@ours.network/fleet 0.19.0-nightly.9 → 1.0.1

package/dist/isolation/policy.d.ts

@@ -23,7 +23,7 @@ export declare function mountConflict(mount: string, forbidden: string): 'exact'
  */
 export declare function validateIsolationConfig(raw: unknown): string[];
 /**
- * Where a role's per-role harness runtime state lives (5.1). Under the agent's
+ * Where a role's per-role harness runtime state lives. Under the agent's
  * own state directory, so it is covered by the state dir's existing lifecycle
  * and by the forbidden-path exception, and is never shared with a peer.
  */

package/dist/isolation/policy.js

@@ -105,7 +105,7 @@ export function validateIsolationConfig(raw) {
     return problems;
 }
 /**
- * Where a role's per-role harness runtime state lives (5.1). Under the agent's
+ * Where a role's per-role harness runtime state lives. Under the agent's
  * own state directory, so it is covered by the state dir's existing lifecycle
  * and by the forbidden-path exception, and is never shared with a peer.
  */
@@ -147,7 +147,7 @@ export function resolveIsolation(cfg, ctx) {
     addRw(stateDir);
     addRw(runCwd);
     if (ctx.harnessHome && ctx.harnessRuntimeDir) {
-        // The harness home is backed by a PER-ROLE directory (5.1): the agent gets a
+        // The harness home is backed by a PER-ROLE directory: the agent gets a
         // writable home for its sessions, caches and history, and anything a future
         // CLI version writes lands there too. The shared credentials, global
         // instructions and configuration are then layered back read-only, so they

package/dist/isolation/registry.d.ts

@@ -11,12 +11,12 @@ export interface Selection {
     detail: string;
 }
 /**
- * Pick the isolation backend for a resolved policy, honouring `auto` (bwrap-first,
- * rootless — OQ-5) and the `on_unavailable` degradation policy.
+ * Pick the isolation backend for a resolved policy, honouring rootless,
+ * bwrap-first `auto` and the `on_unavailable` degradation policy.
  *
  * - `none`         → the identity backend.
  * - `bubblewrap`   → bwrap if available, else degrade/refuse per on_unavailable.
- * - `podman`       → not implemented yet (Phase 6) ⇒ treated as unavailable.
+ * - `podman`       → not implemented ⇒ treated as unavailable.
  * - `auto`         → bwrap if available, else degrade/refuse.
  *
  * On `on_unavailable: strict` with nothing available, throws (fail closed).

package/dist/isolation/registry.js

@@ -4,12 +4,12 @@ import { makeNoneBackend } from './none.js';
 export { makeBubblewrapBackend, unsharesNet } from './bubblewrap.js';
 export { makeNoneBackend } from './none.js';
 /**
- * Pick the isolation backend for a resolved policy, honouring `auto` (bwrap-first,
- * rootless — OQ-5) and the `on_unavailable` degradation policy.
+ * Pick the isolation backend for a resolved policy, honouring rootless,
+ * bwrap-first `auto` and the `on_unavailable` degradation policy.
  *
  * - `none`         → the identity backend.
  * - `bubblewrap`   → bwrap if available, else degrade/refuse per on_unavailable.
- * - `podman`       → not implemented yet (Phase 6) ⇒ treated as unavailable.
+ * - `podman`       → not implemented ⇒ treated as unavailable.
  * - `auto`         → bwrap if available, else degrade/refuse.
  *
  * On `on_unavailable: strict` with nothing available, throws (fail closed).
@@ -20,9 +20,9 @@ export async function selectIsolationBackend(policy, exec = realExec) {
     const candidates = [];
     if (policy.backend === 'auto' || policy.backend === 'bubblewrap')
         candidates.push(makeBubblewrapBackend(exec));
-    // podman: Phase 6 — no candidate yet, so it falls through to on_unavailable.
+    // podman has no candidate yet, so it falls through to on_unavailable.
     let lastDetail = policy.backend === 'podman'
-        ? 'podman backend not implemented yet (Phase 6)'
+        ? 'podman backend is not implemented'
         : 'no isolation backend available';
     for (const b of candidates) {
         const a = await b.available();

