@ours.network/fleet 1.2.0-nightly.9 → 2.0.1

package/dist/runner.js

@@ -1,22 +1,33 @@
+import { readProvenance } from './creation.js';
+import { firstManagedSessionMayStart, managedRecoveryPath, readManagedRecovery, writeManagedRecovery } from './managed-recovery.js';
+import { StartupTelemetry } from './startup-telemetry.js';
+import { managedStartupPrompt, managedTaskPrompt, worklogRecordsPriorWork } from './startup-prompt.js';
+import { createLayoutControl } from './rooms-tasks/layout-control.js';
+import { TemporaryChatIdle } from './temp-idle.js';
+import { taskSupervisorMayRun, taskMemberRetirementProof } from './task-supervision.js';
 import { prepareManagedAgent, releaseManagedAgent } from './agent-ours/service.js';
 import { prepareManagedHarness } from './agent-ours/harness.js';
+import { prepareManagedCliLaunch } from './managed-cli.js';
 import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, realpathSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { randomUUID } from 'node:crypto';
 import { parse } from 'yaml';
 import { agentDir, stateRoot } from './paths.js';
-import { loadConfig, findRole, isolationContextFor, resolveMonitorConfig, resolvePermissions, } from './config.js';
+import { loadConfig, findRole, isolationContextFor, resolveSnapshotMonitor, resolvePermissions, } from './config.js';
 import { getAdapter } from './harness/registry.js';
 import { createMonitor, probeIdentityPresence, } from './monitor.js';
-import { DaemonGenerationObserver, RoleRecoveryController, probeDaemonGeneration, } from './daemon-recovery.js';
+import { DaemonGenerationObserver, RoleRecoveryController, probeDaemonGeneration, acquireSelectedDaemonHealth, } from './daemon-recovery.js';
 import { realExec } from './exec.js';
 import { resolveIsolation } from './isolation/policy.js';
+import { pinSubscriptionForLaunch } from './subscriptions/launch.js';
 import { selectIsolationBackend } from './isolation/registry.js';
 import { resourceArgs, cpuControllerDelegated } from './isolation/resources.js';
 import { resolveLaunchRuntime } from './isolation/runtime.js';
 import { controlRequest, RoleControlServer } from './session/control.js';
 import { ACP_CANCEL_DEADLINE_EXCEEDED, CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED, classifyShellStatus, } from './session/types.js';
+import { sessionBackendCapabilities } from './session/types.js';
+import { bindRoleReminders } from './reminders/runtime.js';
 import { effectiveModelForRole, modelRecoveryHeld, reconcileModelRecovery, recordModelFailure, classifyFailureText, } from './model-recovery.js';
 import { rotateWorklog } from './worklog.js';
 import { reconcilePermanentRoleIdentities } from './creation.js';
@@ -27,7 +38,7 @@ import { ScheduledLoopManager, } from './loops/manager.js';
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from './fleet-proxy.js';
 import { effectivePermissionMode } from './permissions.js';
 import { assertModelPinReachesChild, effectiveRoleModel, repinModelEnv } from './model-env.js';
-import { archiveTempState, markTempSupervisorActive, requestedTempStopReason, } from './temp-lifecycle.js';
+import { archiveTempState, markTempSupervisorActive, requestedTempStopReason, readTempSupervisor, } from './temp-lifecycle.js';
 import { FleetCommandAuditStore } from './fleet-command-audit.js';
 export const SUPERVISOR_RECYCLE_REQUIRED = 'OWNER_CHANNEL_SUPERVISOR_RECYCLE_REQUIRED';
 export class SupervisorRecycleRequiredError extends Error {
@@ -37,6 +48,7 @@ export class SupervisorRecycleRequiredError extends Error {
         this.name = 'SupervisorRecycleRequiredError';
     }
 }
+const defaultProbeGeneration = (env) => probeDaemonGeneration((url, init) => globalThis.fetch(url, init), env);
 const defaultDeps = () => ({
     prepareAgentOurs: prepareManagedAgent,
     releaseAgentOurs: releaseManagedAgent,
@@ -53,7 +65,7 @@ const defaultDeps = () => ({
     now: () => Date.now(),
     log: line => process.stderr.write(line + '\n'),
     fetch: (url, init) => globalThis.fetch(url, init),
-    probeGeneration: env => probeDaemonGeneration((url, init) => globalThis.fetch(url, init), env),
+    probeGeneration: defaultProbeGeneration,
     createMonitor: opts => createMonitor(opts),
     createOwnerChannel: opts => new OwnerChannel(opts),
     startAgentSession: (adapter, options) => adapter.start(options),
@@ -75,12 +87,16 @@ const defaultDeps = () => ({
 });
 const MONITOR_OWNER_FILE = '.monitor-owner';
 const OBSOLETE_OURS_AUTOSTART_ENV = 'OURS_AUTOSTART';
-function localFleetAuditor(stateDir, caller, log) {
+export function localFleetAuditor(stateDir, caller, log, session) {
+    const bindings = new Map();
     const store = new FleetCommandAuditStore(join(stateDir, '.fleet-command-audit.json'));
     return {
         async begin(requestId, argv) {
             let attempt = store.begin(requestId, caller, argv);
             if (attempt.invocation === 'sending') {
+                const binding = session.taskNoticeBinding?.();
+                if (binding)
+                    bindings.set(attempt.correlationId, binding);
                 log(`[${caller}] fleet proxy command ${attempt.correlationId} `
                     + `route=${attempt.classification.route} decision=${attempt.classification.decision}`);
                 attempt = store.invocation(attempt.correlationId, caller, 'delivered');
@@ -94,6 +110,19 @@ function localFleetAuditor(stateDir, caller, log) {
                 ...(input.resourceIds ? { resourceIds: input.resourceIds } : {}),
                 ...(input.presentations ? { presentations: input.presentations } : {}),
             });
+            const binding = bindings.get(attempt.correlationId);
+            if (binding && attempt.outcome?.class === 'success' && attempt.outcome.effect === 'completed') {
+                for (const p of attempt.outcome.presentations ?? [])
+                    if (p.kind === 'task' && p.operation === 'create') {
+                        try {
+                            session.recordTaskCreated?.(binding, { operationId: p.eventId, taskId: p.id, title: p.title ?? p.id, state: p.newState });
+                        }
+                        catch {
+                            log(`[${caller}] task-created conversation notice could not be persisted`);
+                        }
+                    }
+                bindings.delete(attempt.correlationId);
+            }
             if (attempt.outcome?.delivery === 'sending')
                 attempt = store.outcome(attempt.correlationId, caller, 'delivered');
             return attempt;
@@ -300,6 +329,11 @@ const carriedForward = (previous) => ({
     ...(previous.abruptTerminations ? { abruptTerminations: previous.abruptTerminations } : {}),
     ...(previous.supervisorStartedAt ? { supervisorStartedAt: previous.supervisorStartedAt } : {}),
 });
+function unrefTimer(fn, ms) {
+    const timer = setTimeout(fn, ms);
+    timer.unref?.();
+    return () => clearTimeout(timer);
+}
 /** Bounded exponential backoff for the nth consecutive immediate failure. */
 export function backoffFor(consecutiveFailures) {
     if (consecutiveFailures <= 0)
@@ -414,7 +448,7 @@ export function loadTempRole(name) {
     // Upgrade snapshots written before monitor.mode/interrupt existed. A snapshot
     // with no monitor block keeps the historical native/no-supervisor behavior.
