@ours.network/fleet 2.1.1 → 2.2.0

package/dist/rooms-tasks/task-state.js

@@ -8,6 +8,7 @@ import { stateRoot } from '../paths.js';
 import { planWorkspace, ensureWorkspace } from './workspace.js';
 import { storedRoomLaunchPolicy, TASK_TERMINAL_STATES, TASK_CANCELLABLE_STATES } from './types.js';
 import { DEFAULT_TASK_LIST_ID, readTaskLists } from './task-lists.js';
+import { queueMissionCleanup, withManifestRooms } from './notification-manifest.js';
 export const tasksDir = () => join(stateRoot(), 'tasks');
 function taskPath(id) { return join(tasksDir(), `${id}.json`); }
 function taskLockPath(id) { return join(tasksDir(), '.locks', id); }
@@ -165,14 +166,24 @@ function writeTask(record) {
     const status = (task) => task.deletion?.status === 'pending' ? 'deleting' : task.blocked ? `${task.state} (blocked)` : task.state;
     // Read pending events under the same task lock as every mutation. Metadata edits
     // and retries preserve the queue; acknowledgement cannot be resurrected by stale input.
-    const pending = [...(previous?.notification_events ?? [])];
-    if (!previous || status(previous) !== status(record)) {
-        const next = status(record), before = previous ? status(previous) : undefined;
-        pending.push({ eventId: `task:${record.task_id}:${randomUUID()}`, taskId: record.task_id,
-            title: `Task ${!previous ? 'created' : 'updated'}: ${record.title}`.slice(0, 160),
-            body: `Task ${record.task_id}: ${before ? `${before} → ` : 'created in '}${next}.`,
-            target: { kind: 'task', taskId: record.task_id } });
+    let pending = [...(previous?.notification_events ?? [])];
+    if (record.deletion?.status === 'pending') {
+        // Deletion acceptance is the notification fence: queued transitions are obsolete and nothing new is produced.
+        pending = [];
     }
+    else {
+        if (!previous || status(previous) !== status(record)) {
+            const next = status(record), before = previous ? status(previous) : undefined;
+            pending.push({ eventId: `task:${record.task_id}:${randomUUID()}`, taskId: record.task_id,
+                title: `Task ${!previous ? 'created' : 'updated'}: ${record.title}`.slice(0, 160),
+                body: `Task ${record.task_id}: ${before ? `${before} → ` : 'created in '}${next}.`,
+                target: { kind: 'task', taskId: record.task_id }, delivery: 'push-only' });
+        }
+        pending.push(...contributionEvents(previous, record));
+    }
+    if (previous && !previous.contribution_reads && contributionsChanged(previous, record))
+        // First post-upgrade change: everything that existed before it counts as read, under this same lock.
+        persisted.contribution_reads = { progress_read: (previous.progress ?? []).map(entry => entry.id), review_revision: reviewRevision(previous.review) };
     if (pending.length)
         persisted.notification_events = pending;
     else
@@ -180,9 +191,76 @@ function writeTask(record) {
     replaceFileAtomically(taskPath(record.task_id), JSON.stringify(persisted, null, 2) + '\n');
     publishFleetResourceCommit(taskPath(record.task_id));
 }
+/** Packages written before revisions existed count as revision 1; their next change becomes 2. No package is 0. */
+export const reviewRevision = (review) => review ? review.revision ?? 1 : 0;
+const contributionsChanged = (previous, record) => (record.progress ?? []).some(entry => !(previous.progress ?? []).some(old => old.id === entry.id))
+    || reviewRevision(record.review) !== reviewRevision(previous.review);
+/** New Progress entries and new To review revisions push once each; reads and replays produce nothing. */
+function contributionEvents(previous, record) {
+    if (!previous)
+        return [];
+    const id = record.task_id, events = [];
+    for (const entry of record.progress ?? []) {
+        if ((previous.progress ?? []).some(old => old.id === entry.id))
+            continue;
+        events.push({ eventId: `task:${id}:progress:${entry.id}`, taskId: id, title: `Progress: ${record.title}`.slice(0, 160),
+            body: (entry.text.trim() || 'New progress entry').slice(0, 512), target: { kind: 'task', taskId: id }, delivery: 'push-only' });
+    }
+    const revision = reviewRevision(record.review);
+    if (revision > reviewRevision(previous.review))
+        events.push({ eventId: `task:${id}:review:${revision}`, taskId: id, title: `To review updated: ${record.title}`.slice(0, 160),
+            body: `Task ${id}: the review package changed.`, target: { kind: 'task', taskId: id }, delivery: 'push-only' });
+    return events;
+}
+/** Item-based Progress unread and revision-based To review unread. An absent read state means nothing is unread. */
+export function contributionUnread(task) {
+    const reads = task.contribution_reads;
+    if (!reads)
+        return { progress: 0, review: false };
+    const seen = new Set(reads.progress_read);