package/dist/isolation/resources.d.ts

@@ -5,7 +5,7 @@ export interface ResourceArgs {
 }
 /**
  * Build the `systemd-run --user --scope -p … --` prefix that caps the pane's
- * cgroup-v2 scope. Composed OUTSIDE the sandbox wrap (§5.3/§5.4): a tmux pane is
+ * cgroup-v2 scope. Composed OUTSIDE the sandbox wrap: a tmux pane is
  * a child of a tmux SERVER rather than of the role's own runner process, so the
  * only reliable per-agent limit is a transient scope at the pane itself. (Since
  * #32 that server is per role rather than fleet-wide, which is what keeps one

package/dist/isolation/resources.js

@@ -1,7 +1,7 @@
 import { readFileSync } from 'node:fs';
 /**
  * Build the `systemd-run --user --scope -p … --` prefix that caps the pane's
- * cgroup-v2 scope. Composed OUTSIDE the sandbox wrap (§5.3/§5.4): a tmux pane is
+ * cgroup-v2 scope. Composed OUTSIDE the sandbox wrap: a tmux pane is
  * a child of a tmux SERVER rather than of the role's own runner process, so the
  * only reliable per-agent limit is a transient scope at the pane itself. (Since
  * #32 that server is per role rather than fleet-wide, which is what keeps one

package/dist/isolation/types.d.ts

@@ -1,4 +1,4 @@
-/** Isolation backend selector. `auto` probes bubblewrap then podman; `none` disables wrapping. */
+/** Isolation backend selector. `auto` probes bubblewrap; `none` disables wrapping. */
 export type IsolationBackendId = 'auto' | 'bubblewrap' | 'podman' | 'none';
 /** What to do when the requested backend is unavailable. */
 export type OnUnavailable = 'warn' | 'strict';
@@ -38,7 +38,7 @@ export interface Mount {
     mode: 'ro' | 'rw';
 }
 /**
- * Runtime facts the pure resolver needs to compute the durable mount set (§5.2):
+ * Runtime facts the pure resolver needs to compute the durable mount set:
  * the agent's state dir, its working dir, the fleet user's home, and (if the ours
  * broker exposes one) a unix-socket endpoint to bind in.
  */
@@ -52,7 +52,7 @@ export interface WrapContext {
     additionalWriteDirs?: string[];
     /**
      * The harness's home directory on the host (`~/.claude`, `~/.codex`). Mounted
-     * from `harnessRuntimeDir` so the agent's own runtime state is per-role (5.1).
+     * from `harnessRuntimeDir` so the agent's own runtime state is per-role.
      */
     harnessHome?: string;
     /** Per-role writable directory backing `harnessHome` inside the sandbox. */

package/dist/loops/manager.d.ts

@@ -68,8 +68,32 @@ export declare class ScheduledLoopManager implements ScheduledLoopManagerHandle
     private armAbandon;
     private finish;
     private advance;
+    /**
+     * Coalesce a backlog into one skip. The counters alone say how many
+     * occurrences were lost but never when or for how long, so the window is
+     * recorded too and carried on the state until a run is actually told about it
+     * — a dropped pass has to stay visible to the next one, not just to whoever
+     * was reading the log at the time.
+     */
     private skipMissed;
-    private skipRestartMisses;
+    /**
+     * Restart is not, by itself, a reason to lose an occurrence a running manager
+     * would still have run. `poll` tolerates lateness up to one full interval and
+     * runs the tick late; this path used to drop anything already due however
+     * recently, so a role restarted seconds after its own tick came due lost it
+     * outright. For an oversight role that is precisely the pass which would have
+     * recorded why it restarted, so the failure erased its own witness.
+     *
+     * The tolerance is the only thing shared with `poll`. A backlog at least one
+     * interval deep is still coalesced into a single skip and never replayed —
+     * after a long outage exactly one occurrence survives, and `schedule` then
+     * arms it through the ordinary path rather than firing a burst here.
+     *
+     * Running the survivor late cannot outpace the configured cadence: `advance`
+     * moves the cursor by exactly one `intervalMs` per occurrence from the nominal
+     * time, so a loop that keeps restarting still runs at most once per interval.
+     */
+    private skipRestartBacklog;
     /**
      * A run the store could not record is dropped, not retried: the cursor has
      * already moved, so this can never become a busy loop, and the outage is
@@ -86,5 +110,10 @@ export declare class ScheduledLoopManager implements ScheduledLoopManagerHandle
      * until the process was restarted.
      */
     private recover;
+    /**
+     * The envelope is the only channel a scheduled pass has for learning about
+     * the passes that did not happen. A gap stated here is what lets an oversight
+     * role report its own outage instead of resuming as if nothing was missed.
+     */
     private envelope;
 }