     if (role.monitor)
-        role.monitor = resolveMonitorConfig(undefined, role.monitor);
+        role.monitor = resolveSnapshotMonitor(role.monitor);
     role.__temp = true;
     return role;
 }
@@ -448,6 +482,8 @@ export function isRecoverableTempStartupCancellation(temp, result) {
 /** One session lifecycle. `runSupervised` (or a one-shot caller) drives it. */
 export async function runOnce(name, opts = {}, partialDeps = {}) {
     const deps = { ...defaultDeps(), ...partialDeps };
+    const startupTelemetry = new StartupTelemetry(deps.now, line => deps.log(`[${name}] ${line}`));
+    startupTelemetry.mark('supervisor_started');
     const temp = opts.temp === true;
     const dir = agentDir(name, temp);
     const configPath = temp ? opts.configPath : resolveConfigPath(dir, opts.configPath);
@@ -486,14 +522,43 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         deps.log(`[${name}] worklog rotation deferred: concurrent modification detected`);
     else if (rotation.rotated)
         deps.log(`[${name}] worklog rotated: ${rotation.beforeBytes} -> ${rotation.afterBytes} bytes`);
+    const durableTask = Boolean(readTempSupervisor(dir)?.taskOwner);
+    const retainedManaged = durableTask || Boolean(deps.suspendOnStop && adapter.supportsResume);
     const sidFile = join(dir, '.session-id');
+    const backendSidFile = join(dir, role.session === 'codex-app-server' ? '.session-id' : '.acp-session-id');
+    let recovery = retainedManaged ? readManagedRecovery(dir) : undefined;
+    // Native Codex shares .session-id with the runner's pre-launch UUID, so file
+    // existence alone is not evidence that its first backend thread was created.
+    const firstSessionRetry = retainedManaged && existsSync(join(dir, '.booted'))
+        && (!existsSync(backendSidFile) || (role.session === 'codex-app-server' && recovery?.session === 'pending'))
+        && firstManagedSessionMayStart(dir);
+    if (retainedManaged && existsSync(join(dir, '.booted'))
+        && (!existsSync(sidFile) || !existsSync(backendSidFile)) && !firstSessionRetry)
+        throw Error('TASK_CONTEXT_RESUME_UNAVAILABLE');
     if (!existsSync(sidFile))
         writeFileSync(sidFile, randomUUID() + '\n');
     const sessionId = readFileSync(sidFile, 'utf8').trim();
     const bootedFile = join(dir, '.booted');
     const exitFile = join(dir, '.exit-status');
     const booted = existsSync(bootedFile);
-    const mode = booted && adapter.supportsResume ? 'resume' : 'fresh';
+    if (durableTask && !adapter.supportsResume)
+        throw Error('TASK_HARNESS_RESUME_UNSUPPORTED');
+    const mode = booted && adapter.supportsResume && !firstSessionRetry ? 'resume' : 'fresh';
+    const requireResume = retainedManaged && mode === 'resume';
+    if (retainedManaged && !recovery) {
+        // Older admitted sessions have no cursor. Continue once, without replaying
+        // their assignment; fresh sessions record intent before the first attempt.
+        recovery = { version: 1, session: booted ? 'established' : 'pending', readiness: booted,
+            initial: booted ? 'dispatching' : 'pending', active: booted };
+        writeManagedRecovery(dir, recovery);
+    }
+    const recoveryBefore = recovery ? { ...recovery } : undefined;
+    const saveRecovery = (update) => {
+        if (!recovery)
+            return;
+        recovery = { ...recovery, ...update };
+        writeManagedRecovery(dir, recovery);
+    };
     // Stamp EVERY attempt, not just the first. `.booted` used to be written only
     // on the fresh path, so after a restart — including one the supervisor never
     // saw, like an OOM-kill — its mtime still read the original boot and any
@@ -502,10 +567,22 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     writeFileSync(bootedFile, `${new Date(deps.now()).toISOString()} ${mode}\n`);
     const runCwd = role.cwd && existsSync(role.cwd) ? role.cwd : dir;
     role = { ...role, monitor: { ...role.monitor, mode: 'fleet' } };
-    const prep = await adapter.prepareSession(role, { stateDir: dir, runCwd });
+    // Native policy for Fleet commands run from the harness command sandbox. This
+    // is the same step for configured, spawned and task-room agents alike.
+    const prep = prepareManagedCliLaunch(role, {
+        // A temporary agent has no config path threaded through its detached
+        // supervisor; spawn records the one it was created from beside its snapshot.