+    return { progress: (task.progress ?? []).filter(entry => !seen.has(entry.id)).length, review: reviewRevision(task.review) > reads.review_revision };
+}
+/** Acknowledge Progress entries the user actually viewed; unknown IDs are ignored and the set only grows. */
+export function acknowledgeTaskProgress(id, ids) {
+    assertCanonicalTaskId(id);
+    return withTaskLock(id, () => {
+        const task = readTask(id);
+        assertNoPendingDeletion(task);
+        // Without a read state everything present already counts as read: there is nothing to record.
+        const reads = task.contribution_reads;
+        if (!reads)
+            return contributionUnread(task);
+        const present = new Set((task.progress ?? []).map(entry => entry.id));
+        const added = [...new Set(ids.filter(entryId => present.has(entryId) && !reads.progress_read.includes(entryId)))];
+        if (added.length) {
+            task.contribution_reads = { ...reads, progress_read: [...reads.progress_read, ...added] };
+            writeTask(task);
+        }
+        return contributionUnread(task);
+    });
+}
+/** Acknowledge the To review revision the user saw. Only moves forward; a revision newer than current is refused. */
+export function acknowledgeTaskReview(id, revision) {
+    assertCanonicalTaskId(id);
+    return withTaskLock(id, () => {
+        const task = readTask(id);
+        assertNoPendingDeletion(task);
+        const current = reviewRevision(task.review);
+        if (!Number.isSafeInteger(revision) || revision < 0 || revision > current)
+            throw new TaskStateError('That review revision does not exist.');
+        const reads = task.contribution_reads;
+        if (reads && revision > reads.review_revision) {
+            task.contribution_reads = { ...reads, review_revision: Math.max(reads.review_revision, revision) };
+            writeTask(task);
+        }
+        return contributionUnread(task);
+    });
+}
 const retiredNotificationsDir = () => join(tasksDir(), '.notification-retired');
 function typedTaskNotification(value, id) {
-    if (!value || typeof value !== 'object' || Object.keys(value).some(key => !['eventId', 'title', 'body', 'target', 'taskId'].includes(key)))
+    if (!value || typeof value !== 'object' || Object.keys(value).some(key => !['eventId', 'title', 'body', 'target', 'taskId', 'delivery'].includes(key)))
+        return false;
+    if (value.delivery !== undefined && value.delivery !== 'push-only')
         return false;
     const target = value.target;
     return typeof value.eventId === 'string' && value.eventId.startsWith(`task:${id}:`) && value.eventId.length <= 512
@@ -193,9 +271,13 @@ function typedTaskNotification(value, id) {
         && typeof value.body === 'string' && !!value.body.trim() && value.body.length <= 512;
 }
 /** Atomic snapshots contain the events, including intermediate states between polls. */
+/** `upgraded`: IDs of events queued by an earlier release without a delivery policy. They are sent push-only under the
+ * same event ID (state transitions never count as unread); the queued record itself is not rewritten. A service that
+ * already admitted one as an inbox row repairs that row to push-only itself, so the retry matches; any refusal keeps the
+ * event queued. */
 export function pendingTaskNotifications(warn = () => { }) {
     const result = [];
-    for (const dir of [tasksDir(), retiredNotificationsDir()]) {
+    for (const dir of [tasksDir()]) {
         if (!existsSync(dir))
             continue;
         for (const file of readdirSync(dir).filter(file => TASK_ID_PATTERN.test(file.slice(0, -5)) && file.endsWith('.json'))) {
@@ -214,9 +296,11 @@ export function pendingTaskNotifications(warn = () => { }) {
                     throw new Error('invalid notification events');
                 // Only typed task events are delivered. Unsupported entries are never sent or converted,
                 // and they do not block later lifecycle events.
-                const events = value.notification_events.filter(event => typedTaskNotification(event, id));
+                const typed = value.notification_events.filter(event => typedTaskNotification(event, id));
+                const upgraded = typed.filter(event => event.delivery === undefined).map(event => event.eventId);
+                const events = typed.map(event => event.delivery ? event : { ...event, delivery: 'push-only' });
                 if (events.length)
-                    result.push({ taskId: id, events });
+                    result.push({ taskId: id, events, upgraded });
             }
             catch (error) {
                 if (!isNotFoundError(error))
@@ -226,6 +310,25 @@ export function pendingTaskNotifications(warn = () => { }) {
     }
     return result;
 }
+/** Earlier releases kept a deleted task's queued events in `.notification-retired`. They are obsolete: each
+ * becomes a cleanup intent for its task and is never delivered. Returns the number converted. */
