@ours.network/fleet 1.1.0-nightly.9 → 1.1.1

package/dist/rooms-tasks/templates.js

@@ -1,14 +1,45 @@
 import { createHash } from 'node:crypto';
+import { canonicalJson } from '../canonical-json.js';
+import { redactLaunchDefinition, sealLaunchSnapshot } from './launch-snapshot.js';
 export function hashTemplate(t) {
-    const canonical = JSON.stringify({
+    const canonical = canonicalJson({
         name: t.name, version: t.version, description: t.description,
         room: t.room, contract: t.contract, members: t.members,
     });
     return createHash('sha256').update(canonical).digest('hex');
 }
-export function snapshotTemplate(t) {
+export function snapshotTemplate(t, agentTemplates) {
     const { sourceFile: _, ...semantic } = t;
-    return { ...semantic, content_hash: hashTemplate(t) };
+    return { ...semantic, members: semantic.members.map(member => {
+            const definition = agentTemplates?.[member.agent_template];
+            return {
+                ...member,
+                ...(definition ? {
+                    agent_projection: redactLaunchDefinition(definition),
+                    agent_template_hash: createHash('sha256').update(canonicalJson(definition)).digest('hex'),
+                } : {}),
+            };
+        }), content_hash: agentTemplates ? createHash('sha256').update(canonicalJson({
+            template: hashTemplate(t),
+            members: semantic.members.map(member => ({
+                agent_template: member.agent_template,
+                agent_template_hash: agentTemplates?.[member.agent_template]
+                    ? createHash('sha256').update(canonicalJson(agentTemplates[member.agent_template])).digest('hex')
+                    : null,
+            })),
+        })).digest('hex') : hashTemplate(t) };
+}
+/** Explicit mutation boundary immediately before Task/Room plan persistence. */
+export function sealTemplateSnapshot(snapshot, agentTemplates, launchDefinitions) {
+    const referenced = Object.fromEntries([...new Set(snapshot.members.map(member => member.launch_definition_id ?? member.agent_template))]
+        .sort().map(id => {
+        const member = snapshot.members.find(candidate => (candidate.launch_definition_id ?? candidate.agent_template) === id);
+        const definition = launchDefinitions?.[id] ?? agentTemplates[member.agent_template];
+        if (!definition)
+            throw new Error(`Agent Template '${id}' not found`);
+        return [id, definition];
+    }));
+    return { ...snapshot, launch_snapshot_hash: sealLaunchSnapshot(referenced) };
 }
 export function resolveTemplate(name, customTemplates) {
     const atIdx = name.lastIndexOf('@');

package/dist/rooms-tasks/terminal.d.ts

@@ -1,6 +1,9 @@
 import { type RoomCloseDeps } from './close.js';
 import type { CoworkAdapter } from './cowork-adapter.js';
 import type { TaskOutcome, TaskRecord, TaskTerminalIntent } from './types.js';
+export declare const TASK_OPERATION_LOCK_STALE_MS: number;
+/** Common per-task operation lock serializing terminal, deletion, and recovery acceptance. */
+export declare function taskOperationLockPath(taskId: string): string;
 export interface TaskTerminalInput {
     taskId: string;
     kind: TaskTerminalIntent['kind'];