+        stateDir: dir, runCwd, configPath: configPath ?? resolveConfigPath(dir), temp,
+        prep: await adapter.prepareSession(role, { stateDir: dir, runCwd }), log: deps.log,
+    });
     const sessionBackend = role.session ?? 'acp';
     const sessionLabel = sessionBackend === 'acp' ? 'ACP' : 'Codex app-server';
     let launch = adapter.agentSession.prepareLaunch(role, prep);
+    // Resolve the fleet-wide active subscription profile once, now: a later switch
+    // never changes this session (the operator restarts agents to move them).
+    const subscription = pinSubscriptionForLaunch(role, dir);
+    if (subscription?.pin.home)
+        deps.log(`[${name}] subscription: ${subscription.pin.provider} profile ${subscription.pin.profileId}`);
     // Preserve the role's existing isolation policy.
     let wrappedArgv = launch.argv;
     if (role.isolation) {
@@ -516,6 +593,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         launch = { ...launch, argv: runtime.argv };
         const ctx = {
             ...isolationContextFor(role), stateDir: dir, runCwd,
+            subscriptionHome: subscription?.writablePath,
             runtimeReadPaths: [...runtime.readPaths, ...resolveLaunchRuntime([process.execPath, fileURLToPath(new URL('./agent-ours/bridge.js', import.meta.url))]).readPaths],
         };
         const policy = resolveIsolation(role.isolation, ctx);
@@ -538,9 +616,16 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         if (rprefix.length)
             wrappedArgv = [...rprefix, ...wrappedArgv];
     }
+    startupTelemetry.mark('identity_prepare_started');
     const managedService = await deps.prepareAgentOurs(role, dir, opts.identityLifetime ? opts.identityLifetime === 'temporary' : temp);
+    startupTelemetry.mark('identity_ready');
+    let layoutRetiring = false;
+    // Self-reminders live and die with this attempt's runtime binding: every exit
+    // path below stops the dispatcher before that binding is released.
+    let reminderManager;
+    let selectedHealth;
     try {
-        const managedHarness = prepareManagedHarness(role, dir, runCwd, managedService.descriptor, harnessChildEnv(role, launch.env, dir));
+        const managedHarness = prepareManagedHarness(role, dir, runCwd, managedService.descriptor, { ...harnessChildEnv(role, launch.env, dir), ...subscription?.env });
         // Start-stagger: space this launch at least start_stagger_ms after the previous
         // agent launch across the whole host, so a burst of boots (systemd starts every
         // user unit concurrently on boot; `ours-fleet up`/restart-all bulk-start) does not
@@ -556,10 +641,9 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             }
         }
         // Prime the supervisor mail monitor's notification cursor at the
-        // stream tip BEFORE the session launches so no arrival is missed during boot
-        // (backlog before the tip is the SessionStart hook's job). Native-mode roles
-        // leave wake ownership to the harness. Temp snapshots predating `monitor:` are
-        // treated as native (monitor may be undefined on an old role.yaml).
+        // stream tip BEFORE the session launches so no arrival is missed during boot.
+        // Monitor.run checks the body-free initial unread summary after readiness;
+        // managed native hooks do not own backlog delivery.
         let sessionHandle;
         let modelRecovery;
         const resolvedMonitorDeps = monitorDeps(deps, role.env);
@@ -587,8 +671,15 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             name, identity: role.identity, agentDir: dir, cfg: role.monitor,
             deps: resolvedMonitorDeps,
         }) : null;
+        // Injected legacy probes keep their test/embedding contract. Production uses
+        // one retained owner for generation and identity health in this process.
+        const retainHealth = deps.probeGeneration === defaultProbeGeneration
+            && !deps.identityProbeDeps ? acquireSelectedDaemonHealth : undefined;
+        selectedHealth = retainHealth?.(resolvedMonitorDeps.env);
         const daemonObserver = new DaemonGenerationObserver();
-        const initialDaemon = daemonObserver.observe(await deps.probeGeneration(resolvedMonitorDeps.env));
+        const initialDaemon = daemonObserver.observe(selectedHealth
+            ? (await selectedHealth.sample()).generation
+            : await deps.probeGeneration(resolvedMonitorDeps.env));
         let sessionStartedWithoutDaemonBaseline = initialDaemon.kind !== 'baseline';
         if (monitor)
             await monitor.prime({ resetCursor: resetMonitorCursor });
@@ -599,6 +690,20 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         let unsubscribeRecovery;
         let monitorLoop;
         let sessionStartupComplete = false;
+        let startupRecoveryAllowed = false;
+        let successfulTurnObserved = false;
+        let monitorMayStart = false;
+        let monitorStarted = false;
+        const startMonitorAfterStartup = () => {
+            if (!monitorStarted && monitorMayStart && sessionStartupComplete && !deps.shouldStop?.()) {
+                monitorStarted = true;
+                monitorLoop = monitor?.run(pid);
+            }
+            // Reminder wakes follow the same gate as mail wakes: never into a role
+            // whose protected startup turn has not succeeded.
