@ours.network/fleet 1.1.0-nightly.3 → 1.1.0-nightly.30

package/dist/lifecycle-summary.d.ts

@@ -0,0 +1,134 @@
+import type { AgentSelection, ApprovalMode, FilesystemMode, FleetPermissionMode, MonitorInterrupt, MonitorMode, ResolvedRole, SessionBackendId, UnattendedMode } from './config.js';
+import type { IsolationBackendId, NetworkMode, OnUnavailable } from './isolation/types.js';
+/**
+ * Operator-facing launch configuration captured at the launch boundary from
+ * the exact ResolvedRole that was spawned. It is the single source for every
+ * Fleet lifecycle/report surface (CLI and owner-channel/Messenger).
+ *
+ * Security boundary: this object is a strict whitelist. It must never carry
+ * env, cwd or any local path, harness_options, session_options, owner_channel,
+ * or auth_proxy content. Hashes are secondary provenance only, never the
+ * primary description.
+ */
+export interface AgentLaunchConfiguration {
+    version: 1;
+    /** Agent template / launch definition label when one was selected. */
+    template?: string;
+    role: SelectionOrigin;
+    brain: SelectionOrigin;
+    harness: string;
+    session: SessionBackendId;
+    /**
+     * Model observed effective at launch. `null` reports runtime behavior — the
+     * harness ran its own default — not whether the author wrote `model: null`
+     * or omitted the field; effectiveRoleModel cannot distinguish those.
+     */
+    model: string | null;
+    effort?: string;
+    /** Concise first-line mission label (or Cowork-role fallback), never the full mission. */
+    mission?: string;
+    approval: ApprovalMode;
+    filesystem: FilesystemMode;
+    unattended: UnattendedMode;
+    /** Portable policy plus the exact native runtime mode after harness_options. */
+    permissionMode: {
+        fleetMode: FleetPermissionMode;
+        nativeMode: string;
+    };
+    monitor: {
+        mode: MonitorMode;
+        interrupt: MonitorInterrupt;
+    };
+    /** Requested isolation policy only — never resolved runtime facts or host paths. */
+    isolation?: {
+        requested: IsolationBackendId;
+        on_unavailable?: OnUnavailable;
+        network?: NetworkMode;
+        read_mounts?: number;
+        write_mounts?: number;
+    };
+    /** Present only for temporary agents; prompt bodies are never presented. */
+    loops?: {
+        source: 'agent-template' | 'cli' | 'omitted';
+        policy: 'skip-if-busy';
+        entries: Array<{
+            name: string;
+            enabled: boolean;
+            intervalMs: number;
+            initialDelayMs: number;
+            jitterMs: number;
+            prompt: {
+                bytes: number;
+                sha256: string;
+            };
+        }>;
+    };
+}
+/** Where a Brain/Role selection came from; labels are human, hashes secondary. */
+export type SelectionOrigin = {
+    kind: 'named';
+    ref: string;
+} | {
+    kind: 'inline';
+    fingerprint?: string;
+} | {
+    kind: 'unknown';
+};
+export declare const MISSION_LABEL_MAX = 80;
+/**
+ * The inline fingerprint is always computed here from the canonical inline
+ * body; provenance can never be an arbitrary caller string.
+ */
+export declare function selectionOrigin(selection: AgentSelection | undefined): SelectionOrigin;
+export declare function missionLabel(mission: string | undefined): string | undefined;
+/**
+ * Build the presentation from the exact resolved launch state. `origins`
+ * carries the authoring-time selections and template label because a merged
+ * ResolvedRole no longer distinguishes preset references from inline bodies.
+ * `permissionMode` is required at capture time: every supported harness
+ * adapter reports it, and the managed-spawn receiver gets it over the wire
+ * and must never re-resolve mutable configuration.
+ */
+export declare function summarizeResolvedLaunch(role: ResolvedRole, origins: {
+    role: SelectionOrigin;
+    brain: SelectionOrigin;
+    template?: string;
+    permissionMode: {
+        fleetMode: FleetPermissionMode;
+        nativeMode: string;
+    };
+    /** Shown when the resolved role has no mission text (e.g. Cowork role name). */
+    missionFallback?: string;
+}): AgentLaunchConfiguration;
+/**
+ * Component budget for one rendered agent line. The complete mandatory
+ * rendering must always fit — that is a validity condition of a current-v1
+ * configuration, enforced by mandatoryConfigurationFits at the builder AND
+ * the wire boundary — while optional components (monitor, isolation) are
+ * dropped whole with a visible `…` marker past this budget.
+ */
+export declare const AGENT_LINE_MAX_CODE_POINTS = 1500;
+export declare const AGENT_LINE_MAX_BYTES = 5000;
+/**
+ * Validity condition of a current-v1 configuration: its complete mandatory
+ * rendering fits the per-line budget with the optional-omission suffix
+ * reserved. Escaping and code-fence growth (a value made of backticks can
+ * more than triple its code span) make this depend on rendered size, not raw
+ * field lengths, so both summarizeResolvedLaunch and the wire validator call
+ * this instead of trusting per-field caps.
+ */
+export declare function mandatoryConfigurationFits(configuration: AgentLaunchConfiguration): boolean;
+/**
+ * Render one agent's configuration as a single escaped Markdown line segment.
+ * This is the only escaping boundary: callers pass raw values and must not
+ * escape the result again (it is safe as a markdownItems entry and inside
+ * owner-channel lifecycle messages). Every mandatory component always
+ * renders — mandatoryConfigurationFits guarantees the fit for every produced
+ * or wire-accepted configuration; only optional components may be dropped,
+ * whole (never splitting a Markdown span), with a visible `…`.
+ */
+export declare function renderAgentConfiguration(configuration: AgentLaunchConfiguration | undefined, fallback?: {
+    role?: string;
+    brain?: string;
+    permissions?: string;
+}): string;

