@ours.network/fleet 2.1.1 → 2.2.0

package/README.md

@@ -100,7 +100,8 @@ The maintained Codex and Claude ACP adapters remain bundled optional dependencie
 and are resolved internally; users do not install adapter commands or add them to
 `PATH`. Explicit `session_options.codex_app_server.command` and
 `session_options.acp.command` overrides remain available. ours-fleet and its
-maintained adapters require Node 22 or newer.
+maintained adapters require a patched Node.js 22.23.4+, 24.22.1+ or 26.12.1+
+release (see [Security version requirements](#security-version-requirements)).
 
 Each OS user manages their own fleet — to host roles under a sandboxed account,
 become that account and repeat.
@@ -1737,7 +1738,7 @@ These package checks do not replace native Fleet/harness or platform acceptance.
 
 ### Build with selected SDK and CLI archives
 
-Run in the build container with Node 22+, npm and tar available:
+Run in the build container with a patched Node.js (22.23.4+, 24.22.1+ or 26.12.1+), npm and tar available:
 
 ```sh
 node scripts/build-selected.mjs --sdk /artifacts/ours.network-sdk-3.7.2.tgz --cli /artifacts/ours.network-cli-2.7.2.tgz --out-dir /artifacts/consumer
@@ -1971,3 +1972,41 @@ existing role/default configuration when applying this change. Meaningful agent
 commentary, attention requests and final answers continue to be delivered.
 The app associates activity with the channel's bound CID, never a display name.
 It shows unavailable status when the directory observation disconnects.
+
+## Security version requirements
+
+Ours refuses to run on Node.js or cloudflared releases with known security
+defects that affect it. The checks run before setup changes anything and
+again before every tunnel start, and the refusal names the minimum version,
+the version found and where to update.
+
+**Node.js.** Only reviewed stable release lines are accepted, each with its
+own patched floor: 22 (22.23.4+), 24 (24.22.1+) and 26 (26.12.1+). Earlier
+patch levels of these lines, end-of-life lines (20, 21, 23, 25), prerelease
+or nightly builds and release lines that have not been reviewed yet (such as
+27) are refused. A new line is admitted by a reviewed change that adds its
+floor, never by a single global "newer than" comparison. The
+[October 2026 Node.js security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
+fix CVE-2026-111497: the bundled Brotli decoder can write out of bounds when
+decompressing attacker-controlled data, which can cause memory corruption,
+crashes, information disclosure and potentially remote code execution.
+Update from [nodejs.org](https://nodejs.org/en/download) or your package
+manager. The `engines` field in `package.json` records the same floors but
+is advisory; the runtime checks enforce them.
+
+**cloudflared.** A tunnel requires cloudflared **2026.10.2 or later**, as
+reported by `cloudflared --version` for the executable found on the PATH of
+the process that starts the tunnel. Older, prerelease, unrecognized, failing,
+missing or timed-out version checks are refused.
+[Cloudflare's eMudhra incident explanation](https://blog.cloudflare.com/emudhra-certificate-compromise/)
+describes why: earlier releases trust compromised eMudhra intermediate
+certificates, which allows server impersonation. Update with your package
+manager or
+[Cloudflare's update instructions](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/),
+then check `cloudflared --version` again.
+
+These checks do not install or upgrade prerequisites, disable TLS
+verification, rotate credentials or restart services. A process that is
+already running keeps the binaries it started with: update Node.js and
+cloudflared, then restart the affected services (and rebuild or recreate
+containers) yourself.

package/dist/application/conversation-history.d.ts

@@ -25,6 +25,14 @@ export declare function resumedConversationPage(stateDir: string, request: {
 }, live: ConversationPageView, expectedSessionId: string): Promise<ConversationPageView>;
 /** Download authorization requires an actual published attachment, never an orphan copy. */
 export declare function conversationHasAttachment(stateDir: string, attachment: import('../file-delivery/types.js').DeliveredFile): Promise<boolean>;
+/**
+ * The newest assistant message's time alone: the same event the text preview ends with,
+ * found by reading backwards only until it, within the same event and byte bounds.
