@ours.network/fleet 0.19.0-nightly.8 → 1.0.0

package/dist/loops/state.js

@@ -100,6 +100,9 @@ export class ScheduledLoopStateStore {
             if (old?.definitionHash === definition.definitionHash) {
                 next[definition.name] = {
                     ...old, promptHash: definition.promptHash, enabled: definition.enabled,
+                    // A file written before this field existed restores as undefined; an
+                    // unreported gap is absent, not lost, so normalize rather than trust.
+                    missedGap: old.missedGap ?? null,
                 };
             }
             else {
@@ -119,6 +122,7 @@ export class ScheduledLoopStateStore {
                     activeRunId: old?.activeRunId ?? null,
                     counts: old?.counts ?? zeroCounts(), lastError: old?.lastError ?? null,
                     operatorDisabled: old?.operatorDisabled ?? false,
+                    missedGap: old?.missedGap ?? null,
                 };
             }
             if (recoverActive && next[definition.name].activeRunId) {

package/dist/model-env.d.ts

@@ -0,0 +1,71 @@
+import type { ResolvedRole } from './config.js';
+/**
+ * Which environment variable a harness reads to pin the model it RUNS.
+ *
+ * This is not a convenience: for `claude-code` it is the only channel that
+ * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
+ * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
+ * adapter resolves its model in this order — ANTHROPIC_MODEL, then
+ * `settings.model`, then a resumed session's live model, then its first
+ * catalogue entry. A role's declared model was therefore invisible to every
+ * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
+ * an explicitly requested one.
+ */
+export declare const MODEL_ENV_BY_HARNESS: Readonly<Record<string, string>>;
+/** The model-pin variable for a harness, or undefined if it pins no model by env. */
+export declare function modelEnvVar(harness: string | undefined): string | undefined;
+export interface RoleModelEnvInput {
+    harness: string;
+    /** Already resolved by `resolveRoleModel` — may come from the fleet default. */
+    model: string | undefined;
+    /** True when the role (or `--model`) named a model, including `model: null`. */
+    modelWasExplicit: boolean;
+    defaultsEnv?: Record<string, string>;
+    roleEnv?: Record<string, string>;
+    authProxyBaseUrl?: string;
+}
+export interface RoleModelEnv {
+    env: Record<string, string>;
+    /**
+     * The model the harness will actually run. Equal to `env[pin]` for a harness
+     * that pins by env, so anything reporting this value reports the runtime.
+     */
+    model: string | undefined;
+}
+/**
+ * Resolve a role's environment and its runtime model TOGETHER, so the two can
+ * never disagree.
+ *
+ * Precedence, highest first:
+ *   1. an explicit `model:` / `--model` on the role
+ *   2. the role's own `env:` pin
+ *   3. the fleet `defaults.model`
+ *   4. the fleet `defaults.env` pin
+ *
+ * Inheriting the fleet default remains correct when the role names no model
+ * (2, 3, 4); an explicitly named one wins (1). Where both are explicit and they
+ * disagree, there is no defensible winner, so this refuses rather than picking
+ * one silently — the silence is what let a day of "Fable" work run on Opus.
+ *
+ * `model: null` explicitly asks for no fleet-chosen model, so it also clears an
+ * inherited pin instead of leaving one in place to act as a hidden default.
+ */
+export declare function resolveRoleModelEnv(input: RoleModelEnvInput, describe?: (message: string) => Error): RoleModelEnv;
+/**
+ * The model a role will actually run, read back from the environment it was
+ * resolved with. Use this wherever a model is reported to a human.
+ */
+export declare function effectiveRoleModel(role: ResolvedRole): string | undefined;
+/**
+ * Move a role's env pin onto a new model. Anything that changes the model a
+ * role runs after resolution — model-chain recovery is the live example — must
+ * go through this, or it changes only the label.
+ */
+export declare function repinModelEnv(role: ResolvedRole, model: string | undefined): Record<string, string> | undefined;
+/**
+ * Last line of defence, at the exact point a child's environment is composed:
+ * refuse to launch a role whose child would run a model other than the one the
+ * role declares and the banner reports. A spawn that cannot keep those two in
+ * agreement must fail loudly, not start and be believed.
+ */
+export declare function assertModelPinReachesChild(role: ResolvedRole, childEnv: Record<string, string | undefined>): void;

