@ours.network/fleet 1.1.5 → 1.2.0-nightly.10

package/dist/runner.js

@@ -1,5 +1,8 @@
+import { prepareManagedAgent, releaseManagedAgent } from './agent-ours/service.js';
+import { prepareManagedHarness } from './agent-ours/harness.js';
 import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, realpathSync } from 'node:fs';
 import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { randomUUID } from 'node:crypto';
 import { parse } from 'yaml';
 import { agentDir, stateRoot } from './paths.js';
@@ -7,7 +10,6 @@ import { loadConfig, findRole, isolationContextFor, resolveMonitorConfig, resolv
 import { getAdapter } from './harness/registry.js';
 import { createMonitor, probeIdentityPresence, } from './monitor.js';
 import { DaemonGenerationObserver, RoleRecoveryController, probeDaemonGeneration, } from './daemon-recovery.js';
-import { recoverAgentIdentity } from './agent-recovery-gate.js';
 import { realExec } from './exec.js';
 import { resolveIsolation } from './isolation/policy.js';
 import { selectIsolationBackend } from './isolation/registry.js';
@@ -36,6 +38,8 @@ export class SupervisorRecycleRequiredError extends Error {
     }
 }
 const defaultDeps = () => ({
+    prepareAgentOurs: prepareManagedAgent,
+    releaseAgentOurs: releaseManagedAgent,
     exec: realExec,
     cpuDelegated: () => cpuControllerDelegated(),
     isAlive: pid => { try {
@@ -423,7 +427,7 @@ export function loadTempRole(name) {
  * with "no such role". An empty/missing marker means "use the default", same as
  * no -c was ever given.
  */
-function resolveConfigPath(dir, explicit) {
+export function resolveConfigPath(dir, explicit) {
     if (explicit)
         return explicit;
     const marker = join(dir, '.config-path');
@@ -497,11 +501,12 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     // already ran, so rewriting cannot change the fresh/resume decision.
     writeFileSync(bootedFile, `${new Date(deps.now()).toISOString()} ${mode}\n`);
     const runCwd = role.cwd && existsSync(role.cwd) ? role.cwd : dir;
+    role = { ...role, monitor: { ...role.monitor, mode: 'fleet' } };
     const prep = await adapter.prepareSession(role, { stateDir: dir, runCwd });
     const sessionBackend = role.session ?? 'acp';
     const sessionLabel = sessionBackend === 'acp' ? 'ACP' : 'Codex app-server';
     let launch = adapter.agentSession.prepareLaunch(role, prep);
-    // Isolation is additive: only roles that declare `isolation:` are wrapped.
+    // Preserve the role's existing isolation policy.
     let wrappedArgv = launch.argv;
     if (role.isolation) {
         // Start with the same durable context that config validation and doctor judged,
@@ -511,7 +516,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         launch = { ...launch, argv: runtime.argv };
         const ctx = {
             ...isolationContextFor(role), stateDir: dir, runCwd,
-            runtimeReadPaths: runtime.readPaths,
+            runtimeReadPaths: [...runtime.readPaths, ...resolveLaunchRuntime([process.execPath, fileURLToPath(new URL('./agent-ours/bridge.js', import.meta.url))]).readPaths],
         };
         const policy = resolveIsolation(role.isolation, ctx);
         const sel = await selectIsolationBackend(policy, deps.exec); // throws on strict + unavailable
@@ -533,507 +538,527 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         if (rprefix.length)
             wrappedArgv = [...rprefix, ...wrappedArgv];
     }
-    // Start-stagger: space this launch at least start_stagger_ms after the previous
-    // agent launch across the whole host, so a burst of boots (systemd starts every
-    // user unit concurrently on boot; `ours-fleet up`/restart-all bulk-start) does not
-    // hit the harness/API rate limit at once. Time-based via a shared launch gate, so
-    // a lone start or a solo crash-restart waits zero. Applied right before the harness
-    // agent-session start; the cheap monitor prime still runs immediately after.
-    if (staggerMs > 0) {
-        const slot = await reserveLaunchSlot(stateRoot(), staggerMs, deps);
-        const wait = slot - deps.now();
-        if (wait > 0) {
-            deps.log(`[${name}] start-stagger: holding ${wait}ms before launch`);
-            await deps.sleep(wait);
-        }
-    }
-    // Prime the supervisor mail monitor's notification cursor at the
-    // stream tip BEFORE the session launches so no arrival is missed during boot
-    // (backlog before the tip is the SessionStart hook's job). Native-mode roles
-    // leave wake ownership to the harness. Temp snapshots predating `monitor:` are
-    // treated as native (monitor may be undefined on an old role.yaml).
-    let sessionHandle;
-    let modelRecovery;
-    const resolvedMonitorDeps = monitorDeps(deps, role.env);
-    resolvedMonitorDeps.onFailureEvidence = evidence => {
-        if (!role.model_chain)
-            return false;
-        const action = recordModelFailure(dir, role, { ...evidence, model: evidence.model ?? role.model }, role.monitor.turn_fail_threshold ?? 3);
-        if (action.kind === 'advance') {
-            modelRecovery = 'advance';
-            deps.log(`[${name}] MODEL DOWN-SHIFT ${action.from} -> ${action.to}; restarting with resume`);
-            void sessionHandle?.close();
-            return true;
-        }
-        else if (action.kind === 'hold') {
-            modelRecovery = 'hold';
-            deps.log(`[${name}] MODEL CHAIN EXHAUSTED at ${action.model}; held down`);
-            void sessionHandle?.close();
-            return true;
+    const managedService = await deps.prepareAgentOurs(role, dir, opts.identityLifetime ? opts.identityLifetime === 'temporary' : temp);
+    try {
+        const managedHarness = prepareManagedHarness(role, dir, runCwd, managedService.descriptor, harnessChildEnv(role, launch.env, dir));
+        // Start-stagger: space this launch at least start_stagger_ms after the previous
+        // agent launch across the whole host, so a burst of boots (systemd starts every
+        // user unit concurrently on boot; `ours-fleet up`/restart-all bulk-start) does not
+        // hit the harness/API rate limit at once. Time-based via a shared launch gate, so
+        // a lone start or a solo crash-restart waits zero. Applied right before the harness
+        // agent-session start; the cheap monitor prime still runs immediately after.