package/dist/loops/manager.js

@@ -39,7 +39,7 @@ export class ScheduledLoopManager {
     }
     start() {
         if (!this.store.fresh)
-            this.skipRestartMisses();
+            this.skipRestartBacklog();
         this.schedule();
     }
     async stop() {
@@ -143,10 +143,15 @@ export class ScheduledLoopManager {
     async attempt(definition, state, scheduledAt) {
         const runId = `sl_${randomUUID()}`;
         const origin = { kind: 'scheduled-loop', loop: definition.name, runId };
-        const prompt = this.envelope(definition, runId, scheduledAt);
+        // The gap is read here and cleared only if the turn is actually admitted:
+        // an attempt that ends `skipped_busy` or `unavailable` reported it to
+        // nobody, so it has to still be there for the attempt that succeeds.
+        const gap = state.missedGap;
+        const prompt = this.envelope(definition, runId, scheduledAt, gap);
         let claimed = false;
         const result = await this.arbiter.tryScheduled(prompt, origin, () => {
             claimed = true;
+            state.missedGap = null;
             state.activeRunId = runId;
             state.lastRunId = runId;
             state.lastStartedAt = new Date(this.deps.now()).toISOString();
@@ -265,7 +270,15 @@ export class ScheduledLoopManager {
         state.nextScheduledAt = new Date(next).toISOString();
         state.nextDueAt = new Date(next + deterministicJitter(this.role, definition.name, next, definition.jitterMs)).toISOString();
     }
+    /**
+     * Coalesce a backlog into one skip. The counters alone say how many
+     * occurrences were lost but never when or for how long, so the window is
+     * recorded too and carried on the state until a run is actually told about it
+     * — a dropped pass has to stay visible to the next one, not just to whoever
+     * was reading the log at the time.
+     */
     skipMissed(definition, state, now) {
+        const from = state.nextScheduledAt;
         let missed = 0;
         while (Date.parse(state.nextDueAt) <= now) {
             this.advance(definition, state);
@@ -275,14 +288,43 @@ export class ScheduledLoopManager {
         state.counts.skippedMissed = increment(state.counts.skippedMissed, missed);
         state.lastOutcome = 'skipped_missed';
         state.lastFinishedAt = new Date(now).toISOString();
+        // Successive outages before any run lands merge into one gap: the earliest
+        // start wins, so the window always spans the whole silence.
+        const previous = state.missedGap;
+        state.missedGap = {
+            count: increment(previous?.count ?? 0, missed),
+            fromAt: previous?.fromAt ?? from,
+            throughAt: state.lastScheduledAt ?? from,
+            detectedAt: new Date(now).toISOString(),
+        };
         this.store.persist();
-        this.deps.log(`[${this.role}] loop ${definition.name} skipped_missed count=${missed}`);
+        this.deps.log(`[${this.role}] loop ${definition.name} skipped_missed count=${missed} `
+            + `gap=${from}..${state.missedGap.throughAt} `
+            + `unreported=${state.missedGap.count}`);
     }
-    skipRestartMisses() {
+    /**
+     * Restart is not, by itself, a reason to lose an occurrence a running manager
+     * would still have run. `poll` tolerates lateness up to one full interval and
+     * runs the tick late; this path used to drop anything already due however
+     * recently, so a role restarted seconds after its own tick came due lost it
+     * outright. For an oversight role that is precisely the pass which would have