package/dist/model-env.js

@@ -0,0 +1,106 @@
+/**
+ * Which environment variable a harness reads to pin the model it RUNS.
+ *
+ * This is not a convenience: for `claude-code` it is the only channel that
+ * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
+ * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
+ * adapter resolves its model in this order — ANTHROPIC_MODEL, then
+ * `settings.model`, then a resumed session's live model, then its first
+ * catalogue entry. A role's declared model was therefore invisible to every
+ * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
+ * an explicitly requested one.
+ */
+export const MODEL_ENV_BY_HARNESS = {
+    'claude-code': 'ANTHROPIC_MODEL',
+};
+/** The model-pin variable for a harness, or undefined if it pins no model by env. */
+export function modelEnvVar(harness) {
+    return harness === undefined ? undefined : MODEL_ENV_BY_HARNESS[harness];
+}
+/**
+ * Resolve a role's environment and its runtime model TOGETHER, so the two can
+ * never disagree.
+ *
+ * Precedence, highest first:
+ *   1. an explicit `model:` / `--model` on the role
+ *   2. the role's own `env:` pin
+ *   3. the fleet `defaults.model`
+ *   4. the fleet `defaults.env` pin
+ *
+ * Inheriting the fleet default remains correct when the role names no model
+ * (2, 3, 4); an explicitly named one wins (1). Where both are explicit and they
+ * disagree, there is no defensible winner, so this refuses rather than picking
+ * one silently — the silence is what let a day of "Fable" work run on Opus.
+ *
+ * `model: null` explicitly asks for no fleet-chosen model, so it also clears an
+ * inherited pin instead of leaving one in place to act as a hidden default.
+ */
+export function resolveRoleModelEnv(input, describe = message => new Error(message)) {
+    const env = {
+        ...(input.defaultsEnv ?? {}),
+        ...(input.roleEnv ?? {}),
+        ...(input.authProxyBaseUrl ? { ANTHROPIC_BASE_URL: input.authProxyBaseUrl } : {}),
+    };
+    const pin = modelEnvVar(input.harness);
+    if (!pin)
+        return { env, model: input.model };
+    const rolePin = input.roleEnv?.[pin];
+    if (input.modelWasExplicit) {
+        if (rolePin !== undefined && rolePin !== input.model)
+            throw describe(`model '${input.model ?? '(none)'}' contradicts env.${pin} '${rolePin}'; `
+                + `remove one — ${pin} is what the harness actually runs`);
+        if (input.model === undefined)
+            delete env[pin];
+        else
+            env[pin] = input.model;
+        return { env, model: input.model };
+    }
+    // Not explicit: a role-level pin is the most specific thing said about this
+    // role, so it decides — and the reported model follows it.
+    if (rolePin !== undefined)
+        return { env, model: rolePin };
+    if (input.model !== undefined)
+        env[pin] = input.model;
+    return { env, model: input.model ?? env[pin] };
+}
+/**
+ * The model a role will actually run, read back from the environment it was
+ * resolved with. Use this wherever a model is reported to a human.
+ */
+export function effectiveRoleModel(role) {
+    const pin = modelEnvVar(role.harness);
+    return (pin ? role.env?.[pin] : undefined) ?? role.model;
+}
+/**
+ * Move a role's env pin onto a new model. Anything that changes the model a
+ * role runs after resolution — model-chain recovery is the live example — must
+ * go through this, or it changes only the label.
+ */
+export function repinModelEnv(role, model) {
+    const pin = modelEnvVar(role.harness);
+    if (!pin)
+        return role.env;
+    const env = { ...(role.env ?? {}) };
+    if (model === undefined)
+        delete env[pin];
+    else
+        env[pin] = model;
+    return Object.keys(env).length ? env : undefined;
+}
+/**
+ * Last line of defence, at the exact point a child's environment is composed:
+ * refuse to launch a role whose child would run a model other than the one the
+ * role declares and the banner reports. A spawn that cannot keep those two in
+ * agreement must fail loudly, not start and be believed.
+ */
+export function assertModelPinReachesChild(role, childEnv) {
+    const pin = modelEnvVar(role.harness);
+    if (!pin || role.model === undefined)
+        return;
+    const actual = childEnv[pin];
+    if (actual === role.model)
+        return;
+    throw new Error(`[${role.name}] refusing to launch: role model is '${role.model}' but the child's `
+        + `${pin} is ${actual === undefined ? 'unset' : `'${actual}'`} — the session would run a `
+        + 'different model than the one reported');
+}