+        if (staggerMs > 0) {
+            const slot = await reserveLaunchSlot(stateRoot(), staggerMs, deps);
+            const wait = slot - deps.now();
+            if (wait > 0) {
+                deps.log(`[${name}] start-stagger: holding ${wait}ms before launch`);
+                await deps.sleep(wait);
+            }
         }
-        return false;
-    };
-    const monitorOwner = role.monitor?.mode === 'fleet' ? 'fleet' : 'native';
-    const resetMonitorCursor = recordMonitorOwner(dir, monitorOwner);
-    const monitor = monitorOwner === 'fleet' ? deps.createMonitor({
-        name, identity: role.identity, agentDir: dir, cfg: role.monitor,
-        deps: resolvedMonitorDeps,
-    }) : null;
-    const daemonObserver = new DaemonGenerationObserver();
-    const initialDaemon = daemonObserver.observe(await deps.probeGeneration(resolvedMonitorDeps.env));
-    let sessionStartedWithoutDaemonBaseline = initialDaemon.kind !== 'baseline';
-    if (monitor)
-        await monitor.prime({ resetCursor: resetMonitorCursor });
-    rmSync(exitFile, { force: true });
-    let pid;
-    let agentSession;
-    let control;
-    let unsubscribeRecovery;
-    let monitorLoop;
-    let sessionStartupComplete = false;
-    let sessionClosed = false;
-    let ownerChannel;
-    let ownerBinder;
-    let loopManager;
-    let arbiter;
-    let recoveryController;
-    let reloadLoopConfig;
-    let loopGeneration = JSON.stringify((role.loops ?? []).map(loop => [
-        loop.name, loop.definitionHash, loop.promptHash,
-    ]));
-    {
-        const perms = role.permissions ?? resolvePermissions(undefined, undefined);
-        // Say once, at startup, that this role will decide permission requests by
-        // itself. Without it the only trace of an auto-denied tool call is a turn
-        // that quietly did less than it was asked to.
-        if (perms.unattended === 'deny')
-            deps.log(`[${name}] permission policy: unattended=deny — with no console attached, ` +
-                `permission requests are automatically denied once each (reject_once) and the turn continues`);
-        agentSession = await deps.startAgentSession(adapter.agentSession, {
-            role, prep,
-            launch: { ...launch, argv: wrappedArgv, env: harnessChildEnv(role, launch.env, dir) },
-            cwd: runCwd, stateDir: dir, mode, permissions: perms,
-            permissionMode: effectivePermissionMode(role), log: deps.log,
-        });
-        pid = agentSession.pid;
-        arbiter = new RoleTurnArbiter(agentSession);
-        sessionHandle = arbiter;
-        unsubscribeRecovery = agentSession.subscribe(event => {
-            if (event.kind !== 'error' || !event.text || event.origin?.kind === 'stall-watchdog')
-                return;
-            const evidence = classifyFailureText(event.text, sessionBackend, new Date(deps.now()).toISOString());
-            if (evidence)
-                resolvedMonitorDeps.onFailureEvidence?.(evidence);
-        });
-        if (role.owner_channel) {
-            try {
-                ownerBinder = await deps.acquireOwnerBinder(dir, name, role.owner_channel.identity);
+        // Prime the supervisor mail monitor's notification cursor at the
+        // stream tip BEFORE the session launches so no arrival is missed during boot
+        // (backlog before the tip is the SessionStart hook's job). Native-mode roles
+        // leave wake ownership to the harness. Temp snapshots predating `monitor:` are
+        // treated as native (monitor may be undefined on an old role.yaml).
+        let sessionHandle;
+        let modelRecovery;
+        const resolvedMonitorDeps = monitorDeps(deps, role.env);
+        resolvedMonitorDeps.onFailureEvidence = evidence => {
+            if (!role.model_chain)
+                return false;
+            const action = recordModelFailure(dir, role, { ...evidence, model: evidence.model ?? role.model }, role.monitor.turn_fail_threshold ?? 3);
+            if (action.kind === 'advance') {
+                modelRecovery = 'advance';
+                deps.log(`[${name}] MODEL DOWN-SHIFT ${action.from} -> ${action.to}; restarting with resume`);
+                void sessionHandle?.close();
+                return true;
             }
-            catch (error) {
-                if (error instanceof OwnerBinderHandoffTimeoutError) {
-                    try {
-                        const status = await deps.reportOwnerStartupFailure(dir);
-                        deps.log(`[${name}] owner channel startup recovery notice ${status} by authenticated predecessor`);
-                    }
-                    catch (notifyError) {
-                        deps.log(`[${name}] owner channel startup recovery notice unavailable: `
-                            + `${notifyError?.message ?? String(notifyError)}`);
-                    }
-                }
-                await agentSession.close();
-                unsubscribeRecovery?.();
-                throw new Error(`[${name}] owner channel failed to start: `
-                    + `${error?.message ?? String(error)}`);
+            else if (action.kind === 'hold') {
+                modelRecovery = 'hold';
+                deps.log(`[${name}] MODEL CHAIN EXHAUSTED at ${action.model}; held down`);
+                void sessionHandle?.close();
+                return true;
             }
-        }
-        try {
-            if (role.owner_channel)
-                ownerChannel = deps.createOwnerChannel({
-                    role: name,
-                    harness: role.harness,
-                    config: role.owner_channel,
-                    session: arbiter,
-                    stateDir: dir,
-                    env: role.env,
-                    log: deps.log,
-                    ...(ownerBinder ? { binderLease: ownerBinder } : {}),
-                    ...(configPath ? { configPath } : {}),
-                });
-            control = deps.createControlServer(dir, arbiter, deps.log);
-            control.setFleetAuditor(ownerChannel ? {
-                begin: (requestId, argv) => ownerChannel.beginFleetCommandAudit(requestId, argv),
-                finish: input => ownerChannel.finishFleetCommandAudit(input),
-                present: presentations => ownerChannel.notifyFleetLifecycle(presentations),
-            } : localFleetAuditor(dir, name, deps.log));
-            await control.start();
-        }
-        catch (error) {
-            await ownerChannel?.close().catch(() => undefined);
-            ownerBinder?.release();
-            await agentSession.close();
-            unsubscribeRecovery?.();
-            throw error;
-        }
-        if (!role.roomMemberStartup)
-            control.setFleetSpawner(async (requested) => {
-                const event = await executeManagedSpawn(role, configPath, requested, deps.log);
-                // Room-member launches are collected with their Task/Room transaction so
-                // causal delivery is Task → Room → Agents → Room active → Task active.
-                if (!requested.roomMemberStartup && role.owner_channel && ownerChannel?.notifyFleetSpawn) {
-                    try {
-                        await ownerChannel.notifyFleetSpawn(event);
-                    }
-                    catch (error) {
-                        deps.log(`[${name}] Agent lifecycle notice delivery failed: `
-                            + `${error?.message ?? String(error)}`);
+            return false;
+        };
+        const monitorOwner = role.monitor?.mode === 'fleet' ? 'fleet' : 'native';
+        const resetMonitorCursor = recordMonitorOwner(dir, monitorOwner);
+        const monitor = monitorOwner === 'fleet' ? deps.createMonitor({
+            name, identity: role.identity, agentDir: dir, cfg: role.monitor,
+            deps: resolvedMonitorDeps,
+        }) : null;
+        const daemonObserver = new DaemonGenerationObserver();
+        const initialDaemon = daemonObserver.observe(await deps.probeGeneration(resolvedMonitorDeps.env));
+        let sessionStartedWithoutDaemonBaseline = initialDaemon.kind !== 'baseline';
+        if (monitor)
+            await monitor.prime({ resetCursor: resetMonitorCursor });
+        rmSync(exitFile, { force: true });
+        let pid;
+        let agentSession;
+        let control;
+        let unsubscribeRecovery;
+        let monitorLoop;
+        let sessionStartupComplete = false;
+        let sessionClosed = false;
+        let ownerChannel;
+        let ownerBinder;
+        let loopManager;
+        let arbiter;
+        let recoveryController;
+        let reloadLoopConfig;
+        let loopGeneration = JSON.stringify((role.loops ?? []).map(loop => [
+            loop.name, loop.definitionHash, loop.promptHash,
+        ]));
+        {
+            const perms = role.permissions ?? resolvePermissions(undefined, undefined);
+            // Say once, at startup, that this role will decide permission requests by
+            // itself. Without it the only trace of an auto-denied tool call is a turn
+            // that quietly did less than it was asked to.