+     * recorded why it restarted, so the failure erased its own witness.
+     *
+     * The tolerance is the only thing shared with `poll`. A backlog at least one
+     * interval deep is still coalesced into a single skip and never replayed —
+     * after a long outage exactly one occurrence survives, and `schedule` then
+     * arms it through the ordinary path rather than firing a burst here.
+     *
+     * Running the survivor late cannot outpace the configured cadence: `advance`
+     * moves the cursor by exactly one `intervalMs` per occurrence from the nominal
+     * time, so a loop that keeps restarting still runs at most once per interval.
+     */
+    skipRestartBacklog() {
         const now = this.deps.now();
         for (const definition of this.definitions.values()) {
             const state = this.store.state.loops[definition.name];
-            if (definition.enabled && !state.operatorDisabled && Date.parse(state.nextDueAt) <= now)
+            if (definition.enabled && !state.operatorDisabled
+                && now >= Date.parse(state.nextDueAt) + definition.intervalMs)
                 this.skipMissed(definition, state, now);
         }
     }
@@ -340,17 +382,38 @@ export class ScheduledLoopManager {
             this.deps.clearTimer(this.timer);
         this.arm(backoffMs(this.pollFailures));
     }
-    envelope(definition, runId, scheduledAt) {
+    /**
+     * The envelope is the only channel a scheduled pass has for learning about
+     * the passes that did not happen. A gap stated here is what lets an oversight
+     * role report its own outage instead of resuming as if nothing was missed.
+     */
+    envelope(definition, runId, scheduledAt, gap) {
+        const lateBy = Math.max(0, this.deps.now() - scheduledAt);
         return [
             '[fleet-loop]',
             `loop: ${definition.name}`,
             `run: ${runId}`,
             `scheduled_at: ${new Date(scheduledAt).toISOString()}`,
+            ...(lateBy > 0 ? [`started_late_by_ms: ${lateBy}`] : []),
+            ...(gap ? [
+                `missed_occurrences: ${gap.count}`,
+                `missed_window: ${gap.fromAt}..${gap.throughAt}`,
+                `missed_gap_ms: ${Math.max(0, Date.parse(gap.detectedAt) - Date.parse(gap.fromAt))}`,
+            ] : []),
             'origin: local-trusted-config',
             '',
             'This is a scheduled internal maintenance turn, not an owner message and not ordinary ours mail.',
             'Perform one bounded pass. Do not wait for the next tick. Do not report to an owner unless your',
             'configured policy and an existing authenticated proactive-report route authorize a material report.',
+            // Same single route as the owner-request prompt, and for the same reason.
+            'To send a file, call ours `send_file` with the recipient and the path — to your owner-channel',
+            'identity if this role has one, otherwise directly to the contact who should receive it.',
+            'A file written anywhere else is not delivered and nothing will report that it was not.',
+            ...(gap ? ['',
+                'This loop did not run for the window above: those occurrences were coalesced away while the role',
+                'was unavailable, and this pass is the first since. Treat the gap as part of what you are reporting',
+                'on — it is the record of your own outage, and no later pass will be told about it.',
+            ] : []),
             '',
             definition.prompt,
         ].join('\n');