+ * Records older than it are not read, so they are not validated either.
+ */
+export declare function conversationActivity(stateDir: string, signal: AbortSignal): Promise<{
+    at: string;
+}>;
 export declare function conversationPreview(stateDir: string, signal: AbortSignal): Promise<{
     text: string;
     at: string;

package/dist/application/conversation-history.js

@@ -243,6 +243,8 @@ export async function conversationHasAttachment(stateDir, attachment) {
 /** Passive, bounded last assistant text for directory previews. Never opens the
  * ledger writer/recovery path or acquires a session/controller. An incomplete
  * newest append is not committed yet; completed malformed records still fail. */
+/** The assistant message events a preview is made of. */
+const previewAssistant = (event) => ['message.chunk', 'message.replace'].includes(event.kind) && event.payload?.role === 'assistant' && typeof event.payload?.content?.type === 'string';
 /** Bytes of a segment's tail a preview may consider, and the newest events it reads. */
 const PREVIEW_WINDOW_BYTES = 2 * 1024 * 1024;
 const PREVIEW_EVENTS = 200;
@@ -252,7 +254,7 @@ const PREVIEW_EVENTS = 200;
  * cut by the window start is not complete and is skipped. Only the newest
  * segment can have an in-flight append; elsewhere a partial record fails.
  */
-async function previewSegmentEvents(path, newest, need, signal) {
+async function previewSegmentEvents(path, newest, need, signal, until) {
     const events = [];
     const file = await open(path, 'r');
     try {
@@ -263,6 +265,8 @@ async function previewSegmentEvents(path, newest, need, signal) {
             if (event.schemaVersion !== 1 || !Number.isSafeInteger(event.seq))
                 throw Error('preview ledger invalid');
             events.push(event);
+            if (until?.(event))
+                need = events.length;
         };
         while (position > floor && events.length < need) {
             signal.throwIfAborted();
@@ -297,6 +301,37 @@ async function previewSegmentEvents(path, newest, need, signal) {
     }
     return events;
 }
+/**
+ * The newest assistant message's time alone: the same event the text preview ends with,
+ * found by reading backwards only until it, within the same event and byte bounds.
+ * Records older than it are not read, so they are not validated either.
+ */
+export async function conversationActivity(stateDir, signal) {
+    signal.throwIfAborted();
+    const dir = join(stateDir, '.conversation');
+    let files;
+    try {
+        files = (await readdir(dir)).filter(name => /^events-\d{6}\.jsonl$/.test(name)).sort().reverse();
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { at: '' };
+        throw error;
+    }
+    let read = 0;
+    for (const name of files) {
+        signal.throwIfAborted();
+        const events = await previewSegmentEvents(join(dir, name), name === files[0], PREVIEW_EVENTS - read, signal, previewAssistant);
+        const found = events.find(previewAssistant);
+        if (found)
+            return { at: found.at ?? '' };
+        read += events.length;
+        if (read >= PREVIEW_EVENTS)
+            break;
+    }
+    signal.throwIfAborted();
+    return { at: '' };
+}
 export async function conversationPreview(stateDir, signal) {
     signal.throwIfAborted();
     const dir = join(stateDir, '.conversation');
@@ -317,7 +352,7 @@ export async function conversationPreview(stateDir, signal) {
             break;
     }
     signal.throwIfAborted();
-    const assistant = (event) => ['message.chunk', 'message.replace'].includes(event.kind) && event.payload?.role === 'assistant' && typeof event.payload?.content?.type === 'string';
+    const assistant = previewAssistant;
     const end = events.findIndex(assistant);
     if (end < 0)
         return { text: 'No recent agent output', at: '' };

package/dist/application/task-room-service.d.ts

@@ -106,6 +106,8 @@ export interface TaskRoomServiceDeps {
     launchDeletionWorker?(taskId: string): Promise<void>;
     sleep?(ms: number): Promise<void>;
     now?(): number;
+    /** Test seam: register a task room with the notification service before the Owner joins. */
+    associateRoomNotifications?(taskId: string, roomCid: string): Promise<void>;
 }
 /** Exact extraction of the previously CLI-owned task create/start behavior. */
 export declare class TaskRoomApplicationService {
@@ -325,6 +327,11 @@ export declare class TaskRoomApplicationService {
         };
         taskId: string;
     }): Promise<TaskProvisioningContinuationResult>;
+    /**
+     * Before the Owner can join, register the room as this task's with the notification service, so own-room message
+     * preferences apply to its first message. An unreachable service stops here and the saga retries from this step.
