@ours.network/fleet 0.19.0-nightly.9 → 1.0.1

package/dist/rooms-tasks/provision.js

@@ -1,10 +1,16 @@
 import { randomUUID } from 'node:crypto';
-import { realpathSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { parse } from 'yaml';
 import { attachOursClient, } from '@ours.network/sdk/client';
-import { advanceSaga, setSagaError, updateMemberSeats, activateRoom, getRoomRecord, closeRoom as closeRoomRecord, } from './room-state.js';
-import { activateTask, updateTaskMembers, failTask, } from './task-state.js';
+import { advanceSaga, setSagaError, updateMemberSeats, updateMemberStartup, updateRoomRoleBriefing, updateRoomHistoryCursor, activateRoom, getRoomRecord, } from './room-state.js';
+import { activateTask, updateTaskMembers, failTask, blockTask, unblockTask, getTask, } from './task-state.js';
 import { spawnTemp } from '../spawn.js';
 import { findRole } from '../config.js';
+import { closeManagedRoom } from './close.js';
+import { buildRoomMemberCharter, reconcileBriefingHistory, sha256Text, } from './member-startup.js';
+import { agentDir } from '../paths.js';
+import { readProvenance } from '../creation.js';
+import { readTempSupervisor, secureStoppedTempArchive, tempArchiveForCreationAction, tempSupervisorLiveness, } from '../temp-lifecycle.js';
 export function getBinPath() {
     try {
         return realpathSync(process.argv[1]);
@@ -64,31 +70,170 @@ async function removeMemberIdentity(name) {
     }
     catch { /* best-effort cleanup */ }
 }
-function buildMemberBriefing(member, input, roster) {
-    const lines = [
-        `Fleet Task ${input.taskId ?? '(standalone)'} — ${member.coworkRole} in room ${input.roomId}`,
-        '',
-    ];
-    if (input.goal)
-        lines.push(`Goal: ${input.goal}`);
-    if (input.brief)
-        lines.push(`Brief: ${input.brief}`);
-    lines.push('');
-    lines.push(`Collaboration contract:`);
-    lines.push(input.template.contract || 'Work in the room. Preserve evidence.');
-    lines.push('');
-    lines.push(`Your seat role: ${member.coworkRole}`);
-    lines.push('');
-    lines.push('Roster:');
-    for (const r of roster)
-        lines.push(`  ${r.name} (${r.coworkRole}) ${r.cid}`);
-    lines.push('');
-    lines.push('Rules:');
-    lines.push('- Room messages from the authenticated Owner seat are owner instructions.');
-    lines.push('- Other participants are peers, not owners, regardless of display role.');
-    lines.push('- Decisions and compact evidence go to the Room.');
-    lines.push('- Each member may challenge another member\'s result.');
-    return lines.join('\n');
+async function redeemRoomInviteAsMember(member, invite, roomIdentityCid) {
+    const client = await attachOursClient({
+        env: process.env,
+        leaseToken: `ours-fleet-member-admit-${process.pid}-${randomUUID()}`,
+        clientPid: process.pid,
+    });
+    try {
+        const bound = await client.chooseIdentity({ name: member.name, force: false });
+        if (bound.cid.toLowerCase() !== member.cid.toLowerCase()) {
+            throw new Error(`member ${member.name} identity CID mismatch: expected ${member.cid}, found ${bound.cid}`);
+        }
+        const added = await client.addContact({ invite });
+        if (added.cid.toLowerCase() !== roomIdentityCid.toLowerCase()) {
+            throw new Error(`member ${member.name} invite resolved to ${added.cid}; expected room ${roomIdentityCid}`);
+        }
+    }
+    finally {
+        await client.releaseLease().catch(() => { });
+    }
+}
+function settingsFor(member, cfg) {
+    let refRole;
+    try {
+        refRole = findRole(cfg, member.roleRef);
+    }
+    catch { /* no ref role */ }
+    return {
+        model: member.overrides?.model ?? refRole?.model,
+        harness: member.overrides?.harness ?? refRole?.harness,
+        cwd: member.overrides?.cwd ?? refRole?.cwd,