package/dist/loops/state.d.ts

@@ -8,11 +8,29 @@ export interface LoopCounts {
     skippedBusy: number;
     skippedMissed: number;
 }
+/**
+ * A coalesced run of occurrences that were never submitted, held until a run
+ * actually starts and can be told about it. Without it a dropped occurrence
+ * survives only as a counter, which says how many were lost but never when or
+ * for how long — and an oversight role cannot report an outage it cannot date.
+ */
+export interface LoopMissedGap {
+    /** Occurrences coalesced away, summed across every skip since the last run. */
+    count: number;
+    /** Nominal time of the earliest occurrence in the gap. */
+    fromAt: string;
+    /** Nominal time of the latest occurrence in the gap. */
+    throughAt: string;
+    /** When the manager noticed — the end of the outage, not of the last skip. */
+    detectedAt: string;
+}
 export interface LoopRuntimeState {
     definitionHash: string;
     promptHash: string;
     enabled: boolean;
     operatorDisabled: boolean;
+    /** Unreported gap, cleared by the first run that carries it. */
+    missedGap: LoopMissedGap | null;
     nextScheduledAt: string;
     nextDueAt: string;
     lastScheduledAt: string | null;

package/dist/loops/state.js

@@ -100,6 +100,9 @@ export class ScheduledLoopStateStore {
             if (old?.definitionHash === definition.definitionHash) {
                 next[definition.name] = {
                     ...old, promptHash: definition.promptHash, enabled: definition.enabled,
+                    // A file written before this field existed restores as undefined; an
+                    // unreported gap is absent, not lost, so normalize rather than trust.
+                    missedGap: old.missedGap ?? null,
                 };
             }
             else {
@@ -119,6 +122,7 @@ export class ScheduledLoopStateStore {
                     activeRunId: old?.activeRunId ?? null,
                     counts: old?.counts ?? zeroCounts(), lastError: old?.lastError ?? null,
                     operatorDisabled: old?.operatorDisabled ?? false,
+                    missedGap: old?.missedGap ?? null,
                 };
             }
             if (recoverActive && next[definition.name].activeRunId) {

package/dist/model-env.d.ts

@@ -0,0 +1,71 @@
+import type { ResolvedRole } from './config.js';
+/**
+ * Which environment variable a harness reads to pin the model it RUNS.
+ *
+ * This is not a convenience: for `claude-code` it is the only channel that
+ * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
+ * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
+ * adapter resolves its model in this order — ANTHROPIC_MODEL, then
+ * `settings.model`, then a resumed session's live model, then its first
+ * catalogue entry. A role's declared model was therefore invisible to every
+ * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
+ * an explicitly requested one.
+ */
+export declare const MODEL_ENV_BY_HARNESS: Readonly<Record<string, string>>;
+/** The model-pin variable for a harness, or undefined if it pins no model by env. */
+export declare function modelEnvVar(harness: string | undefined): string | undefined;
+export interface RoleModelEnvInput {
+    harness: string;
+    /** Already resolved by `resolveRoleModel` — may come from the fleet default. */
+    model: string | undefined;
+    /** True when the role (or `--model`) named a model, including `model: null`. */
+    modelWasExplicit: boolean;
+    defaultsEnv?: Record<string, string>;
+    roleEnv?: Record<string, string>;
+    authProxyBaseUrl?: string;
+}
+export interface RoleModelEnv {
+    env: Record<string, string>;
+    /**
+     * The model the harness will actually run. Equal to `env[pin]` for a harness
+     * that pins by env, so anything reporting this value reports the runtime.
+     */
+    model: string | undefined;
+}
+/**
+ * Resolve a role's environment and its runtime model TOGETHER, so the two can
+ * never disagree.
+ *
+ * Precedence, highest first:
+ *   1. an explicit `model:` / `--model` on the role
+ *   2. the role's own `env:` pin
+ *   3. the fleet `defaults.model`
+ *   4. the fleet `defaults.env` pin
+ *
+ * Inheriting the fleet default remains correct when the role names no model
+ * (2, 3, 4); an explicitly named one wins (1). Where both are explicit and they
+ * disagree, there is no defensible winner, so this refuses rather than picking
+ * one silently — the silence is what let a day of "Fable" work run on Opus.
+ *
+ * `model: null` explicitly asks for no fleet-chosen model, so it also clears an
+ * inherited pin instead of leaving one in place to act as a hidden default.
+ */
+export declare function resolveRoleModelEnv(input: RoleModelEnvInput, describe?: (message: string) => Error): RoleModelEnv;
+/**
+ * The model a role will actually run, read back from the environment it was
+ * resolved with. Use this wherever a model is reported to a human.
+ */
+export declare function effectiveRoleModel(role: ResolvedRole): string | undefined;
+/**
+ * Move a role's env pin onto a new model. Anything that changes the model a
+ * role runs after resolution — model-chain recovery is the live example — must
+ * go through this, or it changes only the label.
+ */
+export declare function repinModelEnv(role: ResolvedRole, model: string | undefined): Record<string, string> | undefined;
+/**
+ * Last line of defence, at the exact point a child's environment is composed:
+ * refuse to launch a role whose child would run a model other than the one the
+ * role declares and the banner reports. A spawn that cannot keep those two in
+ * agreement must fail loudly, not start and be believed.
+ */
+export declare function assertModelPinReachesChild(role: ResolvedRole, childEnv: Record<string, string | undefined>): void;