package/dist/rooms-tasks/terminal.js

@@ -2,10 +2,11 @@ import { join } from 'node:path';
 import { withFileLock } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
 import { deleteManagedRoom } from './close.js';
-import { beginTaskTerminalIntent, finishTaskTerminalIntent, getTask, setTaskTerminalIntentError, } from './task-state.js';
+import { assertNoPendingDeletion, beginTaskTerminalIntent, finishTaskTerminalIntent, getTask, setTaskTerminalIntentError, } from './task-state.js';
 import { getRoomRecord } from './room-state.js';
-const TASK_OPERATION_LOCK_STALE_MS = 10 * 60_000;
-function taskOperationLockPath(taskId) {
+export const TASK_OPERATION_LOCK_STALE_MS = 10 * 60_000;
+/** Common per-task operation lock serializing terminal, deletion, and recovery acceptance. */
+export function taskOperationLockPath(taskId) {
     return join(stateRoot(), 'locks', 'task-terminal', encodeURIComponent(taskId));
 }
 function errorText(error) {
@@ -24,6 +25,9 @@ export function acceptTaskTerminalIntent(input) {
 export function settleTaskTerminalIntent(input) {
     return withFileLock(taskOperationLockPath(input.taskId), async () => {
         const current = getTask(input.taskId);
+        // Deletion supersedes a pending terminal intent: fail boundedly before any
+        // room side effect so the deletion worker owns all remaining cleanup.
+        assertNoPendingDeletion(current);
         const intent = current.terminal_intent;
         if (!intent)
             throw new Error(`task ${input.taskId} has no accepted terminal intent`);
@@ -45,7 +49,9 @@ export function settleTaskTerminalIntent(input) {
             return finishTaskTerminalIntent(input.taskId);
         }
         catch (error) {
-            setTaskTerminalIntentError(input.taskId, errorText(error), `Retry 'ours-fleet task recover ${input.taskId}'.`);
+            setTaskTerminalIntentError(input.taskId, errorText(error), intent.kind === 'cancelled'
+                ? `Retry 'ours-fleet task cancel ${input.taskId} ${input.taskId}'.`
+                : `Retry 'ours-fleet task done ${input.taskId}'.`);
             throw error;
         }
     }, {}, TASK_OPERATION_LOCK_STALE_MS);

