@ours.network/fleet 0.18.1 → 0.19.0-nightly.2

package/dist/runner.js

@@ -18,13 +18,13 @@ import { TmuxSession } from './session/tmux.js';
 import { ACP_CANCEL_DEADLINE_EXCEEDED, classifyShellStatus } from './session/types.js';
 import { effectiveModelForRole, modelRecoveryHeld, reconcileModelRecovery, recordModelFailure, classifyFailureText, } from './model-recovery.js';
 import { rotateWorklog } from './worklog.js';
+import { reconcilePermanentRoleIdentities } from './creation.js';
 import { OwnerChannel } from './owner-channel/channel.js';
 import { acquireOwnerBinderLease, OwnerBinderHandoffTimeoutError, } from './owner-channel/binder.js';
 import { RoleTurnArbiter } from './session/arbiter.js';
 import { ScheduledLoopManager, } from './loops/manager.js';
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, inheritCallerSpawnDefaults, } from './fleet-proxy.js';
 import { effectivePermissionMode } from './permissions.js';
-import { assertModelPinReachesChild, effectiveRoleModel, repinModelEnv } from './model-env.js';
 import { archiveTempState, markTempSupervisorActive, requestedTempStopReason, } from './temp-lifecycle.js';
 const defaultDeps = () => ({
     tmux: new Tmux(),
@@ -60,32 +60,14 @@ const defaultDeps = () => ({
     },
 });
 const MONITOR_OWNER_FILE = '.monitor-owner';
-/** Fleet roles consume the operator-owned daemon; a role session never starts it. */
-const FLEET_OURS_AUTOSTART = '0';
 /** Environment injected only into the managed harness process. */
 export function managedFleetProxyEnv(role, stateDir) {
     return {
         ...(role.env ?? {}),
-        // This must win over both inherited/configured auto-start. ACP agents run
-        // directly rather than through ours-codex, so the runner owns this fence.
-        OURS_AUTOSTART: FLEET_OURS_AUTOSTART,
         [FLEET_PROXY_STATE_DIR_ENV]: stateDir,
         [FLEET_PROXY_CALLER_ENV]: role.name,
     };
 }
-/**
- * The environment a managed harness child actually receives, checked at the one
- * point where it is composed. `role.env` deliberately wins over harness prep,
- * which is exactly how a stale fleet-wide model pin used to outrank the model
- * the role was spawned with — so the model pin is verified here rather than
- * trusted, and a disagreement stops the launch instead of being reported as a
- * success (see src/model-env.ts).
- */
-export function harnessChildEnv(role, launchEnv, stateDir) {
-    const env = { ...(launchEnv ?? {}), ...managedFleetProxyEnv(role, stateDir) };
-    assertModelPinReachesChild(role, env);
-    return env;
-}
 /**
  * Execute a typed proxy request in the caller's supervisor. Dynamic imports
  * avoid a runner↔spawn initialization cycle (spawn imports runner constants).
@@ -123,19 +105,13 @@ async function executeManagedSpawn(caller, configPath, requested, log) {
         statePath,
         harness: preview.harness,
         session: preview.session,
-        // Read back from the resolved environment, not from the request: the banner
-        // must name the model the child will run, not the one that was asked for.
-        ...(effectiveRoleModel(preview) ? { model: effectiveRoleModel(preview) } : {}),
+        ...(preview.model ? { model: preview.model } : {}),
         monitor: { mode: preview.monitor.mode, interrupt: preview.monitor.interrupt },
-        permissionMode: effectivePermissionMode(preview),
         inherited,
         creationActionId,
     };
     log(`[${caller.name}] managed fleet proxy spawned ${result.lifetime} role ${result.role} `
-        + `harness=${result.harness} session=${result.session} `
-        + `model=${result.model ?? '(harness default)'} `
-        + `permission=${result.permissionMode.fleetMode} `
-        + `native=${result.permissionMode.nativeMode}`);
+        + `harness=${result.harness} session=${result.session}`);
     return result;
 }
 /**
@@ -165,10 +141,6 @@ export function recordMonitorOwner(dir, owner) {
 export function buildPaneCommand(launch, roleEnv, exitStatusPath, paneArgv = launch.argv) {
     const env = {
         PATH: process.env.PATH ?? '', COLORTERM: 'truecolor', ...launch.env, ...(roleEnv ?? {}),
-        // Tmux roles have the same daemon-client boundary as ACP roles. Keep this
-        // last so neither harness preparation nor a role env block can take over
-        // the shared daemon lifecycle.