+export function convertRetiredTaskNotifications() {
+    const dir = retiredNotificationsDir();
+    if (!existsSync(dir))
+        return 0;
+    let converted = 0;
+    for (const file of readdirSync(dir).filter(file => file.endsWith('.json') && TASK_ID_PATTERN.test(file.slice(0, -5)))) {
+        const id = file.slice(0, -5);
+        withTaskLock(id, () => {
+            if (existsSync(taskPath(id)))
+                return; // a prepared copy has no authority while the task exists
+            queueMissionCleanup(id, []);
+            rmSync(join(dir, file), { force: true });
+            converted++;
+        });
+    }
+    return converted;
+}
 /** Service event-id dedupe covers acceptance followed by a crash before this acknowledgement. */
 export function acknowledgeTaskNotification(id, eventId) {
     assertCanonicalTaskId(id);
@@ -583,10 +686,41 @@ export function updateTaskRoom(id, roomId, roomIdentityCid) {
         assertNoPendingTerminalIntent(t);
         t.room_id = roomId;
         t.room_identity_cid = roomIdentityCid;
+        t.notification_manifest = withManifestRooms(t.notification_manifest, [roomIdentityCid]);
         writeTask(t);
         return t;
     });
 }
+/** Record room CIDs as this task's notification-owned rooms (union only). Returns the manifest to register. */
+export function recordNotificationRooms(id, cids) {
+    assertCanonicalTaskId(id);
+    return withTaskLock(id, () => {
+        const t = readTask(id);
+        assertNoPendingDeletion(t);
+        const next = withManifestRooms(t.notification_manifest, cids);
+        if (next !== t.notification_manifest) {
+            t.notification_manifest = next;
+            writeTask(t);
+        }
+        return next;
+    });
+}
+/** After a refused registration (409), move the manifest revision past the refused one; rooms are unchanged. A retry
+ * then registers the full union under a newer revision. Nothing happens if the manifest already moved on. */
+export function advanceNotificationRevision(id, refused) {
+    assertCanonicalTaskId(id);
+    withTaskLock(id, () => {
+        const t = readTask(id);
+        if (t.deletion?.status === 'pending' || t.notification_manifest?.revision !== refused)
+            return;
+        t.notification_manifest = { ...t.notification_manifest, revision: refused + 1 };
+        writeTask(t);
+    });
+}
+/** Every room this task ever recorded, including the current one from records written before manifests existed. */
+export function notificationRoomCids(task) {
+    return withManifestRooms(task.notification_manifest, task.room_identity_cid ? [task.room_identity_cid] : []).room_cids;
+}
 export function updateTaskTemplate(id, template) {
     return withTaskLock(id, () => {
         const t = readTask(id);
@@ -729,6 +863,7 @@ export function beginTaskDeletionIntent(id, actor) {
             // Heal a crash between the intent write and the receipt write.
             if (!readTaskDeletionReceipt(id))
                 writeDeletionReceiptForIntent(stored);
+            queueMissionCleanup(id, notificationRoomCids(stored));
             return { status: 'pending', task: presentTaskLenient(stored) };
         }
         const now = new Date().toISOString();
@@ -741,7 +876,9 @@ export function beginTaskDeletionIntent(id, actor) {
                 name: member.name, identity_cid: member.identity_cid, phase: 'pending', updated_at: now,
             })),
         };
+        // The task write drops queued transitions; the cleanup intent then retires everything already delivered.
         writeTask(stored);
+        queueMissionCleanup(id, notificationRoomCids(stored));
         writeDeletionReceiptForIntent(stored);
         return { status: 'accepted', task: presentTaskLenient(stored) };
     });
@@ -967,12 +1104,9 @@ export function unlinkDeletedTask(id) {
         }
         if (stored.deletion?.status !== 'pending')
             throw new TaskStateError(`task ${id} has no pending deletion`);
-        // Preserve committed deliveries outside the record before deletion. A crash
-        // before unlink may replay two copies; both carry identical service dedupe IDs.
-        const removed = { eventId: `task:${id}:deleted`, taskId: id,
-            title: `Task deleted: ${stored.title}`.slice(0, 160), body: `Task ${id}: deleting → deleted.`,
-            target: { kind: 'task-deleted', taskId: id } };
-        replaceFileAtomically(join(retiredNotificationsDir(), `${id}.json`), JSON.stringify({ notification_events: [...(stored.notification_events ?? []), removed] }) + '\n');
+        // Merge rooms proven since acceptance into the durable cleanup intent before the record disappears.
+        // No deletion notification is produced: deleting retires the task's notifications instead.
+        queueMissionCleanup(id, notificationRoomCids(stored));
         try {
             unlinkSync(taskPath(id));
         }

