@ours.network/fleet 1.2.0-nightly.64 → 1.2.0-nightly.66

package/dist/reminders/tools.js

@@ -0,0 +1,108 @@
+import { z } from 'zod';
+import { ReminderError } from './store.js';
+export const REMINDER_TOOL_NAMES = Object.freeze([
+    'fleet_reminder_create', 'fleet_reminder_list', 'fleet_reminder_update',
+    'fleet_reminder_cancel', 'fleet_reminder_inspect', 'fleet_reminder_ack',
+]);
+const schedule = {
+    local_time: z.string().describe('Calendar date and wall-clock time WITHOUT an offset, e.g. "2027-01-20T16:00". Always a real date: resolve "tomorrow" yourself.'),
+    time_zone: z.string().describe('IANA zone the time is meant in, e.g. "Europe/London", "America/New_York" or "UTC". Use the zone of the person or task, not a guess.'),
+    fold: z.union([z.literal(0), z.literal(1)]).optional().describe('Only for a wall time that occurs twice when clocks go back: 0 = first occurrence, 1 = second.'),
+    late_window_seconds: z.number().int().optional().describe('How late the wake may still be delivered if this agent or the host was offline or busy at the due time (60..604800, default 3600). After it the reminder expires without a wake.'),
+};
+function result(value) {
+    return {
+        content: [{ type: 'text', text: JSON.stringify(value, null, 2) }],
+        structuredContent: value,
+        isError: false,
+    };
+}
+function failure(code, message) {
+    const value = { error: code, message };
+    return { content: [{ type: 'text', text: JSON.stringify(value) }], isError: true };
+}
+/**
+ * Register the self-reminder tools on the agent's own fixed-identity MCP
+ * server. No argument names an agent, identity or recipient: the server is the
+ * caller's own supervisor, so every operation is implicitly self-scoped.
+ */
+export function registerReminderTools(server, backend, 
+/** The endpoint's runtime admission; nothing is read or changed unless it admits. */
+admit) {
+    const run = async (operation, mutates) => {
+        let release;
+        try {
+            release = await admit();
+        }
+        catch {
+            return failure('runtime_not_ready', 'the managed runtime is not admitting tool calls right now; nothing was read or changed');
+        }
+        try {
+            const target = backend();
+            if (!target)
+                return failure('reminders_unavailable', 'self-reminders are not available in this session (the supervisor has not bound them, or this session cannot take scheduled prompts)');
+            try {
+                const value = operation(target);
+                if (mutates)
+                    target.changed();
+                return result(value);
+            }
+            catch (error) {
+                if (error instanceof ReminderError)
+                    return failure(error.code, error.message);
+                return failure('reminder_store_failed', 'the reminder could not be recorded; nothing was changed');
+            }
+        }
+        finally {
+            release();
+        }
+    };
+    server.registerTool('fleet_reminder_create', {
+        description: 'Schedule a one-time reminder that wakes YOU (this agent) at a future date and time. '
+            + 'It sends nothing to anyone: when due, Fleet starts a turn for you with the reminder, and you decide what to do. '