package/dist/lifecycle-summary.js

@@ -0,0 +1,179 @@
+import { createHash } from 'node:crypto';
+import { Buffer } from 'node:buffer';
+import { canonicalJson } from './canonical-json.js';
+import { effectiveRoleModel } from './model-env.js';
+import { markdownCode, markdownProse } from './rooms-tasks/markdown.js';
+const FINGERPRINT_HEX = 12;
+export const MISSION_LABEL_MAX = 80;
+/**
+ * The inline fingerprint is always computed here from the canonical inline
+ * body; provenance can never be an arbitrary caller string.
+ */
+export function selectionOrigin(selection) {
+    if (!selection)
+        return { kind: 'unknown' };
+    if ('ref' in selection)
+        return { kind: 'named', ref: selection.ref };
+    const fingerprint = createHash('sha256').update(canonicalJson(selection.inline)).digest('hex');
+    return { kind: 'inline', fingerprint: fingerprint.slice(0, FINGERPRINT_HEX) };
+}
+export function missionLabel(mission) {
+    const line = mission?.trim().split('\n', 1)[0]?.trim();
+    if (!line)
+        return undefined;
+    const points = Array.from(line);
+    return points.length > MISSION_LABEL_MAX
+        ? `${points.slice(0, MISSION_LABEL_MAX - 1).join('')}…` : line;
+}
+/**
+ * Build the presentation from the exact resolved launch state. `origins`
+ * carries the authoring-time selections and template label because a merged
+ * ResolvedRole no longer distinguishes preset references from inline bodies.
+ * `permissionMode` is required at capture time: every supported harness
+ * adapter reports it, and the managed-spawn receiver gets it over the wire
+ * and must never re-resolve mutable configuration.
+ */
+export function summarizeResolvedLaunch(role, origins) {
+    const mission = missionLabel(role.mission) ?? missionLabel(origins.missionFallback);
+    const fs = role.isolation?.fs;
+    const configuration = {
+        version: 1,
+        ...(origins.template ? { template: origins.template } : {}),
+        role: origins.role,
+        brain: origins.brain,
+        harness: role.harness,
+        session: role.session,
+        model: effectiveRoleModel(role) ?? null,
+        ...(role.effort ? { effort: role.effort } : {}),
+        ...(mission ? { mission } : {}),
+        approval: role.permissions.approval,
+        filesystem: role.permissions.filesystem,
+        unattended: role.permissions.unattended,
+        permissionMode: origins.permissionMode,
+        monitor: { mode: role.monitor.mode, interrupt: role.monitor.interrupt },
+        ...(role.isolation?.backend ? { isolation: {
+                requested: role.isolation.backend,
+                ...(role.isolation.on_unavailable ? { on_unavailable: role.isolation.on_unavailable } : {}),
+                ...(role.isolation.network ? { network: role.isolation.network } : {}),
+                ...(fs?.read?.length ? { read_mounts: fs.read.length } : {}),
+                ...(fs?.write?.length ? { write_mounts: fs.write.length } : {}),
+            } } : {}),
+        ...(role.temporaryLoopSource ? { loops: {
+                source: role.temporaryLoopSource,
+                policy: 'skip-if-busy',
+                entries: (role.temporaryLoops ?? role.loops ?? []).map(loop => ({
+                    name: loop.name, enabled: loop.enabled, intervalMs: loop.intervalMs,
+                    initialDelayMs: loop.initialDelayMs, jitterMs: loop.jitterMs,
+                    prompt: { bytes: loop.promptBytes, sha256: loop.promptHash },
+                })),
+            } } : {}),
+    };
+    // A configuration whose complete mandatory rendering cannot fit must never
+    // be produced; real resolved values sit far below the budget, so this is a
+    // capture defect, not an expected path.
+    if (!mandatoryConfigurationFits(configuration))
+        throw new Error('agent launch presentation exceeds the mandatory rendering budget');
+    return configuration;
+}
+/**
+ * Component budget for one rendered agent line. The complete mandatory
+ * rendering must always fit — that is a validity condition of a current-v1
+ * configuration, enforced by mandatoryConfigurationFits at the builder AND
+ * the wire boundary — while optional components (monitor, isolation) are
+ * dropped whole with a visible `…` marker past this budget.
+ */
+export const AGENT_LINE_MAX_CODE_POINTS = 1_500;
+export const AGENT_LINE_MAX_BYTES = 5_000;
+const codePoints = (value) => Array.from(value).length;
+const utf8 = (value) => Buffer.byteLength(value, 'utf8');
+const OPTIONAL_OMISSION_SUFFIX = '; …';
+function selectionComponent(kind, value) {
+    if (value.kind === 'named')
+        return `${kind} preset ${markdownCode(value.ref)}`;
+    if (value.kind === 'inline')
+        return `inline ${kind}${value.fingerprint ? ` (def ${markdownCode(value.fingerprint)})` : ''}`;
+    return `${kind} unknown`;
+}
+/**
+ * The complete mandatory rendering: template, origins, mission, harness,