package/dist/rooms-tasks/types.d.ts

@@ -5,6 +5,7 @@
  * membership, and archive. Messenger Server owns owner presentation.
  * Fleet stores only IDs, CIDs, orchestration state, and saga cursors.
  */
+import type { AgentLaunchConfiguration } from '../lifecycle-summary.js';
 export type TaskState = 'backlog' | 'provisioning' | 'active' | 'review' | 'done' | 'cancelled' | 'failed';
 export declare const TASK_TERMINAL_STATES: readonly TaskState[];
 export declare const TASK_CANCELLABLE_STATES: readonly TaskState[];
@@ -44,6 +45,47 @@ export interface TaskTerminalIntent {
     first_failure?: string;
     first_recovery_hint?: string;
 }
+/** Origin evidence for an accepted deletion; retained until the record is unlinked. */
+export type TaskDeletionActor = {
+    kind: 'local_control';
+    surface: 'cli' | 'web';
+} | {
+    kind: 'authenticated_owner';
+    surface: 'messenger';
+    cid: string;
+};
+export type TaskDeletionMemberPhase = 'pending' | 'stop_requested' | 'liveness_absent' | 'archive_secured' | 'identity_absent';
+/**
+ * Durable retirement cursor for a managed member when no room orchestration
+ * record exists to carry the equivalent seat cursor.
+ */
+export interface TaskDeletionMemberCursor {
+    name: string;
+    identity_cid: string;
+    phase: TaskDeletionMemberPhase;
+    launch_id?: string;
+    archive_path?: string;
+    updated_at: string;
+}
+/**
+ * First-wins durable deletion intent. There is no settled status: settlement
+ * ends by unlinking the task record, so physical absence is the completion
+ * evidence. While pending, the task is hidden from normal operation and every
+ * lifecycle mutation or room publication is rejected.
+ */
+export interface TaskDeletionIntent {
+    status: 'pending';
+    accepted_at: string;
+    actor: TaskDeletionActor;
+    room_id?: string;
+    /** Snapshot of managed members at acceptance; the missing-room retirement evidence. */
+    members: TaskDeletionMemberCursor[];
+    error?: string;
+    error_at?: string;
+    recovery_hint?: string;
+    first_failure?: string;
+    first_recovery_hint?: string;
+}
 export interface TaskRecord {
     task_id: string;
     /** Stable organizational list identifier. Missing legacy values mean `default`. */
@@ -56,6 +98,14 @@ export interface TaskRecord {
     state: TaskState;
     blocked?: TaskBlocked;
     template?: TaskTemplateRef;
+    execution_plan?: {
+        schema_version: 1;
+        snapshot: TemplateSnapshot;
+        room_policy?: RoomLaunchPolicy;
+        overrides: Record<string, unknown>;
+        overrides_hash: string;
+        plan_hash: string;
+    };
     no_room?: boolean;
     room_id?: string;
     room_identity_cid?: string;
@@ -67,6 +117,7 @@ export interface TaskRecord {
     ended_at?: string;
     outcome?: TaskOutcome;
     terminal_intent?: TaskTerminalIntent;
+    deletion?: TaskDeletionIntent;
 }
 export interface TaskListRecord {
     list_id: string;
@@ -82,7 +133,7 @@ export interface SagaCursor {
     error?: string;
     recovery_hint?: string;
 }
-export type ProvisioningDetail = 'waiting_cowork' | 'waiting_owner_invite' | 'owner_cid_mismatch' | 'member_failed' | 'waiting_seats' | 'uncertain';
+export type ProvisioningDetail = 'waiting_cowork' | 'waiting_owner_authorization' | 'waiting_owner_invite' | 'owner_cid_mismatch' | 'member_failed' | 'waiting_seats' | 'uncertain';
 export interface RoomRoleBriefingDefinition {
     role: string;
     text: string;
@@ -103,6 +154,13 @@ export interface RoomMemberLaunchState {
     /** Redacted, deterministic effective Agent launch definition retained for retry inspection. */
     agent_definition?: Record<string, unknown>;
     agent_fingerprint?: string;
+    agent_template?: string;
+    agent_template_hash?: string;
+    /**
+     * Operator-facing launch configuration captured from the exact resolved
+     * launch state; the single source for later Task/Room lifecycle reports.
+     */
+    presentation?: AgentLaunchConfiguration;
     launch_id?: string;
     updated_at: string;
     error?: string;
@@ -175,6 +233,8 @@ export interface RoomOrchestrationRecord {
     goal?: string;
     task_id?: string;
     template_snapshot?: TemplateSnapshot;
+    /** Resolved once at launch; legacy absence means non-anonymous. */
+    room_policy?: RoomLaunchPolicy;
     saga: SagaCursor;
     provisioning_detail?: ProvisioningDetail;
     owner_seat_cid?: string;
@@ -192,15 +252,19 @@ export interface TemplateMemberSlot {
     slot: string;
     role: string;
     count: number;
-    /** Canonical Agent definition, or stable reference to a declared Agent. */
-    agent: import('../config.js').AgentDefinition | {
-        ref: string;
-    };
+    /** Stable reference to an inert Agent Template, never a persistent Agent. */
+    agent_template: string;
 }
 export interface TemplateRoomConfig {
     quiet_membership?: boolean;
     anonymous?: boolean;
 }
+export interface RoomLaunchPolicy {
+    anonymous: boolean;
+}
+export declare const LEGACY_ROOM_LAUNCH_POLICY: Readonly<RoomLaunchPolicy>;
+/** Validate durable policy before it can influence room creation or recovery. */
+export declare function storedRoomLaunchPolicy(value: RoomLaunchPolicy | undefined): RoomLaunchPolicy;
 export interface TemplateDefinition {
     name: string;
     version: number;
@@ -211,8 +275,27 @@ export interface TemplateDefinition {
     contract?: string;
     members: TemplateMemberSlot[];
 }
-export interface TemplateSnapshot extends TemplateDefinition {
+export interface TemplateSnapshotMember extends TemplateMemberSlot {
+    /** Source of the effective temporary-loop policy, independent of its sealed value. */
+    loop_source?: 'agent-template' | 'cli' | 'omitted';
+    /** Secret-safe public projection; launch material lives in the sealed snapshot. */
+    agent_projection?: Record<string, unknown>;
+    agent_template_hash?: string;
+    /** Private sealed-snapshot lookup key; harmless provenance, not an identity. */
+    launch_definition_id?: string;
+    role_preset?: {
+        id: string;
+        hash: string;
+    };
+    brain_preset?: {
+        id: string;
+        hash: string;
+    };
+}
+export interface TemplateSnapshot extends Omit<TemplateDefinition, 'members'> {
+    members: TemplateSnapshotMember[];
     content_hash: string;
+    launch_snapshot_hash?: string;
 }
 export interface RoomsOwnerConfig {
     provider: string;
@@ -247,4 +330,6 @@ export declare const ROOMS_COWORK_KEYS: readonly ["config"];
 export declare const ROOMS_DEFAULTS_KEYS: readonly ["template", "attach_owner", "close_when_task_done"];
 export declare const TASKS_KEYS: readonly ["default_room_template", "create_mode", "close_room_on_done", "retain_completed_for"];
 export declare const TEMPLATE_KEYS: readonly ["version", "description", "room", "contract", "members", "override_builtin"];
-export declare const TEMPLATE_MEMBER_KEYS: readonly ["slot", "role", "count", "agent"];
+export declare const TEMPLATE_ROOM_KEYS: readonly ["quiet_membership", "anonymous"];
+/** `agent` is accepted only so validation can emit its actionable migration error. */
+export declare const TEMPLATE_MEMBER_KEYS: readonly ["slot", "role", "count", "agent_template", "agent"];

