@ours.network/fleet 2.1.2 → 2.2.0

package/dist/application/conversation-history.d.ts

@@ -25,6 +25,14 @@ export declare function resumedConversationPage(stateDir: string, request: {
 }, live: ConversationPageView, expectedSessionId: string): Promise<ConversationPageView>;
 /** Download authorization requires an actual published attachment, never an orphan copy. */
 export declare function conversationHasAttachment(stateDir: string, attachment: import('../file-delivery/types.js').DeliveredFile): Promise<boolean>;
+/**
+ * The newest assistant message's time alone: the same event the text preview ends with,
+ * found by reading backwards only until it, within the same event and byte bounds.
+ * Records older than it are not read, so they are not validated either.
+ */
+export declare function conversationActivity(stateDir: string, signal: AbortSignal): Promise<{
+    at: string;
+}>;
 export declare function conversationPreview(stateDir: string, signal: AbortSignal): Promise<{
     text: string;
     at: string;

package/dist/application/conversation-history.js

@@ -243,6 +243,8 @@ export async function conversationHasAttachment(stateDir, attachment) {
 /** Passive, bounded last assistant text for directory previews. Never opens the
  * ledger writer/recovery path or acquires a session/controller. An incomplete
  * newest append is not committed yet; completed malformed records still fail. */
+/** The assistant message events a preview is made of. */
+const previewAssistant = (event) => ['message.chunk', 'message.replace'].includes(event.kind) && event.payload?.role === 'assistant' && typeof event.payload?.content?.type === 'string';
 /** Bytes of a segment's tail a preview may consider, and the newest events it reads. */
 const PREVIEW_WINDOW_BYTES = 2 * 1024 * 1024;
 const PREVIEW_EVENTS = 200;
@@ -252,7 +254,7 @@ const PREVIEW_EVENTS = 200;
  * cut by the window start is not complete and is skipped. Only the newest
  * segment can have an in-flight append; elsewhere a partial record fails.
  */
-async function previewSegmentEvents(path, newest, need, signal) {
+async function previewSegmentEvents(path, newest, need, signal, until) {
     const events = [];
     const file = await open(path, 'r');
     try {
@@ -263,6 +265,8 @@ async function previewSegmentEvents(path, newest, need, signal) {
             if (event.schemaVersion !== 1 || !Number.isSafeInteger(event.seq))
                 throw Error('preview ledger invalid');
             events.push(event);
+            if (until?.(event))
+                need = events.length;
         };
         while (position > floor && events.length < need) {
             signal.throwIfAborted();
@@ -297,6 +301,37 @@ async function previewSegmentEvents(path, newest, need, signal) {
     }
     return events;
 }
+/**
+ * The newest assistant message's time alone: the same event the text preview ends with,
+ * found by reading backwards only until it, within the same event and byte bounds.
+ * Records older than it are not read, so they are not validated either.
+ */
+export async function conversationActivity(stateDir, signal) {
+    signal.throwIfAborted();
+    const dir = join(stateDir, '.conversation');
+    let files;
+    try {
+        files = (await readdir(dir)).filter(name => /^events-\d{6}\.jsonl$/.test(name)).sort().reverse();
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { at: '' };
+        throw error;
+    }
+    let read = 0;
+    for (const name of files) {
+        signal.throwIfAborted();
+        const events = await previewSegmentEvents(join(dir, name), name === files[0], PREVIEW_EVENTS - read, signal, previewAssistant);
+        const found = events.find(previewAssistant);
+        if (found)
+            return { at: found.at ?? '' };
+        read += events.length;
+        if (read >= PREVIEW_EVENTS)
+            break;
+    }
+    signal.throwIfAborted();
+    return { at: '' };
+}
 export async function conversationPreview(stateDir, signal) {
     signal.throwIfAborted();
     const dir = join(stateDir, '.conversation');
@@ -317,7 +352,7 @@ export async function conversationPreview(stateDir, signal) {
             break;
     }
     signal.throwIfAborted();
-    const assistant = (event) => ['message.chunk', 'message.replace'].includes(event.kind) && event.payload?.role === 'assistant' && typeof event.payload?.content?.type === 'string';
+    const assistant = previewAssistant;
     const end = events.findIndex(assistant);
     if (end < 0)
         return { text: 'No recent agent output', at: '' };