+            + 'Use it to come back to something later instead of polling or waiting. Repeating a call with the same request_key '
+            + 'and input returns the existing reminder instead of creating another.',
+        inputSchema: {
+            request_key: z.string().describe('Stable key for this scheduling decision, so a retried call cannot create a duplicate (e.g. "release-check-2027-01-20").'),
+            title: z.string().describe('Short label shown in the wake (max 200 characters).'),
+            note: z.string().optional().describe('Private context for your future self: what to check and why (max 4000 characters). Returned by inspect, not in the wake text.'),
+            ...schedule,
+        },
+    }, async (args) => run(({ store }) => store.create(args.request_key, args), true));
+    server.registerTool('fleet_reminder_list', {
+        description: 'List your own reminders. state: "open" (default: scheduled or delivered but not acknowledged), "closed", or "all". '
+            + 'Pages with limit (1..100, default 50) and after (the id from the previous page).',
+        inputSchema: {
+            state: z.enum(['open', 'closed', 'all']).optional(),
+            limit: z.number().int().optional(),
+            after: z.string().optional(),
+        },
+    }, async (args) => run(({ store }) => store.list(args), false));
+    server.registerTool('fleet_reminder_update', {
+        description: 'Change one of your reminders, e.g. to postpone it. Pass the id and the revision you last saw '
+            + '(expected_revision) plus only the fields to change. Any wake already issued for the old revision becomes void.',
+        inputSchema: {
+            id: z.string(),
+            expected_revision: z.number().int(),
+            title: z.string().optional(),
+            note: z.string().optional(),
+            local_time: schedule.local_time.optional(),
+            time_zone: schedule.time_zone.optional(),
+            fold: schedule.fold,
+            late_window_seconds: schedule.late_window_seconds,
+        },
+    }, async ({ id, expected_revision, ...changes }) => run(({ store }) => store.update(id, expected_revision, changes), true));
+    server.registerTool('fleet_reminder_cancel', {
+        description: 'Cancel one of your reminders (id + expected_revision). A wake already waiting for it will not be delivered.',
+        inputSchema: { id: z.string(), expected_revision: z.number().int() },
+    }, async ({ id, expected_revision }) => run(({ store }) => store.cancel(id, expected_revision), true));
+    server.registerTool('fleet_reminder_inspect', {
+        description: 'Read the reminder behind a [fleet-reminder] wake, including its note, and whether the wake is still current and eligible.',
+        inputSchema: { event_id: z.string() },
+    }, async ({ event_id }) => run(({ store }) => store.inspect(event_id), false));
+    server.registerTool('fleet_reminder_ack', {
+        description: 'Record that you handled a [fleet-reminder] wake (event_id + revision from the wake). '
+            + 'It closes the reminder and sends nothing; it does not claim any external action happened. Safe to repeat.',
+        inputSchema: { event_id: z.string(), expected_revision: z.number().int() },
+    }, async ({ event_id, expected_revision }) => run(({ store }) => store.ack(event_id, expected_revision), true));
+}