-        OURS_AUTOSTART: FLEET_OURS_AUTOSTART,
     };
     // Interactive panes should advertise colour even when the supervisor itself
     // was launched with NO_COLOR. A role may still deliberately opt back in to
@@ -247,66 +219,6 @@ const emptyLedger = () => ({
     circuit: 'closed',
     updatedAt: new Date(0).toISOString(),
 });
-/**
- * Carried across a supervisor process's life so its successor can tell an
- * orderly exit from a kill. Present on disk == "a supervisor believed it was
- * running"; the next start finding one that is not its own is proof the
- * previous process died without getting to write anything.
- */
-export const RUN_MARKER_FILE = '.supervisor-run.json';
-function readRunMarker(dir) {
-    try {
-        const raw = JSON.parse(readFileSync(join(dir, RUN_MARKER_FILE), 'utf8'));
-        return raw.version === 1 && typeof raw.pid === 'number' && typeof raw.startedAt === 'string'
-            ? raw : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Claim this state directory for the current supervisor process and report how
- * the previous one ended. Runs BEFORE the first attempt, which is the whole
- * point: after an abrupt kill nothing else writes until an attempt finishes,
- * and an attempt can take minutes.
- */
-export function claimSupervisorRun(dir, startedAt, pid = process.pid) {
-    const previous = readRunMarker(dir);
-    const termination = previous && previous.pid !== pid
-        ? {
-            class: 'abrupt',
-            detail: `supervisor pid ${previous.pid} left an open run marker; `
-                + 'it was terminated without an orderly exit (signal, OOM-kill, or host reset)',
-            observedAt: startedAt,
-            runStartedAt: previous.startedAt,
-        }
-        : previous
-            ? { class: 'unknown', detail: 'run marker belongs to this process', observedAt: startedAt }
-            : { class: 'clean', detail: 'no previous run marker', observedAt: startedAt };
-    try {
-        mkdirSync(dir, { recursive: true });
-        writeFileSync(join(dir, RUN_MARKER_FILE), JSON.stringify({ version: 1, pid, startedAt }, null, 2) + '\n');
-    }
-    catch { /* diagnostics must never take the role down */ }
-    return termination;
-}
-/** Orderly exit: the successor must not read this run as a kill. */
-export function releaseSupervisorRun(dir) {
-    try {
-        rmSync(join(dir, RUN_MARKER_FILE), { force: true });
-    }
-    catch { /* best effort */ }
-}
-/**
- * Fields that describe THIS process's history rather than the current failure
- * streak. Clearing the streak (recovery, an operator `up`, an approved model
- * transition) must not erase the record that the role died and came back.
- */
-const carriedForward = (previous) => ({
-    ...(previous.lastTermination ? { lastTermination: previous.lastTermination } : {}),
-    ...(previous.abruptTerminations ? { abruptTerminations: previous.abruptTerminations } : {}),
-    ...(previous.supervisorStartedAt ? { supervisorStartedAt: previous.supervisorStartedAt } : {}),
-});
 /** Bounded exponential backoff for the nth consecutive immediate failure. */
 export function backoffFor(consecutiveFailures) {
     if (consecutiveFailures <= 0)
@@ -341,10 +253,7 @@ export function writeRestartLedger(dir, ledger) {
 export function resetRestartLedger(dir) {
     if (!existsSync(dir))
         return;
-    const previous = readRestartLedger(dir);
-    writeRestartLedger(dir, {
-        ...emptyLedger(), ...carriedForward(previous), updatedAt: new Date().toISOString(),
-    });
+    writeRestartLedger(dir, { ...emptyLedger(), updatedAt: new Date().toISOString() });
 }
 /** Filename spawnTemp writes into a temp agent dir to carry the fleet start-stagger. */
 export const START_STAGGER_FILE = '.start-stagger-ms';
@@ -475,18 +384,11 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     const effectiveModel = effectiveModelForRole(dir, role);
     if (effectiveModel !== role.model) {
         deps.log(`[${name}] model recovery drift: declared=${role.model ?? '(none)'} effective=${effectiveModel}`);
-        // The env pin has to move with it. A down-shift that changed only
-        // `role.model` was reported as a model change while the child kept running
-        // the model that had just failed, because the pin is what the harness reads.