+            if (monitorMayStart && sessionStartupComplete && !deps.shouldStop?.())
+                reminderManager?.start();
+        };
         let sessionClosed = false;
         let ownerChannel;
         let ownerBinder;
@@ -617,23 +722,66 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             if (perms.unattended === 'deny')
                 deps.log(`[${name}] permission policy: unattended=deny — with no console attached, ` +
                     `permission requests are automatically denied once each (reject_once) and the turn continues`);
+            startupTelemetry.mark('harness_starting');
             agentSession = await managedService.runtime.startHarness(() => deps.startAgentSession(adapter.agentSession, {
                 managedOurs: managedHarness.ours,
                 role, prep,
                 launch: { ...launch, argv: wrappedArgv, env: managedHarness.env },
-                cwd: runCwd, stateDir: dir, mode, permissions: perms,
+                cwd: runCwd, stateDir: dir, mode, requireResume, deferRecoveredPrompts: true, permissions: perms,
                 permissionMode: effectivePermissionMode(role), log: deps.log,
             }));
+            managedService.setFileDelivery?.(agentSession.sendFileToChat?.bind(agentSession));
+            startupTelemetry.mark('harness_ready');
+            saveRecovery({ session: 'established' });
             pid = agentSession.pid;
             arbiter = new RoleTurnArbiter(agentSession);
             sessionHandle = arbiter;
-            unsubscribeRecovery = agentSession.subscribe(event => {
+            reminderManager = bindRoleReminders({
+                role: name, stateDir: dir, runtime: managedService.setReminders ? managedService.runtime.snapshot : {},
+                promptInput: sessionBackendCapabilities(sessionBackend, role.harness).promptInput,
+                admitter: arbiter, service: managedService,
+                deps: {
+                    now: deps.now, log: deps.log,
+                    setTimer: (callback, ms) => setTimeout(callback, ms),
+                    clearTimer: timer => clearTimeout(timer),
+                },
+            });
+            const unsubscribeFailure = agentSession.subscribe(event => {
                 if (event.kind !== 'error' || !event.text || event.origin?.kind === 'stall-watchdog')
                     return;
                 const evidence = classifyFailureText(event.text, sessionBackend, new Date(deps.now()).toISOString());
                 if (evidence)
                     resolvedMonitorDeps.onFailureEvidence?.(evidence);
             });
+            const unsubscribeTelemetry = agentSession.subscribeConversation?.(event => startupTelemetry.observe(event));
+            const unsubscribeStartup = agentSession.subscribeConversation?.(event => {
+                if (event.kind !== 'turn.completed' || !('outcome' in event.payload) || event.payload.outcome !== 'completed')
+                    return;
+                successfulTurnObserved = true;
+                if (startupRecoveryAllowed) {
+                    sessionStartupComplete = true;
+                    startMonitorAfterStartup();
+                }
+            });
+            const activePrompts = new Set();
+            const unsubscribeContinuity = agentSession.subscribeConversation?.(event => {
+                if (!recovery?.readiness)
+                    return;
+                if (event.kind === 'prompt.started') {
+                    if (event.promptId)
+                        activePrompts.add(event.promptId);
+                    saveRecovery({ active: true });
+                }
+                else if (event.kind === 'turn.completed' && 'outcome' in event.payload) {
+                    if (event.promptId)
+                        activePrompts.delete(event.promptId);
+                    // A shutdown/failed turn needs continuation; a successful terminal turn
+                    // proves it may stay idle. Never store prompt bodies in this cursor.
+                    if (event.payload.outcome === 'completed')
+                        saveRecovery({ active: activePrompts.size > 0 });
+                }
+            });
+            unsubscribeRecovery = () => { unsubscribeFailure(); unsubscribeStartup?.(); unsubscribeTelemetry?.(); unsubscribeContinuity?.(); };
             if (role.owner_channel) {
                 try {
                     ownerBinder = await deps.acquireOwnerBinder(dir, name, role.owner_channel.identity);
@@ -670,11 +818,18 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                         ...(configPath ? { configPath } : {}),
                     });
                 control = deps.createControlServer(dir, arbiter, deps.log);
+                control.setCorrespondence?.({ contacts: () => managedService.runtime.readContacts(), history: query => managedService.runtime.readHistory(query) });
                 control.setFleetAuditor(ownerChannel ? {
                     begin: (requestId, argv) => ownerChannel.beginFleetCommandAudit(requestId, argv),
                     finish: input => ownerChannel.finishFleetCommandAudit(input),
                     present: presentations => ownerChannel.notifyFleetLifecycle(presentations),
-                } : localFleetAuditor(dir, name, deps.log));
+                } : localFleetAuditor(dir, name, deps.log, agentSession));
+                control.setLayoutControl?.(createLayoutControl({
+                    agent: name, temporary: temp, standalone: !role.roomMemberStartup,
+                    runtime: managedService.runtime, session: arbiter,
+                    stopping: () => Boolean(deps.shouldStop?.()),
+                    retire: async () => { layoutRetiring = true; await arbiter.close(); },
+                }));
                 await control.start();
             }
             catch (error) {
@@ -700,15 +855,18 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     }
                     return event;
                 });
+            // Recovered prompts may run the managed Fleet CLI immediately. Start them
+            // only now that the control socket, audit and spawn handlers are live, and
+            // never for a role being stopped: they stay durable for its next start.
+            if (!deps.shouldStop?.())
+                agentSession.activateRecoveredPrompts?.();
             resolvedMonitorDeps.delivery = {
                 // A wake is only delivered when its turn TERMINATES successfully. A
                 // refusal or a cancellation reached the agent and was not acted on, so
                 // the monitor must keep its cursor and try again.
                 submit: async (text, options) => {
-                    // Cancelling the runner-owned startup prompt makes startup look failed
-                    // and closes the session before the wake turn can run. During startup,
-                    // steer into the live turn instead; after it completes, honor the
-                    // configured interrupt policy normally.
+                    // Delivery starts after the protected startup turn succeeds. Honor the
+                    // configured interrupt policy for subsequent turns.
                     const policy = options?.interrupt;
                     const interrupt = policy === true && sessionStartupComplete;
                     const promptOptions = {
@@ -716,8 +874,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                         ...(interrupt ? { interruptSource: 'fleet-monitor' } : {}),
                         origin: { kind: 'fleet-monitor' },
                     };
-                    // Startup is already a protected boundary: as with immediate mode,
-                    // steer rather than waiting on/cancelling the runner-owned first turn.