package/dist/runner.d.ts

@@ -4,7 +4,7 @@ import { probeIdentityPresence, type MonitorHandle, type MonitorOpts, type Fetch
 import { type DaemonGenerationProbe } from './daemon-recovery.js';
 import { type Exec } from './exec.js';
 import { RoleControlServer } from './session/control.js';
-import type { AgentSession, ExitRecord, TurnResult } from './session/types.js';
+import { type AgentSession, type ExitRecord, type TurnResult } from './session/types.js';
 import type { AgentSessionAdapter, AgentSessionStartOptions } from './harness/agent-session.js';
 import { type OwnerChannelHandle, type OwnerChannelOptions } from './owner-channel/channel.js';
 import { type OwnerBinderLease } from './owner-channel/binder.js';

package/dist/runner.js

@@ -26,6 +26,8 @@ import { resourceArgs, cpuControllerDelegated } from './isolation/resources.js';
 import { resolveLaunchRuntime } from './isolation/runtime.js';
 import { controlRequest, RoleControlServer } from './session/control.js';
 import { ACP_CANCEL_DEADLINE_EXCEEDED, CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED, classifyShellStatus, } from './session/types.js';
+import { sessionBackendCapabilities } from './session/types.js';
+import { bindRoleReminders } from './reminders/runtime.js';
 import { effectiveModelForRole, modelRecoveryHeld, reconcileModelRecovery, recordModelFailure, classifyFailureText, } from './model-recovery.js';
 import { rotateWorklog } from './worklog.js';
 import { reconcilePermanentRoleIdentities } from './creation.js';
@@ -612,6 +614,9 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     const managedService = await deps.prepareAgentOurs(role, dir, opts.identityLifetime ? opts.identityLifetime === 'temporary' : temp);
     startupTelemetry.mark('identity_ready');
     let layoutRetiring = false;
+    // Self-reminders live and die with this attempt's runtime binding: every exit
+    // path below stops the dispatcher before that binding is released.
+    let reminderManager;
     try {
         const managedHarness = prepareManagedHarness(role, dir, runCwd, managedService.descriptor, { ...harnessChildEnv(role, launch.env, dir), ...subscription?.env });
         // Start-stagger: space this launch at least start_stagger_ms after the previous
@@ -680,6 +685,10 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 monitorStarted = true;
                 monitorLoop = monitor?.run(pid);
             }
+            // Reminder wakes follow the same gate as mail wakes: never into a role
+            // whose protected startup turn has not succeeded.
+            if (monitorMayStart && sessionStartupComplete && !deps.shouldStop?.())
+                reminderManager?.start();
         };
         let sessionClosed = false;
         let ownerChannel;
@@ -713,6 +722,16 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             pid = agentSession.pid;
             arbiter = new RoleTurnArbiter(agentSession);
             sessionHandle = arbiter;
+            reminderManager = bindRoleReminders({
+                role: name, stateDir: dir, runtime: managedService.setReminders ? managedService.runtime.snapshot : {},
+                promptInput: sessionBackendCapabilities(sessionBackend, role.harness).promptInput,
+                admitter: arbiter, service: managedService,
+                deps: {
+                    now: deps.now, log: deps.log,
+                    setTimer: (callback, ms) => setTimeout(callback, ms),
+                    clearTimer: timer => clearTimeout(timer),
+                },
+            });
             const unsubscribeFailure = agentSession.subscribe(event => {
                 if (event.kind !== 'error' || !event.text || event.origin?.kind === 'stall-watchdog')
                     return;
@@ -1105,6 +1124,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 break;
             }
             if (deps.shouldStop?.()) {
+                reminderManager?.stop();
                 if (temp) {
                     retirementReason = requestedTempStopReason(dir) ?? 'supervisor-signal';
                     deps.log(`[${name}] temporary supervisor retirement requested (${retirementReason})`);
@@ -1130,6 +1150,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     if (now - identityAbsentSince >= TEMP_IDENTITY_CLOSE_DEBOUNCE_MS) {
                         retirementReason = 'identity-closed';
                         deps.log(`[${name}] temporary identity '${role.identity}' closed; retiring session and supervisor`);
+                        reminderManager?.stop();
                         await sessionHandle.close();
                         sessionClosed = true;
                         break;
@@ -1153,6 +1174,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             }
         }
         monitorMayStart = false;
+        reminderManager?.stop();
         if (loopManager) {
             control?.setLoopManager(undefined);
             await loopManager.stop();
@@ -1238,6 +1260,8 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         };
     }
     finally {
+        reminderManager?.stop();
+        managedService.setReminders?.(undefined);
         await managedService.close(layoutRetiring);
     }
 }

