedAttachment[];
 export declare function validateAttachmentSelection(files: IncomingAttachment[], config: OwnerAttachmentConfig): string | undefined;
 /**
  * Managed-agent -> owner egress limits. This intentionally does not consult
@@ -62,21 +54,6 @@ export declare function prepareAttachmentDirectory(root: string, requestId: stri
 export declare function admitAttachments(files: RetrievedAttachment[], dir: string, config: OwnerAttachmentConfig, options?: {
     mimePolicy?: 'strict' | 'report-only';
 }): Promise<AdmittedAttachment[]>;
-/** Injectable short-write seam, so partial writes are provably handled. */
-export interface AttachmentWriteDeps {
-    write?(handle: FileHandle, bytes: Uint8Array, offset: number): Promise<number>;
-}
-/**
- * Land crash-recovered file bytes inside an already-prepared request directory.
- *
- * The MCP path handed the daemon a `dest_path` and let its connector write the
- * file. Nothing writes on our behalf any more, so this owns both halves of that
- * contract: the destination is DERIVED from a validated wire id inside `dir`
- * rather than accepted from a caller, and the file is published by link-after-
- * fsync, so a crash or a short write can never leave a partial file where the
- * admission step would read it as complete.
- */
-export declare function writeRecoveredAttachment(dir: string, wireId: string, bytes: Uint8Array, deps?: AttachmentWriteDeps): Promise<string>;
 export declare function recoveredAttachment(file: IncomingAttachment, path: string): Promise<RetrievedAttachment>;
 export declare function removeRequestDirectory(path: string): Promise<void>;
 export declare function cleanupAttachmentRoot(root: string, now: number, retentionMs: number, limit?: number): Promise<number>;

package/dist/owner-channel/attachments.js

@@ -6,14 +6,8 @@ import { replaceFileAtomically } from '../atomic-file.js';
 const WIRE = /^[A-Fa-f0-9]{64}$/;
 const CID = /^[A-Fa-f0-9]{64}$/;
 const MAX_PENDING_REQUESTS = 32;
-/**
- * Admit the daemon's file listing. The rows are typed now, but every field is
- * still re-validated here: sender CID, wire id, sizes and ids all cross the
- * trust boundary and decide routing, so a daemon-side shape change must drop a
- * row rather than produce a half-built attachment.
- */
 export function parseIncomingAttachments(raw) {
-    const values = raw;
+    const values = raw?.files;
     if (!Array.isArray(values))
         return [];
     const out = [];
@@ -46,12 +40,12 @@ export function parseIncomingAttachments(raw) {
 export function parseRetrievedAttachments(raw, expected, recovered = false) {
     const values = raw?.files;
     if (!Array.isArray(values) || values.length !== expected.length)
-        throw new Error('the ours daemon returned an incomplete selected attachment set');
+        throw new Error('ours-mcp returned an incomplete selected attachment set');
     const byWire = new Map(expected.map(file => [file.wireId, file]));
     const out = [];
     for (const value of values) {
         if (!value || typeof value !== 'object')
-            throw new Error('the ours daemon returned invalid attachment metadata');
+            throw new Error('ours-mcp returned invalid attachment metadata');
         const file = value;
         const wireId = String(file.wire_id ?? '');
         const listed = byWire.get(wireId);
@@ -64,7 +58,7 @@ export function parseRetrievedAttachments(raw, expected, recovered = false) {
             || !Number.isSafeInteger(size) || size !== listed.size || mime !== listed.mime
             || kind !== listed.kind || !/^[a-f0-9]{64}$/.test(sha256)
             || typeof file.path !== 'string' || !file.path)
-            throw new Error('selected attachment provenance or integrity metadata mismatched');
+            throw new Error('ours-mcp selected attachment provenance or integrity metadata mismatched');
         out.push({
             ...listed, filename: safeField(file.filename, 255), mime, size, path: file.path, sha256, kind,
             ...(recovered ? {} : parseTranscription(file.transcription, wireId)),
@@ -72,7 +66,7 @@ export function parseRetrievedAttachments(raw, expected, recovered = false) {
         byWire.delete(wireId);
     }
     if (byWire.size)
-        throw new Error('the ours daemon omitted a selected attachment');
+        throw new Error('ours-mcp omitted a selected attachment');
     return out;
 }
 function parseTranscription(value, wireId) {
@@ -225,56 +219,6 @@ export async function admitAttachments(files, dir, config, options = {}) {
     }
     return admitted;
 }
-/**
- * Land crash-recovered file bytes inside an already-prepared request directory.