+            if (perms.unattended === 'deny')
+                deps.log(`[${name}] permission policy: unattended=deny — with no console attached, ` +
+                    `permission requests are automatically denied once each (reject_once) and the turn continues`);
+            agentSession = await managedService.runtime.startHarness(() => deps.startAgentSession(adapter.agentSession, {
+                managedOurs: managedHarness.ours,
+                role, prep,
+                launch: { ...launch, argv: wrappedArgv, env: managedHarness.env },
+                cwd: runCwd, stateDir: dir, mode, permissions: perms,
+                permissionMode: effectivePermissionMode(role), log: deps.log,
+            }));
+            pid = agentSession.pid;
+            arbiter = new RoleTurnArbiter(agentSession);
+            sessionHandle = arbiter;
+            unsubscribeRecovery = agentSession.subscribe(event => {
+                if (event.kind !== 'error' || !event.text || event.origin?.kind === 'stall-watchdog')
+                    return;
+                const evidence = classifyFailureText(event.text, sessionBackend, new Date(deps.now()).toISOString());
+                if (evidence)
+                    resolvedMonitorDeps.onFailureEvidence?.(evidence);
+            });
+            if (role.owner_channel) {
+                try {
+                    ownerBinder = await deps.acquireOwnerBinder(dir, name, role.owner_channel.identity);
+                }
+                catch (error) {
+                    if (error instanceof OwnerBinderHandoffTimeoutError) {
+                        try {
+                            const status = await deps.reportOwnerStartupFailure(dir);
+                            deps.log(`[${name}] owner channel startup recovery notice ${status} by authenticated predecessor`);
+                        }
+                        catch (notifyError) {
+                            deps.log(`[${name}] owner channel startup recovery notice unavailable: `
+                                + `${notifyError?.message ?? String(notifyError)}`);
+                        }
                     }
+                    await agentSession.close();
+                    unsubscribeRecovery?.();
+                    throw new Error(`[${name}] owner channel failed to start: `
+                        + `${error?.message ?? String(error)}`);
                 }
-                return event;
-            });
-        resolvedMonitorDeps.delivery = {
-            // A wake is only delivered when its turn TERMINATES successfully. A
-            // refusal or a cancellation reached the agent and was not acted on, so
-            // the monitor must keep its cursor and try again.
-            submit: async (text, options) => {
-                // Cancelling the runner-owned startup prompt makes startup look failed
-                // and closes the session before the wake turn can run. During startup,
-                // steer into the live turn instead; after it completes, honor the
-                // configured interrupt policy normally.
-                const policy = options?.interrupt;
-                const interrupt = policy === true && sessionStartupComplete;
-                const promptOptions = {
-                    interrupt, steer: true,
-                    ...(interrupt ? { interruptSource: 'fleet-monitor' } : {}),
-                    origin: { kind: 'fleet-monitor' },
-                };
-                // Startup is already a protected boundary: as with immediate mode,
-                // steer rather than waiting on/cancelling the runner-owned first turn.
-                const result = policy === 'after_tool' && sessionStartupComplete
-                    ? await arbiter.submitPromptAfterTool(text, promptOptions)
-                    : await arbiter.submitPrompt(text, promptOptions);
-                const steered = result.accepted
-                    && (result.detail === 'injected' || result.detail === 'startedNewTurn');
-                const boundary = result.safeBoundary;
-                const queuedAfterSteeringFailure = result.detail?.startsWith('steering rejected;') === true;
-                const boundaryDetail = boundary && queuedAfterSteeringFailure
-                    ? boundary.state === 'timeout'
-                        ? `after_tool timed out after ${boundary.waitedMs}ms; steering rejected, queued without cancellation`
-                        : `after_tool ${boundary.state} boundary after ${boundary.waitedMs}ms; steering rejected, queued without cancellation`
-                    : boundary
-                        ? boundary.state === 'timeout'
-                            ? `after_tool timed out after ${boundary.waitedMs}ms; steered without cancellation`
-                            : boundary.state === 'unsupported'
-                                ? 'after_tool unsupported; used non-cancelling queued delivery'
-                                : `after_tool ${boundary.state} delivery after ${boundary.waitedMs}ms`
-                        : result.detail;
-                return {
-                    succeeded: result.succeeded || steered,
-                    outcome: steered ? result.detail : result.outcome,
-                    detail: result.succeeded || steered || !boundary
-                        ? boundaryDetail
-                        : [result.detail, boundaryDetail].filter(Boolean).join('; '),
-                    ...(boundary ? { safeBoundary: boundary.state } : {}),
-                };
-            },
-        };
-        const firstPrompt = mode === 'fresh'
-            ? `Read and follow ${join(dir, 'briefing.md')} now.`
-            : adapter.vocabulary.restartPrompt(role.identity, join(dir, 'WORKLOG.md'), role);
-        // Wait for the first turn's TERMINAL result. An agent that accepts the
-        // startup prompt and then refuses it has not started; logging the role as
-        // up would hide a role that never read its briefing.
-        const starting = arbiter.submitPrompt(firstPrompt, { origin: { kind: 'startup' } });
-        // Monitoring starts immediately. The delivery adapter above downgrades
-        // interruption to steering until this startup turn reaches a terminal
-        // success, so there is neither a deaf gap nor a boot-cancellation loop.
-        monitorLoop = monitor?.run(pid);
-        const started = await starting;
-        // A temporary role's first turn can be the active turn when an ours wake
-        // needs immediate attention. A typed console/monitor cancellation ends
-        // only that turn: the already-live agent session and any queued wake remain
-        // valid. Keep every unproven cancellation, refusal, shutdown, and genuine
-        // failure terminal so a role that never accepted its briefing is not
-        // silently reported as healthy.