package/dist/session/acp.js

@@ -9,7 +9,7 @@ import * as acp from '@agentclientprotocol/sdk';
 import { normalizeSessionUpdate } from './conversation-normalizer.js';
 import { ConversationEventStore } from './conversation-store.js';
 import { SessionEvents } from './events.js';
-import { commandName, memberAuthority, memberBindings, pendingInventory, takeBatch, } from './prompt-batch.js';
+import { commandName, memberAuthority, memberBindings, pendingInventory, takeBatch, refuseAtRelease, RELEASE_GUARD_REFUSED, } from './prompt-batch.js';
 import { recordClaudeRateLimit } from '../subscriptions/observed.js';
 import { DEFAULT_STALL_TIMEOUT_MS, STALL_RECOVERY_PROMPT, StallWatchdog, StallToolHistory, hasStallRecoveryClaim } from './stall-watchdog.js';
 import { ACP_CANCEL_DEADLINE_EXCEEDED, SessionControlError, classifyChildExit, sessionBackendCapabilities, turnResult, } from './types.js';
@@ -167,6 +167,9 @@ function conversationSource(origin) {
         case 'owner': return { source: 'owner_channel', persistBody: false };
         case 'fleet-monitor': return { source: 'fleet_monitor', persistBody: false };
         case 'scheduled-loop': return { source: 'scheduled_loop', persistBody: false };
+        // A supervisor wake like a monitor notice; the body is never retained, so
+        // restart recovery can never replay a reminder past its dispatch fence.
+        case 'self-reminder': return { source: 'fleet_monitor', persistBody: false };
         case 'local-console':
         default:
             return { source: 'local_console', persistBody: true };
@@ -702,6 +705,9 @@ export class AcpSession {
      * for it is what turned a busy agent into a timeout and then into "dead".
      */
     async queuePrompt(text, options = {}) {
+        // A guarded prompt must reach the model only through the release fence.
+        if (options.releaseGuard)
+            options = { ...options, interrupt: false, steer: false };
         if (this.stallRecoveryClaimed && options.origin?.kind === 'fleet-monitor')
             options = { ...options, interrupt: false, steer: false };
         if (this.cancelRecoveryReason)
@@ -727,7 +733,7 @@ export class AcpSession {
         const run = this.observation.checkpoint(() => {
             this.admitToLedger(promptId, text, queuedBehind, options);
             this.queueDepth++;
-            return this.enqueue(promptId, text, options.origin);
+            return this.enqueue(promptId, text, options.origin, options.releaseGuard);
         });
         const completion = run.then(result => {
             this.queueDepth = Math.max(0, this.queueDepth - 1);
@@ -752,10 +758,11 @@ export class AcpSession {
      * own step in the chain, so its place in line is unchanged; what the step
      * does when it is reached is release a whole snapshot, not one prompt.
      */
-    enqueue(promptId, text, origin) {
+    enqueue(promptId, text, origin, releaseGuard) {
         const entry = {
             promptId, text, origin, ...conversationSource(origin), admittedAt: new Date().toISOString(),
             command: this.advertisedCommands.has(commandName(text) ?? ''),
+            ...(releaseGuard ? { releaseGuard } : {}),
         };
         this.pendingPrompts.push(entry);
         const run = this.promptTail.then(() => this.release(entry));
@@ -772,6 +779,16 @@ export class AcpSession {
     release(entry) {
         if (entry.released)
             return entry.released;
+        const refused = refuseAtRelease(this.pendingPrompts, entry, Boolean(this.sessionId && this.isAlive()));
+        if (refused) {
+            this.conversation.appendSafe({
+                kind: 'turn.completed', sessionGeneration: this.sessionGeneration, acpSessionId: this.sessionId,
+                promptId: entry.promptId, turnId: entry.promptId,
+                payload: { outcome: 'cancelled', stopReason: RELEASE_GUARD_REFUSED },
+            });
+            entry.released = Promise.resolve(refused);
+            return entry.released;
+        }
         const members = takeBatch(this.pendingPrompts, entry);
         for (const member of members)
             this.sharedTurns.set(member.promptId, members[0].promptId);