package/dist/rooms-tasks/types.d.ts

@@ -115,6 +115,13 @@ export interface TaskNotificationEvent {
         taskId: string;
     };
     taskId: string;
+    /** Born read in the notification service: pushed, never an unread item. Absent on events queued before it. */
+    delivery?: 'push-only';
+}
+/** Persisted reads of Progress entries and To review revisions; absent until the first post-upgrade change. */
+export interface TaskContributionReads {
+    progress_read: string[];
+    review_revision: number;
 }
 /** Who wrote a progress entry or review change, as established by the Fleet surface. */
 export type TaskContributionAuthor = {
@@ -162,6 +169,9 @@ export interface TaskRecord {
     review?: TaskReview;
     /** Pending lifecycle events, committed atomically with their task change. */
     notification_events?: TaskNotificationEvent[];
+    contribution_reads?: TaskContributionReads;
+    /** Rooms whose notifications belong to this task; only grows. */
+    notification_manifest?: import('./notification-manifest.js').TaskNotificationManifest;
     workspace?: import('./workspace.js').OwnedWorkspace;
     task_id: string;
     /** Stable organizational list identifier. Missing legacy values mean `default`. */

package/dist/runtime-security.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/runtime-security.js

@@ -0,0 +1,6 @@
+// Imported first by the CLI entry point: refuse an unpatched Node.js before any other module runs.
+import { isSecureNodeVersion, nodeVersionError } from './security-versions.js';
+if (!isSecureNodeVersion(process.versions.node)) {
+    process.stderr.write(`${nodeVersionError(process.versions.node)}\n`);
+    process.exit(1);
+}

package/dist/security-versions.d.ts

@@ -0,0 +1,20 @@
+export declare const NODE_PATCHED_FLOORS: Readonly<Record<number, readonly [number, number, number]>>;
+export declare const NODE_SECURITY_ADVISORY = "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases";
+export declare const NODE_DOWNLOAD_URL = "https://nodejs.org/en/download";
+export declare const NODE_SECURITY_REQUIREMENT: string;
+export declare const CLOUDFLARED_MIN_VERSION: readonly number[];
+export declare const CLOUDFLARED_SECURITY_ADVISORY = "https://blog.cloudflare.com/emudhra-certificate-compromise/";
+export declare const CLOUDFLARED_UPDATE_URL = "https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/";
+export declare const CLOUDFLARED_VERSION_TIMEOUT_MS = 10000;
+/** Returns [major, minor, patch] for a stable Node.js version string, otherwise null. */
+export declare function parseNodeVersion(version: string): number[] | null;
+export declare function isSecureNodeVersion(version: string): boolean;
+export declare function nodeVersionError(version: string): string;
+export declare function assertSecureNodeVersion(version?: string): void;
+/** Returns [year, month, patch] for exact stable `cloudflared --version` output, otherwise null. */
+export declare function parseCloudflaredVersion(output: string): number[] | null;
+/** `reason` must be a fixed description such as "not found" or "timed out", never command output. */
+export declare function cloudflaredUnavailableError(reason: string): string;
+export declare function cloudflaredVersionError(output: string): string;
+export declare function isSecureCloudflaredVersion(output: string): boolean;
+export declare function assertSecureCloudflaredVersion(output: string): void;