-        const interruptedForWake = isRecoverableTempStartupCancellation(temp, started)
-            || (started.outcome === 'cancelled' && started.cancellationSource === 'stall-watchdog');
-        if (!started.succeeded && !interruptedForWake) {
-            monitor?.stop();
-            await control.close();
-            ownerBinder?.release();
-            await agentSession.close();
-            unsubscribeRecovery?.();
-            if (modelRecovery) {
-                if (monitorLoop)
-                    await monitorLoop;
-                return {
-                    elapsedSecs: 0,
-                    exit: {
-                        version: 1,
-                        class: 'program-exit',
-                        detail: `${sessionLabel} startup triggered model recovery (${modelRecovery})`,
-                    },
-                    rotated: false,
-                    mode,
-                    modelRecovery,
-                };
             }
-            throw new Error(`[${name}] ${sessionLabel} startup prompt ${started.outcome}` +
-                `${started.detail ? `: ${started.detail}` : ''}`);
-        }
-        if (started.cancellationSource === 'stall-watchdog')
-            deps.log(`[${name}] ${sessionLabel} startup diagnostic recovery requires operator attention; keeping supervisor alive`);
-        else if (interruptedForWake)
-            deps.log(`[${name}] ${sessionLabel} startup prompt cancelled by ${started.cancellationSource}; `
-                + 'keeping temporary supervisor alive');
-        sessionStartupComplete = true;
-        if (ownerChannel) {
             try {
-                await ownerChannel.start();
+                if (role.owner_channel)
+                    ownerChannel = deps.createOwnerChannel({
+                        role: name,
+                        harness: role.harness,
+                        config: role.owner_channel,
+                        session: arbiter,
+                        startupPending: () => !sessionStartupComplete,
+                        stateDir: dir,
+                        env: role.env,
+                        log: deps.log,
+                        ...(ownerBinder ? { binderLease: ownerBinder } : {}),
+                        ...(configPath ? { configPath } : {}),
+                    });
+                control = deps.createControlServer(dir, arbiter, deps.log);
+                control.setFleetAuditor(ownerChannel ? {
+                    begin: (requestId, argv) => ownerChannel.beginFleetCommandAudit(requestId, argv),
+                    finish: input => ownerChannel.finishFleetCommandAudit(input),
+                    present: presentations => ownerChannel.notifyFleetLifecycle(presentations),
+                } : localFleetAuditor(dir, name, deps.log));
+                await control.start();
             }
             catch (error) {
-                monitor?.stop();
-                if (monitorLoop)
-                    await monitorLoop;
-                await ownerChannel.close().catch(() => undefined);
-                await control.close();
+                await ownerChannel?.close().catch(() => undefined);
                 ownerBinder?.release();
                 await agentSession.close();
                 unsubscribeRecovery?.();
-                throw new Error(`[${name}] owner channel failed to start: `
-                    + `${error?.message ?? String(error)}`);
-            }
-        }
-        if (ownerChannel) {
-            control.setOwnerChannel(ownerChannel);
-        }
-        reloadLoopConfig = async () => {
-            const nextRole = findRole(loadConfig(configPath), name);
-            const definitions = nextRole.loops ?? [];
-            const generation = JSON.stringify(definitions.map(loop => [
-                loop.name, loop.definitionHash, loop.promptHash,
-            ]));
-            if (generation === loopGeneration && (loopManager || !definitions.length))
-                return { changed: false, loops: definitions.length };
-            if (!loopManager && definitions.length) {
-                loopManager = deps.createLoopManager(name, definitions, dir, arbiter, {
-                    now: deps.now,
-                    setTimer: (callback, ms) => setTimeout(callback, ms),
-                    clearTimer: timer => clearTimeout(timer),
-                    log: deps.log,
-                });
-                control.setLoopManager(loopManager);
-                loopManager.start();
+                throw error;
             }
-            else {
-                loopManager?.reconcile(definitions);
-            }
-            loopGeneration = generation;
-            deps.log(`[${name}] scheduled loops reloaded (${definitions.length} definitions)`);
-            return { changed: true, loops: definitions.length };
-        };
-        // Temporary agents are immutable launch snapshots: never re-resolve mutable Fleet YAML.
-        if (!temp)
-            control.setConfigReloader(reloadLoopConfig);
-        if (role.loops?.length) {
-            try {
-                loopManager = deps.createLoopManager(name, role.loops, dir, arbiter, {
-                    now: deps.now,
-                    setTimer: (callback, ms) => setTimeout(callback, ms),
-                    clearTimer: timer => clearTimeout(timer),
-                    log: deps.log,
+            if (!role.roomMemberStartup)
+                control.setFleetSpawner(async (requested) => {
+                    const event = await executeManagedSpawn(role, configPath, requested, deps.log);
+                    // Room-member launches are collected with their Task/Room transaction so
+                    // causal delivery is Task → Room → Agents → Room active → Task active.
+                    if (!requested.roomMemberStartup && role.owner_channel && ownerChannel?.notifyFleetSpawn) {
+                        try {
+                            await ownerChannel.notifyFleetSpawn(event);
+                        }
+                        catch (error) {
+                            deps.log(`[${name}] Agent lifecycle notice delivery failed: `
+                                + `${error?.message ?? String(error)}`);
+                        }
+                    }
+                    return event;
                 });
-                control.setLoopManager(loopManager);
-                loopManager.start();
-            }
-            catch (error) {
-                if (temp) {
+            resolvedMonitorDeps.delivery = {
+                // A wake is only delivered when its turn TERMINATES successfully. A
+                // refusal or a cancellation reached the agent and was not acted on, so
+                // the monitor must keep its cursor and try again.
+                submit: async (text, options) => {
+                    // Cancelling the runner-owned startup prompt makes startup look failed
+                    // and closes the session before the wake turn can run. During startup,
+                    // steer into the live turn instead; after it completes, honor the
+                    // configured interrupt policy normally.
+                    const policy = options?.interrupt;
+                    const interrupt = policy === true && sessionStartupComplete;
+                    const promptOptions = {
+                        interrupt, steer: true,
+                        ...(interrupt ? { interruptSource: 'fleet-monitor' } : {}),
+                        origin: { kind: 'fleet-monitor' },
+                    };
+                    // Startup is already a protected boundary: as with immediate mode,
+                    // steer rather than waiting on/cancelling the runner-owned first turn.
+                    const result = policy === 'after_tool' && sessionStartupComplete
+                        ? await arbiter.submitPromptAfterTool(text, promptOptions)
+                        : await arbiter.submitPrompt(text, promptOptions);
+                    const steered = result.accepted
+                        && (result.detail === 'injected' || result.detail === 'startedNewTurn');
+                    const boundary = result.safeBoundary;
+                    const queuedAfterSteeringFailure = result.detail?.startsWith('steering rejected;') === true;
+                    const boundaryDetail = boundary && queuedAfterSteeringFailure
+                        ? boundary.state === 'timeout'
+                            ? `after_tool timed out after ${boundary.waitedMs}ms; steering rejected, queued without cancellation`
+                            : `after_tool ${boundary.state} boundary after ${boundary.waitedMs}ms; steering rejected, queued without cancellation`
+                        : boundary
+                            ? boundary.state === 'timeout'
+                                ? `after_tool timed out after ${boundary.waitedMs}ms; steered without cancellation`
+                                : boundary.state === 'unsupported'
+                                    ? 'after_tool unsupported; used non-cancelling queued delivery'
+                                    : `after_tool ${boundary.state} delivery after ${boundary.waitedMs}ms`
+                            : result.detail;
+                    return {
+                        succeeded: result.succeeded || steered,
+                        outcome: steered ? result.detail : result.outcome,
+                        detail: result.succeeded || steered || !boundary
+                            ? boundaryDetail
+                            : [result.detail, boundaryDetail].filter(Boolean).join('; '),
+                        ...(boundary ? { safeBoundary: boundary.state } : {}),
+                    };
+                },
+            };
+            const firstPrompt = mode === 'fresh'
+                ? `Read and follow ${join(dir, 'briefing.md')} now.`
+                : `Your supervisor has verified your assigned identity and room readiness. Read ${join(dir, 'WORKLOG.md')} and ${join(dir, 'briefing.md')}, then continue using the available ours tools.`;
+            // Wait for the first turn's TERMINAL result. An agent that accepts the
+            // startup prompt and then refuses it has not started; logging the role as
+            // up would hide a role that never read its briefing.