package/dist/monitor.d.ts

@@ -122,7 +122,7 @@ export declare function filterEvents(events: NotifyEvent[], wakeSources: string[
 /**
  * Summarize a (coalesced) batch of events into one content-free console line —
  * count + senders + ids, ending in the call to action. Falls back to compact
- * counts when a burst would blow past the length cap (design §3, edge: burst).
+ * counts when a burst would exceed the length cap.
  */
 export declare function formatNotificationLine(events: NotifyEvent[]): string;
 /**
@@ -146,7 +146,7 @@ export declare function looksModal(pane: string): boolean;
  * Heuristic: did the turn shown in this pane TERMINATE in an API-level error?
  * Claude Code renders a failed turn's tail as an `API Error:` line (a Usage-Policy
  * refusal, a 4xx, etc.). We scan a generous tail window so the marker survives a
- * trailing idle composer redrawn beneath it (design §3.2, refine empirically).
+ * trailing idle composer redrawn beneath it; refine empirically.
  * The N-consecutive threshold in the Monitor debounces the odd false match.
  */
 export declare function looksApiError(pane: string): boolean;

package/dist/monitor.js

@@ -2,7 +2,7 @@ import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { classifyFailureText } from './model-recovery.js';
-// Code constants (not config — YAGNI, design §2).
+// Code constants rather than user configuration.
 const DEFAULT_PORT = 3050;
 // The daemon normally holds for 25s, but that value is operator-configurable
 // and synchronous daemon work can delay the response. The former 35s timer
@@ -191,7 +191,7 @@ const plural = (n, one, many = one + 's') => (n === 1 ? one : many);
 /**
  * Summarize a (coalesced) batch of events into one content-free console line —
  * count + senders + ids, ending in the call to action. Falls back to compact
- * counts when a burst would blow past the length cap (design §3, edge: burst).
+ * counts when a burst would exceed the length cap.
  */
 export function formatNotificationLine(events) {
     const of = (t) => events.filter(e => e.event === t);
@@ -229,7 +229,7 @@ export function formatNotificationLine(events) {
     ].filter(Boolean).join(', ');
     return `${PREFIX} ${compact} — run get_messages`;
 }
-// ─── Modal-dialog detection (design §3.2, refined empirically) ────────────────
+// ─── Modal-dialog detection, refined empirically ─────────────────────────────
 //
 // `❯` is Claude Code's ordinary composer prompt, so it is on screen in nearly
 // every capture. Testing for it *anywhere* in the pane therefore says nothing;
@@ -285,7 +285,7 @@ export function looksModal(pane) {
  * Heuristic: did the turn shown in this pane TERMINATE in an API-level error?
  * Claude Code renders a failed turn's tail as an `API Error:` line (a Usage-Policy
  * refusal, a 4xx, etc.). We scan a generous tail window so the marker survives a
- * trailing idle composer redrawn beneath it (design §3.2, refine empirically).
+ * trailing idle composer redrawn beneath it; refine empirically.
  * The N-consecutive threshold in the Monitor debounces the odd false match.
  */
 export function looksApiError(pane) {

package/dist/ops.d.ts

@@ -21,12 +21,12 @@ export interface OpsDeps {
      * Called the INSTANT a registration is created, before anything else can
      * fail. A creation transaction that learns about registrations only from
      * `up()`'s return value learns nothing when `up()` throws — and the service
-     * it just registered is then invisible to rollback (6.2). Optional: plain
+     * it just registered is then invisible to rollback. Optional: plain
      * `ours-fleet up` has no transaction to tell.
      */
     onInstalled?(outcome: InstallOutcome): void;
     /**
-     * Optional: supervises the single watchdog-scheduler process (Task 10).
+     * Optional: supervises the single watchdog-scheduler process.
      * Absent for callers that predate watchdogs — `up`/`down` must never throw
      * just because this hook is missing.
      */