+                    // after_tool waits for a safe boundary in subsequent active turns.
                     const result = policy === 'after_tool' && sessionStartupComplete
                         ? await arbiter.submitPromptAfterTool(text, promptOptions)
                         : await arbiter.submitPrompt(text, promptOptions);
@@ -746,17 +903,23 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     };
                 },
             };
-            const firstPrompt = mode === 'fresh'
-                ? `Read and follow ${join(dir, 'briefing.md')} now.`
-                : `Your supervisor has verified your assigned identity and room readiness. Read ${join(dir, 'WORKLOG.md')} and ${join(dir, 'briefing.md')}, then continue using the available ours tools.`;
+            // The worklog is continuity input only when it records work. It outlives `.booted`,
+            // which a rotation to a fresh conversation clears, so the log itself is the evidence.
+            const priorWork = worklogRecordsPriorWork(dir);
+            const firstPrompt = managedStartupPrompt(dir, mode, priorWork);
             // Wait for the first turn's TERMINAL result. An agent that accepts the
             // startup prompt and then refuses it has not started; logging the role as
-            // up would hide a role that never read its briefing.
-            const starting = arbiter.submitPrompt(firstPrompt, { origin: { kind: 'startup' } });
-            // Monitoring starts immediately. The delivery adapter above downgrades
-            // interruption to steering until this startup turn reaches a terminal
-            // success, so there is neither a deaf gap nor a boot-cancellation loop.
-            monitorLoop = monitor?.run(pid);
+            // up would hide a role that never completed its readiness turn.
+            const retainedResume = retainedManaged && mode === 'resume' && recoveryBefore?.readiness === true;
+            if (!retainedResume)
+                startupTelemetry.mark('startup_submitted');
+            // The backend already verified the saved conversation. Resuming a managed
+            // member admits new wakes/console input without replaying startup or work.
+            const starting = retainedResume
+                ? Promise.resolve({ accepted: false, succeeded: true, outcome: 'completed', detail: 'retained backend resumed; no readiness prompt submitted' })
+                : arbiter.submitPrompt(firstPrompt, { origin: { kind: 'startup' } });
+            // Keep the early cursor baseline; do not deliver wakes into the protected
+            // first turn. Steering can pre-empt startup just like cancellation.
             // Owner traffic and agent replies must be observed during a long first
             // turn. Ordinary owner input steers until startup has proved successful.
             if (ownerChannel) {
@@ -778,6 +941,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 }
             }
             const started = await starting;
+            startupTelemetry.finish();
             // A temporary role's first turn can be the active turn when an ours wake
             // needs immediate attention. A typed console/monitor cancellation ends
             // only that turn: the already-live agent session and any queued wake remain
@@ -816,7 +980,38 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             else if (interruptedForWake)
                 deps.log(`[${name}] ${sessionLabel} startup prompt cancelled by ${started.cancellationSource}; `
                     + 'keeping temporary supervisor alive');
-            sessionStartupComplete = true;
+            startupRecoveryAllowed = interruptedForWake;
+            sessionStartupComplete = started.succeeded || (interruptedForWake && successfulTurnObserved);
+            if (started.succeeded && !retainedResume)
+                startupTelemetry.mark('readiness_turn_completed');
+            if (started.succeeded)
+                saveRecovery({ readiness: true });
+            // Readiness is now complete. Configured work (or retained continuity) is
+            // admitted as a distinct turn; its terminal result must not block console
+            // readiness, mail delivery, or supervisor liveness. Empty fresh agents wait
+            // for authenticated console input or the monitor's unread/arrival wake.
+            const configuredWork = Boolean(role.mission?.trim() || role.roomMemberStartup?.task?.trim() || role.briefing_file?.trim());
+            const initialPending = retainedManaged && recoveryBefore?.initial === 'pending';
+            const interruptedWork = retainedManaged && (recoveryBefore?.active || recoveryBefore?.initial === 'dispatching');
+            const workPrompt = retainedManaged
+                ? initialPending && configuredWork ? managedTaskPrompt(dir, 'fresh', false)
+                    : interruptedWork ? 'Fleet supervisor restarted. Continue pending work in the restored conversation; do not redo completed steps. '
+                        + (recoveryBefore?.initial === 'dispatching' ? `If you have not yet received your assignment, read ${join(dir, 'briefing.md')} once before acting. ` : '')
+                        + 'Read the continuation log only as needed to recover your next action. If no work remains, end this turn and wait for a concrete task or supervisor wake.' : undefined
+                : configuredWork || booted || priorWork ? managedTaskPrompt(dir, mode, priorWork) : undefined;
+            if (started.succeeded && !deps.shouldStop?.() && workPrompt) {
+                saveRecovery({ initial: 'dispatching', active: true });
+                const queued = await arbiter.queuePrompt(workPrompt, {
+                    origin: { kind: 'startup' },
+                });
+                void queued.completion.then(result => {
+                    if (result.succeeded)
+                        saveRecovery({ initial: 'completed', active: activePrompts.size > 0 });
+                    deps.log(`[${name}] configured task turn ${result.outcome}`);
+                }, () => deps.log(`[${name}] configured task turn failed`));
+            }
+            else if (started.succeeded && initialPending && !configuredWork)
+                saveRecovery({ initial: 'completed' });
             reloadLoopConfig = async () => {
                 const nextRole = findRole(loadConfig(configPath), name);
                 const definitions = nextRole.loops ?? [];
@@ -873,9 +1068,12 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             }
         }
         deps.log(`[${name}] up; pid=${pid} cwd=${runCwd} harness=${role.harness} session=${sessionBackend} mode=${mode}`);
-        // The monitor loop lives exactly as long as the session: it starts once the
-        // pane pid is known and is stopped when that pid dies (task dies with runner).
-        monitorLoop ??= monitor?.run(pid);
+        const healthyAt = deps.now();
+        opts.onHealthy?.();
+        // Keep arrivals behind the early prime() cursor; never re-prime at startup.
+        // Recoverable cancellation preserves the supervisor, not monitor readiness.