+     */
+    private associateRoomNotifications;
     private setOwnerRoomCommands;
     private reconcileProvisioningOwner;
     private acceptTerminal;

package/dist/application/task-room-service.js

@@ -20,6 +20,7 @@ import { withFileLock } from '../atomic-file.js';
 import { launchFleetWorker } from '../rooms-tasks/external-worker.js';
 import { storedRoomLaunchPolicy, TASK_CANCELLABLE_STATES, TASK_TERMINAL_STATES } from '../rooms-tasks/types.js';
 import { deriveTaskRoomName } from '../rooms-tasks/task-room-name.js';
+import { associateRoomNotifications } from '../notifications/mission-ownership.js';
 // Cowork 1.3.0+ stores this selector verbatim and matches future room commands.
 const OWNER_ROOM_COMMANDS = ['*'];
 /** Repairable terminal observation derived entirely from durable Task/Room state. */
@@ -705,6 +706,21 @@ export class TaskRoomApplicationService {
             return { kind: 'provisioning_resume_failed', task, room, issues };
         }
     }
+    /**
+     * Before the Owner can join, register the room as this task's with the notification service, so own-room message
+     * preferences apply to its first message. An unreachable service stops here and the saga retries from this step.
+     */
+    async associateRoomNotifications(room) {
+        if (!room.task_id || !room.room_identity_cid)
+            return;
+        try {
+            await (this.deps.associateRoomNotifications ?? associateRoomNotifications)(room.task_id, room.room_identity_cid);
+        }
+        catch (error) {
+            setSagaError(room.room_id, error instanceof Error ? error.message : String(error), `Start or repair the notification service, then run ours-fleet task start ${room.task_id}.`, 'waiting_cowork');
+            throw error;
+        }
+    }
     async setOwnerRoomCommands(cowork, roomId, role) {
         try {
             await cowork.setRoleCommands(roomId, { role, commands: [...OWNER_ROOM_COMMANDS] });
@@ -748,6 +764,8 @@ export class TaskRoomApplicationService {
         if (!existing && !cfg.ownerInvite)
             throw new ConfigError('rooms.owner: configure public_invite or public_invite_file before continuing task provisioning');
         await this.setOwnerRoomCommands(cowork, roomId, existing?.role ?? cfg.rooms.owner.role);
+        if (!existing)
+            await this.associateRoomNotifications(room);
         const acceptedCid = existing?.identity_cid ?? (await cowork.acceptInvite(roomId, cfg.ownerInvite, {
             role: cfg.rooms.owner.role, expected_cid: cfg.rooms.owner.expected_cid,
         })).seat_cid;
@@ -1182,6 +1200,7 @@ export class TaskRoomApplicationService {
         if (attachOwner) {
             room = advanceSaga(room.room_id, 'attach_owner', 2);
             await this.setOwnerRoomCommands(cowork, room.room_id, rooms.owner.role);
+            await this.associateRoomNotifications(room);
             try {
                 const accepted = await cowork.acceptInvite(room.room_id, cfg.ownerInvite, {
                     role: rooms.owner.role, expected_cid: rooms.owner.expected_cid,

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "2.1.1",
-  "buildId": "27ffd73f427b",
-  "commit": "7beeb5809663f045677d7ec92515f88ce0001145",
+  "version": "2.2.0",
+  "buildId": "31d6e72bc212",
+  "commit": "f70ffa3f08be7346d3be96e5380d11667d306df6",
   "dirty": false,
-  "builtAt": "2026-10-28T12:03:39.903Z",
+  "builtAt": "2026-10-28T21:45:52.624Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/cli.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import './runtime-security.js';