package/dist/session/arbiter.d.ts

@@ -1,5 +1,17 @@
 import type { ConversationHandlePage, ExitRecord, InterruptOutcome, PromptOrigin, QueuedPrompt, SessionEvent, AgentSession, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnResult } from './types.js';
 import type { ConversationEventV1, ConversationSnapshot, PromptReceipt, SubmitPromptCommand } from './conversation-types.js';
+export type ReminderAttempt = 
+/** Admitted; `queued.completion` settles when the turn (or its refusal) ends. */
+{
+    state: 'admitted';
+    queued: QueuedPrompt;
+} | {
+    state: 'busy';
+} | {
+    state: 'unavailable';
+    error: string;
+    admitted: false;
+};
 export type ScheduledAttempt = {
     state: 'started';
     queued: QueuedPrompt;
@@ -68,6 +80,17 @@ export declare class RoleTurnArbiter implements AgentSession {
     tryScheduled(text: string, origin: Extract<PromptOrigin, {
         kind: 'scheduled-loop';
     }>, beforeQueue?: () => void | Promise<void>): Promise<ScheduledAttempt>;
+    /**
+     * Admit a self-reminder wake only into an idle role, at the same boundary
+     * every producer uses. It never interrupts or steers, and never joins a
+     * queue behind other work: a busy role answers `busy` and the caller tries
+     * again later. `beforeQueue` makes the caller's durable claim; if it
+     * declines, nothing is queued. `releaseGuard` is the session's last-moment
+     * fence and is the only way the prompt can reach the model.
+     */
+    tryReminder(text: string, origin: Extract<PromptOrigin, {
+        kind: 'self-reminder';
+    }>, beforeQueue: () => boolean, releaseGuard: () => boolean): Promise<ReminderAttempt>;
     /** Retire only at the same admission boundary used by all prompt producers. */
     retireIfIdle(expired: (snapshot: SessionSnapshot, queueDepth: number) => boolean): Promise<boolean>;
     sharedTurnId(promptId: string): string | undefined;

package/dist/session/arbiter.js

@@ -154,6 +154,39 @@ export class RoleTurnArbiter {
             throw error;
         });
     }
+    /**
+     * Admit a self-reminder wake only into an idle role, at the same boundary
+     * every producer uses. It never interrupts or steers, and never joins a
+     * queue behind other work: a busy role answers `busy` and the caller tries
+     * again later. `beforeQueue` makes the caller's durable claim; if it
+     * declines, nothing is queued. `releaseGuard` is the session's last-moment
+     * fence and is the only way the prompt can reach the model.
+     */
+    async tryReminder(text, origin, beforeQueue, releaseGuard) {
+        await new Promise(resolve => setImmediate(resolve));
+        return this.exclusive(async () => {
+            const snapshot = this.session.snapshot();
+            if (this.stopping || this.retiring || !snapshot.alive || snapshot.readiness === 'failed')
+                return { state: 'unavailable', error: this.stopping ? 'role is stopping' : 'session is unavailable', admitted: false };
+            if (snapshot.readiness !== 'idle' || this.unsettled > 0)
+                return { state: 'busy' };
+            if (!beforeQueue())
+                return { state: 'unavailable', error: 'claim declined', admitted: false };
+            try {
+                const queued = await this.session.queuePrompt(text, {
+                    interrupt: false, steer: false, origin, releaseGuard,
+                });
+                return { state: 'admitted', queued: this.track(queued) };
+            }
+            catch (error) {
+                return { state: 'unavailable', error: error?.message ?? String(error), admitted: false };
+            }
+        }).catch(error => {
+            if (error instanceof AdmissionRetiredError)
+                return { state: 'unavailable', error: error.message, admitted: false };
+            throw error;
+        });
+    }
     /** Retire only at the same admission boundary used by all prompt producers. */
     retireIfIdle(expired) {
         return this.exclusive(async () => {