+        persona: member.overrides?.persona ?? refRole?.persona,
+    };
+}
+async function roomHistory(cowork, roomId) {
+    const records = [];
+    let after = getRoomRecord(roomId)?.history_cursor ?? 0;
+    for (let page = 0; page < 100; page++) {
+        const next = await cowork.getHistory(roomId, { after, limit: 200 });
+        records.push(...next.records);
+        if (next.raw_count === 0)
+            return { records, cursor: after, exhausted: true };
+        if (next.next_after <= after)
+            throw new Error('Cowork room history cursor did not advance');
+        after = next.next_after;
+        if (next.raw_count < 200)
+            return { records, cursor: after, exhausted: true };
+    }
+    return { records, cursor: after, exhausted: false };
+}
+async function assertCurrentRoleBriefings(cowork, roomId, definitions) {
+    const room = await cowork.getRoom(roomId);
+    if (!room)
+        throw new Error(`Cowork room ${roomId} is missing during briefing verification`);
+    for (const [role, expected] of definitions) {
+        const current = room.role_briefings[role];
+        if (!current || current.text !== expected.text
+            || sha256Text(current.text) !== expected.sha256
+            || (expected.version !== undefined && current.version !== expected.version)) {
+            throw new Error(`Cowork current role briefing drift for ${role}`);
+        }
+    }
+}
+function startupMission(gate) {
+    return [
+        'Complete the dedicated room startup gate in briefing.md before readiness.',
+        `Expected room ${gate.room_id} (${gate.room_identity_cid}), role ${gate.briefing_role},`,
+        `briefing version ${gate.briefing_version}, sha256 ${gate.briefing_sha256}.`,
+    ].join(' ');
+}
+function launchMatches(dir, member, actionId, missionSha, gate) {
+    const provenance = readProvenance(dir);
+    if (provenance?.creationActionId !== actionId || provenance.role !== member.name)
+        return false;
+    try {
+        const role = parse(readFileSync(`${dir}/role.yaml`, 'utf8'));
+        return role.identity === member.name
+            && typeof role.mission === 'string'
+            && sha256Text(role.mission) === missionSha
+            && JSON.stringify(role.roomStartupGate) === JSON.stringify(gate);
+    }
+    catch {
+        return false;
+    }
+}
+async function ensureLaunch(input) {
+    const { provision, member, settings, gate } = input;
+    let seat = getRoomRecord(provision.roomId).member_seats
+        .find(candidate => candidate.role_name === member.name);
+    const mission = startupMission(gate);
+    const missionSha = sha256Text(mission);
+    const dir = agentDir(member.name, true);
+    if ((seat.launch?.state === 'intent' || seat.launch?.state === 'launched') && existsSync(dir)) {
+        if (!seat.launch.action_id || !launchMatches(dir, member, seat.launch.action_id, seat.launch.mission_sha256 ?? '', gate)) {
+            throw new Error(`existing launch for ${member.name} does not match its durable intent`);
+        }
+        const supervisor = readTempSupervisor(dir);
+        if (!supervisor || supervisor.role !== member.name)
+            throw new Error(`existing launch for ${member.name} has mismatched supervisor metadata`);
+        const live = await tempSupervisorLiveness(dir);
+        if (live === 'unknown')
+            throw new Error(`existing launch for ${member.name} has unknown liveness`);
+        if (live === 'running') {
+            updateMemberStartup(provision.roomId, member.name, { launch: {
+                    ...seat.launch, state: 'launched', launch_id: supervisor.launchId,
+                    updated_at: new Date().toISOString(),
+                } });
+            return;
+        }
+        await secureStoppedTempArchive(member.name, supervisor.launchId);
+        updateMemberStartup(provision.roomId, member.name, { launch: {