 import './harness/claude-code.js';
 import './harness/codex.js';
 import './harness/hermes.js';

package/dist/cli.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import './runtime-security.js';
 import { beginWorkspaceReplacement, abandonWorkspaceReplacement, discardRetiredWorkspaceReplacement, clearWorkspaceReplacement, confirmWorkspaceReplacement, finishWorkspaceReplacement, readWorkspaceBinding, readWorkspaceReplacement, requiresWorkspaceReplacement, refreshWorkspaceReplacement } from './workspace-replacement.js';
 import { completeTunnelSetup } from './tunnel-setup-completion.js';
 import { readTunnelSetupFile, readTunnelSetupStdin, readTunnelSetupArgument, redeemTunnelSetup, inspectTunnelSetup, verifyTunnelSetupTarget } from './tunnel-setup-input.js';

package/dist/doctor.js

@@ -1,4 +1,6 @@
+import { cloudflaredUnavailableError, cloudflaredVersionError, CLOUDFLARED_VERSION_TIMEOUT_MS, isSecureCloudflaredVersion, isSecureNodeVersion, nodeVersionError, parseCloudflaredVersion } from './security-versions.js';
 import { describeRegistration, refreshServiceRegistrations, registrationDrift } from './supervisor/registration-refresh.js';
+import { join } from 'node:path';
 import { userInfo } from 'node:os';
 import { existsSync, readFileSync } from 'node:fs';
 import { attachOursClient, } from '@ours.network/sdk/client';
@@ -8,7 +10,7 @@ import { getAdapter, productionAdapters } from './harness/registry.js';
 import { analyzeFleetPermissions, formatNative } from './permissions.js';
 import { managedCliReport } from './managed-cli.js';
 import { resolveBundledAcpAgent } from './harness/acp-agent.js';
-import { agentDir, deriveXdgRuntimeDir } from './paths.js';
+import { agentDir, deriveXdgRuntimeDir, stateRoot } from './paths.js';
 import { resolveIsolation, harnessRuntimeDir } from './isolation/policy.js';
 import { hermesConfiguredProvider } from './harness/hermes-startup.js';
 import { makeBubblewrapBackend } from './isolation/bubblewrap.js';
@@ -116,11 +118,22 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 detail: `could not inspect: ${error?.message ?? String(error)}` });
         }
     }
-    const major = Number(process.versions.node.split('.')[0]);
+    const secureNode = isSecureNodeVersion(process.versions.node);
     checks.push({
-        name: 'node', ok: major >= 20,
-        detail: major >= 20 ? `v${process.versions.node}` : `v${process.versions.node} — need >= 20`,
+        name: 'node', ok: secureNode,
+        detail: secureNode ? `v${process.versions.node}` : nodeVersionError(process.versions.node),
     });
+    // A configured workspace tunnel starts the cloudflared found on PATH.
+    if (existsSync(join(stateRoot(), 'workspace', 'tunnel.json'))) {
+        const connector = await exec('cloudflared', ['--version'], { timeout: CLOUDFLARED_VERSION_TIMEOUT_MS });
+        const secure = connector.code === 0 && isSecureCloudflaredVersion(connector.stdout);
+        checks.push({
+            name: 'cloudflared', ok: secure,
+            detail: secure ? `version ${parseCloudflaredVersion(connector.stdout).join('.')}`
+                : connector.code !== 0 ? cloudflaredUnavailableError(connector.code === 127 ? 'not found' : 'version check failed')
+                    : cloudflaredVersionError(connector.stdout),
+        });
+    }
     // The configuration is a checked prerequisite in its own right. A config the
     // `config` command rejects must fail here too, with the same cause — while the
     // host checks below still run, because they are what the operator needs next.