package/dist/rooms-tasks/types.js

@@ -7,6 +7,17 @@
  */
 export const TASK_TERMINAL_STATES = ['done', 'cancelled', 'failed'];
 export const TASK_CANCELLABLE_STATES = ['backlog', 'provisioning', 'active', 'review'];
+export const LEGACY_ROOM_LAUNCH_POLICY = Object.freeze({
+    anonymous: false,
+});
+/** Validate durable policy before it can influence room creation or recovery. */
+export function storedRoomLaunchPolicy(value) {
+    if (value === undefined)
+        return { ...LEGACY_ROOM_LAUNCH_POLICY };
+    if (typeof value.anonymous !== 'boolean')
+        throw new Error('invalid durable Room launch policy; anonymous must be a boolean');
+    return { ...value };
+}
 // ── Validation keys ─────────────────────────────────────────────────────
 export const ROOMS_KEYS = ['cowork', 'owner', 'defaults'];
 export const ROOMS_OWNER_KEYS = ['provider', 'public_invite', 'public_invite_file', 'expected_cid', 'role'];
@@ -14,4 +25,6 @@ export const ROOMS_COWORK_KEYS = ['config'];
 export const ROOMS_DEFAULTS_KEYS = ['template', 'attach_owner', 'close_when_task_done'];
 export const TASKS_KEYS = ['default_room_template', 'create_mode', 'close_room_on_done', 'retain_completed_for'];
 export const TEMPLATE_KEYS = ['version', 'description', 'room', 'contract', 'members', 'override_builtin'];
-export const TEMPLATE_MEMBER_KEYS = ['slot', 'role', 'count', 'agent'];
+export const TEMPLATE_ROOM_KEYS = ['quiet_membership', 'anonymous'];
+/** `agent` is accepted only so validation can emit its actionable migration error. */
+export const TEMPLATE_MEMBER_KEYS = ['slot', 'role', 'count', 'agent_template', 'agent'];

package/dist/runner.d.ts

@@ -7,6 +7,7 @@ import type { AgentSession, ExitRecord, TurnResult } from './session/types.js';
 import type { AgentSessionAdapter, AgentSessionStartOptions } from './harness/agent-session.js';
 import { type OwnerChannelHandle, type OwnerChannelOptions } from './owner-channel/channel.js';
 import { type OwnerBinderLease } from './owner-channel/binder.js';
+import { ScheduledLoopManager, type ScheduledLoopManagerHandle } from './loops/manager.js';
 export interface RunnerDeps {
     exec: Exec;
     cpuDelegated(): boolean;
@@ -26,6 +27,8 @@ export interface RunnerDeps {
     startAgentSession(adapter: AgentSessionAdapter, options: AgentSessionStartOptions): Promise<AgentSession>;
     /** Construct the authenticated role control route (injectable where sockets are unavailable). */
     createControlServer(stateDir: string, session: AgentSession, log: (line: string) => void): Pick<RoleControlServer, 'start' | 'close' | 'setFleetSpawner' | 'setFleetAuditor' | 'setOwnerChannel' | 'setConfigReloader' | 'setLoopManager'>;
+    /** Construct scheduled-loop execution (injectable for fail-closed startup tests). */
+    createLoopManager(...args: ConstructorParameters<typeof ScheduledLoopManager>): ScheduledLoopManagerHandle;
     /** Acquire the cross-process owner-channel binder lease before replacing the control socket. */
     acquireOwnerBinder(stateDir: string, role: string, identity: string): Promise<OwnerBinderLease>;
     /** Ask the still-authenticated predecessor to emit the fixed recovery notice. */