+ * model, effort, portable policy triple, and fleet/native permission mode.
+ * These must never be omitted from an operator-facing line.
+ */
+function mandatoryComponents(configuration) {
+    return [
+        configuration.template ? `template ${markdownCode(configuration.template)}` : undefined,
+        selectionComponent('Role', configuration.role),
+        configuration.mission ? `mission “${markdownProse(configuration.mission)}”` : undefined,
+        selectionComponent('Brain', configuration.brain),
+        `harness ${markdownCode(configuration.harness)}`,
+        `model ${configuration.model === null ? 'harness-default' : markdownCode(configuration.model)}`,
+        configuration.effort ? `effort ${markdownProse(configuration.effort)}` : undefined,
+        `approval=${configuration.approval}, filesystem=${configuration.filesystem}, `
+            + `unattended=${configuration.unattended}`,
+        `mode ${configuration.permissionMode.fleetMode}/${markdownProse(configuration.permissionMode.nativeMode)}`,
+    ].filter((part) => Boolean(part));
+}
+function optionalComponents(configuration) {
+    return [
+        `monitor ${configuration.monitor.mode}/${String(configuration.monitor.interrupt)}`,
+        configuration.isolation
+            ? `isolation requested ${configuration.isolation.requested}`
+                + `${configuration.isolation.network ? `, net ${configuration.isolation.network}` : ''}`
+                + `${configuration.isolation.on_unavailable ? `, on-unavailable ${configuration.isolation.on_unavailable}` : ''}`
+                + `${configuration.isolation.read_mounts || configuration.isolation.write_mounts
+                    ? `, mounts +${configuration.isolation.read_mounts ?? 0}ro/+${configuration.isolation.write_mounts ?? 0}rw` : ''}`
+            : undefined,
+        configuration.loops
+            ? configuration.loops.source === 'omitted'
+                ? 'temporary loops omitted (legacy behavior)'
+                : configuration.loops.entries.length === 0
+                    ? `temporary loops disabled (source ${configuration.loops.source})`
+                    : `temporary loops ${configuration.loops.entries.map(loop => `${loop.name}:${loop.enabled ? 'enabled' : 'disabled'}`
+                        + ` interval=${loop.intervalMs}ms delay=${loop.initialDelayMs}ms jitter=${loop.jitterMs}ms`
+                        + ` prompt=${loop.prompt.bytes}B/${loop.prompt.sha256.slice(0, 12)}`).join(', ')}; policy skip-if-busy; source ${configuration.loops.source}`
+            : undefined,
+    ].filter((part) => Boolean(part));
+}
+/**
+ * Validity condition of a current-v1 configuration: its complete mandatory
+ * rendering fits the per-line budget with the optional-omission suffix
+ * reserved. Escaping and code-fence growth (a value made of backticks can
+ * more than triple its code span) make this depend on rendered size, not raw
+ * field lengths, so both summarizeResolvedLaunch and the wire validator call
+ * this instead of trusting per-field caps.
+ */
+export function mandatoryConfigurationFits(configuration) {
+    const reserved = `${mandatoryComponents(configuration).join('; ')}${OPTIONAL_OMISSION_SUFFIX}`;
+    return codePoints(reserved) <= AGENT_LINE_MAX_CODE_POINTS && utf8(reserved) <= AGENT_LINE_MAX_BYTES;
+}
+/**
+ * Render one agent's configuration as a single escaped Markdown line segment.
+ * This is the only escaping boundary: callers pass raw values and must not
+ * escape the result again (it is safe as a markdownItems entry and inside
+ * owner-channel lifecycle messages). Every mandatory component always
+ * renders — mandatoryConfigurationFits guarantees the fit for every produced
+ * or wire-accepted configuration; only optional components may be dropped,
+ * whole (never splitting a Markdown span), with a visible `…`.
+ */
+export function renderAgentConfiguration(configuration, fallback) {
+    if (!configuration) {
+        const labels = [
+            fallback?.role ? `Role ${markdownProse(fallback.role)}` : undefined,
+            fallback?.brain ? `Brain ${markdownProse(fallback.brain)}` : undefined,
+            fallback?.permissions ? `permissions ${markdownProse(fallback.permissions)}` : undefined,
+        ].filter(Boolean).join('; ');
+        return `legacy launch; resolved details unavailable${labels ? ` (${labels})` : ''}`;
+    }
+    let line = mandatoryComponents(configuration).join('; ');
+    let omitted = false;
+    for (const part of optionalComponents(configuration)) {
+        const next = `${line}; ${part}`;
+        if (codePoints(`${next}${OPTIONAL_OMISSION_SUFFIX}`) > AGENT_LINE_MAX_CODE_POINTS
+            || utf8(`${next}${OPTIONAL_OMISSION_SUFFIX}`) > AGENT_LINE_MAX_BYTES) {
+            omitted = true;
+            continue;
+        }
+        line = next;
+    }
+    return omitted ? `${line}${OPTIONAL_OMISSION_SUFFIX}` : line;
+}