package/dist/session/codex-app-server.js

@@ -6,7 +6,7 @@ import { isAbsolute, join, resolve } from 'node:path';
 import { boundedJson } from './conversation-normalizer.js';
 import { ConversationEventStore } from './conversation-store.js';
 import { SessionEvents } from './events.js';
-import { memberAuthority, memberBindings, pendingInventory, takeBatch, } from './prompt-batch.js';
+import { memberAuthority, memberBindings, pendingInventory, takeBatch, refuseAtRelease, RELEASE_GUARD_REFUSED, } from './prompt-batch.js';
 import { CodexAppServerTransport } from './codex-app-server-transport.js';
 import { CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED, SessionControlError, sessionBackendCapabilities, turnResult, } from './types.js';
 const PERMISSION_TIMEOUT_MS = 10 * 60_000;
@@ -27,6 +27,7 @@ function sourceFor(origin) {
         case 'owner': return { source: 'owner_channel', persistBody: false };
         case 'fleet-monitor': return { source: 'fleet_monitor', persistBody: false };
         case 'scheduled-loop': return { source: 'scheduled_loop', persistBody: false };
+        case 'self-reminder': return { source: 'fleet_monitor', persistBody: false };
         case 'local-console':
         default: return { source: 'local_console', persistBody: true };
     }
@@ -223,6 +224,9 @@ export class CodexAppServerSession {
         };
     }
     async queuePrompt(text, options = {}) {
+        // A guarded prompt must reach the model only through the release fence.
+        if (options.releaseGuard)
+            options = { ...options, interrupt: false, steer: false };
         if (this.closing || !this.threadId || !this.transport.isAlive())
             throw new SessionControlError('offline', this.lastError ?? 'Codex app-server session is offline');
         let delivery;
@@ -242,7 +246,7 @@ export class CodexAppServerSession {
         const run = this.observation.checkpoint(() => {
             this.admit(promptId, text, queuedBehind, options);
             this.queueDepth++;
-            return this.enqueue(promptId, text, options.origin);
+            return this.enqueue(promptId, text, options.origin, options.releaseGuard);
         });
         const completion = run.then(result => {
             this.queueDepth = Math.max(0, this.queueDepth - 1);
@@ -263,11 +267,12 @@ export class CodexAppServerSession {
         return this.sharedTurns.get(promptId);
     }
     /** Each prompt keeps its own step in the chain; the step it reaches releases a whole snapshot. */
-    enqueue(promptId, text, origin) {
+    enqueue(promptId, text, origin, releaseGuard) {
         const entry = {
             promptId, text, origin, ...sourceFor(origin), admittedAt: new Date().toISOString(),
             // The one text the native session runs as an operation instead of a turn.
             command: text.trim() === '/compact',
+            ...(releaseGuard ? { releaseGuard } : {}),
         };
         this.pendingPrompts.push(entry);
         const run = this.promptTail.then(() => this.release(entry));
@@ -283,6 +288,16 @@ export class CodexAppServerSession {
     release(entry) {
         if (entry.released)
             return entry.released;
+        const refused = refuseAtRelease(this.pendingPrompts, entry, Boolean(this.threadId && this.transport.isAlive()));
+        if (refused) {
+            this.conversation.appendSafe({
+                kind: 'turn.completed', sessionGeneration: this.sessionGeneration,
+                promptId: entry.promptId, turnId: entry.promptId,
+                payload: { outcome: 'cancelled', stopReason: RELEASE_GUARD_REFUSED },
+            });
+            entry.released = Promise.resolve(refused);
+            return entry.released;
+        }
         const members = takeBatch(this.pendingPrompts, entry);
         for (const member of members)
             this.sharedTurns.set(member.promptId, members[0].promptId);

package/dist/session/prompt-batch.d.ts

@@ -18,6 +18,8 @@ export interface PendingPrompt {
     command?: boolean;
     /** Set when a release takes this prompt; every member of that turn shares it. */
     released?: Promise<TurnResult>;
+    /** Last-moment validity check for an internal prompt; see `refuseAtRelease`. */
+    releaseGuard?: () => boolean;
 }
 /**
  * How a waiting prompt takes part in a release.
@@ -31,7 +33,7 @@ export interface PendingPrompt {
  *    adapter as the entire prompt, so it is its own turn and a boundary
  *    between the messages before and after it. The session decides this at
  *    admission; text that merely starts with a slash is an ordinary message.
- *  - `internal`: startup, scheduled-loop and stall-watchdog prompts. They own
+ *  - `internal`: startup, scheduled-loop, self-reminder and stall-watchdog prompts. They own
  *    their turn's lifecycle (and, for a loop, the redaction of its whole
  *    transcript), run alone, and never split the messages around them.
  */
@@ -45,6 +47,20 @@ export declare function commandName(text: string): string | undefined;
  * admitted after it returns belongs to the next release.
  */
 export declare function takeBatch(pending: PendingPrompt[], head: PendingPrompt): PendingPrompt[];
+/**
+ * The release-time fence for a guarded internal prompt. A prompt can wait in
+ * the queue long after it was admitted; whatever it was about may have been
+ * cancelled, revised or expired meanwhile, or the role may be stopping. The
+ * guard answers at the one moment that matters — the prompt is about to reach
+ * the model — and a refusal removes it unsent.
+ *
+ * The guard runs only when the session is live: an offline session fails the
+ * turn without handing it to the adapter, so consuming the guard there would
+ * record a dispatch that never happened. Returns the refused result, or
+ * undefined when the release should proceed.
+ */
+export declare function refuseAtRelease(pending: PendingPrompt[], entry: PendingPrompt, online: boolean): TurnResult | undefined;
+export declare const RELEASE_GUARD_REFUSED = "release-guard-refused";
 /** Exact, server-computed identity of one member's body inside a shared turn. */
 export interface MemberBinding {
     index: number;