package/dist/ops.js

@@ -17,7 +17,7 @@ import { daemonIdentityProvisioner, reconcilePermanentRoleIdentities, } from './
 /** Materialize a role's state dir from config: briefing + markers. Returns the dir. */
 export function applyRole(role, opts = {}) {
     const adapter = getAdapter(role.harness);
-    const errs = adapter.validateOptions(role.harness_options);
+    const errs = adapter.validateOptions(role.harness_options, role);
     if (errs.length)
         throw new Error(`role '${role.name}': ` + errs.map(e => `${e.path}: ${e.message}`).join('; '));
     const dir = agentDir(role.name, opts.temp === true);
@@ -62,7 +62,7 @@ export async function up(cfg, names, deps, configPath, identityGuarantee) {
         // guessing "stopped" from an unanswered probe silently discards a live
         // conversation.
         // An explicit operator `up` is the sanctioned way to release a held-down
-        // role: the still-alive runner polls this file and resumes (3.2).
+        // role: the still-alive runner polls this file and resumes.
         resetRestartLedger(dir);
         const live = await deps.backend.liveness(role.name)
             .catch(e => ({ state: 'unknown', detail: e instanceof Error ? e.message : String(e) }));
@@ -71,7 +71,7 @@ export async function up(cfg, names, deps, configPath, identityGuarantee) {
         else if (live.state === 'unknown')
             deps.log(`  ! ${role.name}: liveness unknown, keeping session context — ${live.detail}`);
         // Report what each install actually did, so a creation transaction can undo
-        // only the registrations IT made (6.2). Announced immediately as well as
+        // only the registrations IT made. Announced immediately as well as
         // returned: a later role in this same loop can throw, and the registrations
         // already made must still be undoable.
         const outcome = { ...await deps.backend.install(role.name, deps.binPath), role: role.name };
@@ -94,7 +94,7 @@ function stableStringify(value) {
         return v;
     });
 }
-/** sha256 over the resolved enabled-watchdog set, stable regardless of config source order (finding #4). */
+/** SHA-256 over the resolved enabled-watchdog set, stable regardless of config source order. */
 function watchdogFingerprint(enabled) {
     const sorted = [...enabled].sort((a, b) => a.name.localeCompare(b.name));
     return createHash('sha256').update(stableStringify(sorted)).digest('hex');
@@ -117,14 +117,14 @@ function writeFingerprint(fingerprint) {
 }
 /**
  * Install/start (or stop) the single supervised watchdog-scheduler process
- * (Task 10) to match the config's enabled watchdogs. Runs on every `up`,
+ * to match the config's enabled watchdogs. Runs on every `up`,
  * including a named `up <Role>` — cheap and idempotent, and the alternative
  * (only reconciling on a whole-fleet `up`) would leave a newly-enabled
  * watchdog unscheduled until the next bare `up`. Never throws: a scheduler
  * hiccup must not fail the role installs that already succeeded.
  *
  * Restarts ONLY when something the scheduler actually needs to pick up
- * changed (finding #4): an unconditional `restart()` on every `up` —
+ * changed: an unconditional `restart()` on every `up` —
  * including a named `up <SomeUnrelatedRole>` — interrupted whatever the
  * scheduler was mid-run (a 15s stop timeout can kill a long check without a
  * report). Two independent signals decide: `svc.install()`'s own `changed`
@@ -142,7 +142,7 @@ async function reconcileWatchdogScheduler(cfg, deps, configPath) {
         return;
     const enabled = cfg.watchdogs.filter(w => w.enabled);
     try {
-        // Check supervised() before any stop (final review #3): on an
+        // Check supervised() before any stop: on an
         // unsupervised platform/config, the scheduler was never installed, so
         // stopping it is not just a no-op — on Linux, stop() throws for a unit
         // that was never loaded. A watchdog-less fleet must not see that
@@ -162,7 +162,7 @@ async function reconcileWatchdogScheduler(cfg, deps, configPath) {
         if (unitChanged || fingerprintChanged) {
             // restart(), not start(): start() is a no-op on an already-active unit,
             // so a config change (new/changed watchdogs) would never reach a
-            // scheduler that's already running (final review #4).
+            // scheduler that's already running.
             await svc.restart();
             deps.log(`↑ watchdogs scheduler (${enabled.map(w => w.name).join(', ')})`);
         }
@@ -208,7 +208,7 @@ export async function down(cfg, names, deps) {
     // Only a whole-fleet `down` (no names) stops the scheduler — stopping one
     // named role is not a decision to stop watching the others (tolerate
     // absence/errors: a never-installed scheduler must not fail `down`).
-    // supervised() gates the call itself (final review #3): on an
+    // supervised() gates the call itself: on an
     // unsupervised platform/config there is nothing installed to stop, and
     // Linux's stop() throws for a unit that was never loaded.
     if (names.length === 0 && deps.watchdogService?.supervised()) {