+        monitorMayStart = true;
+        startMonitorAfterStartup();
         recoveryController = new RoleRecoveryController({
             role: name, identity: role.identity, stateDir: dir, now: deps.now, sleep: deps.sleep,
             log: deps.log,
@@ -902,6 +1100,14 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 }
             },
         });
+        let chatIdle;
+        try {
+            if (temp && !role.roomMemberStartup && !readTempSupervisor(dir)?.taskOwner)
+                chatIdle = new TemporaryChatIdle(dir, deps.now());
+        }
+        catch {
+            deps.log(`[${name}] automatic idle closure disabled: activity state is unreadable`);
+        }
         const start = deps.now();
         let nextLoopReloadAt = deps.now() + 30_000;
         let nextIdentityPollAt = deps.now();
@@ -916,7 +1122,9 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             const now = deps.now();
             if (now >= nextDaemonProbeAt) {
                 nextDaemonProbeAt = now + 2_000;
-                const observation = daemonObserver.observe(await deps.probeGeneration(resolvedMonitorDeps.env));
+                const observation = daemonObserver.observe(selectedHealth
+                    ? (await selectedHealth.sample()).generation
+                    : await deps.probeGeneration(resolvedMonitorDeps.env));
                 if (observation.kind === 'lost')
                     recoveryController.noteLoss(observation.reason);
                 if (observation.kind === 'changed' || observation.kind === 'available'
@@ -925,7 +1133,21 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     void recoveryController.recover(observation.generation).catch(error => deps.log(`[${name}] daemon recovery controller failed: ${error?.name ?? 'Error'}`));
                 }
             }
+            let idleExpired = false;
+            try {
+                idleExpired = chatIdle?.observe(sessionHandle.snapshot(), sessionHandle.conversationSnapshot?.().queueDepth ?? -1, now) ?? false;
+            }
+            catch {
+                chatIdle = undefined;
+                deps.log(`[${name}] automatic idle closure disabled: activity state could not be saved`);
+            }
+            if (idleExpired && await arbiter.retireIfIdle((snapshot, queue) => chatIdle.observe(snapshot, queue, deps.now()))) {
+                retirementReason = 'idle-timeout';
+                sessionClosed = true;
+                break;
+            }
             if (deps.shouldStop?.()) {
+                reminderManager?.stop();
                 if (temp) {
                     retirementReason = requestedTempStopReason(dir) ?? 'supervisor-signal';
                     deps.log(`[${name}] temporary supervisor retirement requested (${retirementReason})`);
@@ -936,21 +1158,25 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             }
             if (temp && now >= nextIdentityPollAt) {
                 nextIdentityPollAt = now + TEMP_IDENTITY_POLL_MS;
-                const presence = await probeIdentityPresence(role.identity, deps.fetch, resolvedMonitorDeps.env);
+                const presence = selectedHealth
+                    ? selectedHealth.presence(role.identity, await selectedHealth.sample())
+                    : await probeIdentityPresence(role.identity, deps.fetch, resolvedMonitorDeps.env, deps.identityProbeDeps);
+                const identityObservedAt = deps.now();
                 if (presence.state === 'present') {
                     identityObserved = true;
                     identityAbsentSince = undefined;
                 }
                 else if (presence.state === 'absent' && identityObserved) {
-                    identityAbsentSince ??= now;
+                    identityAbsentSince ??= identityObservedAt;
                     // Require a continuous, time-bounded run of authoritative absence.
                     // The first positive observation is the readiness gate: cold harness
                     // starts may spend minutes loading the harness and briefing before the
                     // agent creates/binds its identity, and absence before then is not a
                     // close event. After readiness, debounce a real disappearance.
-                    if (now - identityAbsentSince >= TEMP_IDENTITY_CLOSE_DEBOUNCE_MS) {
+                    if (identityObservedAt - identityAbsentSince >= TEMP_IDENTITY_CLOSE_DEBOUNCE_MS) {
                         retirementReason = 'identity-closed';
                         deps.log(`[${name}] temporary identity '${role.identity}' closed; retiring session and supervisor`);
+                        reminderManager?.stop();
                         await sessionHandle.close();
                         sessionClosed = true;
                         break;
@@ -973,6 +1199,8 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 }
             }
         }
+        monitorMayStart = false;
+        reminderManager?.stop();
         if (loopManager) {
             control?.setLoopManager(undefined);
             await loopManager.stop();
@@ -1018,11 +1246,12 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         const rotate = (why) => {
             writeFileSync(sidFile, randomUUID() + '\n');
             rmSync(bootedFile, { force: true });
+            rmSync(managedRecoveryPath(dir), { force: true });
             rotated = true;
             deps.log(`[${name}] ${why} -> rotated session-id; next start is FRESH`);
         };
-        if (!temp && deps.shouldStop?.())
-            deps.log(`[${name}] supervisor stop requested -> next start RESUMES context`);
+        if (readTempSupervisor(dir)?.taskOwner || ((!temp || deps.suspendOnStop) && deps.shouldStop?.()))
+            deps.log(`[${name}] supervisor/context retained -> next start RESUMES context`);
         else if (exitRecord.detail.includes(ACP_CANCEL_DEADLINE_EXCEEDED)
             || exitRecord.detail.includes(CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED))
             // This is a deliberate adapter reclamation, not evidence that resume state
@@ -1053,11 +1282,15 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             throw new SupervisorRecycleRequiredError();
         return {
             elapsedSecs: elapsed, exit: exitRecord, rotated, mode, modelRecovery,
-            ...(retirementReason ? { retirementReason } : {}),
+            healthySecs: (deps.now() - healthyAt) / 1000,
+            ...(layoutRetiring ? { retirementReason: 'operator-stop' } : retirementReason ? { retirementReason } : {}),
         };
     }
     finally {
-        await managedService.close(false);
+        selectedHealth?.release();
+        reminderManager?.stop();
+        managedService.setReminders?.(undefined);
+        await managedService.close(layoutRetiring);
     }
 }
 /**
@@ -1072,11 +1305,13 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
  */
 export async function runSupervised(name, opts = {}, partialDeps = {}, attempt = runOnce) {
     const deps = { ...defaultDeps(), ...partialDeps };
-    const dir = agentDir(name);
+    const taskMember = opts.temp === true;
+    const dir = agentDir(name, taskMember);
     mkdirSync(dir, { recursive: true });
     let stopping = false;
     const requestStop = () => { stopping = true; };
-    const shouldStop = () => stopping || (partialDeps.shouldStop?.() ?? false);
+    const shouldStop = () => stopping || (partialDeps.shouldStop?.() ?? false)
+        || (taskMember && requestedTempStopReason(dir) === 'operator-stop');
     deps.shouldStop = shouldStop;
     const stamp = () => new Date(deps.now()).toISOString();
     // Record how the PREVIOUS supervisor process ended before doing anything
@@ -1104,10 +1339,12 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
     process.on('SIGINT', requestStop);
     try {
         while (!shouldStop()) {
+            if (taskMember && !taskSupervisorMayRun(name))
+                break;
             let ledger = readRestartLedger(dir);
             try {
                 const configPath = resolveConfigPath(dir, opts.configPath);
-                const role = findRole(loadConfig(configPath), name);
+                const role = taskMember ? loadTempRole(name) : findRole(loadConfig(configPath), name);
                 reconcileModelRecovery(dir, role, stamp());
                 if (modelRecoveryHeld(dir)) {
                     await deps.sleep(HELD_DOWN_POLL_MS);
@@ -1123,20 +1360,74 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
                 await deps.sleep(HELD_DOWN_POLL_MS);
                 continue;
             }
+            if (attempt === runOnce && taskMember) {
+                // Boot-time daemon unavailability must not consume the harness crash budget.