-        role = { ...role, model: effectiveModel, env: repinModelEnv(role, effectiveModel) };
+        role = { ...role, model: effectiveModel };
     }
     if (modelRecoveryHeld(dir))
         throw new Error(`[${name}] model chain exhausted — held down until config changes or recovery reset`);
     const adapter = getAdapter(role.harness);
-    // Say the running model out loud, once, from the resolved environment. The
-    // spawn banner is a claim made before the process exists; this is the log line
-    // that can be checked against the session afterwards.
-    deps.log(`[${name}] model: ${effectiveRoleModel(role) ?? '(harness default)'}`);
     mkdirSync(dir, { recursive: true });
     const rotation = rotateWorklog(join(dir, 'WORKLOG.md'), role.worklog);
     if (rotation.deferred)
@@ -501,12 +403,8 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     const exitFile = join(dir, '.exit-status');
     const booted = existsSync(bootedFile);
     const mode = booted && adapter.supportsResume ? 'resume' : 'fresh';
-    // Stamp EVERY attempt, not just the first. `.booted` used to be written only
-    // on the fresh path, so after a restart — including one the supervisor never
-    // saw, like an OOM-kill — its mtime still read the original boot and any
-    // health check reading it reported "no restarts". The existence test above
-    // already ran, so rewriting cannot change the fresh/resume decision.
-    writeFileSync(bootedFile, `${new Date(deps.now()).toISOString()} ${mode}\n`);
+    if (mode === 'fresh')
+        writeFileSync(bootedFile, '');
     const runCwd = role.cwd && existsSync(role.cwd) ? role.cwd : dir;
     const prep = await adapter.prepareSession(role, { stateDir: dir, runCwd });
     const sessionBackend = role.session ?? 'tmux';
@@ -627,23 +525,12 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             name,
             argv: wrappedArgv,
             cwd: runCwd,
-            env: harnessChildEnv(role, launch.env, dir),
+            env: { ...launch.env, ...managedFleetProxyEnv(role, dir) },
             stateDir: dir,
             mode,
             permissions: perms,
             modeId: adapter.acpPermissionModeId?.(role),
-            // The role's declared MCP servers, and the bundled agent's `_meta`
-            // vocabulary for the options it takes no flag for. Both come from the
-            // ADAPTER and from `prep`: the ACP launch cannot carry `prep.argv`, so this
-            // is the route by which harness_options that used to be silently dropped
-            // for an ACP role actually reach the session.
-            mcpServers: adapter.acpMcpServers?.(role),
-            sessionMeta: adapter.acpSessionMeta?.(role, prep),
             permissionMode: effectivePermissionMode(role),
-            // Provenance travels with the exact ACP launch. Keeping it out of a
-            // role-only adapter hook prevents a PATH fallback or resolver skew from
-            // claiming metadata trust for an argv it did not authenticate.
-            permissionMetadataSource: launch.permissionMetadataSource,
             log: deps.log,
         });
         pid = acpSession.pid;
@@ -1041,129 +928,100 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
     mkdirSync(dir, { recursive: true });
     const shouldStop = deps.shouldStop ?? (() => false);
     const stamp = () => new Date(deps.now()).toISOString();
-    // Record how the PREVIOUS supervisor process ended before doing anything
-    // else. An external kill writes nothing itself, and the next ledger write is
-    // an attempt away — which is why an OOM-kill used to leave every durable
-    // indicator describing the run that died.
-    const startedAt = stamp();
-    const termination = claimSupervisorRun(dir, startedAt);
-    {
-        const previous = readRestartLedger(dir);
-        const abrupt = (previous.abruptTerminations ?? 0) + (termination.class === 'abrupt' ? 1 : 0);
-        writeRestartLedger(dir, {
-            ...previous,
-            lastTermination: termination,
-            abruptTerminations: abrupt,
-            supervisorStartedAt: startedAt,
-            updatedAt: startedAt,
-        });
-        if (termination.class === 'abrupt')
-            deps.log(`[${name}] previous supervisor run (started ${termination.runStartedAt}) `
-                + `ended abruptly: ${termination.detail}; abrupt terminations recorded: ${abrupt}`);
-    }
-    try {
-        while (!shouldStop()) {
-            let ledger = readRestartLedger(dir);
-            try {
-                const configPath = resolveConfigPath(dir, opts.configPath);
-                const role = findRole(loadConfig(configPath), name);
-                reconcileModelRecovery(dir, role, stamp());
-                if (modelRecoveryHeld(dir)) {
-                    await deps.sleep(HELD_DOWN_POLL_MS);
-                    continue;
-                }
-            }
-            catch {
-                // Normal attempt path reports config errors through the restart circuit.