package/dist/application/task-room-service.d.ts

@@ -106,6 +106,8 @@ export interface TaskRoomServiceDeps {
     launchDeletionWorker?(taskId: string): Promise<void>;
     sleep?(ms: number): Promise<void>;
     now?(): number;
+    /** Test seam: register a task room with the notification service before the Owner joins. */
+    associateRoomNotifications?(taskId: string, roomCid: string): Promise<void>;
 }
 /** Exact extraction of the previously CLI-owned task create/start behavior. */
 export declare class TaskRoomApplicationService {
@@ -325,6 +327,11 @@ export declare class TaskRoomApplicationService {
         };
         taskId: string;
     }): Promise<TaskProvisioningContinuationResult>;
+    /**
+     * Before the Owner can join, register the room as this task's with the notification service, so own-room message
+     * preferences apply to its first message. An unreachable service stops here and the saga retries from this step.
+     */
+    private associateRoomNotifications;
     private setOwnerRoomCommands;
     private reconcileProvisioningOwner;
     private acceptTerminal;

package/dist/application/task-room-service.js

@@ -20,6 +20,7 @@ import { withFileLock } from '../atomic-file.js';
 import { launchFleetWorker } from '../rooms-tasks/external-worker.js';
 import { storedRoomLaunchPolicy, TASK_CANCELLABLE_STATES, TASK_TERMINAL_STATES } from '../rooms-tasks/types.js';
 import { deriveTaskRoomName } from '../rooms-tasks/task-room-name.js';
+import { associateRoomNotifications } from '../notifications/mission-ownership.js';
 // Cowork 1.3.0+ stores this selector verbatim and matches future room commands.
 const OWNER_ROOM_COMMANDS = ['*'];
 /** Repairable terminal observation derived entirely from durable Task/Room state. */
@@ -705,6 +706,21 @@ export class TaskRoomApplicationService {
             return { kind: 'provisioning_resume_failed', task, room, issues };
         }
     }
+    /**
+     * Before the Owner can join, register the room as this task's with the notification service, so own-room message
+     * preferences apply to its first message. An unreachable service stops here and the saga retries from this step.
+     */
+    async associateRoomNotifications(room) {
+        if (!room.task_id || !room.room_identity_cid)
+            return;
+        try {
+            await (this.deps.associateRoomNotifications ?? associateRoomNotifications)(room.task_id, room.room_identity_cid);
+        }
+        catch (error) {
+            setSagaError(room.room_id, error instanceof Error ? error.message : String(error), `Start or repair the notification service, then run ours-fleet task start ${room.task_id}.`, 'waiting_cowork');
+            throw error;
+        }
+    }
     async setOwnerRoomCommands(cowork, roomId, role) {
         try {
             await cowork.setRoleCommands(roomId, { role, commands: [...OWNER_ROOM_COMMANDS] });
@@ -748,6 +764,8 @@ export class TaskRoomApplicationService {
         if (!existing && !cfg.ownerInvite)
             throw new ConfigError('rooms.owner: configure public_invite or public_invite_file before continuing task provisioning');
         await this.setOwnerRoomCommands(cowork, roomId, existing?.role ?? cfg.rooms.owner.role);
+        if (!existing)
+            await this.associateRoomNotifications(room);
         const acceptedCid = existing?.identity_cid ?? (await cowork.acceptInvite(roomId, cfg.ownerInvite, {
             role: cfg.rooms.owner.role, expected_cid: cfg.rooms.owner.expected_cid,
         })).seat_cid;
@@ -1182,6 +1200,7 @@ export class TaskRoomApplicationService {
         if (attachOwner) {
             room = advanceSaga(room.room_id, 'attach_owner', 2);
             await this.setOwnerRoomCommands(cowork, room.room_id, rooms.owner.role);
+            await this.associateRoomNotifications(room);
             try {
                 const accepted = await cowork.acceptInvite(room.room_id, cfg.ownerInvite, {
                     role: rooms.owner.role, expected_cid: rooms.owner.expected_cid,