package/dist/loops/config.d.ts

@@ -7,6 +7,9 @@ export interface LoopConfig {
     initial_delay?: string;
     jitter?: string;
 }
+/** Agent Template-local loops are implicitly scoped to the temporary agent. */
+export type AgentLoopConfig = Omit<LoopConfig, 'roles'>;
+export type AgentLoopsConfig = Record<string, AgentLoopConfig>;
 export interface ResolvedLoop {
     name: string;
     selectors: string[];
@@ -24,7 +27,13 @@ export interface ResolvedRoleLoop extends Omit<ResolvedLoop, 'selectors' | 'role
     role: string;
     definitionHash: string;
 }
-export declare function resolveLoops(block: unknown, baseFile: string, roles: ResolvedRole[], vars: Record<string, string>): {
+export declare function resolveLoops(block: unknown, baseFile: string, roles: ResolvedRole[], vars: Record<string, string>, options?: {
+    assertTrustedSource?: boolean;
+}): {
     loops: ResolvedLoop[];
     byRole: Map<string, ResolvedRoleLoop[]>;
 };
+/** Resolve the canonical Agent Template schema without inventing a second loop language. */
+export declare function resolveAgentLoops(block: unknown, role: ResolvedRole, sourceFile?: string): ResolvedRoleLoop[];
+/** Fully explicit private snapshot form; prompt text is retained for deterministic recovery. */
+export declare function canonicalAgentLoops(loops: ResolvedRoleLoop[]): AgentLoopsConfig;