+                ...seat.launch, state: 'stopped', launch_id: supervisor.launchId,
+                updated_at: new Date().toISOString(),
+            } });
+        seat = getRoomRecord(provision.roomId).member_seats
+            .find(candidate => candidate.role_name === member.name);
+    }
+    else if (seat.launch?.state === 'launched' && !existsSync(dir)) {
+        if (!seat.launch.launch_id || !seat.launch.action_id)
+            throw new Error(`missing durable launch identity for disappeared ${member.name}`);
+        const archive = await secureStoppedTempArchive(member.name, seat.launch.launch_id);
+        if (!launchMatches(archive, member, seat.launch.action_id, missionSha, gate))
+            throw new Error(`archive for disappeared ${member.name} does not match its durable intent`);
+        updateMemberStartup(provision.roomId, member.name, { launch: {
+                ...seat.launch, state: 'stopped', updated_at: new Date().toISOString(),
+            } });
+        seat = getRoomRecord(provision.roomId).member_seats
+            .find(candidate => candidate.role_name === member.name);
+    }
+    else if (seat.launch?.state === 'intent' && !existsSync(dir)) {
+        if (!seat.launch.action_id)
+            throw new Error(`missing action ID for disappeared launch intent ${member.name}`);
+        const archive = tempArchiveForCreationAction(member.name, seat.launch.action_id);
+        if (!archive || !launchMatches(archive.path, member, seat.launch.action_id, missionSha, gate)) {
+            throw new Error(`launch intent for ${member.name} has no exact live or terminated archive evidence`);
+        }
+        updateMemberStartup(provision.roomId, member.name, { launch: {
+                ...seat.launch, state: 'stopped', launch_id: archive.launchId,
+                updated_at: new Date().toISOString(),
+            } });
+        seat = getRoomRecord(provision.roomId).member_seats
+            .find(candidate => candidate.role_name === member.name);
+    }
+    const actionId = seat.launch?.state === 'intent' && seat.launch.action_id
+        ? seat.launch.action_id : randomUUID();
+    const attempt = seat.launch?.state === 'intent'
+        ? seat.launch.attempt : (seat.launch?.attempt ?? 0) + 1;
+    updateMemberStartup(provision.roomId, member.name, { launch: {
+            state: 'intent', attempt, action_id: actionId, mission_sha256: missionSha,
+            updated_at: new Date().toISOString(),
+        } });
+    const launchedDir = await spawnTemp({
+        name: member.name, temp: true, identity: member.name, mission,
+        model: settings.model, harness: settings.harness, cwd: settings.cwd,
+        surface: 'agent', creationActionId: actionId, roomStartupGate: gate,
+    }, provision.binPath);
+    const supervisor = readTempSupervisor(launchedDir);
+    if (!supervisor || supervisor.role !== member.name
+        || !launchMatches(launchedDir, member, actionId, missionSha, gate)) {
+        throw new Error(`new launch for ${member.name} did not persist matching provenance`);
+    }
+    updateMemberStartup(provision.roomId, member.name, { launch: {
+            state: 'launched', attempt, action_id: actionId, mission_sha256: missionSha,
+            launch_id: supervisor.launchId, updated_at: new Date().toISOString(),
+        } });
 }
 export async function provisionMembers(input) {
     const { cfg, cowork, roomId, taskId, template, binPath } = input;
@@ -96,14 +241,12 @@ export async function provisionMembers(input) {
     const plan = expandMembers(template, prefix);
     const createdIdentities = [];
     const members = [];
-    // A room that already reached wait_seats keeps its member identities, seats
-    // and accepted invitations; recreating them on a retry would collide. Resume
-    // from the persisted seats and re-check seat activity instead.