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "2.1.2",
-  "buildId": "5bf10a772912",
-  "commit": "dd8adad553ca71b0edae5cc1040eacaaed51e50a",
+  "version": "2.2.0",
+  "buildId": "31d6e72bc212",
+  "commit": "f70ffa3f08be7346d3be96e5380d11667d306df6",
   "dirty": false,
-  "builtAt": "2026-10-28T20:22:31.826Z",
+  "builtAt": "2026-10-28T21:45:52.624Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/notifications/fleet-producer.d.ts

@@ -14,7 +14,6 @@ export declare class FleetNotificationProducer {
     private readonly dirty;
     private readonly retryAt;
     private discoveryNeeded;
-    private taskRoles?;
     private stopped;
     private readonly existing;
     private cleanup?;

package/dist/notifications/fleet-producer.js

@@ -1,45 +1,35 @@
 import { observeFleetResources } from '../application/resource-observer.js';
-import { roomsDir } from '../rooms-tasks/room-state.js';
 import { cleanupDir, drainNotificationTargetCleanup, notificationAgentId, hasPendingNotificationTargetCleanup } from './target-cleanup.js';
-import { closeSync, existsSync, lstatSync, openSync, readSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { closeSync, existsSync, lstatSync, openSync, readSync, readdirSync, statSync } from 'node:fs';
 import { basename, join, relative, resolve, sep } from 'node:path';
 import { createHash } from 'node:crypto';
 import { NotificationOutbox } from './outbox.js';
+import { readSessionOwnership, validOwnerTask } from '../session/session-ownership.js';
+const MAX_BINDINGS = 16;
 const BATCH_BYTES = 256 * 1024;
 const TURN_ROLES = 4, TURN_MS = 8;
-const RUNTIME_FILES = new Set(['.monitor-status', '.monitor-state.json', '.notify-cursor', '.session-events.jsonl', '.session-events.jsonl.1', '.subscription-usage.json']);
-/** Unlike a UI inventory, unread classification must not treat unreadable records as absence. */
-function taskRoleAssociations() {
-    const dir = roomsDir(), result = new Map();
-    let files;
+const RUNTIME_FILES = new Set(['.session-ownership.json', '.monitor-status', '.monitor-state.json', '.notify-cursor', '.session-events.jsonl', '.session-events.jsonl.1', '.subscription-usage.json']);
+function bind(bindings, event) {
+    const payload = event.payload;
+    const taskId = payload?.taskId;
+    if (!(payload?.launchId === null || typeof payload?.launchId === 'string') || !(taskId === null || validOwnerTask(taskId))
+        || (taskId !== null && payload?.launchId === null))
+        return;
+    bindings[event.sessionGeneration] = taskId;
+    const keys = Object.keys(bindings);
+    for (const key of keys.slice(0, Math.max(0, keys.length - MAX_BINDINGS)))
+        delete bindings[key];
+}
+/** Startup skips earlier history, where a live generation's binding may lie: seed from the durable sidecar, keyed by
+ * exact generation. An absent sidecar is legacy history (generations stay unknown); an unreadable or invalid one is
+ * unavailable evidence and returns undefined, so the caller holds its checkpoint instead of emitting unowned work. */
+function seedBindings(roleDir) {
     try {
-        files = readdirSync(dir);
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return result;
-        throw error;
+        return Object.fromEntries(Object.entries(readSessionOwnership(roleDir)).map(([generation, owner]) => [generation, owner.taskId]));
     }
-    for (const name of files.filter(name => name.endsWith('.json'))) {
-        const file = join(dir, name), stat = lstatSync(file);
-        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024)
-            throw Error('Unreadable room association');
-        const room = JSON.parse(readFileSync(file, 'utf8'));
-        if (!room || typeof room.room_id !== 'string' || !Array.isArray(room.member_seats))
-            throw Error('Invalid room association');
-        if (room.task_id === undefined)
-            continue;
-        if (typeof room.task_id !== 'string' || !/^[A-Za-z0-9_-]{1,120}$/.test(room.task_id))
-            throw Error('Invalid task association');
-        for (const seat of room.member_seats) {
-            if (typeof seat.role_name !== 'string')
-                throw Error('Invalid member association');
-            if (result.has(seat.role_name) && result.get(seat.role_name) !== room.task_id)
-                throw Error('Ambiguous task association');
-            result.set(seat.role_name, room.task_id);
-        }
+    catch {
+        return undefined;
     }
-    return result;
 }
 /** Read durable supervisor ledgers without restarting agents or attaching a
  * conversation controller. Each tick reads at most 256 KiB per role, from its
@@ -56,7 +46,6 @@ export class FleetNotificationProducer {
     dirty = new Set();
     retryAt = new Map();
     discoveryNeeded = true;
-    taskRoles;
     stopped = false;
     existing = new Map();
     cleanup;
@@ -66,7 +55,7 @@ export class FleetNotificationProducer {
         this.config = config;
         this.warn = warn;
         let healthy = true;
-        observeFleetResources({ retryWatchFailures: true, roots, paths: [...roots, roomsDir(), cleanupDir()],
+        observeFleetResources({ retryWatchFailures: true, roots, paths: [...roots, cleanupDir()],
             onInvalidated: path => this.accept(path) }, state => {
             if (state.health !== 'healthy') {
                 healthy = false;
@@ -191,13 +180,6 @@ export class FleetNotificationProducer {
         });
         if (this.discoveryNeeded) {
             this.discoveryNeeded = false;
-            try {
-                this.taskRoles = taskRoleAssociations();
-            }
-            catch {
-                this.taskRoles = undefined;
-                this.warn('Notification task association unavailable; delivering unclassified events');
-            }
             for (const root of this.roots)
                 for (const name of this.names(root))
                     this.dirty.add(join(root, name));