package/dist/runner.js

@@ -14,7 +14,7 @@ import { selectIsolationBackend } from './isolation/registry.js';
 import { resourceArgs, cpuControllerDelegated } from './isolation/resources.js';
 import { resolveLaunchRuntime } from './isolation/runtime.js';
 import { controlRequest, RoleControlServer } from './session/control.js';
-import { ACP_CANCEL_DEADLINE_EXCEEDED, classifyShellStatus } from './session/types.js';
+import { ACP_CANCEL_DEADLINE_EXCEEDED, CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED, classifyShellStatus, } from './session/types.js';
 import { effectiveModelForRole, modelRecoveryHeld, reconcileModelRecovery, recordModelFailure, classifyFailureText, } from './model-recovery.js';
 import { rotateWorklog } from './worklog.js';
 import { reconcilePermanentRoleIdentities } from './creation.js';
@@ -26,6 +26,7 @@ import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from './fleet-prox
 import { effectivePermissionMode } from './permissions.js';
 import { assertModelPinReachesChild, effectiveRoleModel, repinModelEnv } from './model-env.js';
 import { archiveTempState, markTempSupervisorActive, requestedTempStopReason, } from './temp-lifecycle.js';
+import { FleetCommandAuditStore } from './fleet-command-audit.js';
 export const SUPERVISOR_RECYCLE_REQUIRED = 'OWNER_CHANNEL_SUPERVISOR_RECYCLE_REQUIRED';
 export class SupervisorRecycleRequiredError extends Error {
     code = SUPERVISOR_RECYCLE_REQUIRED;
@@ -53,6 +54,7 @@ const defaultDeps = () => ({
     createOwnerChannel: opts => new OwnerChannel(opts),
     startAgentSession: (adapter, options) => adapter.start(options),
     createControlServer: (stateDir, session, log) => new RoleControlServer(stateDir, session, log),
+    createLoopManager: (...args) => new ScheduledLoopManager(...args),
     acquireOwnerBinder: (stateDir, role, identity) => acquireOwnerBinderLease(stateDir, role, identity),
     reportOwnerStartupFailure: async (stateDir) => {
         const response = await controlRequest(stateDir, {
@@ -69,6 +71,32 @@ const defaultDeps = () => ({
 });
 const MONITOR_OWNER_FILE = '.monitor-owner';
 const OBSOLETE_OURS_AUTOSTART_ENV = 'OURS_AUTOSTART';
+function localFleetAuditor(stateDir, caller, log) {
+    const store = new FleetCommandAuditStore(join(stateDir, '.fleet-command-audit.json'));
+    return {
+        async begin(requestId, argv) {
+            let attempt = store.begin(requestId, caller, argv);
+            if (attempt.invocation === 'sending') {
+                log(`[${caller}] fleet proxy command ${attempt.correlationId} `
+                    + `route=${attempt.classification.route} decision=${attempt.classification.decision}`);
+                attempt = store.invocation(attempt.correlationId, caller, 'delivered');
+            }
+            return attempt;
+        },
+        async finish(input) {
+            let attempt = store.finish(input.correlationId, caller, {
+                class: input.class, effect: input.effect,
+                ...(input.exitCode === undefined ? {} : { exitCode: input.exitCode }),
+                ...(input.resourceIds ? { resourceIds: input.resourceIds } : {}),
+                ...(input.presentations ? { presentations: input.presentations } : {}),
+            });
+            if (attempt.outcome?.delivery === 'sending')
+                attempt = store.outcome(attempt.correlationId, caller, 'delivered');
+            return attempt;
+        },
+        async present() { },
+    };
+}
 /** Environment injected only into the managed harness process. */
 export function managedFleetProxyEnv(role, stateDir) {
     const roleEnv = { ...(role.env ?? {}) };
@@ -464,6 +492,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     const runCwd = role.cwd && existsSync(role.cwd) ? role.cwd : dir;
     const prep = await adapter.prepareSession(role, { stateDir: dir, runCwd });
     const sessionBackend = role.session ?? 'acp';
+    const sessionLabel = sessionBackend === 'acp' ? 'ACP' : 'Codex app-server';
     let launch = adapter.agentSession.prepareLaunch(role, prep);
     // Isolation is additive: only roles that declare `isolation:` are wrapped.
     let wrappedArgv = launch.argv;
@@ -554,7 +583,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     let control;
     let unsubscribeRecovery;
     let monitorLoop;
-    let acpStartupComplete = false;
+    let sessionStartupComplete = false;
     let sessionClosed = false;
     let ownerChannel;
     let ownerBinder;
@@ -583,9 +612,9 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         arbiter = new RoleTurnArbiter(agentSession);
         sessionHandle = arbiter;
         unsubscribeRecovery = agentSession.subscribe(event => {
-            if (event.kind !== 'error' || !event.text)
+            if (event.kind !== 'error' || !event.text || event.origin?.kind === 'stall-watchdog')
                 return;
-            const evidence = classifyFailureText(event.text, 'acp', new Date(deps.now()).toISOString());
+            const evidence = classifyFailureText(event.text, sessionBackend, new Date(deps.now()).toISOString());
             if (evidence)
                 resolvedMonitorDeps.onFailureEvidence?.(evidence);
         });
@@ -610,31 +639,50 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     + `${error?.message ?? String(error)}`);