package/dist/session/prompt-batch.js

@@ -5,7 +5,7 @@ import { createHash } from 'node:crypto';
  * small is the body: each entry carries a short preview, not the prompt.
  */
 const INVENTORY_TEXT_CHARS = 200;
-const INTERNAL = new Set(['startup', 'scheduled-loop', 'stall-watchdog']);
+const INTERNAL = new Set(['startup', 'scheduled-loop', 'stall-watchdog', 'self-reminder']);
 export function promptClass(prompt) {
     if (INTERNAL.has(prompt.origin?.kind ?? 'local-console'))
         return 'internal';
@@ -42,6 +42,40 @@ export function takeBatch(pending, head) {
     }
     return members;
 }
+/**
+ * The release-time fence for a guarded internal prompt. A prompt can wait in
+ * the queue long after it was admitted; whatever it was about may have been
+ * cancelled, revised or expired meanwhile, or the role may be stopping. The
+ * guard answers at the one moment that matters — the prompt is about to reach
+ * the model — and a refusal removes it unsent.
+ *
+ * The guard runs only when the session is live: an offline session fails the
+ * turn without handing it to the adapter, so consuming the guard there would
+ * record a dispatch that never happened. Returns the refused result, or
+ * undefined when the release should proceed.
+ */
+export function refuseAtRelease(pending, entry, online) {
+    if (!entry.releaseGuard || !online)
+        return undefined;
+    // Only an internal prompt is guaranteed to be its own release; any other
+    // class could be carried by another prompt's batch past this fence, so a
+    // guarded prompt of that kind is refused rather than sent unchecked.
+    let allowed = false;
+    if (promptClass(entry) === 'internal')
+        try {
+            allowed = entry.releaseGuard() === true;
+        }
+        catch {
+            allowed = false;
+        }
+    if (allowed)
+        return undefined;
+    const at = pending.indexOf(entry);
+    if (at >= 0)
+        pending.splice(at, 1);
+    return { accepted: false, outcome: 'cancelled', succeeded: false, detail: RELEASE_GUARD_REFUSED };
+}
+export const RELEASE_GUARD_REFUSED = 'release-guard-refused';
 export function memberBindings(members, sourceOf) {
     return members.map((member, at) => ({
         index: at + 1,

package/dist/session/types.d.ts

@@ -31,6 +31,13 @@ export type PromptOrigin = {
     kind: 'scheduled-loop';
     loop: string;
     runId: string;
+}
+/** A due self-reminder wake; the agent's own stored reminder, never owner input. */
+ | {
+    kind: 'self-reminder';
+    eventId: string;
+    reminderId: string;
+    revision: number;
 } | {
     kind: 'owner-admin-console';
     commandId: string;
@@ -181,6 +188,12 @@ export interface SubmitPromptOptions {
     actor?: {
         browserSession?: string;
     };
+    /**
+     * Checked synchronously at the turn boundary, immediately before the prompt
+     * would be handed to a live model. False drops the prompt unsent. Only
+     * honoured for internal prompts, which always run alone.
+     */
+    releaseGuard?: () => boolean;
 }
 export interface SessionSnapshot {
     backend: SessionBackendId;