@@ -242,10 +224,23 @@ export class FleetNotificationProducer {
                 const initial = this.existing.get(roleDir);
                 if (initial === null)
                     throw Error('Notification startup ledger boundary unavailable');
-                outbox.saveCheckpoint(initial ?? { segment: segments[0], offset: 0, prompts: [] });
+                // History before the startup boundary is skipped, but the live generation's binding may lie in it:
+                // seed it from the role's durable ownership sidecar.
+                if (initial) {
+                    const bindings = seedBindings(roleDir);
+                    if (!bindings) {
+                        this.warn('Notification ownership evidence unavailable; ledger admission held');
+                        this.retryAt.set(roleDir, Date.now() + 30_000);
+                        this.dirty.add(roleDir);
+                        return;
+                    }
+                    outbox.saveCheckpoint({ ...initial, bindings });
+                }
+                else
+                    outbox.saveCheckpoint({ segment: segments[0], offset: 0, prompts: [] });
             }
             const saved = outbox.checkpoint;
-            const current = { ...saved, prompts: [...saved.prompts], messages: { ...saved.messages } };
+            const current = { ...saved, prompts: [...saved.prompts], messages: { ...saved.messages }, bindings: { ...saved.bindings } };
             let index = segments.indexOf(current.segment);
             if (index < 0) {
                 this.warn('Notification ledger segment unavailable; checkpoint retained');
@@ -275,7 +270,7 @@ export class FleetNotificationProducer {
             finally {
                 closeSync(fd);
             }
-            let position = 0, blocked = false;
+            let position = 0, blocked = false, admitted = false, unavailable = false, sidecar;
             while (position < count) {
                 const end = buffer.indexOf(10, position);
                 if (end < 0 || end >= count) {
@@ -298,6 +293,8 @@ export class FleetNotificationProducer {
                 if (event.schemaVersion !== 1 || event.roleId !== roleId)
                     throw new Error('invalid ledger event');
                 const prompt = `${event.sessionGeneration}:${event.promptId}`;
+                if (event.kind === 'session.ownership')
+                    bind(current.bindings, event);
                 if (event.kind === 'prompt.admitted' && event.promptId && ['browser', 'owner_admin_console', 'owner_channel'].includes(event.source ?? '')) {
                     if (!current.prompts.includes(prompt))
                         current.prompts.push(prompt);
@@ -305,10 +302,25 @@ export class FleetNotificationProducer {
                 if (['message.chunk', 'message.replace'].includes(event.kind) && event.promptId && event.messageId && current.prompts.includes(prompt))
                     current.messages[prompt] = event.messageId;
                 if (event.kind === 'turn.completed' && event.promptId && current.prompts.includes(prompt)) {
-                    if (!outbox.enqueue(`${roleId}:${event.sessionGeneration}:${event.seq}`, { ...(this.taskRoles ? { taskId: this.taskRoles.get(roleId) ?? null } : {}), anchor: { kind: 'fleet-message', messageId: current.messages[prompt] ?? event.promptId } })) {
+                    // Task association only from this generation's own binding: a task, null (non-task role), or unknown (omitted).
+                    // A generation bound before this checkpoint (an older checkpoint, or startup history) is recovered from the
+                    // durable sidecar by exact generation; other generations are never relabelled.
+                    // Unavailable sidecar evidence holds the checkpoint before this completion: nothing unowned is emitted.
+                    if (!Object.hasOwn(current.bindings, event.sessionGeneration)) {
+                        sidecar ??= seedBindings(roleDir);
+                        if (!sidecar) {
+                            unavailable = true;
+                            break;
+                        }
+                        if (Object.hasOwn(sidecar, event.sessionGeneration))
+                            current.bindings[event.sessionGeneration] = sidecar[event.sessionGeneration];
+                    }
+                    const binding = Object.hasOwn(current.bindings, event.sessionGeneration) ? { taskId: current.bindings[event.sessionGeneration] } : {};
+                    if (!outbox.enqueue(`${roleId}:${event.sessionGeneration}:${event.seq}`, { ...binding, anchor: { kind: 'fleet-message', messageId: current.messages[prompt] ?? event.promptId } })) {
                         blocked = true;
                         break;
                     }
+                    admitted = true;
                     current.prompts = current.prompts.filter(p => p !== prompt);
                     delete current.messages[prompt];
                 }
@@ -319,8 +331,14 @@ export class FleetNotificationProducer {
             }
             if (current.segment !== saved.segment || current.offset !== saved.offset)
                 outbox.saveCheckpoint(current);
-            if (blocked) {
-                this.retryAt.set(roleDir, Date.now() + 1000);
+            // Prompt only after both completion and checkpoint have been durably recorded.
+            if (admitted)
+                outbox.prompt();
+            if (unavailable)
+                this.warn('Notification ownership evidence unavailable; ledger admission held');
+            if (blocked || unavailable) {
+                // Corrupt evidence needs an operator repair: re-check it slowly rather than spin.
+                this.retryAt.set(roleDir, Date.now() + (unavailable ? 30_000 : 1000));
                 this.dirty.add(roleDir);
             }
             else if ((current.segment !== saved.segment || current.offset !== saved.offset)