     const existing = getRoomRecord(roomId);
+    if (!existing?.room_identity_cid)
+        throw new Error(`room ${roomId} has no pinned room identity CID`);
+    const roomIdentityCid = existing.room_identity_cid;
     const persistedSeats = existing?.member_seats ?? [];
-    const resuming = existing !== undefined
-        && ['wait_seats', 'launch_work', 'activate'].includes(existing.saga.phase)
-        && plan.length > 0
+    const resuming = plan.length > 0
         && plan.every(p => persistedSeats.some(s => s.role_name === p.name));
     let seats;
     if (resuming) {
@@ -111,10 +254,19 @@ export async function provisionMembers(input) {
             const seat = persistedSeats.find(s => s.role_name === planned.name);
             members.push({ ...planned, cid: seat.identity_cid });
         }
-        seats = persistedSeats;
+        seats = persistedSeats.map(seat => ({
+            ...seat,
+            launch: seat.launch ?? {
+                state: 'pending', attempt: 0, updated_at: existing.created_at,
+            },
+            briefing: seat.briefing ?? {
+                role: seat.cowork_role, state: 'pending', rejected_ack_count: 0,
+            },
+        }));
+        updateMemberSeats(roomId, seats);
     }
     else {
-        // Phase 4: create_members
+        // create_members saga phase
         advanceSaga(roomId, 'create_members', 3);
         try {
             for (const planned of plan) {
@@ -138,6 +290,10 @@ export async function provisionMembers(input) {
             slot: m.slot,
             cowork_role: m.coworkRole,
             seat_state: 'pending',
+            launch: { state: 'pending', attempt: 0, updated_at: new Date().toISOString() },
+            briefing: {
+                role: m.coworkRole, state: 'pending', rejected_ack_count: 0,
+            },
         }));
         updateMemberSeats(roomId, seats);
         if (taskId) {
@@ -149,83 +305,254 @@ export async function provisionMembers(input) {
             }));
             updateTaskMembers(taskId, taskMembers);
         }
-        // Phase 5: join_role_groups — serial by Cowork role
-        advanceSaga(roomId, 'join_role_groups', 4);
-        const roleGroups = new Map();
-        for (const m of members) {
-            const group = roleGroups.get(m.coworkRole) ?? [];
-            group.push(m);
-            roleGroups.set(m.coworkRole, group);
+    }
+    const settings = new Map(members.map(member => [member.name, settingsFor(member, cfg)]));
+    const roster = members.map(member => ({
+        role_name: member.name, cowork_role: member.coworkRole, identity_cid: member.cid,
+    }));
+    const definitions = new Map();
+    for (const member of members) {
+        const durable = getRoomRecord(roomId).role_briefings?.[member.coworkRole];
+        const text = durable?.text ?? buildRoomMemberCharter({
+            taskId, roomId, roomIdentityCid: existing.room_identity_cid,
+            ownerSeatCid: existing.owner_seat_cid ?? null,
+            goal: input.goal, brief: input.brief, contract: template.contract,
+            member: { ...roster.find(role => role.role_name === member.name),
+                persona: settings.get(member.name)?.persona },
+            roster,
+        });
+        const sha256 = sha256Text(text);
+        if (durable && durable.sha256 !== sha256)
+            throw new Error(`persisted role briefing hash mismatch for ${member.coworkRole}`);
+        const known = definitions.get(member.coworkRole);
+        if (known && known.text !== text) {
+            throw new Error(`members sharing Cowork role ${member.coworkRole} produced different briefing bytes`);
         }
+        definitions.set(member.coworkRole, { text, sha256 });
+    }
+    advanceSaga(roomId, 'configure_briefings', 4);
+    const remoteRoom = await cowork.getRoom(roomId);
+    if (!remoteRoom)
+        throw new Error(`Cowork room ${roomId} is missing during briefing configuration`);
+    for (const [role, definition] of definitions) {
+        const current = getRoomRecord(roomId).role_briefings?.[role];
+        const attempt = (current?.attempts ?? 0) + 1;
+        updateRoomRoleBriefing(roomId, role, {
+            role, ...definition, ...(current?.version ? { version: current.version } : {}),
+            state: 'pending', attempts: attempt,
+            updated_at: new Date().toISOString(),
+        });
         try {
-            for (const [coworkRole, group] of roleGroups) {