package/dist/temp-lifecycle.js

@@ -1,5 +1,6 @@
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, } from 'node:fs';
 import { parse } from 'yaml';
+import { removeReminderState } from './reminders/store.js';
 import { randomUUID } from 'node:crypto';
 import { basename, join } from 'node:path';
 import { replaceFileAtomically, withFileLock, withSynchronousFileLock } from './atomic-file.js';
@@ -187,11 +188,19 @@ export function archiveTempState(role, reason, outcome, detail, now = new Date()
             return undefined;
         throw error;
     }
+    // Archived evidence is inert: no runner will ever load it again. Scheduling
+    // state is not evidence, so the retired agent's reminders (and their private
+    // notes) are removed rather than archived with it.
     try {
         appendTermination(paths.retiring, record);
     }
     finally {
-        renameSync(paths.retiring, paths.target);
+        try {
+            removeReminderState(paths.retiring);
+        }
+        finally {
+            renameSync(paths.retiring, paths.target);
+        }
     }
     return paths.target;
 }

package/dist/web/conversation-stream.js

@@ -193,7 +193,7 @@ export function registerConversationStream(app, services, auth) {
             if (replaced || !nextAvailable)
                 stopFollow();
             if (state.health !== 'healthy')
-                resync(state.failure ?? 'role-observation-unavailable', false);
+                resync(state.failure ?? 'role-observation-unavailable', state.health !== 'unsupported');
             else if (replaced)
                 resync('role-replaced');
             const shouldOpen = nextAvailable && (!available || replaced);
@@ -224,7 +224,7 @@ export function registerConversationStream(app, services, auth) {
             timer.unref();
         }
         catch {
-            resync('role-observation-unavailable', false);
+            resync('role-observation-unavailable');
             close();
         }
     });

package/docs/conversation-stream.md

@@ -42,8 +42,10 @@ The six logical types are:
   `sessionGeneration`, `stateRevision` and `ledgerBarrier`. Do not merge it as a
   patch or use its barrier as coverage.
 - `resync`: `{reason,retry,capability}`. Clear partial assembly and resynchronize
-  explicitly or enter supported fallback. `retry:false` means persistent
-  unsupported/oversize observation: do not loop reconnects. `capability` is
+  explicitly or enter supported fallback. Temporary role read/watch failure is
+  retryable; a fresh observer can recover after repair. `retry:false` alone does
+  not establish permanent incapability on older servers. Explicit unsupported
+  capability or persistent oversize remains supported fallback without tight reconnects. `capability` is
   `degraded`, except `auth-expired` below.
 - `keepalive`: `{at:number}`. Transport liveness only; it cannot certify role,
   session, replay, or private-control health.
@@ -130,6 +132,18 @@ history. REST remains for initial latest history, user-requested older pages,
 explicit recovery, and older/unsupported/degraded server fallback. Healthy active
 consumers must not periodically fetch role details or history.
 
+Active pane and independent voice consumers recover transient transport, temporary observer or
+bootstrap failures after their bounded fast attempts: one delayed attempt after 10 seconds,
+then 20 seconds, then capped 30 seconds between failed settled attempts. Fallback refresh ticks
+do not start probes. Retire/abort the fallback request and timer before recovery takes cursor
+ownership; fence late responses without waiting indefinitely for cancellation. Resume only
+same-generation certified coverage; otherwise establish a canonical latest baseline. Ordinary
+REST progress and identical unsuccessful resync never reset the fast restart budget. Complete
+ready ends fallback polling and resets delayed backoff. Pane generation replacement may load a
+new baseline; voice generation replacement stops that session until explicit Start, without
+transferring controller/provider leases. Auth-required/expired ends automatic reads/probes.
+
+
 Complete role delivery relies on native directory notifications for fleet config,
 role manifests and session files. Qualified native host filesystems are the
 intended deployment (macOS local APFS or Linux local filesystems with functional