+            const starting = arbiter.submitPrompt(firstPrompt, { origin: { kind: 'startup' } });
+            // Monitoring starts immediately. The delivery adapter above downgrades
+            // interruption to steering until this startup turn reaches a terminal
+            // success, so there is neither a deaf gap nor a boot-cancellation loop.
+            monitorLoop = monitor?.run(pid);
+            // Owner traffic and agent replies must be observed during a long first
+            // turn. Ordinary owner input steers until startup has proved successful.
+            if (ownerChannel) {
+                try {
+                    await ownerChannel.start();
+                    control.setOwnerChannel(ownerChannel);
+                }
+                catch (error) {
                     monitor?.stop();
                     if (monitorLoop)
                         await monitorLoop;
                     await control.close();
+                    await ownerChannel.close().catch(() => undefined);
                     ownerBinder?.release();
                     await agentSession.close();
                     unsubscribeRecovery?.();
-                    throw new Error(`[${name}] configured temporary loop manager failed to start: `
+                    throw new Error(`[${name}] owner channel failed to start: `
                         + `${error?.message ?? String(error)}`);
                 }
-                deps.log(`[${name}] scheduled loop manager unavailable: ${error?.name ?? 'Error'}`);
-            }
-        }
-    }
-    deps.log(`[${name}] up; pid=${pid} cwd=${runCwd} harness=${role.harness} session=${sessionBackend} mode=${mode}`);
-    // The monitor loop lives exactly as long as the session: it starts once the
-    // pane pid is known and is stopped when that pid dies (task dies with runner).
-    monitorLoop ??= monitor?.run(pid);
-    recoveryController = new RoleRecoveryController({
-        role: name, identity: role.identity, stateDir: dir, now: deps.now, sleep: deps.sleep,
-        log: deps.log,
-        recoverAgent: async () => {
-            const evidence = await recoverAgentIdentity(arbiter, role.identity);
-            return evidence.ok ? { ok: true } : { ok: false, reason: evidence.reason };
-        },
-        recoverOwner: async (epoch) => {
-            if (!ownerChannel?.recover)
-                return { ok: true };
-            try {
-                await ownerChannel.recover(epoch);
-                return { ok: true };
             }
-            catch (error) {
-                return { ok: false, reason: error instanceof Error
-                        ? `OWNER_${error.name.toUpperCase()}` : 'OWNER_UNKNOWN_ERROR' };
+            const started = await starting;
+            // A temporary role's first turn can be the active turn when an ours wake
+            // needs immediate attention. A typed console/monitor cancellation ends
+            // only that turn: the already-live agent session and any queued wake remain
+            // valid. Keep every unproven cancellation, refusal, shutdown, and genuine
+            // failure terminal so a role that never accepted its briefing is not
+            // silently reported as healthy.
+            const interruptedForWake = isRecoverableTempStartupCancellation(temp, started)
+                || (started.outcome === 'cancelled' && started.cancellationSource === 'stall-watchdog');
+            if (!started.succeeded && !interruptedForWake) {
+                monitor?.stop();
+                await control.close();
+                await ownerChannel?.close().catch(() => undefined);
+                ownerBinder?.release();
+                await agentSession.close();
+                unsubscribeRecovery?.();
+                if (modelRecovery) {
+                    if (monitorLoop)
+                        await monitorLoop;
+                    return {
+                        elapsedSecs: 0,
+                        exit: {
+                            version: 1,
+                            class: 'program-exit',
+                            detail: `${sessionLabel} startup triggered model recovery (${modelRecovery})`,
+                        },
+                        rotated: false,
+                        mode,
+                        modelRecovery,
+                    };
+                }
+                throw new Error(`[${name}] ${sessionLabel} startup prompt ${started.outcome}` +
+                    `${started.detail ? `: ${started.detail}` : ''}`);
             }
-        },
-    });
-    const start = deps.now();
-    let nextLoopReloadAt = deps.now() + 30_000;
-    let nextIdentityPollAt = deps.now();
-    let nextDaemonProbeAt = deps.now();
-    let lastReloadError = '';
-    let identityObserved = false;
-    let identityAbsentSince;
-    let retirementReason;
-    let supervisorRecycleRequired = false;
-    while (sessionHandle.isAlive()) {
-        await deps.sleep(temp ? 500 : 2000);
-        const now = deps.now();
-        if (now >= nextDaemonProbeAt) {
-            nextDaemonProbeAt = now + 2_000;
-            const observation = daemonObserver.observe(await deps.probeGeneration(resolvedMonitorDeps.env));
-            if (observation.kind === 'lost')
-                recoveryController.noteLoss(observation.reason);
-            if (observation.kind === 'changed' || observation.kind === 'available'
-                || (observation.kind === 'baseline' && sessionStartedWithoutDaemonBaseline)) {
-                sessionStartedWithoutDaemonBaseline = false;
-                void recoveryController.recover(observation.generation).catch(error => deps.log(`[${name}] daemon recovery controller failed: ${error?.name ?? 'Error'}`));
+            if (started.cancellationSource === 'stall-watchdog')
+                deps.log(`[${name}] ${sessionLabel} startup diagnostic recovery requires operator attention; keeping supervisor alive`);
+            else if (interruptedForWake)
+                deps.log(`[${name}] ${sessionLabel} startup prompt cancelled by ${started.cancellationSource}; `
+                    + 'keeping temporary supervisor alive');
+            sessionStartupComplete = true;
+            reloadLoopConfig = async () => {
+                const nextRole = findRole(loadConfig(configPath), name);
+                const definitions = nextRole.loops ?? [];
+                const generation = JSON.stringify(definitions.map(loop => [
+                    loop.name, loop.definitionHash, loop.promptHash,
+                ]));
+                if (generation === loopGeneration && (loopManager || !definitions.length))
+                    return { changed: false, loops: definitions.length };
+                if (!loopManager && definitions.length) {
+                    loopManager = deps.createLoopManager(name, definitions, dir, arbiter, {
+                        now: deps.now,
+                        setTimer: (callback, ms) => setTimeout(callback, ms),
+                        clearTimer: timer => clearTimeout(timer),
+                        log: deps.log,
+                    });
+                    control.setLoopManager(loopManager);
+                    loopManager.start();
+                }
+                else {
+                    loopManager?.reconcile(definitions);
+                }
+                loopGeneration = generation;
+                deps.log(`[${name}] scheduled loops reloaded (${definitions.length} definitions)`);
+                return { changed: true, loops: definitions.length };
+            };
+            // Temporary agents are immutable launch snapshots: never re-resolve mutable Fleet YAML.