package/dist/owner-channel/channel.d.ts

@@ -217,6 +217,13 @@ export declare class OwnerChannel implements OwnerChannelHandle {
      * CLI is asked to bounce this very process; neither can happen afterwards.
      */
     private restartSelf;
+    /**
+     * The caller may itself be a room member. Persist and acknowledge acceptance
+     * before an external worker starts a saga that can retire this process.
+     */
+    private closeRoomFromOwner;
+    /** Carry a task terminal request through a worker that survives this role. */
+    private terminalTaskFromOwner;
     /** Code-point-safe tail of the worklog, or undefined when there is none. */
     private readWorklogTail;
     /** Bound harness-command output to a single outbound message. */
@@ -250,6 +257,16 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private warnOwnerOfUnauthorizedSender;
     private effectiveOwners;
     private authorizationIntegrity;
+    /**
+     * Report what the session actually did with the prompt, not what the config
+     * asked for. `interrupt: true` used to be reported as "your request
+     * interrupted the previous task" unconditionally; the session now answers
+     * whether anything was cancelled, whether the request is queued behind
+     * earlier prompts, or whether it is held until the current task reaches a
+     * safe stopping point. Backends that report no delivery state keep the old
+     * queuedBehind-based wording.
+     */
+    private acceptanceNotice;
     private complete;
     private commentsState;
     /** Model-authored commentary only; raw protocol/tool data never reaches here. */