- *
- * The MCP path handed the daemon a `dest_path` and let its connector write the
- * file. Nothing writes on our behalf any more, so this owns both halves of that
- * contract: the destination is DERIVED from a validated wire id inside `dir`
- * rather than accepted from a caller, and the file is published by link-after-
- * fsync, so a crash or a short write can never leave a partial file where the
- * admission step would read it as complete.
- */
-export async function writeRecoveredAttachment(dir, wireId, bytes, deps = {}) {
-    if (!WIRE.test(wireId))
-        throw new Error('recovered attachment wire id is not a 64-hex value');
-    const dirStat = await lstat(dir);
-    if (!dirStat.isDirectory() || dirStat.isSymbolicLink())
-        throw new Error('recovered attachment directory is not a safe directory');
-    const write = deps.write
-        ?? ((handle, buffer, offset) => handle.write(buffer, offset, buffer.length - offset)
-            .then(result => result.bytesWritten));
-    const finalPath = join(dir, `.recovered-${wireId}-${randomUUID()}`);
-    const tmp = join(dir, `.${basename(finalPath)}.${randomUUID()}.tmp`);
-    const handle = await open(tmp, 'wx', 0o600);
-    try {
-        for (let written = 0; written < bytes.length;) {
-            const advanced = await write(handle, bytes, written);
-            if (advanced <= 0)
-                throw new Error(`recovered attachment write made no progress at byte ${written}`);
-            written += advanced;
-        }
-        await handle.sync();
-    }
-    catch (error) {
-        await handle.close().catch(() => undefined);
-        await rm(tmp, { force: true });
-        throw error;
-    }
-    await handle.close();
-    // link publishes the finished bytes under a name that never existed in a
-    // partial state; the temp is only ever removed after it succeeded.
-    try {
-        await link(tmp, finalPath);
-    }
-    catch (error) {
-        await rm(tmp, { force: true });
-        throw error;
-    }
-    await rm(tmp, { force: true });
-    await chmod(finalPath, 0o600);
-    return finalPath;
-}
 export async function recoveredAttachment(file, path) {
     const stat = await lstat(path);
     if (!stat.isFile() || stat.isSymbolicLink() || stat.size !== file.size)

package/dist/owner-channel/channel.d.ts

@@ -1,8 +1,10 @@
+import { type ChildProcessWithoutNullStreams } from 'node:child_process';
 import { type OwnerChannelConfig } from '../config.js';
+import { type FetchLike } from '../monitor.js';
 import { type SessionHandle } from '../session/types.js';
 import { type OwnerFleetOps } from './commands.js';
 import type { ManagedFleetSpawnResult } from '../fleet-proxy.js';
-import { type OursOps } from './ours-client.js';
+import { type OursToolClient } from './mcp.js';
 import { type OwnerUpdatePhase } from './notices.js';
 import { type OwnerEntry } from './state.js';
 import { type OwnerTaskPhase } from './tasks.js';
@@ -15,8 +17,15 @@ export interface OwnerChannelOptions {
     session: SessionHandle;
     stateDir: string;
     env?: Record<string, string>;
+    command?: string;
     log(line: string): void;
-    client?: OursOps;
+    client?: OursToolClient;
+    /** Legacy child-process test seam; production uses the direct notification API. */
+    watch?: (identity: string) => ChildProcessWithoutNullStreams;
+    /** Test seam for the production direct notification long-poll. */
+    watchFetch?: FetchLike;
+    /** Test seam for the long-poll stall bound; production uses OWNER_WATCH_STALL_MS. */
+    watchStallMs?: number;
     /** Test seam; production uses the detached ours-fleet CLI (`fleetCliOps`). */
     fleet?: OwnerFleetOps;
     /** Forwarded to fleet CLI invocations spawned for owner commands. */
@@ -109,13 +118,7 @@ export type { OwnerUpdatePhase } from './notices.js';
 export interface OwnerContact {
     cid: string;
     name: string;
-    /** Structural, from which daemon collection the row came: established or pending. */
     status: string;
-    /**
-     * Retained for the `ours-fleet owner contact list` column. The daemon's typed
-     * contact view has no such field, so it is always absent; it is not inferred
-     * from anything a contact controls.