             }
         }
-        control = deps.createControlServer(dir, arbiter, deps.log);
         try {
+            if (role.owner_channel)
+                ownerChannel = deps.createOwnerChannel({
+                    role: name,
+                    harness: role.harness,
+                    config: role.owner_channel,
+                    session: arbiter,
+                    stateDir: dir,
+                    env: role.env,
+                    log: deps.log,
+                    ...(ownerBinder ? { binderLease: ownerBinder } : {}),
+                    ...(configPath ? { configPath } : {}),
+                });
+            control = deps.createControlServer(dir, arbiter, deps.log);
+            control.setFleetAuditor(ownerChannel ? {
+                begin: (requestId, argv) => ownerChannel.beginFleetCommandAudit(requestId, argv),
+                finish: input => ownerChannel.finishFleetCommandAudit(input),
+                present: presentations => ownerChannel.notifyFleetLifecycle(presentations),
+            } : localFleetAuditor(dir, name, deps.log));
             await control.start();
         }
         catch (error) {
+            await ownerChannel?.close().catch(() => undefined);
             ownerBinder?.release();
             await agentSession.close();
             unsubscribeRecovery?.();
             throw error;
         }
-        control.setFleetSpawner(async (requested) => {
-            const event = await executeManagedSpawn(role, configPath, requested, deps.log);
-            // Room-member launches are collected with their Task/Room transaction so
-            // causal delivery is Task → Room → Agents → Room active → Task active.
-            if (!requested.roomMemberStartup && role.owner_channel && ownerChannel?.notifyFleetSpawn) {
-                try {
-                    await ownerChannel.notifyFleetSpawn(event);
-                }
-                catch (error) {
-                    deps.log(`[${name}] Agent lifecycle notice delivery failed: `
-                        + `${error?.message ?? String(error)}`);
+        if (!role.roomMemberStartup)
+            control.setFleetSpawner(async (requested) => {
+                const event = await executeManagedSpawn(role, configPath, requested, deps.log);
+                // Room-member launches are collected with their Task/Room transaction so
+                // causal delivery is Task → Room → Agents → Room active → Task active.
+                if (!requested.roomMemberStartup && role.owner_channel && ownerChannel?.notifyFleetSpawn) {
+                    try {
+                        await ownerChannel.notifyFleetSpawn(event);
+                    }
+                    catch (error) {
+                        deps.log(`[${name}] Agent lifecycle notice delivery failed: `
+                            + `${error?.message ?? String(error)}`);
+                    }
                 }
-            }
-            return event;
-        });
+                return event;
+            });
         resolvedMonitorDeps.delivery = {
             // A wake is only delivered when its turn TERMINATES successfully. A
             // refusal or a cancellation reached the agent and was not acted on, so
@@ -645,7 +693,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 // steer into the live turn instead; after it completes, honor the
                 // configured interrupt policy normally.
                 const policy = options?.interrupt;
-                const interrupt = policy === true && acpStartupComplete;
+                const interrupt = policy === true && sessionStartupComplete;
                 const promptOptions = {
                     interrupt, steer: true,
                     ...(interrupt ? { interruptSource: 'fleet-monitor' } : {}),
@@ -653,7 +701,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 };
                 // Startup is already a protected boundary: as with immediate mode,
                 // steer rather than waiting on/cancelling the runner-owned first turn.
-                const result = policy === 'after_tool' && acpStartupComplete
+                const result = policy === 'after_tool' && sessionStartupComplete
                     ? await arbiter.submitPromptAfterTool(text, promptOptions)
                     : await arbiter.submitPrompt(text, promptOptions);
                 const steered = result.accepted
@@ -699,7 +747,8 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         // valid. Keep every unproven cancellation, refusal, shutdown, and genuine
         // failure terminal so a role that never accepted its briefing is not
         // silently reported as healthy.
-        const interruptedForWake = isRecoverableTempStartupCancellation(temp, started);
+        const interruptedForWake = isRecoverableTempStartupCancellation(temp, started)
+            || (started.outcome === 'cancelled' && started.cancellationSource === 'stall-watchdog');
         if (!started.succeeded && !interruptedForWake) {
             monitor?.stop();
             await control.close();
@@ -714,32 +763,23 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     exit: {
                         version: 1,
                         class: 'program-exit',