package/dist/model-env.js

@@ -0,0 +1,106 @@
+/**
+ * Which environment variable a harness reads to pin the model it RUNS.
+ *
+ * This is not a convenience: for `claude-code` it is the only channel that
+ * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
+ * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
+ * adapter resolves its model in this order — ANTHROPIC_MODEL, then
+ * `settings.model`, then a resumed session's live model, then its first
+ * catalogue entry. A role's declared model was therefore invisible to every
+ * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
+ * an explicitly requested one.
+ */
+export const MODEL_ENV_BY_HARNESS = {
+    'claude-code': 'ANTHROPIC_MODEL',
+};
+/** The model-pin variable for a harness, or undefined if it pins no model by env. */
+export function modelEnvVar(harness) {
+    return harness === undefined ? undefined : MODEL_ENV_BY_HARNESS[harness];
+}
+/**
+ * Resolve a role's environment and its runtime model TOGETHER, so the two can
+ * never disagree.
+ *
+ * Precedence, highest first:
+ *   1. an explicit `model:` / `--model` on the role
+ *   2. the role's own `env:` pin
+ *   3. the fleet `defaults.model`
+ *   4. the fleet `defaults.env` pin
+ *
+ * Inheriting the fleet default remains correct when the role names no model
+ * (2, 3, 4); an explicitly named one wins (1). Where both are explicit and they
+ * disagree, there is no defensible winner, so this refuses rather than picking
+ * one silently — the silence is what let a day of "Fable" work run on Opus.
+ *
+ * `model: null` explicitly asks for no fleet-chosen model, so it also clears an
+ * inherited pin instead of leaving one in place to act as a hidden default.
+ */
+export function resolveRoleModelEnv(input, describe = message => new Error(message)) {
+    const env = {
+        ...(input.defaultsEnv ?? {}),
+        ...(input.roleEnv ?? {}),
+        ...(input.authProxyBaseUrl ? { ANTHROPIC_BASE_URL: input.authProxyBaseUrl } : {}),
+    };
+    const pin = modelEnvVar(input.harness);
+    if (!pin)
+        return { env, model: input.model };
+    const rolePin = input.roleEnv?.[pin];
+    if (input.modelWasExplicit) {
+        if (rolePin !== undefined && rolePin !== input.model)
+            throw describe(`model '${input.model ?? '(none)'}' contradicts env.${pin} '${rolePin}'; `
+                + `remove one — ${pin} is what the harness actually runs`);
+        if (input.model === undefined)
+            delete env[pin];
+        else
+            env[pin] = input.model;
+        return { env, model: input.model };
+    }
+    // Not explicit: a role-level pin is the most specific thing said about this
+    // role, so it decides — and the reported model follows it.
+    if (rolePin !== undefined)
+        return { env, model: rolePin };
+    if (input.model !== undefined)
+        env[pin] = input.model;
+    return { env, model: input.model ?? env[pin] };
+}
+/**
+ * The model a role will actually run, read back from the environment it was
+ * resolved with. Use this wherever a model is reported to a human.
+ */
+export function effectiveRoleModel(role) {
+    const pin = modelEnvVar(role.harness);
+    return (pin ? role.env?.[pin] : undefined) ?? role.model;
+}
+/**
+ * Move a role's env pin onto a new model. Anything that changes the model a
+ * role runs after resolution — model-chain recovery is the live example — must
+ * go through this, or it changes only the label.
+ */
+export function repinModelEnv(role, model) {
+    const pin = modelEnvVar(role.harness);
+    if (!pin)
+        return role.env;
+    const env = { ...(role.env ?? {}) };
+    if (model === undefined)
+        delete env[pin];
+    else
+        env[pin] = model;
+    return Object.keys(env).length ? env : undefined;
+}
+/**
+ * Last line of defence, at the exact point a child's environment is composed:
+ * refuse to launch a role whose child would run a model other than the one the
+ * role declares and the banner reports. A spawn that cannot keep those two in
+ * agreement must fail loudly, not start and be believed.
+ */
+export function assertModelPinReachesChild(role, childEnv) {
+    const pin = modelEnvVar(role.harness);
+    if (!pin || role.model === undefined)
+        return;
+    const actual = childEnv[pin];
+    if (actual === role.model)
+        return;
+    throw new Error(`[${role.name}] refusing to launch: role model is '${role.model}' but the child's `
+        + `${pin} is ${actual === undefined ? 'unset' : `'${actual}'`} — the session would run a `
+        + 'different model than the one reported');
+}