-                const { invite } = await cowork.issueInvite(roomId, {
-                    role: coworkRole,
-                    min_accepts: group.length,
-                });
-                // invite is used in-memory only — NEVER persisted
-                for (const member of group) {
-                    await cowork.acceptInvite(roomId, invite, {
-                        role: coworkRole,
-                        expected_cid: member.cid,
-                    });
-                }
+            const remote = remoteRoom.role_briefings[role];
+            if (remote && (remote.text !== definition.text
+                || sha256Text(remote.text) !== definition.sha256
+                || (current?.version !== undefined && remote.version !== current.version))) {
+                throw new Error(`Cowork current role briefing drift for ${role}`);
             }
+            if (!remote && current?.version !== undefined)
+                throw new Error(`Cowork current role briefing is missing for ${role}`);
+            const configured = remote ?? await cowork.setRoleBriefing(roomId, {
+                role, text: definition.text,
+            });
+            if (configured.text !== definition.text)
+                throw new Error(`Cowork returned different briefing bytes for role ${role}`);
+            updateRoomRoleBriefing(roomId, role, {
+                role, ...definition, version: configured.version, state: 'configured',
+                attempts: attempt, updated_at: configured.updated_at,
+            });
         }
         catch (error) {
-            for (const name of createdIdentities)
-                await removeMemberIdentity(name);
-            setSagaError(roomId, error instanceof Error ? error.message : String(error), 'Role-group admission failed. Retry with `task recover`.', 'member_failed');
+            updateRoomRoleBriefing(roomId, role, {
+                role, ...definition, ...(current?.version ? { version: current.version } : {}),
+                state: 'failed', attempts: attempt,
+                updated_at: new Date().toISOString(),
+                last_error: error instanceof Error ? error.message : String(error),
+            });
+            setSagaError(roomId, error instanceof Error ? error.message : String(error), 'Role briefing configuration failed. Retry task or room recover.', 'member_failed');
             if (taskId)
-                failTask(taskId, error instanceof Error ? error.message : String(error));
+                blockTask(taskId, error instanceof Error ? error.message : String(error));
             throw error;
         }
     }
-    // Phase 6: wait_seats
-    advanceSaga(roomId, 'wait_seats', 5);
+    const policy = {
+        timeoutMs: input.startupWait?.timeoutMs ?? 60_000,
+        initialDelayMs: input.startupWait?.initialDelayMs ?? 250,
+        maxDelayMs: input.startupWait?.maxDelayMs ?? 2_000,
+        now: input.startupWait?.now ?? Date.now,
+        sleep: input.startupWait?.sleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms))),
+    };
+    advanceSaga(roomId, 'join_role_groups', 5);
+    try {
+        const observedSeats = await cowork.getSeats(roomId);
+        for (const member of members) {
+            const observed = observedSeats.find(seat => seat.identity_cid === member.cid
+                && seat.seat_state !== 'removed');
+            if (observed && observed.role !== member.coworkRole)
+                throw new Error(`Cowork seat ${member.cid} has role ${observed.role}; expected ${member.coworkRole}`);
+        }
+        const admitted = new Set(observedSeats
+            .filter(seat => seat.seat_state !== 'removed').map(seat => seat.identity_cid));
+        const roleGroups = new Map();
+        for (const member of members.filter(candidate => !admitted.has(candidate.cid))) {
+            roleGroups.set(member.coworkRole, [
+                ...(roleGroups.get(member.coworkRole) ?? []), member,
+            ]);
+        }
+        const issuance = await Promise.allSettled([...roleGroups].map(async ([coworkRole, group]) => ({
+            coworkRole,
+            group,
+            ...await cowork.issueInvite(roomId, { role: coworkRole, min_accepts: group.length }),
+        })));
+        const admissions = issuance.flatMap(result => result.status === 'fulfilled' ? [result.value] : []);
+        const issuanceFailure = issuance.find(result => result.status === 'rejected');
+        if (issuanceFailure?.status === 'rejected') {