package/dist/loops/config.js

@@ -1,13 +1,15 @@
 import { createHash } from 'node:crypto';
 import { lstatSync } from 'node:fs';
 import { ConfigError, ROLE_NAME_RE } from '../config.js';
-import { parseDuration } from '../duration.js';
+import { sessionBackendCapabilities } from '../session/types.js';
+import { formatDuration, parseDuration } from '../duration.js';
 const LOOP_KEYS = ['roles', 'interval', 'prompt', 'enabled', 'initial_delay', 'jitter'];
 const MIN_INTERVAL_MS = 60_000;
 const MAX_DURATION_MS = 30 * 24 * 60 * 60 * 1_000;
 const MAX_JITTER_MS = 60 * 60 * 1_000;
 const MAX_PROMPT_BYTES = 16 * 1024;
 const MAX_PROMPT_SCALARS = 12_000;
+const MAX_AGENT_LOOPS = 64;
 function substitute(value, vars) {
     if (typeof value === 'string')
         return value.replace(/\$\{(\w+)\}/g, (match, key) => key in vars ? String(vars[key]) : match);
@@ -47,7 +49,7 @@ function normalizePrompt(raw, where) {
 function digest(value) {
     return createHash('sha256').update(JSON.stringify(value)).digest('hex');
 }
-export function resolveLoops(block, baseFile, roles, vars) {
+export function resolveLoops(block, baseFile, roles, vars, options = {}) {
     const byRole = new Map(roles.map(role => [role.name, []]));
     if (block === undefined || block === null)
         return { loops: [], byRole };
@@ -90,8 +92,8 @@ export function resolveLoops(block, baseFile, roles, vars) {
         const prompt = normalizePrompt(value.prompt, `${where}: prompt`);
         if (enabled)
             for (const role of selected) {
-                if (role.session !== 'acp')
-                    throw new ConfigError(`${where} selects role '${role.name}' with session '${role.session}'; scheduled loops require session: acp`);
+                if (!sessionBackendCapabilities(role.session, role.harness).promptInput)
+                    throw new ConfigError(`${where} selects role '${role.name}' with session '${role.session}'; scheduled loops require managed prompt input`);
             }
         const promptHash = digest(prompt);
         const resolved = {
@@ -113,10 +115,41 @@ export function resolveLoops(block, baseFile, roles, vars) {
     for (const values of byRole.values())
         values.sort((a, b) => a.name.localeCompare(b.name));
     out.sort((a, b) => a.name.localeCompare(b.name));
-    if (out.some(loop => loop.enabled))
+    if (out.some(loop => loop.enabled) && options.assertTrustedSource !== false)
         assertSafeLoopConfig(baseFile);
     return { loops: out, byRole };
 }
+/** Resolve the canonical Agent Template schema without inventing a second loop language. */
+export function resolveAgentLoops(block, role, sourceFile = '(temporary Agent loop)') {
+    if (block === undefined)
+        return [];
+    if (!block || typeof block !== 'object' || Array.isArray(block))
+        throw new ConfigError(`${sourceFile}: Agent loops must be a non-empty map`);
+    if (!Object.keys(block).length)
+        throw new ConfigError(`${sourceFile}: Agent loops must be non-empty; use an explicit no-loops override to disable template loops`);
+    if (Object.keys(block).length > MAX_AGENT_LOOPS)
+        throw new ConfigError(`${sourceFile}: Agent loops may contain at most ${MAX_AGENT_LOOPS} entries`);
+    const scoped = Object.fromEntries(Object.entries(block).map(([name, raw]) => {
+        if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+            return [name, raw];
+        const value = raw;
+        if (Object.hasOwn(value, 'roles'))
+            throw new ConfigError(`${sourceFile}: Agent loop '${name}' has unknown key roles; Agent loops are implicitly scoped`);
+        return [name, { ...value, roles: [role.name] }];
+    }));
+    return resolveLoops(scoped, sourceFile, [role], {}, { assertTrustedSource: false })
+        .byRole.get(role.name) ?? [];
+}
+/** Fully explicit private snapshot form; prompt text is retained for deterministic recovery. */
+export function canonicalAgentLoops(loops) {
+    return Object.fromEntries(loops.map(loop => [loop.name, {
+            enabled: loop.enabled,
+            interval: formatDuration(loop.intervalMs),
+            initial_delay: formatDuration(loop.initialDelayMs),
+            jitter: formatDuration(loop.jitterMs),
+            prompt: loop.prompt,
+        }]));
+}
 function assertSafeLoopConfig(path) {
     let stat;
     try {