package/dist/monitor.d.ts

@@ -122,7 +122,7 @@ export declare function filterEvents(events: NotifyEvent[], wakeSources: string[
 /**
  * Summarize a (coalesced) batch of events into one content-free console line —
  * count + senders + ids, ending in the call to action. Falls back to compact
- * counts when a burst would blow past the length cap (design §3, edge: burst).
+ * counts when a burst would exceed the length cap.
  */
 export declare function formatNotificationLine(events: NotifyEvent[]): string;
 /**
@@ -146,7 +146,7 @@ export declare function looksModal(pane: string): boolean;
  * Heuristic: did the turn shown in this pane TERMINATE in an API-level error?
  * Claude Code renders a failed turn's tail as an `API Error:` line (a Usage-Policy
  * refusal, a 4xx, etc.). We scan a generous tail window so the marker survives a
- * trailing idle composer redrawn beneath it (design §3.2, refine empirically).
+ * trailing idle composer redrawn beneath it; refine empirically.
  * The N-consecutive threshold in the Monitor debounces the odd false match.
  */
 export declare function looksApiError(pane: string): boolean;

package/dist/monitor.js

@@ -2,7 +2,7 @@ import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { classifyFailureText } from './model-recovery.js';
-// Code constants (not config — YAGNI, design §2).
+// Code constants rather than user configuration.
 const DEFAULT_PORT = 3050;
 // The daemon normally holds for 25s, but that value is operator-configurable
 // and synchronous daemon work can delay the response. The former 35s timer
@@ -191,7 +191,7 @@ const plural = (n, one, many = one + 's') => (n === 1 ? one : many);
 /**
  * Summarize a (coalesced) batch of events into one content-free console line —
  * count + senders + ids, ending in the call to action. Falls back to compact
- * counts when a burst would blow past the length cap (design §3, edge: burst).
+ * counts when a burst would exceed the length cap.
  */
 export function formatNotificationLine(events) {
     const of = (t) => events.filter(e => e.event === t);
@@ -229,7 +229,7 @@ export function formatNotificationLine(events) {
     ].filter(Boolean).join(', ');
     return `${PREFIX} ${compact} — run get_messages`;
 }
-// ─── Modal-dialog detection (design §3.2, refined empirically) ────────────────
+// ─── Modal-dialog detection, refined empirically ─────────────────────────────
 //
 // `❯` is Claude Code's ordinary composer prompt, so it is on screen in nearly
 // every capture. Testing for it *anywhere* in the pane therefore says nothing;
@@ -285,7 +285,7 @@ export function looksModal(pane) {
  * Heuristic: did the turn shown in this pane TERMINATE in an API-level error?
  * Claude Code renders a failed turn's tail as an `API Error:` line (a Usage-Policy
  * refusal, a 4xx, etc.). We scan a generous tail window so the marker survives a
- * trailing idle composer redrawn beneath it (design §3.2, refine empirically).
+ * trailing idle composer redrawn beneath it; refine empirically.
  * The N-consecutive threshold in the Monitor debounces the odd false match.
  */
 export function looksApiError(pane) {

package/dist/ops.d.ts

@@ -21,12 +21,12 @@ export interface OpsDeps {
      * Called the INSTANT a registration is created, before anything else can
      * fail. A creation transaction that learns about registrations only from
      * `up()`'s return value learns nothing when `up()` throws — and the service
-     * it just registered is then invisible to rollback (6.2). Optional: plain
+     * it just registered is then invisible to rollback. Optional: plain
      * `ours-fleet up` has no transaction to tell.
      */
     onInstalled?(outcome: InstallOutcome): void;
     /**
-     * Optional: supervises the single watchdog-scheduler process (Task 10).
+     * Optional: supervises the single watchdog-scheduler process.
      * Absent for callers that predate watchdogs — `up`/`down` must never throw
      * just because this hook is missing.
      */