-            }
-            if (ledger.circuit === 'open') {
-                // Held down. Stay alive — exiting would hand the role straight back to
-                // the service manager — and watch for an operator reset.
-                await deps.sleep(HELD_DOWN_POLL_MS);
-                continue;
-            }
-            let result;
-            try {
-                result = await attempt(name, { configPath: opts.configPath, allowResumeRotation: !ledger.resumeDiscarded }, deps);
-            }
-            catch (e) {
-                // A session that could not even start is an immediate failure like any
-                // other; it must count, or an unstartable role loops forever.
-                result = {
-                    elapsedSecs: 0,
-                    exit: { version: 1, class: 'unknown', detail: e instanceof Error ? e.message : String(e) },
-                    rotated: false,
-                    mode: 'fresh',
-                };
-            }
-            // Re-read: the attempt itself may have taken minutes, and an operator may
-            // have reset the ledger meanwhile.
-            ledger = readRestartLedger(dir);
-            if (result.modelRecovery === 'advance') {
-                writeRestartLedger(dir, {
-                    ...emptyLedger(),
-                    ...carriedForward(ledger),
-                    lastReason: 'approved model-chain transition',
-                    updatedAt: stamp(),
-                });
-                continue;
-            }
-            if (result.modelRecovery === 'hold') {
+    while (!shouldStop()) {
+        let ledger = readRestartLedger(dir);
+        try {
+            const configPath = resolveConfigPath(dir, opts.configPath);
+            const role = findRole(loadConfig(configPath), name);
+            reconcileModelRecovery(dir, role, stamp());
+            if (modelRecoveryHeld(dir)) {
                 await deps.sleep(HELD_DOWN_POLL_MS);
                 continue;
             }
-            const fastFailSecs = fastFailSecsFor(name, opts.configPath);
-            // The fast-fail boundary starts a recovery episode; it must not also be
-            // the boundary that declares recovery successful. Otherwise alternating
-            // 19s and 20s deaths erase one another forever. Require the configured
-            // number of fast-fail windows to survive before closing an active streak.
-            // This hysteresis stays adapter-relative (100s for the current 20s/5-attempt
-            // policy) and still lets a genuinely sustained session reset the breaker.
-            const stableRecoverySecs = fastFailSecs * RESTART_FAIL_THRESHOLD;
-            const recoveryFailed = result.elapsedSecs < fastFailSecs
-                || (ledger.consecutiveImmediateFailures > 0 && result.elapsedSecs < stableRecoverySecs);
-            if (!recoveryFailed) {
-                // A session that ran for a while is not a restart loop, whatever ended it.
-                writeRestartLedger(dir, {
-                    ...emptyLedger(),
-                    ...carriedForward(ledger),
-                    lastReason: result.exit.detail,
-                    updatedAt: stamp(),
-                });
-                continue;
+        }
+        catch {
+            // Normal attempt path reports config errors through the restart circuit.
+        }
+        if (ledger.circuit === 'open') {
+            // Held down. Stay alive — exiting would hand the role straight back to
+            // the service manager — and watch for an operator reset.
+            await deps.sleep(HELD_DOWN_POLL_MS);
+            continue;
+        }
+        let result;
+        try {
+            // Service-manager boot and automatic retry bypass the operator-facing
+            // up/restart commands. Reconcile again immediately before every real
+            // permanent harness attempt; the operation is idempotent and releases its
+            // provisioning lease before the agent or owner channel binds.
+            if (attempt === runOnce) {
+                const configPath = resolveConfigPath(dir, opts.configPath);
+                const role = findRole(loadConfig(configPath), name);
+                await reconcilePermanentRoleIdentities(role, undefined, deps.log);
             }
-            const failures = ledger.consecutiveImmediateFailures + 1;
-            const reason = `${result.exit.detail} after ${result.elapsedSecs.toFixed(1)}s`;
-            const next = {
-                version: 1,
-                ...carriedForward(ledger),
-                consecutiveImmediateFailures: failures,
-                lastReason: reason,
-                nextDelayMs: backoffFor(failures),
-                resumeDiscarded: ledger.resumeDiscarded || result.rotated,
-                circuit: failures >= RESTART_FAIL_THRESHOLD ? 'open' : 'closed',
-                updatedAt: stamp(),
+            result = await attempt(name, { configPath: opts.configPath, allowResumeRotation: !ledger.resumeDiscarded }, deps);
+        }
+        catch (e) {
+            // A session that could not even start is an immediate failure like any
+            // other; it must count, or an unstartable role loops forever.