-     */
     kind?: string;
     human?: {
         cid?: string;
@@ -133,7 +136,6 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private readonly authorizations;
     private readonly conversations;
     private readonly tasks;
-    private readonly messageRecovery;
     private readonly attachmentRecovery;
     private readonly attachmentConfig;
     private readonly attachmentRoot;
@@ -142,7 +144,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
      * (a crash must replay them) but must not be queued twice while live.
      */
     private readonly inFlight;
-    /** Wires already NACKed to the managed agent, so a history replay stays quiet. */
+    /** Wires already NACKed to the managed agent, so a deferred replay stays quiet. */
     private readonly relayNacks;
     /**
      * fleet.yaml declares the restart baseline; `/comments on|off` changes only
@@ -153,6 +155,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private readonly commentsBaseline;
     private commentsEnabled;
     private stopping;
+    private watchProcess?;
     private watchTask?;
     private watchAbort?;
     private drainTask?;
@@ -171,12 +174,6 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
     notifyFleetSpawn(event: ManagedFleetSpawnResult): Promise<void>;
     private manageNow;
-    /**
-     * The daemon reports established contacts and pending introductions as two
-     * separate collections, so the status is structural rather than a word parsed
-     * out of a rendered line. Nothing here can be spoofed by a contact's own
-     * display name.
-     */
     private contacts;
     private contact;
     private assertCid;
@@ -190,15 +187,6 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private safeTaskReport;
     private safeProactiveMessage;
     private drainAll;
-    /**
-     * Claim the exact oldest unread SQLite batch before marking it read.
-     * The journal contains only wire IDs and sequence numbers; bodies remain in
-     * the daemon's persistent history and are recovered with getHistoryItem.
-     */
-    private claimMessages;
-    private messageClaim;
-    private historyMessage;
-    private attachmentMetadata;
     private attachmentGroups;
     private handleAttachmentGroup;
     private handle;
@@ -236,7 +224,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private managedAttachmentReplyWire;
     /**
      * One bounded NACK per wire: an unroutable or refused relay must be visible
-     * to the authenticated agent, while its history replays stay quiet. NACK
+     * to the authenticated agent, while its deferred replays stay quiet. NACK
      * delivery is best-effort — it must never make the failure worse.
      */
     private nackManagedAgent;
@@ -250,6 +238,16 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private warnOwnerOfUnauthorizedSender;
     private effectiveOwners;
     private authorizationIntegrity;
+    /**
+     * Report what the session actually did with the prompt, not what the config
+     * asked for. `interrupt: true` used to be reported as "your request
+     * interrupted the previous task" unconditionally; the session now answers
+     * whether anything was cancelled, whether the request is queued behind
+     * earlier prompts, or whether it is held until the current task reaches a
+     * safe stopping point. Backends that report no delivery state keep the old
+     * queuedBehind-based wording.
+     */
+    private acceptanceNotice;
     private complete;
     private commentsState;
     /** Model-authored commentary only; raw protocol/tool data never reaches here. */
@@ -269,12 +267,15 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private progressPhase;
     private watchLoop;
     /**
-     * `recovered` distinguishes a first-ever start from unreadable persisted
-     * diagnostics. Notification correctness does not depend on this state: every
-     * establishment drains and then replays SDK hints from offset zero.
+     * `recovered` distinguishes a first-ever start (no state, nothing lost) from a
+     * cursor we HAD and can no longer read. Only the latter is a recovery, and the
+     * caller needs to know because the reason it reports is the only evidence a
+     * durable cursor was ever lost.
      */
     private readWatchState;
     private writeWatchState;
+    /** Compatibility path for injected child-process tests; production is direct. */
+    private legacyWatchLoop;
     private errorText;
     private logError;
 }