package/dist/notifications/fleet-producer.d.ts

@@ -14,7 +14,6 @@ export declare class FleetNotificationProducer {
     private readonly dirty;
     private readonly retryAt;
     private discoveryNeeded;
-    private taskRoles?;
     private stopped;
     private readonly existing;
     private cleanup?;

package/dist/notifications/fleet-producer.js

@@ -1,45 +1,35 @@
 import { observeFleetResources } from '../application/resource-observer.js';
-import { roomsDir } from '../rooms-tasks/room-state.js';
 import { cleanupDir, drainNotificationTargetCleanup, notificationAgentId, hasPendingNotificationTargetCleanup } from './target-cleanup.js';
-import { closeSync, existsSync, lstatSync, openSync, readSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { closeSync, existsSync, lstatSync, openSync, readSync, readdirSync, statSync } from 'node:fs';
 import { basename, join, relative, resolve, sep } from 'node:path';
 import { createHash } from 'node:crypto';
 import { NotificationOutbox } from './outbox.js';
+import { readSessionOwnership, validOwnerTask } from '../session/session-ownership.js';
+const MAX_BINDINGS = 16;
 const BATCH_BYTES = 256 * 1024;
 const TURN_ROLES = 4, TURN_MS = 8;
-const RUNTIME_FILES = new Set(['.monitor-status', '.monitor-state.json', '.notify-cursor', '.session-events.jsonl', '.session-events.jsonl.1', '.subscription-usage.json']);
-/** Unlike a UI inventory, unread classification must not treat unreadable records as absence. */
-function taskRoleAssociations() {
-    const dir = roomsDir(), result = new Map();
-    let files;
+const RUNTIME_FILES = new Set(['.session-ownership.json', '.monitor-status', '.monitor-state.json', '.notify-cursor', '.session-events.jsonl', '.session-events.jsonl.1', '.subscription-usage.json']);
+function bind(bindings, event) {
+    const payload = event.payload;
+    const taskId = payload?.taskId;
+    if (!(payload?.launchId === null || typeof payload?.launchId === 'string') || !(taskId === null || validOwnerTask(taskId))
+        || (taskId !== null && payload?.launchId === null))
+        return;
+    bindings[event.sessionGeneration] = taskId;
+    const keys = Object.keys(bindings);
+    for (const key of keys.slice(0, Math.max(0, keys.length - MAX_BINDINGS)))
+        delete bindings[key];
+}
+/** Startup skips earlier history, where a live generation's binding may lie: seed from the durable sidecar, keyed by
+ * exact generation. An absent sidecar is legacy history (generations stay unknown); an unreadable or invalid one is
+ * unavailable evidence and returns undefined, so the caller holds its checkpoint instead of emitting unowned work. */
+function seedBindings(roleDir) {
     try {
-        files = readdirSync(dir);
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return result;
-        throw error;
+        return Object.fromEntries(Object.entries(readSessionOwnership(roleDir)).map(([generation, owner]) => [generation, owner.taskId]));
     }
-    for (const name of files.filter(name => name.endsWith('.json'))) {
-        const file = join(dir, name), stat = lstatSync(file);
-        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024)
-            throw Error('Unreadable room association');
-        const room = JSON.parse(readFileSync(file, 'utf8'));
-        if (!room || typeof room.room_id !== 'string' || !Array.isArray(room.member_seats))
-            throw Error('Invalid room association');
-        if (room.task_id === undefined)
-            continue;
-        if (typeof room.task_id !== 'string' || !/^[A-Za-z0-9_-]{1,120}$/.test(room.task_id))
-            throw Error('Invalid task association');
-        for (const seat of room.member_seats) {
-            if (typeof seat.role_name !== 'string')
-                throw Error('Invalid member association');
-            if (result.has(seat.role_name) && result.get(seat.role_name) !== room.task_id)
-                throw Error('Ambiguous task association');
-            result.set(seat.role_name, room.task_id);
-        }
+    catch {
+        return undefined;
     }
-    return result;
 }
 /** Read durable supervisor ledgers without restarting agents or attaching a
  * conversation controller. Each tick reads at most 256 KiB per role, from its
@@ -56,7 +46,6 @@ export class FleetNotificationProducer {
     dirty = new Set();
     retryAt = new Map();
     discoveryNeeded = true;
-    taskRoles;
     stopped = false;
     existing = new Map();
     cleanup;
@@ -66,7 +55,7 @@ export class FleetNotificationProducer {