+            if (!temp)
+                control.setConfigReloader(reloadLoopConfig);
+            if (role.loops?.length) {
+                try {
+                    loopManager = deps.createLoopManager(name, role.loops, dir, arbiter, {
+                        now: deps.now,
+                        setTimer: (callback, ms) => setTimeout(callback, ms),
+                        clearTimer: timer => clearTimeout(timer),
+                        log: deps.log,
+                    });
+                    control.setLoopManager(loopManager);
+                    loopManager.start();
+                }
+                catch (error) {
+                    if (temp) {
+                        monitor?.stop();
+                        if (monitorLoop)
+                            await monitorLoop;
+                        await control.close();
+                        ownerBinder?.release();
+                        await agentSession.close();
+                        unsubscribeRecovery?.();
+                        throw new Error(`[${name}] configured temporary loop manager failed to start: `
+                            + `${error?.message ?? String(error)}`);
+                    }
+                    deps.log(`[${name}] scheduled loop manager unavailable: ${error?.name ?? 'Error'}`);
+                }
             }
         }
-        if (temp && deps.shouldStop?.()) {
-            retirementReason = requestedTempStopReason(dir) ?? 'supervisor-signal';
-            deps.log(`[${name}] temporary supervisor retirement requested (${retirementReason})`);
-            await sessionHandle.close();
-            sessionClosed = true;
-            break;
-        }
-        if (temp && now >= nextIdentityPollAt) {
-            nextIdentityPollAt = now + TEMP_IDENTITY_POLL_MS;
-            const presence = await probeIdentityPresence(role.identity, deps.fetch, resolvedMonitorDeps.env);
-            if (presence.state === 'present') {
-                identityObserved = true;
-                identityAbsentSince = undefined;
+        deps.log(`[${name}] up; pid=${pid} cwd=${runCwd} harness=${role.harness} session=${sessionBackend} mode=${mode}`);
+        // The monitor loop lives exactly as long as the session: it starts once the
+        // pane pid is known and is stopped when that pid dies (task dies with runner).
+        monitorLoop ??= monitor?.run(pid);
+        recoveryController = new RoleRecoveryController({
+            role: name, identity: role.identity, stateDir: dir, now: deps.now, sleep: deps.sleep,
+            log: deps.log,
+            recoverAgent: async () => {
+                try {
+                    const release = await managedService.runtime.admit();
+                    release();
+                    return { ok: true };
+                }
+                catch {
+                    return { ok: false, reason: 'SUPERVISOR_IDENTITY_NOT_READY' };
+                }
+            },
+            recoverOwner: async (epoch) => {
+                if (!ownerChannel?.recover)
+                    return { ok: true };
+                try {
+                    await ownerChannel.recover(epoch);
+                    return { ok: true };
+                }
+                catch (error) {
+                    return { ok: false, reason: error instanceof Error
+                            ? `OWNER_${error.name.toUpperCase()}` : 'OWNER_UNKNOWN_ERROR' };
+                }
+            },
+        });
+        const start = deps.now();
+        let nextLoopReloadAt = deps.now() + 30_000;
+        let nextIdentityPollAt = deps.now();
+        let nextDaemonProbeAt = deps.now();
+        let lastReloadError = '';
+        let identityObserved = false;
+        let identityAbsentSince;
+        let retirementReason;
+        let supervisorRecycleRequired = false;
+        while (sessionHandle.isAlive()) {
+            await deps.sleep(temp ? 500 : 2000);
+            const now = deps.now();
+            if (now >= nextDaemonProbeAt) {
+                nextDaemonProbeAt = now + 2_000;
+                const observation = daemonObserver.observe(await deps.probeGeneration(resolvedMonitorDeps.env));
+                if (observation.kind === 'lost')
+                    recoveryController.noteLoss(observation.reason);
+                if (observation.kind === 'changed' || observation.kind === 'available'
+                    || (observation.kind === 'baseline' && sessionStartedWithoutDaemonBaseline)) {
+                    sessionStartedWithoutDaemonBaseline = false;
+                    void recoveryController.recover(observation.generation).catch(error => deps.log(`[${name}] daemon recovery controller failed: ${error?.name ?? 'Error'}`));
+                }
             }
-            else if (presence.state === 'absent' && identityObserved) {
-                identityAbsentSince ??= now;
-                // Require a continuous, time-bounded run of authoritative absence.
-                // The first positive observation is the readiness gate: cold harness
-                // starts may spend minutes loading the harness and briefing before the
-                // agent creates/binds its identity, and absence before then is not a
-                // close event. After readiness, debounce a real disappearance.
-                if (now - identityAbsentSince >= TEMP_IDENTITY_CLOSE_DEBOUNCE_MS) {
-                    retirementReason = 'identity-closed';
-                    deps.log(`[${name}] temporary identity '${role.identity}' closed; retiring session and supervisor`);
-                    await sessionHandle.close();
-                    sessionClosed = true;
-                    break;
+            if (deps.shouldStop?.()) {
+                if (temp) {
+                    retirementReason = requestedTempStopReason(dir) ?? 'supervisor-signal';
+                    deps.log(`[${name}] temporary supervisor retirement requested (${retirementReason})`);
                 }
+                await sessionHandle.close();
+                sessionClosed = true;
+                break;
             }
-            else if (presence.state === 'unknown')
-                identityAbsentSince = undefined;
-        }
-        if (reloadLoopConfig && now >= nextLoopReloadAt) {
-            nextLoopReloadAt = now + 30_000;
-            try {
-                await reloadLoopConfig();
-                lastReloadError = '';
+            if (temp && now >= nextIdentityPollAt) {
+                nextIdentityPollAt = now + TEMP_IDENTITY_POLL_MS;
+                const presence = await probeIdentityPresence(role.identity, deps.fetch, resolvedMonitorDeps.env);
+                if (presence.state === 'present') {
+                    identityObserved = true;
+                    identityAbsentSince = undefined;
+                }
+                else if (presence.state === 'absent' && identityObserved) {
+                    identityAbsentSince ??= now;
+                    // Require a continuous, time-bounded run of authoritative absence.
+                    // The first positive observation is the readiness gate: cold harness
+                    // starts may spend minutes loading the harness and briefing before the
+                    // agent creates/binds its identity, and absence before then is not a
+                    // close event. After readiness, debounce a real disappearance.
+                    if (now - identityAbsentSince >= TEMP_IDENTITY_CLOSE_DEBOUNCE_MS) {
+                        retirementReason = 'identity-closed';
+                        deps.log(`[${name}] temporary identity '${role.identity}' closed; retiring session and supervisor`);
+                        await sessionHandle.close();
+                        sessionClosed = true;
+                        break;
+                    }
+                }
+                else if (presence.state === 'unknown')
+                    identityAbsentSince = undefined;
             }
-            catch (error) {
-                const message = error?.message ?? String(error);
-                if (message !== lastReloadError)
-                    deps.log(`[${name}] scheduled loop config reload rejected: ${message}`);
-                lastReloadError = message;
+            if (reloadLoopConfig && now >= nextLoopReloadAt) {
+                nextLoopReloadAt = now + 30_000;
+                try {
+                    await reloadLoopConfig();
+                    lastReloadError = '';
+                }
+                catch (error) {
+                    const message = error?.message ?? String(error);
+                    if (message !== lastReloadError)
+                        deps.log(`[${name}] scheduled loop config reload rejected: ${message}`);
+                    lastReloadError = message;
+                }
             }
         }
-    }
-    if (loopManager) {
-        control?.setLoopManager(undefined);
-        await loopManager.stop();
-    }
-    // Let already-settled path operations publish their aggregate result before
-    // the shutdown fence invalidates the epoch. This never waits on I/O.