package/dist/security-versions.js

@@ -0,0 +1,70 @@
+// Security version floors for the runtimes Ours executes. Keep this file
+// identical in ours-network, ours-fleet and ours-app.
+//
+// Node.js policy: only reviewed stable release lines are admitted, each with
+// its own patched floor. A new line (for example a future 27 or 28 release) is
+// added by a reviewed change once its security releases have been checked;
+// until then it is refused, as are prerelease builds, end-of-life lines and
+// earlier patch levels of a listed line. A single global ">=" comparison would
+// admit vulnerable intermediate lines, so every line keeps an explicit floor.
+export const NODE_PATCHED_FLOORS = Object.freeze({ 22: [22, 23, 4], 24: [24, 22, 1], 26: [26, 12, 1] });
+export const NODE_SECURITY_ADVISORY = 'https://nodejs.org/en/blog/vulnerability/october-2026-security-releases';
+export const NODE_DOWNLOAD_URL = 'https://nodejs.org/en/download';
+export const NODE_SECURITY_REQUIREMENT = Object.values(NODE_PATCHED_FLOORS).map(floor => `${floor.join('.')}+`).join(', ');
+// cloudflared releases before 2026.10.2 trust compromised eMudhra intermediates.
+export const CLOUDFLARED_MIN_VERSION = Object.freeze([2026, 10, 2]);
+export const CLOUDFLARED_SECURITY_ADVISORY = 'https://blog.cloudflare.com/emudhra-certificate-compromise/';
+export const CLOUDFLARED_UPDATE_URL = 'https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/';
+export const CLOUDFLARED_VERSION_TIMEOUT_MS = 10_000;
+const atLeast = (version, floor) => {
+    for (let i = 0; i < floor.length; i++)
+        if (version[i] !== floor[i])
+            return version[i] > floor[i];
+    return true;
+};
+/** Returns [major, minor, patch] for a stable Node.js version string, otherwise null. */
+export function parseNodeVersion(version) {
+    const match = /^v?(\d{1,9})\.(\d{1,9})\.(\d{1,9})$/.exec(String(version));
+    return match ? match.slice(1).map(Number) : null;
+}
+export function isSecureNodeVersion(version) {
+    const parsed = parseNodeVersion(version);
+    const floor = parsed && NODE_PATCHED_FLOORS[parsed[0]];
+    return Boolean(floor && atLeast(parsed, floor));
+}
+export function nodeVersionError(version) {
+    const shown = /^v?[0-9A-Za-z.+-]{1,64}$/.test(String(version)) ? String(version).replace(/^v/, '') : 'unrecognized';
+    return `Node.js ${shown} is not permitted. Ours requires a patched supported Node.js release: ${NODE_SECURITY_REQUIREMENT} `
+        + 'within those release lines; prerelease, end-of-life and unreviewed release lines are refused. '
+        + `Earlier patch levels are affected by CVE-2026-111497 (Brotli decompression out-of-bounds write) and the other October 2026 fixes: ${NODE_SECURITY_ADVISORY} `
+        + `Update Node.js from ${NODE_DOWNLOAD_URL} or your package manager, then retry.`;
+}
+export function assertSecureNodeVersion(version = process.versions.node) {
+    if (!isSecureNodeVersion(version))
+        throw new Error(nodeVersionError(version));
+}
+/** Returns [year, month, patch] for exact stable `cloudflared --version` output, otherwise null. */
+export function parseCloudflaredVersion(output) {
+    const match = /^cloudflared version (\d{4})\.(\d{1,2})\.(\d{1,6})(?: \(built [^\r\n()]*\))?\r?\n?$/.exec(String(output));
+    const parsed = match?.slice(1).map(Number);
+    return parsed && parsed[1] >= 1 && parsed[1] <= 12 ? parsed : null;
+}
+const cloudflaredGuidance = () => `cloudflared releases before ${CLOUDFLARED_MIN_VERSION.join('.')} trust compromised eMudhra intermediate certificates, which allows server impersonation: ${CLOUDFLARED_SECURITY_ADVISORY} `
+    + `Update the cloudflared executable on this host's PATH (${CLOUDFLARED_UPDATE_URL}, or your package manager), check it with "cloudflared --version", then retry.`;
+/** `reason` must be a fixed description such as "not found" or "timed out", never command output. */
+export function cloudflaredUnavailableError(reason) {
+    return `cloudflared could not be verified (${reason}). A tunnel requires cloudflared ${CLOUDFLARED_MIN_VERSION.join('.')} or later. ${cloudflaredGuidance()}`;
+}
+export function cloudflaredVersionError(output) {
+    const parsed = parseCloudflaredVersion(output);
+    const found = parsed ? `version ${parsed.join('.')}` : 'with an unrecognized version';
+    return `cloudflared ${found} is not permitted; a tunnel requires cloudflared ${CLOUDFLARED_MIN_VERSION.join('.')} or later. ${cloudflaredGuidance()}`;
+}
+export function isSecureCloudflaredVersion(output) {
+    const parsed = parseCloudflaredVersion(output);
+    return Boolean(parsed && atLeast(parsed, CLOUDFLARED_MIN_VERSION));
+}
+export function assertSecureCloudflaredVersion(output) {
+    if (!isSecureCloudflaredVersion(output))
+        throw new Error(cloudflaredVersionError(output));
+}

package/dist/session/acp.d.ts

@@ -208,6 +208,9 @@ export declare class AcpSession implements AgentSession {
     private activeTurn?;
     private constructor();
     static start(options: AcpSessionOptions): Promise<AcpSession>;
+    /** Construction failed after the child and connection exist: close the connection, stop the child (bounded TERM, then
+     * KILL), and check liveness at the end. Every cleanup failure is kept; a child not proven exited is named by pid. */
+    private static releaseFailedStart;
     /**
      * Honest restart recovery: a prompt that was admitted but never
      * started is safe to dispatch again; a turn that had already started may