package/dist/notifications/mission-ownership.d.ts

@@ -0,0 +1,31 @@
+import type { TaskRecord } from '../rooms-tasks/types.js';
+import { type ProducerConfig } from './outbox.js';
+/** The service predates mission ownership: it has no such route. Work is retained, never reported as done. */
+export declare class MissionOwnershipUnsupported extends Error {
+}
+export declare class MissionOwnershipUnavailable extends Error {
+}
+export declare function missionRequest(config: ProducerConfig, path: string, body: unknown, request?: typeof fetch): Promise<{
+    status: number;
+    data: any;
+}>;
+/**
+ * Register a room as this task's before the Owner can join it: with own-room messages off, the service must know
+ * the room before the room can message the Owner. Unreachable service or unconfirmed coverage → throws, so room
+ * activation waits and retries. No producer configured → nothing to gate. An older service without the route →
+ * admitted with a warning (it cannot suppress own-room messages either).
+ */
+export declare function associateRoomNotifications(taskId: string, roomCid: string, options?: {
+    config?: ProducerConfig | undefined;
+    warn?: (line: string) => void;
+    request?: typeof fetch;
+}): Promise<void>;
+/** Retire every queued deleted task's notifications; an intent is removed only after the service acknowledged it. */
+export declare function drainMissionCleanup(config: ProducerConfig, warn: (line: string) => void, request?: typeof fetch): Promise<boolean>;
+/**
+ * Register every existing task's rooms under one numbered run, then mark the run complete. Until a run completes
+ * the service refuses own-room OFF, so no room that existed before this release can escape the preference.
+ * The inventory is read in full before the run starts: an unreadable task or layout throws, and the run never
+ * completes on partial evidence. Every task must be confirmed by the service before completion.
+ */
+export declare function bootstrapMissionRooms(config: ProducerConfig, tasks: () => TaskRecord[], layoutRooms: (task: TaskRecord) => string[], request?: typeof fetch): Promise<void>;