-                        detail: `ACP startup triggered model recovery (${modelRecovery})`,
+                        detail: `${sessionLabel} startup triggered model recovery (${modelRecovery})`,
                     },
                     rotated: false,
                     mode,
                     modelRecovery,
                 };
             }
-            throw new Error(`[${name}] ACP startup prompt ${started.outcome}` +
+            throw new Error(`[${name}] ${sessionLabel} startup prompt ${started.outcome}` +
                 `${started.detail ? `: ${started.detail}` : ''}`);
         }
-        if (interruptedForWake)
-            deps.log(`[${name}] ACP startup prompt cancelled by ${started.cancellationSource}; `
+        if (started.cancellationSource === 'stall-watchdog')
+            deps.log(`[${name}] ${sessionLabel} startup diagnostic recovery requires operator attention; keeping supervisor alive`);
+        else if (interruptedForWake)
+            deps.log(`[${name}] ${sessionLabel} startup prompt cancelled by ${started.cancellationSource}; `
                 + 'keeping temporary supervisor alive');
-        acpStartupComplete = true;
-        if (role.owner_channel) {
-            ownerChannel = deps.createOwnerChannel({
-                role: name,
-                harness: role.harness,
-                config: role.owner_channel,
-                session: arbiter,
-                stateDir: dir,
-                env: role.env,
-                log: deps.log,
-                ...(ownerBinder ? { binderLease: ownerBinder } : {}),
-                ...(configPath ? { configPath } : {}),
-            });
+        sessionStartupComplete = true;
+        if (ownerChannel) {
             try {
                 await ownerChannel.start();
             }
@@ -758,10 +798,6 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         }
         if (ownerChannel) {
             control.setOwnerChannel(ownerChannel);
-            control.setFleetAuditor({
-                begin: (requestId, argv) => ownerChannel.beginFleetCommandAudit(requestId, argv),
-                finish: input => ownerChannel.finishFleetCommandAudit(input),
-            });
         }
         reloadLoopConfig = async () => {
             const nextRole = findRole(loadConfig(configPath), name);
@@ -772,7 +808,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             if (generation === loopGeneration && (loopManager || !definitions.length))
                 return { changed: false, loops: definitions.length };
             if (!loopManager && definitions.length) {
-                loopManager = new ScheduledLoopManager(name, definitions, dir, arbiter, {
+                loopManager = deps.createLoopManager(name, definitions, dir, arbiter, {
                     now: deps.now,
                     setTimer: (callback, ms) => setTimeout(callback, ms),
                     clearTimer: timer => clearTimeout(timer),
@@ -788,10 +824,12 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             deps.log(`[${name}] scheduled loops reloaded (${definitions.length} definitions)`);
             return { changed: true, loops: definitions.length };
         };
-        control.setConfigReloader(reloadLoopConfig);
+        // Temporary agents are immutable launch snapshots: never re-resolve mutable Fleet YAML.
+        if (!temp)
+            control.setConfigReloader(reloadLoopConfig);
         if (role.loops?.length) {
             try {
-                loopManager = new ScheduledLoopManager(name, role.loops, dir, arbiter, {
+                loopManager = deps.createLoopManager(name, role.loops, dir, arbiter, {
                     now: deps.now,
                     setTimer: (callback, ms) => setTimeout(callback, ms),
                     clearTimer: timer => clearTimeout(timer),
@@ -801,6 +839,17 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 loopManager.start();
             }
             catch (error) {
+                if (temp) {
+                    monitor?.stop();
+                    if (monitorLoop)
+                        await monitorLoop;
+                    await control.close();
+                    ownerBinder?.release();
+                    await agentSession.close();
+                    unsubscribeRecovery?.();
+                    throw new Error(`[${name}] configured temporary loop manager failed to start: `
+                        + `${error?.message ?? String(error)}`);
+                }
                 deps.log(`[${name}] scheduled loop manager unavailable: ${error?.name ?? 'Error'}`);
             }
         }
@@ -946,7 +995,8 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         rotated = true;
         deps.log(`[${name}] ${why} -> rotated session-id; next start is FRESH`);
     };
-    if (exitRecord.detail.includes(ACP_CANCEL_DEADLINE_EXCEEDED))
+    if (exitRecord.detail.includes(ACP_CANCEL_DEADLINE_EXCEEDED)
+        || exitRecord.detail.includes(CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED))
         // This is a deliberate adapter reclamation, not evidence that resume state
         // is poisoned. Preserve the context even when the resumed generation hits
         // the same bound immediately; runSupervised still counts the fast exit and