package/dist/owner-channel/channel.js

@@ -6,6 +6,7 @@ import { DEFAULT_OWNER_ATTACHMENT_MIME, canonicalCid, } from '../config.js';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { ACP_CANCEL_DEADLINE_EXCEEDED, SessionControlError, interruptOutcome, } from '../session/types.js';
 import { VERSION } from '../version.js';
+import { renderMarkdownFailure, renderMarkdownResult, taskStatus, } from '../rooms-tasks/markdown.js';
 import { dispatchOwnerCommand, fleetCliOps, isOwnerCommandText, } from './commands.js';
 import { OURS_BOUND_ELSEWHERE, OursSdkClient, oursErrorCode, } from './ours-client.js';
 import { ownerNotices, } from './notices.js';
@@ -195,10 +196,13 @@ export class OwnerChannel {
                 ? ' with interruption'
                 : event.monitor.interrupt === 'after_tool' ? ' with after-tool steering' : '';
             const monitor = `${event.monitor.mode} monitor${monitorPolicy}`;
+            const permission = event.permissionMode
+                ? `; permission ${event.permissionMode.fleetMode}, native ${event.permissionMode.nativeMode}`
+                : '';
             const inherited = event.inherited.length
                 ? ` Supervisor inherited omitted defaults: ${event.inherited.join(', ')}.` : '';
             await this.sendProactiveMessage(`🧑‍💻 ${event.caller} spawned ${event.lifetime} agent ${event.role} `
-                + `(${event.harness}/${event.session}${model}; ${monitor}).${inherited}`, `fleet-spawn\0${event.creationActionId}`, 0);
+                + `(${event.harness}/${event.session}${model}; ${monitor}${permission}).${inherited}`, `fleet-spawn\0${event.creationActionId}`, 0);
         });
         this.managementTail = run.then(() => undefined, () => undefined);
         return run;
@@ -789,17 +793,13 @@ export class OwnerChannel {
             outbox = this.outboxDir(originWireId);
             await mkdir(outbox, { recursive: true, mode: 0o700 });
             const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
-            const queued = await this.options.session.queuePrompt(this.ownerAttachmentPrompt(sender, originWireId, requestId, outbox, admitted, group.caption), {
+            const queued = await this.options.session.queuePrompt(this.ownerAttachmentPrompt(sender, originWireId, requestId, admitted, group.caption), {
                 interrupt: this.options.config.interrupt,
                 ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
                 origin: { kind: 'owner', requestId,
                     ...(group.caption ? { displayText: String(group.caption.text ?? '') } : {}) },
             });
-            const accepted = this.options.config.interrupt
-                ? ownerNotices.receivedInterrupting()
-                : queued.queuedBehind > 0
-                    ? ownerNotices.receivedQueued(queued.queuedBehind)
-                    : ownerNotices.receivedStarted();
+            const accepted = this.acceptanceNotice(queued);
             handledWireIds.forEach(wire => this.inFlight.add(wire));
             const receipt = this.send(sender.id, accepted, originWireId).then(() => undefined).catch(error => {
                 this.logError(`attachment request ${requestId.slice(0, 12)} acceptance notice failed`, error);
@@ -918,7 +918,7 @@ export class OwnerChannel {
         let queued;
         const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
         try {
-            queued = await this.options.session.queuePrompt(this.ownerPrompt(sender, text, wireId, outbox), {
+            queued = await this.options.session.queuePrompt(this.ownerPrompt(sender, text, wireId), {
                 interrupt: this.options.config.interrupt,
                 ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
                 origin: { kind: 'owner', requestId, displayText: text },
@@ -940,14 +940,7 @@ export class OwnerChannel {
             this.state.remember(wireId);
             return true;
         }
-        // Interrupting the live turn does not remove prompts which were already
-        // accepted into the ACP queue. Never claim this request is running while
-        // the session itself says earlier work remains ahead of it.
-        const accepted = queued.queuedBehind > 0
-            ? ownerNotices.receivedQueued(queued.queuedBehind)
-            : this.options.config.interrupt
-                ? ownerNotices.receivedInterrupting()
-                : ownerNotices.receivedStarted();
+        const accepted = this.acceptanceNotice(queued);
         this.inFlight.add(wireId);
         const receipt = this.send(sender.id, accepted, wireId).then(() => undefined).catch(error => {
             this.logError(`request ${requestId.slice(0, 12)} acceptance notice failed`, error);
@@ -996,6 +989,8 @@ export class OwnerChannel {
                 return this.commentsState();
             },
             fleetList: () => this.fleetOps.list(),
+            closeRoom: roomId => this.closeRoomFromOwner(sender, roomId, wireId),
+            terminalTask: (taskId, kind, outcome) => this.terminalTaskFromOwner(sender, taskId, kind, outcome, wireId),
             recentEvents: limit => this.options.session.eventsSince(0).slice(-limit),
             readWorklogTail: maxChars => this.readWorklogTail(maxChars),
             reply: async (replyText) => { await this.send(sender.id, replyText, wireId); },
@@ -1046,6 +1041,60 @@ export class OwnerChannel {
         this.options.log(`[${this.options.role}] owner requested ${command}`);
         await this.fleetOps.restart(mode);
     }
+    /**
+     * The caller may itself be a room member. Persist and acknowledge acceptance
+     * before an external worker starts a saga that can retire this process.
+     */
+    async closeRoomFromOwner(sender, roomId, wireId) {
+        const { acceptManagedRoomClose, recordManagedRoomCloseError } = await import('../rooms-tasks/close.js');
+        await acceptManagedRoomClose(roomId);
+        await this.send(sender.id, renderMarkdownFailure({
+            kind: 'pending', subject: `/room delete ${roomId} ${roomId}`,
+            detail: 'The deletion request was accepted and is still being settled.',
+            action: `Run /room recover ${roomId} if deletion remains pending.`,
+        }), wireId);
+        this.state.remember(wireId);
+        try {
+            await this.fleetOps.closeRoom(roomId);
+        }
+        catch (error) {
+            await recordManagedRoomCloseError(roomId, error instanceof Error ? error.message : String(error), `External delete worker failed to start. Retry /room delete ${roomId} ${roomId}.`);
+            throw error;
+        }
+    }
+    /** Carry a task terminal request through a worker that survives this role. */
+    async terminalTaskFromOwner(sender, taskId, kind, outcome, wireId) {
+        const { getTask } = await import('../rooms-tasks/task-state.js');