package/dist/session/acp.js

@@ -1,4 +1,5 @@
 import { ConversationObservation } from './conversation-observation.js';
+import { recordSessionOwnership } from './session-ownership.js';
 import { appendTaskCreated } from './task-notice.js';
 import { spawn } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
@@ -336,7 +337,17 @@ export class AcpSession {
         this.conversation = new ConversationEventStore(join(options.stateDir, '.conversation'), {
             roleId: options.name, log: line => options.log(`[${options.name}] ${line}`),
         });
+        // Only earlier generations are below the page floor. The current ownership
+        // binding must be visible through both canonical pages and passive replay.
         this.conversationStartCursor = this.conversation.lastCursor();
+        // Unavailable ownership refuses the start; release the ledger descriptor this constructor opened.
+        try {
+            recordSessionOwnership(this.conversation, this.sessionGeneration, options.stateDir);
+        }
+        catch (error) {
+            this.conversation.close();
+            throw error;
+        }
         // A durable append can precede its inventory mutation. Capture only after
         // the synchronous owner checkpoint, never the state at append notification.
         this.conversation.subscribe(() => this.observation.scheduleCapture());
@@ -417,7 +428,14 @@ export class AcpSession {
         });
         const stream = acp.ndJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout));
         const connection = app.connect(stream);
-        instance = new AcpSession(options, child, connection);
+        try {
+            instance = new AcpSession(options, child, connection);
+        }
+        catch (error) {
+            // A cleanup exception never replaces the ownership failure: both are kept.
+            throw await AcpSession.releaseFailedStart(child, connection, error)
+                .catch(cleanupError => new AggregateError([error, cleanupError], 'ACP start failed and its cleanup failed', { cause: error }));
+        }
         try {
             await instance.initialize();
             instance.startStallWatchdog();
@@ -430,6 +448,45 @@ export class AcpSession {
             throw error;
         }
     }
+    /** Construction failed after the child and connection exist: close the connection, stop the child (bounded TERM, then
+     * KILL), and check liveness at the end. Every cleanup failure is kept; a child not proven exited is named by pid. */
+    static async releaseFailedStart(child, connection, error) {
+        const failures = [];
+        try {
+            connection.close();
+        }
+        catch (closeError) {
+            failures.push(closeError);
+        }
+        const exited = () => child.exitCode !== null || child.signalCode !== null;
+        const wait = (ms) => new Promise(resolve => {
+            if (exited())
+                return resolve();
+            const settle = () => { clearTimeout(timer); child.off('exit', settle); resolve(); };
+            const timer = setTimeout(settle, ms);
+            timer.unref();
+            child.on('exit', settle);
+        });
+        let killFailed = false;
+        const signal = (name) => { try {
+            child.kill(name);
+        }
+        catch (killError) {
+            killFailed = true;
+            failures.push(killError);
+        } };
+        if (!exited()) {
+            signal('SIGTERM');
+            await wait(2_500);
+        }
+        if (!exited()) {
+            signal('SIGKILL');
+            await wait(2_500);
+        }
+        if (!exited())
+            failures.push(new Error(`ACP child (pid ${child.pid}) ${killFailed ? 'exit unproven: a stop signal failed' : 'is still running'}`));
+        return failures.length ? new AggregateError([error, ...failures], 'ACP start failed and its release is unproven', { cause: error }) : error;
+    }
     /**
      * Honest restart recovery: a prompt that was admitted but never
      * started is safe to dispatch again; a turn that had already started may

package/dist/session/codex-app-server.js

@@ -1,4 +1,5 @@
 import { ConversationObservation } from './conversation-observation.js';
+import { recordSessionOwnership } from './session-ownership.js';
 import { appendTaskCreated } from './task-notice.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
@@ -173,7 +174,17 @@ export class CodexAppServerSession {
         this.conversation = new ConversationEventStore(join(options.stateDir, '.conversation'), {
             roleId: options.name, log: line => options.log(`[${options.name}] ${line}`),
         });
+        // Only earlier generations are below the page floor. The current ownership
+        // binding must be visible through both canonical pages and passive replay.
         this.conversationStartCursor = this.conversation.lastCursor();
+        // Unavailable ownership refuses the start; release the ledger descriptor this constructor opened.
+        try {
+            recordSessionOwnership(this.conversation, this.sessionGeneration, options.stateDir);
+        }
+        catch (error) {
+            this.conversation.close();
+            throw error;
+        }
         // A durable append can precede its inventory mutation. Capture only after
         // the synchronous owner checkpoint, never the state at append notification.
         this.conversation.subscribe(() => this.observation.scheduleCapture());
@@ -191,7 +202,17 @@ export class CodexAppServerSession {
             onRequest: (method, id, params) => instance?.serverRequest(method, id, params),
             onExit: exit => instance?.transportExited(exit),
         });
-        instance = new CodexAppServerSession(options, transport);
+        try {
+            instance = new CodexAppServerSession(options, transport);
+        }
+        catch (error) {
+            // Existing bounded TERM→KILL; its waits are not proof, so liveness is checked after it returns.
+            const failures = [];
+            await transport.close().catch((closeError) => { failures.push(closeError); });
+            if (transport.isAlive())
+                failures.push(new Error(`Codex app-server transport (pid ${transport.pid}) is still running`));
+            throw failures.length ? new AggregateError([error, ...failures], 'Codex app-server start failed and its release is unproven', { cause: error }) : error;
+        }
         try {
             await instance.initialize();
             instance.recoverOpenPrompts();