package/dist/notifications/mission-ownership.js

@@ -0,0 +1,148 @@
+import { mkdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { stateRoot } from '../paths.js';
+import { canonicalCid, pendingMissionCleanups, settleMissionCleanup, unavailableMissionCleanups, validRoomCid } from '../rooms-tasks/notification-manifest.js';
+import { advanceNotificationRevision, notificationRoomCids, recordNotificationRooms } from '../rooms-tasks/task-state.js';
+import { producerConfig } from './outbox.js';
+/** The service predates mission ownership: it has no such route. Work is retained, never reported as done. */
+export class MissionOwnershipUnsupported extends Error {
+}
+export class MissionOwnershipUnavailable extends Error {
+}
+export async function missionRequest(config, path, body, request = fetch) {
+    let response;
+    try {
+        response = await request(config.origin + path, {
+            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),
+            headers: { ...(config.gatewayCredential
+                    ? { 'X-Ours-Api-Token': config.gatewayCredential, 'X-Ours-Notifications-Producer': config.token }
+                    : { Authorization: `Bearer ${config.token}` }), 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+    }
+    catch {
+        throw new MissionOwnershipUnavailable('notification service unreachable');
+    }
+    const data = await response.json().catch(() => undefined);
+    if (response.status === 404)
+        throw new MissionOwnershipUnsupported('notification service does not support mission ownership');
+    return { status: response.status, data };
+}
+/**
+ * Register the task's current manifest. Only a 2xx response whose `contactIds` include every requested room proves
+ * coverage. A 409 (mission deleted, stale or conflicting revision) proves nothing about these rooms: the local revision
+ * is moved past the refused one, so a later retry registers the full union under a newer revision, and this attempt fails.
+ */
+async function registerMission(config, taskId, manifest, request) {
+    const { status, data } = await missionRequest(config, '/api/v1/missions/associate', { taskId, revision: manifest.revision, contactIds: manifest.room_cids }, request);
+    if (status >= 200 && status < 300) {
+        const registered = Array.isArray(data?.contactIds) ? new Set(data.contactIds.filter(validRoomCid).map(canonicalCid)) : undefined;
+        if (registered && manifest.room_cids.every(cid => registered.has(cid)))
+            return;
+        throw new MissionOwnershipUnavailable('notification service did not confirm every mission room');
+    }
+    if (status === 409)
+        advanceNotificationRevision(taskId, manifest.revision);
+    throw new MissionOwnershipUnavailable(`notification service refused room registration (HTTP ${status})`);
+}
+/**
+ * Register a room as this task's before the Owner can join it: with own-room messages off, the service must know
+ * the room before the room can message the Owner. Unreachable service or unconfirmed coverage → throws, so room
+ * activation waits and retries. No producer configured → nothing to gate. An older service without the route →
+ * admitted with a warning (it cannot suppress own-room messages either).
+ */
+export async function associateRoomNotifications(taskId, roomCid, options = {}) {
+    const manifest = recordNotificationRooms(taskId, [roomCid]);
+    const config = 'config' in options ? options.config : producerConfig();
+    if (!config)
+        return;
+    try {
+        await registerMission(config, taskId, manifest, options.request);
+    }
+    catch (error) {
+        if (error instanceof MissionOwnershipUnsupported) {
+            options.warn?.('Notification service does not support mission rooms; own-room message preferences are unavailable');
+            return;
+        }
+        if (error instanceof MissionOwnershipUnavailable)
+            throw new Error('Waiting for notification service to register the mission room');
+        throw error;
+    }
+}
+/** Retire every queued deleted task's notifications; an intent is removed only after the service acknowledged it. */