         this.config = config;
         this.warn = warn;
         let healthy = true;
-        observeFleetResources({ retryWatchFailures: true, roots, paths: [...roots, roomsDir(), cleanupDir()],
+        observeFleetResources({ retryWatchFailures: true, roots, paths: [...roots, cleanupDir()],
             onInvalidated: path => this.accept(path) }, state => {
             if (state.health !== 'healthy') {
                 healthy = false;
@@ -191,13 +180,6 @@ export class FleetNotificationProducer {
         });
         if (this.discoveryNeeded) {
             this.discoveryNeeded = false;
-            try {
-                this.taskRoles = taskRoleAssociations();
-            }
-            catch {
-                this.taskRoles = undefined;
-                this.warn('Notification task association unavailable; delivering unclassified events');
-            }
             for (const root of this.roots)
                 for (const name of this.names(root))
                     this.dirty.add(join(root, name));
@@ -242,10 +224,23 @@ export class FleetNotificationProducer {
                 const initial = this.existing.get(roleDir);
                 if (initial === null)
                     throw Error('Notification startup ledger boundary unavailable');
-                outbox.saveCheckpoint(initial ?? { segment: segments[0], offset: 0, prompts: [] });
+                // History before the startup boundary is skipped, but the live generation's binding may lie in it:
+                // seed it from the role's durable ownership sidecar.
+                if (initial) {
+                    const bindings = seedBindings(roleDir);
+                    if (!bindings) {
+                        this.warn('Notification ownership evidence unavailable; ledger admission held');
+                        this.retryAt.set(roleDir, Date.now() + 30_000);
+                        this.dirty.add(roleDir);
+                        return;
+                    }
+                    outbox.saveCheckpoint({ ...initial, bindings });
+                }
+                else
+                    outbox.saveCheckpoint({ segment: segments[0], offset: 0, prompts: [] });
             }
             const saved = outbox.checkpoint;
-            const current = { ...saved, prompts: [...saved.prompts], messages: { ...saved.messages } };
+            const current = { ...saved, prompts: [...saved.prompts], messages: { ...saved.messages }, bindings: { ...saved.bindings } };
             let index = segments.indexOf(current.segment);
             if (index < 0) {
                 this.warn('Notification ledger segment unavailable; checkpoint retained');
@@ -275,7 +270,7 @@ export class FleetNotificationProducer {
             finally {
                 closeSync(fd);
             }
-            let position = 0, blocked = false;
+            let position = 0, blocked = false, admitted = false, unavailable = false, sidecar;
             while (position < count) {
                 const end = buffer.indexOf(10, position);
                 if (end < 0 || end >= count) {
@@ -298,6 +293,8 @@ export class FleetNotificationProducer {
                 if (event.schemaVersion !== 1 || event.roleId !== roleId)
                     throw new Error('invalid ledger event');
                 const prompt = `${event.sessionGeneration}:${event.promptId}`;
+                if (event.kind === 'session.ownership')
+                    bind(current.bindings, event);
                 if (event.kind === 'prompt.admitted' && event.promptId && ['browser', 'owner_admin_console', 'owner_channel'].includes(event.source ?? '')) {
                     if (!current.prompts.includes(prompt))
                         current.prompts.push(prompt);
@@ -305,10 +302,25 @@ export class FleetNotificationProducer {
                 if (['message.chunk', 'message.replace'].includes(event.kind) && event.promptId && event.messageId && current.prompts.includes(prompt))
                     current.messages[prompt] = event.messageId;
                 if (event.kind === 'turn.completed' && event.promptId && current.prompts.includes(prompt)) {
-                    if (!outbox.enqueue(`${roleId}:${event.sessionGeneration}:${event.seq}`, { ...(this.taskRoles ? { taskId: this.taskRoles.get(roleId) ?? null } : {}), anchor: { kind: 'fleet-message', messageId: current.messages[prompt] ?? event.promptId } })) {
+                    // Task association only from this generation's own binding: a task, null (non-task role), or unknown (omitted).