-    await Promise.resolve();
-    await Promise.resolve();
-    recoveryController?.cancel();
-    control?.setConfigReloader(undefined);
-    // Close the authenticated control route before releasing the binder lease;
-    // otherwise the predecessor can unlink the replacement's new socket.
-    if (control) {
-        control.setOwnerChannel(undefined);
-        await control.close();
-        control = undefined;
-    }
-    if (ownerChannel)
-        await ownerChannel.close();
-    if (ownerChannel?.binderReleaseSafe?.() === false) {
-        deps.log(`[${name}] owner binder retained because client quiescence was not proven at shutdown`);
-        supervisorRecycleRequired = true;
-    }
-    else
-        ownerBinder?.release();
-    if (monitor) {
-        monitor.stop();
-        await monitorLoop;
-    }
-    unsubscribeRecovery?.();
-    if (agentSession && !sessionClosed)
-        await agentSession.close();
-    const elapsed = (deps.now() - start) / 1000;
-    // Establish what actually happened before deciding anything. Absence of a
-    // record is `unknown` — except when the console itself is gone, which is a
-    // different event with a different consequence.
-    const exitRecord = agentSession.exitResult()
-        ?? { version: 1, class: 'unknown', detail: 'the agent session stopped without reporting an exit' };
-    writeFileSync(exitFile, JSON.stringify({
-        ...exitRecord, at: new Date(deps.now()).toISOString(), elapsedSecs: Number(elapsed.toFixed(1)),
-    }) + '\n');
-    let rotated = false;
-    const rotate = (why) => {
-        writeFileSync(sidFile, randomUUID() + '\n');
-        rmSync(bootedFile, { force: true });
-        rotated = true;
-        deps.log(`[${name}] ${why} -> rotated session-id; next start is FRESH`);
-    };
-    if (exitRecord.detail.includes(ACP_CANCEL_DEADLINE_EXCEEDED)
-        || exitRecord.detail.includes(CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED))
-        // This is a deliberate adapter reclamation, not evidence that resume state
-        // is poisoned. Preserve the context even when the resumed generation hits
-        // the same bound immediately; runSupervised still counts the fast exit and
-        // opens its circuit after the configured number of consecutive failures.
-        deps.log(`[${name}] forced cancellation recovery (${elapsed.toFixed(0)}s, ${exitRecord.detail}) ` +
-            `-> next start RESUMES context`);
-    else if (exitRecord.class === 'clean' && adapter.exitPolicy.cleanExitIsFresh)
-        rotate(`clean exit (code 0)`);
-    else if (exitRecord.class === 'session-destroyed')
-        // Someone tore the console down; the agent did not fail. Rotating here
-        // would discard a live conversation for an operator action.
-        deps.log(`[${name}] ${exitRecord.detail} (${elapsed.toFixed(0)}s) -> next start RESUMES context`);
-    else if (mode === 'resume' && elapsed < adapter.exitPolicy.fastFailSecs) {
-        // Self-heal a poisoned resume — but only once per failure sequence. Rotating
-        // on every attempt would discard the conversation again and again while the
-        // real cause (a broken command, a missing binary) went unaddressed.
-        if (opts.allowResumeRotation === false)
-            deps.log(`[${name}] resume failed fast again (${elapsed.toFixed(0)}s, ${exitRecord.detail}) ` +
-                `-> resume state was already discarded once; keeping it`);
+        if (loopManager) {
+            control?.setLoopManager(undefined);
+            await loopManager.stop();
+        }
+        // Let already-settled path operations publish their aggregate result before
+        // the shutdown fence invalidates the epoch. This never waits on I/O.
+        await Promise.resolve();
+        await Promise.resolve();
+        recoveryController?.cancel();
+        control?.setConfigReloader(undefined);
+        // Close the authenticated control route before releasing the binder lease;
+        // otherwise the predecessor can unlink the replacement's new socket.
+        if (control) {
+            control.setOwnerChannel(undefined);
+            await control.close();
+            control = undefined;
+        }
+        if (ownerChannel)
+            await ownerChannel.close();
+        if (ownerChannel?.binderReleaseSafe?.() === false) {
+            deps.log(`[${name}] owner binder retained because client quiescence was not proven at shutdown`);
+            supervisorRecycleRequired = true;
+        }
         else
-            rotate(`resume failed fast (${elapsed.toFixed(0)}s, ${exitRecord.detail})`);
+            ownerBinder?.release();
+        if (monitor) {
+            monitor.stop();
+            await monitorLoop;
+        }
+        unsubscribeRecovery?.();
+        if (agentSession && !sessionClosed)
+            await agentSession.close();
+        const elapsed = (deps.now() - start) / 1000;
+        // Establish what actually happened before deciding anything. Absence of a
+        // record is `unknown` — except when the console itself is gone, which is a
+        // different event with a different consequence.
+        const exitRecord = agentSession.exitResult()
+            ?? { version: 1, class: 'unknown', detail: 'the agent session stopped without reporting an exit' };
+        writeFileSync(exitFile, JSON.stringify({
+            ...exitRecord, at: new Date(deps.now()).toISOString(), elapsedSecs: Number(elapsed.toFixed(1)),
+        }) + '\n');
+        let rotated = false;
+        const rotate = (why) => {
+            writeFileSync(sidFile, randomUUID() + '\n');
+            rmSync(bootedFile, { force: true });
+            rotated = true;
+            deps.log(`[${name}] ${why} -> rotated session-id; next start is FRESH`);
+        };
+        if (!temp && deps.shouldStop?.())
+            deps.log(`[${name}] supervisor stop requested -> next start RESUMES context`);
+        else if (exitRecord.detail.includes(ACP_CANCEL_DEADLINE_EXCEEDED)
+            || exitRecord.detail.includes(CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED))
+            // This is a deliberate adapter reclamation, not evidence that resume state
+            // is poisoned. Preserve the context even when the resumed generation hits
+            // the same bound immediately; runSupervised still counts the fast exit and
+            // opens its circuit after the configured number of consecutive failures.
+            deps.log(`[${name}] forced cancellation recovery (${elapsed.toFixed(0)}s, ${exitRecord.detail}) ` +
+                `-> next start RESUMES context`);
+        else if (exitRecord.class === 'clean' && adapter.exitPolicy.cleanExitIsFresh)
+            rotate(`clean exit (code 0)`);
+        else if (exitRecord.class === 'session-destroyed')
+            // Someone tore the console down; the agent did not fail. Rotating here
+            // would discard a live conversation for an operator action.