+export async function drainMissionCleanup(config, warn, request = fetch) {
+    let pending = false;
+    for (const intent of pendingMissionCleanups().slice(0, 32)) {
+        try {
+            const { status } = await missionRequest(config, '/api/v1/missions/delete', { taskId: intent.taskId, contactIds: intent.contactIds }, request);
+            if (status >= 200 && status < 300) {
+                if (!settleMissionCleanup(intent))
+                    pending = true;
+                continue;
+            }
+            warn(`Mission notification cleanup pending (HTTP ${status}); intent retained`);
+        }
+        catch (error) {
+            warn(error instanceof MissionOwnershipUnsupported
+                ? 'Notification service does not support mission cleanup; cleanup pending'
+                : 'Mission notification cleanup pending; intent retained');
+        }
+        return true;
+    }
+    // An unreadable intent stays pending (and its file retained): overall cleanup is never reported done around it.
+    const unavailable = unavailableMissionCleanups();
+    if (unavailable.length)
+        warn(`Mission notification cleanup unavailable for ${unavailable.length} unreadable intent(s); files retained`);
+    return pending || unavailable.length > 0 || pendingMissionCleanups().length > 32;
+}
+const bootstrapFile = () => join(stateRoot(), 'notifications', 'mission-bootstrap.json');
+/** Only a missing file starts at 0. Unreadable, corrupt or out-of-range state is refused and its bytes are kept. */
+function nextGeneration() {
+    let text;
+    try {
+        text = readFileSync(bootstrapFile(), 'utf8');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw new MissionOwnershipUnavailable('mission bootstrap state unreadable');
+    }
+    let generation = 0;
+    if (text !== undefined) {
+        let value;
+        try {
+            value = JSON.parse(text);
+        }
+        catch {
+            throw new MissionOwnershipUnavailable('mission bootstrap state corrupt; file retained');
+        }
+        const stored = value && typeof value === 'object' && !Array.isArray(value) ? value.generation : undefined;
+        if (typeof stored !== 'number' || !Number.isSafeInteger(stored) || stored < 0)
+            throw new MissionOwnershipUnavailable('mission bootstrap state invalid; file retained');
+        generation = stored;
+    }
+    if (!Number.isSafeInteger(generation + 1))
+        throw new MissionOwnershipUnavailable('mission bootstrap generation exhausted');
+    mkdirSync(dirname(bootstrapFile()), { recursive: true, mode: 0o700 });
+    replaceFileAtomically(bootstrapFile(), JSON.stringify({ generation: generation + 1 }) + '\n', 0o600);
+    return generation + 1;
+}
+/**
+ * Register every existing task's rooms under one numbered run, then mark the run complete. Until a run completes
+ * the service refuses own-room OFF, so no room that existed before this release can escape the preference.
+ * The inventory is read in full before the run starts: an unreadable task or layout throws, and the run never
+ * completes on partial evidence. Every task must be confirmed by the service before completion.
+ */
+export async function bootstrapMissionRooms(config, tasks, layoutRooms, request = fetch) {
+    const inventory = tasks().filter(task => task.deletion?.status !== 'pending')
+        .map(task => ({ task, cids: [...notificationRoomCids(task), ...layoutRooms(task)] })).filter(entry => entry.cids.length);
+    const generation = nextGeneration();
+    const begin = await missionRequest(config, '/api/v1/missions/bootstrap', { generation, complete: false }, request);
+    if (begin.status < 200 || begin.status >= 300)
+        throw new MissionOwnershipUnavailable(`bootstrap refused (HTTP ${begin.status})`);
+    for (const { task, cids } of inventory)
+        await registerMission(config, task.task_id, recordNotificationRooms(task.task_id, cids), request);
+    const done = await missionRequest(config, '/api/v1/missions/bootstrap', { generation, complete: true }, request);
+    if (done.status < 200 || done.status >= 300)
+        throw new MissionOwnershipUnavailable(`bootstrap completion refused (HTTP ${done.status})`);
+}