package/dist/model-recovery.d.ts

@@ -5,7 +5,7 @@ export interface FailureEvidence {
     httpStatus?: number;
     model?: string;
     confidence: 'low' | 'medium' | 'high';
-    source: 'claude-pane' | 'acp' | 'auth-proxy';
+    source: 'claude-pane' | 'acp' | 'codex-app-server' | 'auth-proxy';
     observedAt: string;
 }
 export interface ModelRecoveryLedger {

package/dist/ops.js

@@ -179,23 +179,8 @@ async function reconcileWatchdogScheduler(cfg, deps, configPath) {
     }
 }
 export async function down(cfg, names, deps) {
-    const roles = names.length ? names.map(name => cfg.roles.find(role => role.name === name)) : cfg.roles;
-    for (let index = 0; index < roles.length; index++) {
-        const role = roles[index];
-        const requested = names[index];
-        if (!role && requested && /^[A-Za-z0-9_-]+$/.test(requested)
-            && existsSync(agentDir(requested, true))) {
-            try {
-                const outcome = await stopTempSupervisor(requested, { exec: deps.exec ?? realExec });
-                deps.log(`■ ${outcome === 'stopped' ? 'stopping' : 'stopped'} temporary role ${requested}`);
-            }
-            catch (e) {
-                deps.log(`  ! could not stop temporary role ${requested}: ${e instanceof Error ? e.message : String(e)}`);
-            }
-            continue;
-        }
-        if (!role)
-            throw new Error(`no such role '${requested}'`);
+    const roles = selectRoles(cfg, names);
+    for (const role of roles) {
         // Never swallow the backend's reason. "maybe not running" hid real stop
         // failures — a wedged unit, an unreachable user bus — behind a guess.
         try {