+            deps.log(`[${name}] ${exitRecord.detail} (${elapsed.toFixed(0)}s) -> next start RESUMES context`);
+        else if (mode === 'resume' && elapsed < adapter.exitPolicy.fastFailSecs) {
+            // Self-heal a poisoned resume — but only once per failure sequence. Rotating
+            // on every attempt would discard the conversation again and again while the
+            // real cause (a broken command, a missing binary) went unaddressed.
+            if (opts.allowResumeRotation === false)
+                deps.log(`[${name}] resume failed fast again (${elapsed.toFixed(0)}s, ${exitRecord.detail}) ` +
+                    `-> resume state was already discarded once; keeping it`);
+            else
+                rotate(`resume failed fast (${elapsed.toFixed(0)}s, ${exitRecord.detail})`);
+        }
+        else
+            deps.log(`[${name}] ${exitRecord.detail} (${elapsed.toFixed(0)}s) -> next start RESUMES context`);
+        if (supervisorRecycleRequired)
+            throw new SupervisorRecycleRequiredError();
+        return {
+            elapsedSecs: elapsed, exit: exitRecord, rotated, mode, modelRecovery,
+            ...(retirementReason ? { retirementReason } : {}),
+        };
+    }
+    finally {
+        await managedService.close(false);
     }
-    else
-        deps.log(`[${name}] ${exitRecord.detail} (${elapsed.toFixed(0)}s) -> next start RESUMES context`);
-    if (supervisorRecycleRequired)
-        throw new SupervisorRecycleRequiredError();
-    return {
-        elapsedSecs: elapsed, exit: exitRecord, rotated, mode, modelRecovery,
-        ...(retirementReason ? { retirementReason } : {}),
-    };
 }
 /**
  * The persistent supervisor for one permanent role: run child sessions in a
@@ -1049,7 +1074,10 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
     const deps = { ...defaultDeps(), ...partialDeps };
     const dir = agentDir(name);
     mkdirSync(dir, { recursive: true });
-    const shouldStop = deps.shouldStop ?? (() => false);
+    let stopping = false;
+    const requestStop = () => { stopping = true; };
+    const shouldStop = () => stopping || (partialDeps.shouldStop?.() ?? false);
+    deps.shouldStop = shouldStop;
     const stamp = () => new Date(deps.now()).toISOString();
     // Record how the PREVIOUS supervisor process ended before doing anything
     // else. An external kill writes nothing itself, and the next ledger write is
@@ -1071,6 +1099,9 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
             deps.log(`[${name}] previous supervisor run (started ${termination.runStartedAt}) `
                 + `ended abruptly: ${termination.detail}; abrupt terminations recorded: ${abrupt}`);
     }
+    // Service-manager stops must run the same cleanup as a completed session.
+    process.on('SIGTERM', requestStop);
+    process.on('SIGINT', requestStop);
     try {
         while (!shouldStop()) {
             let ledger = readRestartLedger(dir);
@@ -1125,6 +1156,8 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
                     mode: 'fresh',
                 };
             }
+            if (stopping)
+                break;
             // Re-read: the attempt itself may have taken minutes, and an operator may
             // have reset the ledger meanwhile.
             ledger = readRestartLedger(dir);
@@ -1189,8 +1222,12 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
         return readRestartLedger(dir);
     }
     finally {
-        // Only an orderly return through this loop clears the marker; a signal or
-        // an OOM-kill leaves it, which is exactly how the successor detects them.
+        process.off('SIGTERM', requestStop);
+        process.off('SIGINT', requestStop);
+        // An orderly shutdown clears the marker; an unhandled signal or OOM-kill
+        // leaves it so the successor can identify an abrupt termination.
+        if (shouldStop())
+            await deps.releaseAgentOurs(findRole(loadConfig(opts.configPath), name));
         releaseSupervisorRun(dir);
     }
 }
@@ -1220,10 +1257,15 @@ export async function runTemp(name, deps = {}, attempt = runOnce) {
     let result;
     let failure;
     try {
-        result = await attempt(name, { temp: true }, {
-            ...deps,
-            shouldStop: () => Boolean(signal) || (deps.shouldStop?.() ?? false),
-        });
+        for (let recoveryAttempt = 0;; recoveryAttempt++) {
+            result = await attempt(name, { temp: true }, {
+                ...deps,
+                shouldStop: () => Boolean(signal) || (deps.shouldStop?.() ?? false),
+            });
+            if (result.exit.class === 'clean' || result.retirementReason || signal || deps.shouldStop?.() || recoveryAttempt >= 2)
+                break;
+            await (deps.sleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms))))(Math.min(5000, 1000 * (recoveryAttempt + 1)));
+        }
     }
     catch (error) {
         failure = error;
@@ -1231,23 +1273,27 @@ export async function runTemp(name, deps = {}, attempt = runOnce) {
     finally {
         process.off('SIGTERM', onTerm);
         process.off('SIGINT', onInt);
-        const requested = requestedTempStopReason(dir);
-        const reason = requested
-            ?? result?.retirementReason
-            ?? (failure instanceof SupervisorRecycleRequiredError ? 'supervisor-recycle' : undefined)
-            ?? (signal ? 'supervisor-signal' : failure ? 'startup-failure' : 'session-ended');
-        // A service-manager stop can make the child connection close before the
-        // runner reaches its normal loop. That is still a successful requested
-        // retirement, not a startup failure.
-        const outcome = failure && !requested && !signal ? 'failed' : 'retired';
-        const detail = failure
-            ? (failure instanceof Error ? failure.message : String(failure))
-            : result
-                ? `${result.exit.detail}; elapsed=${result.elapsedSecs.toFixed(1)}s`
-                : 'temporary supervisor ended without an attempt result';
-        const archived = archiveTempState(name, reason, outcome, detail);
-        deps.log?.(`[${name}] temporary lifecycle ${outcome}: ${reason}`
-            + `${archived ? `; evidence archived at ${archived}` : '; state already archived'}`);
+        // A recycle replaces the supervisor process, not the logical temporary agent.
+        if (!(failure instanceof SupervisorRecycleRequiredError) || signal || deps.shouldStop?.()) {
+            const requested = requestedTempStopReason(dir);
+            const reason = requested
+                ?? result?.retirementReason
+                ?? (failure instanceof SupervisorRecycleRequiredError ? 'supervisor-recycle' : undefined)
+                ?? (signal ? 'supervisor-signal' : failure ? 'startup-failure' : 'session-ended');
+            // A service-manager stop can make the child connection close before the
+            // runner reaches its normal loop. That is still a successful requested
+            // retirement, not a startup failure.
+            const outcome = failure && !requested && !signal ? 'failed' : 'retired';
+            const detail = failure
+                ? (failure instanceof Error ? failure.message : String(failure))
+                : result
+                    ? `${result.exit.detail}; elapsed=${result.elapsedSecs.toFixed(1)}s`
+                    : 'temporary supervisor ended without an attempt result';
+            await (deps.releaseAgentOurs ?? releaseManagedAgent)(loadTempRole(name));
+            const archived = archiveTempState(name, reason, outcome, detail);
+            deps.log?.(`[${name}] temporary lifecycle ${outcome}: ${reason}`
+                + `${archived ? `; evidence archived at ${archived}` : '; state already archived'}`);
+        }
     }
     if (failure)
         throw failure;