package/dist/session/conversation-types.d.ts

@@ -8,7 +8,7 @@ import type { PromptOrigin, SessionSnapshot, TurnCancellationSource, TurnOutcome
  * file touches the wire: transport updates are reduced into these shapes by a
  * session adapter, and the store assigns `seq`/`eventId`/timestamps.
  */
-export type ConversationEventKind = 'prompt.admitted' | 'prompt.started' | 'prompt.interrupt_requested' | 'message.chunk' | 'message.replace' | 'thought.chunk' | 'thought.replace' | 'plan.replace' | 'tool.upsert' | 'tool.content_chunk' | 'permission.requested' | 'permission.resolved' | 'file.attached' | 'fleet.task_created' | 'monitor.delivery' | 'usage.updated' | 'turn.state' | 'turn.completed' | 'session.state' | 'session.info' | 'capabilities.updated' | 'error'
+export type ConversationEventKind = 'prompt.admitted' | 'prompt.started' | 'prompt.interrupt_requested' | 'message.chunk' | 'message.replace' | 'thought.chunk' | 'thought.replace' | 'plan.replace' | 'tool.upsert' | 'tool.content_chunk' | 'permission.requested' | 'permission.resolved' | 'file.attached' | 'fleet.task_created' | 'monitor.delivery' | 'usage.updated' | 'turn.state' | 'turn.completed' | 'session.state' | 'session.info' | 'session.ownership' | 'capabilities.updated' | 'error'
 /** A well-formed transport update this version cannot represent. Bounded, never a crash. */
  | 'unsupported';
 /** Where a conversation record came from. Typed provenance, never prompt text. */
@@ -142,6 +142,12 @@ export interface UsageUpdatedPayload {
 export interface SessionStatePayload {
     currentModeId?: string;
 }
+/** First event of a generation: the launch it belongs to and that launch's task, or null for a non-task role. */
+export interface SessionOwnershipPayload {
+    /** Null for a role without temp-supervisor metadata (explicitly standalone). */
+    launchId: string | null;
+    taskId: string | null;
+}
 export interface SessionInfoPayload {
     title?: string | null;
     updatedAt?: string | null;
@@ -236,7 +242,7 @@ export interface BoundedJson {
 }
 export type ConversationPayload = {
     attachment: import('../file-delivery/types.js').DeliveredFile;
-} | MessageChunkPayload | ThoughtChunkPayload | PlanReplacePayload | ToolUpsertPayload | UsageUpdatedPayload | SessionStatePayload | SessionInfoPayload | CapabilitiesUpdatedPayload | UnsupportedPayload | PromptAdmittedPayload | PromptStartedPayload | PromptInterruptRequestedPayload | PermissionRequestedPayload | PermissionResolvedPayload | TurnStatePayload | TurnCompletedPayload | MonitorDeliveryPayload | SessionLifecyclePayload | ErrorPayload | TaskCreatedNotice;
+} | MessageChunkPayload | ThoughtChunkPayload | PlanReplacePayload | ToolUpsertPayload | UsageUpdatedPayload | SessionStatePayload | SessionInfoPayload | SessionOwnershipPayload | CapabilitiesUpdatedPayload | UnsupportedPayload | PromptAdmittedPayload | PromptStartedPayload | PromptInterruptRequestedPayload | PermissionRequestedPayload | PermissionResolvedPayload | TurnStatePayload | TurnCompletedPayload | MonitorDeliveryPayload | SessionLifecyclePayload | ErrorPayload | TaskCreatedNotice;
 export interface ConversationEventV1 {
     schemaVersion: 1;
     roleId: string;