+        const { acceptTaskTerminalIntent, recordTaskTerminalIntentError, } = await import('../rooms-tasks/terminal.js');
+        const task = getTask(taskId);
+        const accepted = await acceptTaskTerminalIntent({
+            taskId, kind, roomId: task.room_id, outcome,
+        });
+        if (accepted.terminal_intent?.status === 'settled') {
+            await this.send(sender.id, renderMarkdownResult({
+                icon: '📋', title: 'Task terminal action complete',
+                fields: [
+                    { label: 'ID', value: taskId, kind: 'code' },
+                    { label: 'Status', value: taskStatus(accepted.state), kind: 'markdown' },
+                ],
+            }), wireId);
+            this.state.remember(wireId);
+            return;
+        }
+        await this.send(sender.id, renderMarkdownFailure({
+            kind: 'pending', subject: `/task ${kind === 'done' ? 'done' : 'cancel'} ${taskId}`,
+            detail: 'The terminal request was accepted and is still being settled.',
+            action: `Run /task recover ${taskId} if it remains pending.`,
+        }), wireId);
+        this.state.remember(wireId);
+        try {
+            await this.fleetOps.settleTask(taskId);
+        }
+        catch (error) {
+            await recordTaskTerminalIntentError(taskId, error instanceof Error ? error.message : String(error), `External settle worker failed to start. Retry the identical task command or run task recover ${taskId}.`);
+            throw error;
+        }
+    }
     /** Code-point-safe tail of the worklog, or undefined when there is none. */
     async readWorklogTail(maxChars) {
         try {
@@ -1332,6 +1381,32 @@ export class OwnerChannel {
     authorizationIntegrity() {
         return this.options.config.agent ? { ok: true } : this.authorizations.integrity();
     }
+    /**
+     * Report what the session actually did with the prompt, not what the config
+     * asked for. `interrupt: true` used to be reported as "your request
+     * interrupted the previous task" unconditionally; the session now answers
+     * whether anything was cancelled, whether the request is queued behind
+     * earlier prompts, or whether it is held until the current task reaches a
+     * safe stopping point. Backends that report no delivery state keep the old
+     * queuedBehind-based wording.
+     */
+    acceptanceNotice(queued) {
+        switch (queued.delivery) {
+            case 'interrupted': return ownerNotices.receivedInterrupting();
+            case 'deferred': return ownerNotices.receivedDeferred();
+            case 'queued': return ownerNotices.receivedQueued(Math.max(1, queued.queuedBehind));
+            case 'started': return ownerNotices.receivedStarted();
+            default:
+                // Interrupting the live turn does not remove prompts which were already
+                // accepted into the ACP queue. Never claim this request is running while
+                // the session itself says earlier work remains ahead of it.
+                return queued.queuedBehind > 0
+                    ? ownerNotices.receivedQueued(queued.queuedBehind)
+                    : this.options.config.interrupt
+                        ? ownerNotices.receivedInterrupting()
+                        : ownerNotices.receivedStarted();
+        }
+    }
     async complete(active, outbox, queued, activityCursor) {
         const progressMs = this.options.config.progress_interval_ms;
         let lastSeq = activityCursor;
@@ -1532,7 +1607,7 @@ export class OwnerChannel {
             throw new Error('commentary appears to contain secret, reasoning, or raw tool content');
         return message;
     }
-    ownerAttachmentPrompt(sender, wireId, requestId, outbox, files, caption) {
+    ownerAttachmentPrompt(sender, wireId, requestId, files, caption) {
         const lines = [
             '[fleet-owner]',
             `Authenticated owner ${safeField(sender.name, 160)} (${sender.id}) sent owner-channel attachment request ${wireId}.`,
@@ -1556,10 +1631,13 @@ export class OwnerChannel {
                     lines.push(`- voice transcript status: ${transcription?.status ?? 'unavailable'}`, `- voice transcript fallback: audio path above; category ${transcription?.errorCategory ?? 'not_provided'}`);
             }
         }
-        lines.push('Answer in your final assistant response; fleet routes it only to the authenticated sender and correlates it to the originating file wire.', `To attach response files, write regular files only to: ${outbox}`);
+        lines.push('Answer in your final assistant response; fleet routes it only to the authenticated sender and correlates it to the originating file wire.', 
+        // send_file is the only delivery route an agent is given: a tool call either
+        // delivers or reports an error, where a file written to disk does neither.
+        'To send the owner a file — now or later in this turn — call ours `send_file`:', `contact: ${this.options.config.identity}`, 'and the path of the finished file. Fleet routes it to the authenticated owner.', 'A file written anywhere else is not delivered and nothing will report that it was not.', 'Use descriptive unique filenames. Send nothing the owner did not request or should not receive.');
         return lines.join('\n');
     }
-    ownerPrompt(sender, text, wireId, outbox) {
+    ownerPrompt(sender, text, wireId) {
         return [
             '[fleet-owner]',
             `Authenticated owner ${sender.name} (${sender.id}) sent owner-channel message ${wireId}.`,
@@ -1573,10 +1651,13 @@ export class OwnerChannel {
             ] : [
                 'Managed-agent outbound relay is not configured; do not send intermediate or proactive owner-channel messages.',
             ]),
-            'To attach files to your response, copy each finished file directly into this fleet outbox:',
-            outbox,
-            'Fleet sends every regular file in that directory to the authenticated owner, correlated to this request.',
-            'Use descriptive unique filenames. Put nothing there that the owner did not request or should not receive.',
+            // send_file is the only delivery route an agent is given: a tool call either
+            // delivers or reports an error, where a file written to disk does neither.
+            'To send the owner a file — now or later in this turn — call ours `send_file`:',
+            `contact: ${this.options.config.identity}`,
+            'and the path of the finished file. Fleet routes it to the authenticated owner.',
+            'A file written anywhere else is not delivered and nothing will report that it was not.',
+            'Use descriptive unique filenames. Send nothing the owner did not request or should not receive.',
             '',
             text || '(empty message)',
         ].join('\n');