+                    // A generation bound before this checkpoint (an older checkpoint, or startup history) is recovered from the
+                    // durable sidecar by exact generation; other generations are never relabelled.
+                    // Unavailable sidecar evidence holds the checkpoint before this completion: nothing unowned is emitted.
+                    if (!Object.hasOwn(current.bindings, event.sessionGeneration)) {
+                        sidecar ??= seedBindings(roleDir);
+                        if (!sidecar) {
+                            unavailable = true;
+                            break;
+                        }
+                        if (Object.hasOwn(sidecar, event.sessionGeneration))
+                            current.bindings[event.sessionGeneration] = sidecar[event.sessionGeneration];
+                    }
+                    const binding = Object.hasOwn(current.bindings, event.sessionGeneration) ? { taskId: current.bindings[event.sessionGeneration] } : {};
+                    if (!outbox.enqueue(`${roleId}:${event.sessionGeneration}:${event.seq}`, { ...binding, anchor: { kind: 'fleet-message', messageId: current.messages[prompt] ?? event.promptId } })) {
                         blocked = true;
                         break;
                     }
+                    admitted = true;
                     current.prompts = current.prompts.filter(p => p !== prompt);
                     delete current.messages[prompt];
                 }
@@ -319,8 +331,14 @@ export class FleetNotificationProducer {
             }
             if (current.segment !== saved.segment || current.offset !== saved.offset)
                 outbox.saveCheckpoint(current);
-            if (blocked) {
-                this.retryAt.set(roleDir, Date.now() + 1000);
+            // Prompt only after both completion and checkpoint have been durably recorded.
+            if (admitted)
+                outbox.prompt();
+            if (unavailable)
+                this.warn('Notification ownership evidence unavailable; ledger admission held');
+            if (blocked || unavailable) {
+                // Corrupt evidence needs an operator repair: re-check it slowly rather than spin.
+                this.retryAt.set(roleDir, Date.now() + (unavailable ? 30_000 : 1000));
                 this.dirty.add(roleDir);
             }
             else if ((current.segment !== saved.segment || current.offset !== saved.offset)

package/dist/notifications/mission-ownership.d.ts

@@ -0,0 +1,31 @@
+import type { TaskRecord } from '../rooms-tasks/types.js';
+import { type ProducerConfig } from './outbox.js';
+/** The service predates mission ownership: it has no such route. Work is retained, never reported as done. */
+export declare class MissionOwnershipUnsupported extends Error {
+}
+export declare class MissionOwnershipUnavailable extends Error {
+}
+export declare function missionRequest(config: ProducerConfig, path: string, body: unknown, request?: typeof fetch): Promise<{
+    status: number;
+    data: any;
+}>;
+/**
+ * Register a room as this task's before the Owner can join it: with own-room messages off, the service must know
+ * the room before the room can message the Owner. Unreachable service or unconfirmed coverage → throws, so room
+ * activation waits and retries. No producer configured → nothing to gate. An older service without the route →
+ * admitted with a warning (it cannot suppress own-room messages either).
+ */
+export declare function associateRoomNotifications(taskId: string, roomCid: string, options?: {
+    config?: ProducerConfig | undefined;
+    warn?: (line: string) => void;
+    request?: typeof fetch;
+}): Promise<void>;
+/** Retire every queued deleted task's notifications; an intent is removed only after the service acknowledged it. */
+export declare function drainMissionCleanup(config: ProducerConfig, warn: (line: string) => void, request?: typeof fetch): Promise<boolean>;
+/**
+ * Register every existing task's rooms under one numbered run, then mark the run complete. Until a run completes
+ * the service refuses own-room OFF, so no room that existed before this release can escape the preference.
+ * The inventory is read in full before the run starts: an unreadable task or layout throws, and the run never
+ * completes on partial evidence. Every task must be confirmed by the service before completion.
+ */
+export declare function bootstrapMissionRooms(config: ProducerConfig, tasks: () => TaskRecord[], layoutRooms: (task: TaskRecord) => string[], request?: typeof fetch): Promise<void>;