+            const cleanup = await Promise.allSettled(admissions.map(admission => cowork.revokeInvite(roomId, admission.invite_id)));
+            const cleanupFailures = cleanup.filter(result => result.status === 'rejected');
+            if (cleanupFailures.length > 0) {
+                throw new AggregateError([issuanceFailure.reason, ...cleanupFailures.map(result => result.reason)], 'role descriptor issuance failed and one or more issued descriptors could not be revoked');
+            }
+            throw issuanceFailure.reason;
+        }
+        const redemptions = await Promise.allSettled(admissions.flatMap(({ group, invite }) => group.map(member => redeemRoomInviteAsMember(member, invite, roomIdentityCid))));
+        const redemptionFailure = redemptions.find(result => result.status === 'rejected');
+        if (redemptionFailure?.status === 'rejected') {
+            const cleanup = await Promise.allSettled(admissions.map(admission => cowork.revokeInvite(roomId, admission.invite_id)));
+            const cleanupFailures = cleanup.filter(result => result.status === 'rejected');
+            if (cleanupFailures.length > 0) {
+                throw new AggregateError([redemptionFailure.reason, ...cleanupFailures.map(result => result.reason)], 'member invite redemption failed and one or more issued descriptors could not be revoked');
+            }
+            throw redemptionFailure.reason;
+        }
+        const deadline = policy.now() + policy.timeoutMs;
+        let delay = policy.initialDelayMs;
+        for (;;) {
+            const reconciled = await cowork.recoverRoom(roomId);
+            const waiting = members.some(member => {
+                const seat = reconciled.seats.find(candidate => candidate.identity_cid === member.cid && candidate.seat_state !== 'removed');
+                if (seat && seat.role !== member.coworkRole) {
+                    throw new Error(`Cowork seat ${member.cid} has role ${seat.role}; expected ${member.coworkRole}`);
+                }
+                return !seat;
+            });
+            if (!waiting)
+                break;
+            if (policy.now() >= deadline) {
+                throw new Error('Cowork did not authenticate every required room seat after invite redemption');
+            }
+            await policy.sleep(delay);
+            delay = Math.min(policy.maxDelayMs, Math.max(delay + 1, delay * 2));
+        }
+    }
+    catch (error) {
+        setSagaError(roomId, error instanceof Error ? error.message : String(error), 'Role-group admission failed. Retry with `task recover`.', 'member_failed');
+        if (taskId)
+            blockTask(taskId, error instanceof Error ? error.message : String(error));
+        throw error;
+    }
+    if (taskId && getTask(taskId).blocked)
+        unblockTask(taskId);
+    advanceSaga(roomId, 'wait_seats', 6);
     const coworkSeats = await cowork.getSeats(roomId);
     const memberCids = new Set(members.map(m => m.cid));
-    const allActive = [...memberCids].every(cid => coworkSeats.some(s => s.identity_cid === cid && s.seat_state === 'active'));
+    const allActive = [...memberCids].every(cid => coworkSeats.some(s => s.identity_cid === cid
+        && s.role === members.find(member => member.cid === cid)?.coworkRole
+        && s.seat_state === 'active'));
     if (!allActive) {
-        advanceSaga(roomId, 'wait_seats', 5, 'waiting_seats');
+        advanceSaga(roomId, 'wait_seats', 6, 'waiting_seats');
         // Seats are pending — return record for caller to retry later
         return getRoomRecord(roomId);
     }
     const activeSeats = seats.map(s => ({ ...s, seat_state: 'active' }));
     updateMemberSeats(roomId, activeSeats);
-    // Phase 7: launch_work
-    advanceSaga(roomId, 'launch_work', 6);
+    advanceSaga(roomId, 'launch_work', 7);
     try {
         for (const member of members) {
-            const briefing = buildMemberBriefing(member, input, members);
-            let refRole;
-            try {
-                refRole = findRole(cfg, member.roleRef);
-            }
-            catch { /* no ref role */ }
-            const model = member.overrides?.model ?? refRole?.model;
-            const harness = member.overrides?.harness ?? refRole?.harness;
-            const cwd = member.overrides?.cwd ?? refRole?.cwd;
-            const persona = member.overrides?.persona ?? refRole?.persona;
-            await spawnTemp({
-                name: member.name,
-                temp: true,