package/dist/owner-channel/commands.d.ts

@@ -1,4 +1,5 @@
 import type { InterruptOutcome, SessionEvent, SessionSnapshot } from '../session/types.js';
+import type { TaskOutcome, TaskTerminalIntent } from '../rooms-tasks/types.js';
 import { type OwnerCommentsState } from './notices.js';
 /**
  * Fleet-level effects a deterministic owner command may trigger. Production
@@ -10,6 +11,10 @@ export interface OwnerFleetOps {
     restart(mode: 'keep' | 'fresh'): Promise<void>;
     /** `ours-fleet ls` output. */
     list(): Promise<string>;
+    /** Start a room-close worker outside the caller role's supervisor lifecycle. */
+    closeRoom(roomId: string): Promise<void>;
+    /** Resume a task terminal intent outside the caller role's supervisor lifecycle. */
+    settleTask(taskId: string): Promise<void>;
 }
 /**
  * The narrow capability surface a command executor sees. Everything here is
@@ -40,6 +45,10 @@ export interface OwnerCommandContext {
      */
     setComments(enabled: boolean): OwnerCommentsState;
     fleetList(): Promise<string>;
+    /** Persist acceptance, acknowledge it, then launch the external close worker. */
+    closeRoom(roomId: string): Promise<void>;
+    /** Persist terminal intent, acknowledge it, then launch the external settle worker. */
+    terminalTask(taskId: string, kind: TaskTerminalIntent['kind'], outcome?: TaskOutcome): Promise<void>;
     recentEvents(limit: number): SessionEvent[];
     readWorklogTail(maxChars: number): Promise<string | undefined>;
     reply(text: string): Promise<void>;