package/dist/session/session-ownership.d.ts

@@ -0,0 +1,18 @@
+import type { ConversationEventStore } from './conversation-store.js';
+/** Durable generation → launch/task evidence, independent of the transcript tail. Bounded to recent generations. */
+export declare const SESSION_OWNERSHIP_FILE = ".session-ownership.json";
+export interface SessionOwnership {
+    launchId: string | null;
+    taskId: string | null;
+}
+/** Canonical Fleet task identity; a task owner always has a launch. */
+export declare const validOwnerTask: (taskId: unknown) => taskId is string;
+/** Absent evidence is `{}` (no file: ENOENT only). Unreadable or invalid evidence throws and is never treated as absent. */
+export declare function readSessionOwnership(stateDir: string): Record<string, SessionOwnership>;
+/**
+ * Bind this session generation to its launch before any prompt can be admitted. A task member's generation names
+ * its task; a role without temp-supervisor metadata is explicitly standalone. Existing but unreadable metadata is
+ * unavailable evidence: the session refuses to start rather than guess. For a task-owned generation both the
+ * sidecar and the ledger event must persist, or the session start fails (no prompt is admitted without its binding).
+ */
+export declare function recordSessionOwnership(conversation: ConversationEventStore, sessionGeneration: string, stateDir: string): void;

package/dist/session/session-ownership.js

@@ -0,0 +1,74 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { readTempSupervisor, TEMP_SUPERVISOR_FILE } from '../temp-lifecycle.js';
+/** Durable generation → launch/task evidence, independent of the transcript tail. Bounded to recent generations. */
+export const SESSION_OWNERSHIP_FILE = '.session-ownership.json';
+const MAX_GENERATIONS = 16;
+/** Canonical Fleet task identity; a task owner always has a launch. */
+export const validOwnerTask = (taskId) => typeof taskId === 'string' && /^[0-9a-z]{9}[0-9a-f]{8}$/.test(taskId);
+/** Absent evidence is `{}` (no file: ENOENT only). Unreadable or invalid evidence throws and is never treated as absent. */
+export function readSessionOwnership(stateDir) {
+    let text;
+    try {
+        text = readFileSync(join(stateDir, SESSION_OWNERSHIP_FILE), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return {};
+        throw error;
+    }
+    if (text.length > 64 * 1024)
+        throw new Error('session ownership evidence too large');
+    const value = JSON.parse(text);
+    if (value?.schema !== 1 || !value.generations || typeof value.generations !== 'object' || Array.isArray(value.generations))
+        throw new Error('invalid session ownership evidence');
+    const result = {};
+    for (const [generation, owner] of Object.entries(value.generations)) {
+        if (!owner || !(owner.launchId === null || typeof owner.launchId === 'string')
+            || !(owner.taskId === null || validOwnerTask(owner.taskId)) || (owner.taskId !== null && owner.launchId === null))
+            throw new Error('invalid session ownership evidence');
+        result[generation] = { launchId: owner.launchId, taskId: owner.taskId };
+    }
+    return result;
+}
+/**
+ * Bind this session generation to its launch before any prompt can be admitted. A task member's generation names
+ * its task; a role without temp-supervisor metadata is explicitly standalone. Existing but unreadable metadata is
+ * unavailable evidence: the session refuses to start rather than guess. For a task-owned generation both the
+ * sidecar and the ledger event must persist, or the session start fails (no prompt is admitted without its binding).
+ */
+export function recordSessionOwnership(conversation, sessionGeneration, stateDir) {
+    let owner;
+    if (!existsSync(join(stateDir, TEMP_SUPERVISOR_FILE)))
+        owner = { launchId: null, taskId: null };
+    else {
+        const metadata = readTempSupervisor(stateDir);
+        if (!metadata)
+            throw new Error('session ownership unavailable: temp supervisor metadata is unreadable');
+        const taskId = metadata.taskOwner?.taskId ?? null;
+        if (taskId !== null && !validOwnerTask(taskId))
+            throw new Error('session ownership unavailable: invalid task owner');
+        owner = { launchId: metadata.launchId, taskId };
+    }
+    const draft = { kind: 'session.ownership', sessionGeneration, payload: owner };
+    if (!owner.taskId) {
+        // A standalone role keeps the existing degrade-not-die behaviour. A sidecar that cannot be updated is left exactly as
+        // it was (never reset): the ledger event still binds this generation, and the observer refuses to guess from it.
+        try {
+            writeSidecar(stateDir, sessionGeneration, owner);
+        }
+        catch { /* evidence preserved; the ledger binding remains */ }
+        conversation.appendSafe(draft);
+        return;
+    }
+    writeSidecar(stateDir, sessionGeneration, owner);
+    conversation.append(draft);
+}
+/** Initializes only on proven absence. Corrupt or unreadable prior evidence throws and its bytes stay untouched. */
+function writeSidecar(stateDir, sessionGeneration, owner) {
+    const generations = readSessionOwnership(stateDir);
+    delete generations[sessionGeneration];
+    const kept = Object.entries(generations).slice(-(MAX_GENERATIONS - 1));
+    replaceFileAtomically(join(stateDir, SESSION_OWNERSHIP_FILE), JSON.stringify({ schema: 1, generations: Object.fromEntries([...kept, [sessionGeneration, owner]]) }) + '\n', 0o600);
+}