+                const { waitForRoleDaemon } = await import('./startup-readiness.js');
+                await waitForRoleDaemon(name, undefined, {}, true);
+            }
+            if (taskMember && (shouldStop() || !taskSupervisorMayRun(name)))
+                break;
+            if (attempt === runOnce && taskMember) {
+                // Cowork can come up after the daemon on boot. Wait read-only so a
+                // gateway still starting its upstream does not spend the failure budget.
+                const { waitForTaskRoomManagement } = await import('./startup-readiness.js');
+                await waitForTaskRoomManagement(name, { shouldStop });
+            }
+            if (taskMember && (shouldStop() || !taskSupervisorMayRun(name)))
+                break;
+            const fastFailSecs = taskMember ? tempFastFailSecs(name) : fastFailSecsFor(name, opts.configPath);
+            // The fast-fail boundary starts a recovery episode; it must not also be
+            // the boundary that declares recovery successful. Otherwise alternating
+            // 19s and 20s deaths erase one another forever. Require the configured
+            // number of fast-fail windows to survive before closing an active streak.
+            // This hysteresis stays adapter-relative (100s for the current 20s/5-attempt
+            // policy) and still lets a genuinely sustained session reset the breaker.
+            const stableRecoverySecs = fastFailSecs * RESTART_FAIL_THRESHOLD;
+            // A session that stays up that long has recovered, even if it never
+            // returns: a host reset or OOM-kill ends it without reaching the
+            // post-attempt reset below, and a stale streak would then hold the role
+            // down after a few transient boot failures spread over days.
+            const streakAtStart = ledger;
+            const clearSustainedStreak = () => {
+                if (streakAtStart.consecutiveImmediateFailures === 0)
+                    return;
+                const current = readRestartLedger(dir);
+                // Never overwrite an operator reset, an open circuit or a successor's state.
+                if (current.circuit === 'open' || current.updatedAt !== streakAtStart.updatedAt
+                    || current.consecutiveImmediateFailures !== streakAtStart.consecutiveImmediateFailures
+                    || readRunMarker(dir)?.startedAt !== startedAt)
+                    return;
+                writeRestartLedger(dir, {
+                    ...emptyLedger(),
+                    ...carriedForward(current),
+                    lastReason: `sustained healthy session (${stableRecoverySecs}s)`,
+                    updatedAt: stamp(),
+                });
+                deps.log(`[${name}] healthy for ${stableRecoverySecs}s; cleared `
+                    + `${current.consecutiveImmediateFailures} earlier immediate failure(s)`);
+            };
+            let cancelStabilityTimer;
+            const onHealthy = () => {
+                if (cancelStabilityTimer || streakAtStart.consecutiveImmediateFailures === 0)
+                    return;
+                cancelStabilityTimer = (deps.setTimer ?? unrefTimer)(clearSustainedStreak, stableRecoverySecs * 1000);
+            };
             let result;
             try {
                 // Service-manager boot and automatic retry bypass the operator-facing
                 // up/restart commands. Reconcile again immediately before every real
                 // permanent harness attempt; the operation is idempotent and releases its
                 // provisioning lease before the agent or owner channel binds.
-                if (attempt === runOnce) {
+                if (attempt === runOnce && !taskMember) {
                     const configPath = resolveConfigPath(dir, opts.configPath);
                     const role = findRole(loadConfig(configPath), name);
                     await reconcilePermanentRoleIdentities(role, undefined, deps.log);
                 }
-                result = await attempt(name, { configPath: opts.configPath, allowResumeRotation: !ledger.resumeDiscarded }, deps);
+                result = await attempt(name, { configPath: opts.configPath, ...(taskMember ? { temp: true } : {}),
+                    allowResumeRotation: taskMember ? false : !ledger.resumeDiscarded, onHealthy }, deps);
             }
             catch (e) {
+                cancelStabilityTimer?.();
                 if (e instanceof SupervisorRecycleRequiredError) {
                     writeRestartLedger(dir, {
                         ...ledger,
@@ -1156,8 +1447,14 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
                     mode: 'fresh',
                 };
             }
-            if (stopping)
+            cancelStabilityTimer?.();
+            if (stopping || (taskMember && (shouldStop() || result.retirementReason))) {
+                // An orderly stop of a session that was healthy long enough is a
+                // recovery too; only the timer's race with the stop is decided here.