package/dist/notifications/outbox.d.ts

@@ -44,12 +44,22 @@ export declare class NotificationOutbox {
     checkpoint?: unknown;
     private running?;
     private retired;
+    private again;
+    private failed;
+    private closed;
     private timer;
     constructor(file: string, config: ProducerConfig, project: (value: unknown, id: string) => Promise<NotificationInput>, warn?: (message: string) => void);
     private persist;
     advance(cursor: number): void;
     saveCheckpoint(checkpoint: unknown): void;
     enqueue(id: string, value: unknown, cursor?: number | undefined): boolean;
+    /**
+     * Deliver soon after a durable enqueue instead of at the next recovery tick. A request
+     * during a pass (which iterates its own snapshot) runs one follow-up pass after it;
+     * after a failed pass only the recovery timer retries, so arrivals during an outage
+     * add no attempts.
+     */
+    prompt(): void;
     drain(): Promise<void>;
     private drainOnce;
     /** Wait for the current send before clearing queued sends and retiring its target. */

package/dist/notifications/outbox.js

@@ -99,6 +99,9 @@ export class NotificationOutbox {
     checkpoint;
     running;
     retired = false;
+    again = false;
+    failed = false;
+    closed = false;
     timer;
     constructor(file, config, project, warn = () => { }) {
         this.file = file;
@@ -152,12 +155,34 @@ export class NotificationOutbox {
         this.persist([...this.entries, { id, value, targetVersion: 1 }], cursor);
         return true;
     }
+    /**
+     * Deliver soon after a durable enqueue instead of at the next recovery tick. A request
+     * during a pass (which iterates its own snapshot) runs one follow-up pass after it;
+     * after a failed pass only the recovery timer retries, so arrivals during an outage
+     * add no attempts.
+     */
+    prompt() {
+        if (this.closed || this.retired || this.failed)
+            return;
+        if (this.running) {
+            this.again = true;
+            return;
+        }
+        void this.drain();
+    }
     drain() {
         if (this.retired)
             return Promise.resolve();
-        return this.running ??= this.drainOnce().finally(() => { this.running = undefined; });
+        return this.running ??= this.drainOnce().finally(() => {
+            this.running = undefined;
+            if (this.again) {
+                this.again = false;
+                this.prompt();
+            }
+        });
     }
     async drainOnce() {
+        this.failed = false;
         let attempts = 0;
         for (const entry of [...this.entries]) {
             if (!supported(entry))
@@ -188,6 +213,7 @@ export class NotificationOutbox {
                 this.persist(this.entries.filter(e => !same(entry.id)(e)));
             }
             catch {
+                this.failed = true;
                 this.warn('Notification producer delivery pending; retrying from durable outbox');
                 break;
             }
@@ -195,5 +221,5 @@ export class NotificationOutbox {
     }
     /** Wait for the current send before clearing queued sends and retiring its target. */
     async retire() { this.retired = true; clearInterval(this.timer); await this.running; this.persist(this.entries.filter(entry => !supported(entry))); }
-    async close() { clearInterval(this.timer); await this.running; }
+    async close() { this.closed = true; clearInterval(this.timer); await this.running; }
 }