+            result = {
+                elapsedSecs: 0,
+                exit: { version: 1, class: 'unknown', detail: e instanceof Error ? e.message : String(e) },
+                rotated: false,
+                mode: 'fresh',
             };
-            if (next.circuit === 'open') {
-                next.openedAt = stamp();
-                next.nextDelayMs = 0;
-                writeRestartLedger(dir, next);
-                deps.log(`[${name}] HELD DOWN after ${failures} immediate failures at ${next.openedAt} — ` +
-                    `${reason}; the agent will not be restarted until: ours-fleet restart ${name}`);
-                continue;
-            }
+        }
+        // Re-read: the attempt itself may have taken minutes, and an operator may
+        // have reset the ledger meanwhile.
+        ledger = readRestartLedger(dir);
+        if (result.modelRecovery === 'advance') {
+            writeRestartLedger(dir, {
+                ...emptyLedger(),
+                lastReason: 'approved model-chain transition',
+                updatedAt: stamp(),
+            });
+            continue;
+        }
+        if (result.modelRecovery === 'hold') {
+            await deps.sleep(HELD_DOWN_POLL_MS);
+            continue;
+        }
+        const fastFailSecs = fastFailSecsFor(name, opts.configPath);
+        const immediate = result.elapsedSecs < fastFailSecs;
+        if (!immediate) {
+            // A session that ran for a while is not a restart loop, whatever ended it.
+            writeRestartLedger(dir, {
+                ...emptyLedger(),
+                lastReason: result.exit.detail,
+                updatedAt: stamp(),
+            });
+            continue;
+        }
+        const failures = ledger.consecutiveImmediateFailures + 1;
+        const reason = `${result.exit.detail} after ${result.elapsedSecs.toFixed(1)}s`;
+        const next = {
+            version: 1,
+            consecutiveImmediateFailures: failures,
+            lastReason: reason,
+            nextDelayMs: backoffFor(failures),
+            resumeDiscarded: ledger.resumeDiscarded || result.rotated,
+            circuit: failures >= RESTART_FAIL_THRESHOLD ? 'open' : 'closed',
+            updatedAt: stamp(),
+        };
+        if (next.circuit === 'open') {
+            next.openedAt = stamp();
+            next.nextDelayMs = 0;
             writeRestartLedger(dir, next);
-            deps.log(`[${name}] immediate failure ${failures}/${RESTART_FAIL_THRESHOLD} (${reason}) ` +
-                `-> backing off ${next.nextDelayMs}ms`);
-            await deps.sleep(next.nextDelayMs);
+            deps.log(`[${name}] HELD DOWN after ${failures} immediate failures at ${next.openedAt} — ` +
+                `${reason}; the agent will not be restarted until: ours-fleet restart ${name}`);
+            continue;
         }
-        return readRestartLedger(dir);
-    }
-    finally {
-        // Only an orderly return through this loop clears the marker; a signal or
-        // an OOM-kill leaves it, which is exactly how the successor detects them.
-        releaseSupervisorRun(dir);
+        writeRestartLedger(dir, next);
+        deps.log(`[${name}] immediate failure ${failures}/${RESTART_FAIL_THRESHOLD} (${reason}) ` +
+            `-> backing off ${next.nextDelayMs}ms`);
+        await deps.sleep(next.nextDelayMs);
     }
+    return readRestartLedger(dir);
 }
 /**
  * How short an attempt has to be to count as immediate. The role's harness

package/dist/session/acp.d.ts

@@ -1,26 +1,10 @@
 import * as acp from '@agentclientprotocol/sdk';
 import type { CommonPermissions } from '../config.js';
-import type { AcpMcpServer } from '../harness/types.js';
 import { ConversationEventStore } from './conversation-store.js';
 import type { ConversationSnapshot, PromptOrigin, PromptReceipt, SubmitPromptCommand } from './conversation-types.js';
 import type { ConversationHandlePage, ExitRecord, InterruptOutcome, QueuedPrompt, SessionEvent, RuntimeSelectorMetadata, SessionHandle, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnOutcome, TurnResult } from './types.js';
 /** Bound safe-boundary waiting without turning a hung tool into cancellation. */
 export declare const AFTER_TOOL_BOUNDARY_TIMEOUT_MS = 120000;
-/**
- * How long a steering-started turn is presumed to still own the adapter after
- * its last update. Such a turn has no prompt id, so it never reports a
- * stopReason and there is no exact end to observe — silence is the only signal
- * available, and this is the bound that turns it into a decision.