+                if ((result.healthySecs ?? 0) >= stableRecoverySecs)
+                    clearSustainedStreak();
                 break;
+            }
             // Re-read: the attempt itself may have taken minutes, and an operator may
             // have reset the ledger meanwhile.
             ledger = readRestartLedger(dir);
@@ -1174,14 +1471,6 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
                 await deps.sleep(HELD_DOWN_POLL_MS);
                 continue;
             }
-            const fastFailSecs = fastFailSecsFor(name, opts.configPath);
-            // The fast-fail boundary starts a recovery episode; it must not also be
-            // the boundary that declares recovery successful. Otherwise alternating
-            // 19s and 20s deaths erase one another forever. Require the configured
-            // number of fast-fail windows to survive before closing an active streak.
-            // This hysteresis stays adapter-relative (100s for the current 20s/5-attempt
-            // policy) and still lets a genuinely sustained session reset the breaker.
-            const stableRecoverySecs = fastFailSecs * RESTART_FAIL_THRESHOLD;
             const recoveryFailed = result.elapsedSecs < fastFailSecs
                 || (ledger.consecutiveImmediateFailures > 0 && result.elapsedSecs < stableRecoverySecs);
             if (!recoveryFailed) {
@@ -1211,7 +1500,7 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
                 next.nextDelayMs = 0;
                 writeRestartLedger(dir, next);
                 deps.log(`[${name}] HELD DOWN after ${failures} immediate failures at ${next.openedAt} — ` +
-                    `${reason}; the agent will not be restarted until: ours-fleet restart ${name}`);
+                    `${reason}; recover with: ${taskMember ? `ours-fleet task recover-members ${readTempSupervisor(dir).taskOwner.taskId}` : `ours-fleet restart ${name}`}`);
                 continue;
             }
             writeRestartLedger(dir, next);
@@ -1226,7 +1515,7 @@ export async function runSupervised(name, opts = {}, partialDeps = {}, attempt =
         process.off('SIGINT', requestStop);
         // An orderly shutdown clears the marker; an unhandled signal or OOM-kill
         // leaves it so the successor can identify an abrupt termination.
-        if (shouldStop())
+        if (!taskMember && shouldStop())
             await deps.releaseAgentOurs(findRole(loadConfig(opts.configPath), name));
         releaseSupervisorRun(dir);
     }
@@ -1245,9 +1534,67 @@ function fastFailSecsFor(name, configPath) {
         return 20;
     }
 }
+function tempFastFailSecs(name) {
+    try {
+        return getAdapter(loadTempRole(name).harness).exitPolicy.fastFailSecs;
+    }
+    catch {
+        return 20;
+    }
+}
 /** Temp-agent entrypoint: run once, journal why it ended, then archive its evidence. */
+/** The parent uses the same adapter-relative sustained-uptime reset boundary. */
+export function stableSupervisorWindow(name, temp, configPath) {
+    try {
+        const role = temp ? loadTempRole(name) : findRole(loadConfig(configPath), name);
+        return getAdapter(role.harness).exitPolicy.fastFailSecs * RESTART_FAIL_THRESHOLD;
+    }
+    catch {
+        return 20 * RESTART_FAIL_THRESHOLD;
+    }
+}
 export async function runTemp(name, deps = {}, attempt = runOnce) {
     const dir = agentDir(name, true);
+    const metadata = readTempSupervisor(dir);
+    // Non-resumable standalone temporaries retain their prior finite lifecycle:
+    // a parent stop retires them rather than promising retained conversation.
+    if (!metadata?.taskOwner && deps.suspendOnStop && !getAdapter(loadTempRole(name).harness).supportsResume)
+        deps = { ...deps, suspendOnStop: false };
+    if (!metadata?.taskOwner) {
+        const role = loadTempRole(name);
+        const provenance = readProvenance(dir);
+        if (role.roomMemberStartup?.task_id
+            || (name.startsWith('layout-') && provenance?.creationActionId?.startsWith('task-')))
+            throw Error('TASK_SUPERVISOR_OWNER_MISSING');
+    }
+    if (metadata?.taskOwner) {
+        // Serialize the entire process lifetime before metadata/session writes.
+        const lease = await acquireOwnerBinderLease(join(dir, '.task-supervisor'), 'task-supervisor', name);
+        let ownershipVerified = false;
+        try {
+            const mayRun = taskSupervisorMayRun(name);
+            ownershipVerified = true;
+            if (!mayRun)
+                return;
+            await markTempSupervisorActive(dir);
+            await runSupervised(name, { temp: true }, deps, attempt);
+        }
+        finally {
+            try {
+                if (ownershipVerified && requestedTempStopReason(dir)) {
+                    // Parent shutdown suspends; an explicit stop retires the exact saved
+                    // owner even when no harness attempt ran (for example held circuits).
+                    await (deps.releaseAgentOurs ?? releaseManagedAgent)(loadTempRole(name), taskMemberRetirementProof(name));
+                    const archived = archiveTempState(name, 'operator-stop', 'retired', 'explicit task member retirement');
+                    deps.log?.(`[${name}] task member retired: operator-stop${archived ? `; evidence archived at ${archived}` : ''}`);
+                }
+            }
+            finally {
+                lease.release();
+            }
+        }
+        return;
+    }
     await markTempSupervisorActive(dir);
     let signal;
     const onTerm = () => { signal = 'SIGTERM'; };
@@ -1274,7 +1621,8 @@ export async function runTemp(name, deps = {}, attempt = runOnce) {
         process.off('SIGTERM', onTerm);
         process.off('SIGINT', onInt);
         // A recycle replaces the supervisor process, not the logical temporary agent.
-        if (!(failure instanceof SupervisorRecycleRequiredError) || signal || deps.shouldStop?.()) {
+        if (!((signal || deps.shouldStop?.()) && deps.suspendOnStop && !requestedTempStopReason(dir))
+            && (!(failure instanceof SupervisorRecycleRequiredError) || signal || deps.shouldStop?.())) {
             const requested = requestedTempStopReason(dir);
             const reason = requested
                 ?? result?.retirementReason