package/dist/session/acp.d.ts

@@ -27,7 +27,15 @@ export declare const CODEX_DISABLE_INHERITED_MCP_ENV = "OURS_FLEET_CODEX_DISABLE
 export declare function promptContentBlocks(text: string, origin?: PromptOrigin): acp.ContentBlock[];
 export declare function runtimeSelector(options: acp.SessionConfigOption[] | null | undefined, category: string): RuntimeSelectorMetadata | undefined;
 export interface AcpSessionOptions {
+    /** Opt-in Fleet watchdog, owned by this ACP session, never a process restart. */
+    stallRecovery?: {
+        timeoutMs?: number;
+        tickMs?: number;
+        cancelWaitMs?: number;
+    };
     name: string;
+    /** Harness identity used only for honest optional capability reporting. */
+    harness?: string;
     argv: string[];
     cwd: string;
     env: Record<string, string>;
@@ -89,6 +97,7 @@ export declare function classifyStopReason(stopReason: string | undefined): Turn
 export declare class AcpSession implements AgentSession {
     private readonly options;
     readonly backend: "acp";
+    readonly capabilities: import("./types.js").AgentSessionCapabilities;
     readonly pid: number;
     private readonly child;
     private readonly events;
@@ -115,7 +124,7 @@ export declare class AcpSession implements AgentSession {
     private queueDepth;
     private exit;
     private steeringSupported;
-    private capabilities?;
+    private agentCapabilities?;
     private runtimeModel?;
     private reasoningEffort?;
     private controllerCount;
@@ -141,6 +150,15 @@ export declare class AcpSession implements AgentSession {
     private terminate;
     /** ACP-authenticated in-flight calls, including independently reserved permissions. */
     private readonly activeToolCalls;
+    private stallWatchdog?;
+    private stallToolHistory?;
+    private stallRecoveryClaimed;
+    private managedTurnCount;
+    private steeringWasUsed;
+    private steeringRequests;
+    private retryNativeTurnId?;
+    private stallTimer?;
+    private stallAttempt?;
     private readonly toolBoundaryWaiters;
     private activeTurn?;
     private constructor();
@@ -272,7 +290,13 @@ export declare class AcpSession implements AgentSession {
     private declaredMcpServers;
     private initialize;
     private captureRuntimeMetadata;
+    private startStallWatchdog;
+    private checkStallWatchdog;
+    private stallObservation;
+    private recoverStall;
+    /** Keep the original queue slot (including startup) until recovery finishes. */
     private runPrompt;
+    private runSinglePrompt;
     private steerPrompt;
     private requestPermission;
     /**
@@ -291,6 +315,8 @@ export declare class AcpSession implements AgentSession {
      * malformed requests on the ordinary fail-closed path.
      */
     private isEffectiveCodexProtectedMcpApproval;
+    /** Pinned codex-acp 1.1.7 structured metadata, never stderr or assistant text. */
+    private recordStallMetadata;
     private recordUpdate;
     /**
      * Codex ACP's phase extension is the only currently supported visibility