- *
- * Sized from the fleet's own scheduled-run history: across 1513 completed
- * scheduled runs the longest silence WITHIN a working turn was 120.2 s (p99
- * 41.0 s; 5 runs above 60 s). A shorter grace would release the lease while the
- * adapter is still working and re-admit a prompt into a busy turn, which is the
- * FLEET-003 failure itself. The costs are deliberately asymmetric: holding too
- * long skips one best-effort maintenance tick, releasing too early SIGTERMs a
- * live role.
- */
-export declare const STEERING_OCCUPANCY_IDLE_MS = 150000;
 /** Server-generated typed provenance followed by the exact human-authored body. */
 export declare function promptContentBlocks(text: string, origin?: PromptOrigin): acp.ContentBlock[];
 export declare function runtimeSelector(options: acp.SessionConfigOption[] | null | undefined, category: string): RuntimeSelectorMetadata | undefined;
@@ -36,22 +20,6 @@ export interface AcpSessionOptions {
     modeId?: string;
     /** Adapter-resolved live permission policy; separate from ACP agent-specific session modes. */
     permissionMode?: NonNullable<SessionSnapshot['permissionMode']>;
-    /** Adapter-authenticated request-metadata vocabulary; never inferred from ACP `_meta`. */
-    permissionMetadataSource?: 'codex-acp';
-    /**
-     * MCP servers the ROLE declares, for every session/new, resume and load. Empty
-     * or omitted sends `[]`, which is what fleet has always sent and leaves the
-     * agent's own configuration untouched.
-     */
-    mcpServers?: AcpMcpServer[];
-    /**
-     * Adapter-supplied `_meta` for session/new — the only route by which a
-     * capability the CLI takes as a flag reaches an agent that accepts none.
-     * Per-agent vocabulary, so the ADAPTER decides whether there is anything to
-     * send; this layer only forwards it. Never sent on resume or load: it carries
-     * session-creation options the agent has already applied.
-     */
-    sessionMeta?: Record<string, unknown>;
     log(line: string): void;
     /** Test seam for the cancel-escalation grace period; production uses the default. */
     cancelGraceMs?: number;
@@ -63,8 +31,6 @@ export interface AcpSessionOptions {
     controllerGraceMs?: number;
     /** Test seam; production uses AFTER_TOOL_BOUNDARY_TIMEOUT_MS. */
     afterToolBoundaryTimeoutMs?: number;
-    /** Test seam; production uses STEERING_OCCUPANCY_IDLE_MS. */
-    steeringOccupancyIdleMs?: number;
 }
 /**
  * Classify an ACP `stopReason` into a terminal outcome. A refusal and a
@@ -83,8 +49,6 @@ export declare class AcpSession implements SessionHandle {
     private readonly child;
     private readonly events;
     private readonly conversation;
-    /** Cursor before this runner generation began; older durable events stay off the live console. */
-    private readonly conversationStartCursor?;
     /** New on every runner start; permission/turn IDs from prior generations are stale. */
     private readonly sessionGeneration;
     /** True while `session/load` replays history as ordinary updates. */
@@ -94,12 +58,6 @@ export declare class AcpSession implements SessionHandle {
     private connection;
     private sessionId?;
     private readiness;
-    /**
-     * Last non-replayed session update from the agent. `readiness` cannot answer
-     * "is this agent working" for a steered turn (FLEET-002), and this is the
-     * evidence that can.
-     */
-    private lastUpdateAt?;
     private lastError?;
     private promptTail;
     private queueDepth;
@@ -115,13 +73,6 @@ export declare class AcpSession implements SessionHandle {
     private cancelEscalation?;
     private cancelForceKill?;
     private cancelRecoveryReason?;
-    /**
-     * Held while a steering-started turn is believed to own the adapter. It is a
-     * lease, not a latch: `steeringRelease` always fires, so the role can never be
-     * stranded busy by a wake whose turn ended without telling anyone.