package/dist/owner-channel/channel.d.ts

@@ -2,6 +2,7 @@ import { type OwnerChannelConfig } from '../config.js';
 import { type AgentSession } from '../session/types.js';
 import { type OwnerFleetOps } from './commands.js';
 import type { ManagedFleetSpawnResult } from '../fleet-proxy.js';
+import { type FleetAuditAttempt, type FleetAuditPresentation, type FleetCommandOutcomeClass } from '../fleet-command-audit.js';
 import { type OursOps } from './ours-client.js';
 import { type OwnerUpdatePhase } from './notices.js';
 import { type OwnerEntry } from './state.js';
@@ -27,14 +28,45 @@ export interface OwnerChannelOptions {
     binderDeps?: OwnerBinderDeps;
     /** Pre-acquired by the runner so the predecessor control socket remains reachable while waiting. */
     binderLease?: OwnerBinderLease;
+    recoveryDeps?: {
+        now(): number;
+        setTimer(fn: () => void, ms: number): ReturnType<typeof setTimeout>;
+        clearTimer(timer: ReturnType<typeof setTimeout>): void;
+        deadlineMs?: number;
+    };
 }
 export interface OwnerChannelHandle {
     start(): Promise<void>;
     drain(): Promise<void>;
     close(): Promise<void>;
+    /** Reattach this same supervisor-owned channel after a daemon generation change. */
+    recover?(epoch: string): Promise<void>;
+    /** False when shutdown skipped client disposal because quiescence was unproven. */
+    binderReleaseSafe?(): boolean;
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
     /** Fleet-owned deterministic lifecycle notice; absent on legacy test doubles. */
     notifyFleetSpawn?(event: ManagedFleetSpawnResult): Promise<void>;
+    notifyFleetLifecycle?(presentations: FleetAuditPresentation[]): Promise<void>;
+    beginFleetCommandAudit?(requestId: string, argv: string[]): Promise<FleetAuditAttempt>;
+    finishFleetCommandAudit?(input: {
+        correlationId: string;
+        class: FleetCommandOutcomeClass;
+        exitCode?: number;
+        effect: 'not_started' | 'completed' | 'unknown';
+        resourceIds?: Record<string, string>;
+        presentations?: FleetAuditPresentation[];
+    }): Promise<FleetAuditAttempt>;
+}
+export declare const OWNER_RECOVERY_QUEUE_CAPACITY = 32;
+export declare const OWNER_RECOVERY_DEGRADED = "OWNER_RECOVERY_DEGRADED";
+export declare class OwnerRecoveryDegradedError extends Error {
+    readonly code = "OWNER_RECOVERY_DEGRADED";
+    constructor();
+}
+export declare class OwnerRecoveryTimeoutError extends Error {
+    readonly stage: string;
+    readonly code = "OWNER_RECOVERY_DEGRADED";
+    constructor(stage: string);
 }
 export type OwnerChannelManagementRequest = {
     action: 'contact_list';
@@ -144,6 +176,8 @@ export declare class OwnerChannel implements OwnerChannelHandle {
      * (a crash must replay them) but must not be queued twice while live.
      */
     private readonly inFlight;
+    /** SDK handlers entered during the current getMessages call. */
+    private readonly typedHandlersEntered;
     /** Wires already NACKed to the managed agent, so a history replay stays quiet. */
     private readonly relayNacks;
     /**
@@ -162,17 +196,47 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private readonly completionTasks;
     private readonly activeRequests;
     private managementTail;
+    private recoveryEpoch?;
+    private recoveryTask?;
+    private recoveryToken;
+    private recoveryQueued;
+    private watchGeneration;
+    /** A timed-out client operation that must settle before replacement is safe. */
+    private recoveryQuiescence?;
+    private releaseSafe;
     private ready;
+    private startedOnce;
+    private shutdownDegraded;
     private binder?;
     private binderOwnedInternally;
     private readonly fleetOps;
     private readonly prepareRestart;
+    private readonly commandAudits;
+    private readonly lifecycleOutbox;
     constructor(options: OwnerChannelOptions);
     start(): Promise<void>;
     drain(): Promise<void>;
     close(): Promise<void>;
+    binderReleaseSafe(): boolean;
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
     notifyFleetSpawn(event: ManagedFleetSpawnResult): Promise<void>;
+    notifyFleetLifecycle(presentations: FleetAuditPresentation[]): Promise<void>;
+    private flushPendingFleetLifecycle;
+    beginFleetCommandAudit(requestId: string, argv: string[]): Promise<FleetAuditAttempt>;
+    finishFleetCommandAudit(input: {
+        correlationId: string;
+        class: FleetCommandOutcomeClass;
+        exitCode?: number;
+        effect: 'not_started' | 'completed' | 'unknown';
+        resourceIds?: Record<string, string>;
+        presentations?: FleetAuditPresentation[];
+    }): Promise<FleetAuditAttempt>;
+    private flushPendingFleetCommandAudits;
+    private deliverFleetCommandOutcome;
+    recover(epoch: string): Promise<void>;
+    private recoveryStage;
+    private writeShutdownState;
+    private queueManagement;
     private manageNow;
     /**
      * The daemon reports established contacts and pending introductions as two
@@ -213,6 +277,15 @@ export declare class OwnerChannel implements OwnerChannelHandle {
      * agent itself can execute /force-restart, /model, or any other command.
      */
     private handleCommand;
+    /**
+     * Register one typed adapter per primary slash command. The adapter performs
+     * the live CID check before constructing the same slash text and entering the
+     * existing dispatcher; its null SDK result avoids duplicating the ordinary
+     * owner-channel replies that remain the command's result contract.
+     */
+    private registerTypedCommands;
+    private handleRecoveredTypedCommand;
+    private handleTypedCommand;
     /** Queue raw slash text to the harness and report the turn's outcome. */
     private runHarnessCommand;
     /**
@@ -225,9 +298,8 @@ export declare class OwnerChannel implements OwnerChannelHandle {
      * before an external worker starts a saga that can retire this process.
      */
     private closeRoomFromOwner;
-    private recoverRoomFromOwner;
-    /** Carry a task terminal request through a worker that survives this role. */
-    private recoverTaskFromOwner;
+    /** Accept a permanent any-state deletion, acknowledge it, then hand cleanup to a durable worker. */
+    private deleteTaskFromOwner;
     private terminalTaskFromOwner;
     /** Code-point-safe tail of the worklog, or undefined when there is none. */
     private readWorklogTail;