-     */
-    private steeringOccupied;
-    private steeringRelease?;
     /**
      * Rejects the moment the adapter process is gone. Every in-flight ACP request
      * races it, so a dead adapter can never leave a turn — and therefore a
@@ -143,20 +94,6 @@ export declare class AcpSession implements SessionHandle {
      */
     private recoverOpenPrompts;
     isAlive(): boolean;
-    /**
-     * Take the occupancy lease for a turn the adapter started on its own behalf.
-     * Refreshed by every adapter update, so it tracks work actually happening
-     * rather than a fixed guess at how long a wake takes.
-     */
-    private holdSteeringOccupancy;
-    private refreshSteeringOccupancy;
-    /**
-     * Every exit from occupancy comes through here, including the ones that are
-     * not the timer: a real turn boundary, close, and adapter exit. A lease that
-     * can leak is worse than the bug it fixes — it would leave the role reporting
-     * `running` forever and starve scheduled admission permanently.
-     */
-    private releaseSteeringOccupancy;
     snapshot(): SessionSnapshot;
     private toolCall;
     private reserveTool;
@@ -189,28 +126,6 @@ export declare class AcpSession implements SessionHandle {
      * for it is what turned a busy agent into a timeout and then into "dead".
      */
     queuePrompt(text: string, options?: SubmitPromptOptions): Promise<QueuedPrompt>;
-    /**
-     * Prepare the session for a prompt that asked to pre-empt current work.
-     *
-     * The old behaviour was one unconditional `session/cancel` notification
-     * followed immediately by `session/prompt`. That is what produced the owner's
-     * "request failed before completion":
-     *
-     *  - `cancelActive` only awaits settlement when `this.activeTurn` is set, and
-     *    a turn the ADAPTER started (steering's `startedNewTurn`) is never tracked
-     *    here. So the cancel raced the adapter's own transcript repair and the new
-     *    prompt landed while the last assistant message still held an unresolved
-     *    `tool_use` — rejected with `stop_reason=tool_use`.
-     *  - With nothing running at all, it still sent the cancel, and the prompt
-     *    landed on a bare interrupted user message — rejected with
-     *    `stop_reason=null`.
-     *
-     * So: never cancel across a tool boundary, and never cancel something whose
-     * settlement cannot be awaited. Everything else is queued, which the ACP queue
-     * already does correctly. The returned state is what the caller may claim to a
-     * human — `interrupted` only when a turn really was cancelled.
-     */
-    private prepareInterruptingDelivery;
     /**
      * Durably record a prompt admission BEFORE acceptance is returned. Browser
      * admissions are transactional — a prompt the ledger cannot hold is refused,
@@ -258,15 +173,6 @@ export declare class AcpSession implements SessionHandle {
     private settlePendingAutomatically;
     exitResult(): ExitRecord | null;
     close(): Promise<void>;
-    /**
-     * The role's declared MCP servers, or `[]`.
-     *
-     * Sent on resume and load as well as on new: the agent builds its server set
-     * once per session, so a resumed session that omitted them would come back
-     * without the tools the role's config declares — which is exactly the shape of
-     * silent drop this plumbing exists to end.
-     */
-    private declaredMcpServers;
     private initialize;
     private captureRuntimeMetadata;
     private runPrompt;
@@ -279,15 +185,6 @@ export declare class AcpSession implements SessionHandle {
      */
     private settleAutomatically;
     private withinAutomaticBoundary;
-    /**
-     * Codex ACP 1.1.7 marks its protected MCP elicitation bridge on a locationless
-     * execute request. The marker is meaningful only together with the runner's
-     * independently supplied, adapter-authenticated metadata vocabulary and effective
-     * mode: an arbitrary ACP process cannot gain this path by copying `_meta` alone.
-     * Exact option ids/kinds bind recognition to the protected-MCP shape and keep
-     * malformed requests on the ordinary fail-closed path.
-     */
-    private isEffectiveCodexProtectedMcpApproval;
     private recordUpdate;
     /**
      * Codex ACP's phase extension is the only currently supported visibility
@@ -302,6 +199,5 @@ export declare class AcpSession implements SessionHandle {
     }): ConversationHandlePage;
     conversationSnapshot(): ConversationSnapshot;
     subscribeConversation(listener: Parameters<ConversationEventStore['subscribe']>[0]): () => void;
-    private isCurrentConversationEvent;
     private fail;
 }