-                identity: member.name,
-                mission: briefing,
-                model,
-                harness,
-                cwd,
-                persona,
-                surface: 'agent',
-            }, binPath);
+            const definition = getRoomRecord(roomId).role_briefings?.[member.coworkRole];
+            if (!definition?.version)
+                throw new Error(`role ${member.coworkRole} briefing is not configured`);
+            await ensureLaunch({
+                provision: input, member, settings: settings.get(member.name),
+                gate: {
+                    room_id: roomId, room_identity_cid: existing.room_identity_cid,
+                    briefing_role: member.coworkRole, briefing_version: definition.version,
+                    briefing_sha256: definition.sha256,
+                    owner_seat_cid: existing.owner_seat_cid ?? null,
+                },
+            });
         }
     }
     catch (error) {
         setSagaError(roomId, error instanceof Error ? error.message : String(error), 'Member launch failed. Some agents may be running. Retry with `task recover`.', 'member_failed');
         throw error;
     }
-    // Phase 8: activate
-    advanceSaga(roomId, 'activate', 7);
+    const deadline = policy.now() + policy.timeoutMs;
+    let delay = policy.initialDelayMs;
+    for (;;) {
+        const history = await roomHistory(cowork, roomId);
+        let allAcknowledged = true;
+        let relayFailed = false;
+        for (const member of members) {
+            const currentRoom = getRoomRecord(roomId);
+            const definition = currentRoom.role_briefings[member.coworkRole];
+            const previous = currentRoom.member_seats
+                .find(seat => seat.role_name === member.name).briefing;
+            const result = reconcileBriefingHistory(history.records, {
+                roomId, roomIdentityCid: existing.room_identity_cid,
+                ownerSeatCid: existing.owner_seat_cid ?? null,
+                memberCid: member.cid, role: member.coworkRole,
+                version: definition.version, sha256: definition.sha256,
+            }, previous);
+            if (result.drift) {
+                setSagaError(roomId, result.drift, 'Cowork role briefing history drifted; inspect current room briefing state.', 'uncertain');
+                if (taskId)
+                    blockTask(taskId, result.drift);
+                throw new Error(result.drift);
+            }
+            updateMemberStartup(roomId, member.name, { briefing: result.briefing });
+            allAcknowledged &&= result.briefing.state === 'acknowledged';
+            relayFailed ||= result.briefing.state === 'relay_failed';
+        }
+        updateRoomHistoryCursor(roomId, history.cursor);
+        if (!history.exhausted) {
+            const reason = 'Cowork history backlog exceeded 20,000 raw records in one pass; '
+                + 'cursor progress was preserved, retry recovery to continue.';
+            setSagaError(roomId, reason, reason, 'uncertain');
+            throw new Error(reason);
+        }
+        if (relayFailed) {
+            const reason = 'Cowork recorded terminal send_failed for a role briefing; '
+                + 'same-version redelivery requires Cowork support or seat replacement.';
+            advanceSaga(roomId, 'wait_briefing_acks', 8, 'briefing_delivery_failed');
+            setSagaError(roomId, reason, reason, 'briefing_delivery_failed');
+            if (taskId)
+                blockTask(taskId, reason);
+            return getRoomRecord(roomId);
+        }
+        if (allAcknowledged)
+            break;
+        if (policy.now() >= deadline) {
+            advanceSaga(roomId, 'wait_briefing_acks', 8, 'waiting_briefing_acks');
+            return getRoomRecord(roomId);
+        }
+        advanceSaga(roomId, 'wait_briefing_acks', 8, 'waiting_briefing_acks');
+        await policy.sleep(delay);
+        delay = Math.min(policy.maxDelayMs, Math.max(delay + 1, delay * 2));
+    }
+    const finalDefinitions = new Map([...definitions].map(([role, definition]) => {
+        const persisted = getRoomRecord(roomId).role_briefings[role];
+        return [role, { ...definition, version: persisted.version }];
+    }));
+    try {
+        await assertCurrentRoleBriefings(cowork, roomId, finalDefinitions);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        setSagaError(roomId, reason, 'Cowork current role briefing drifted before activation; inspect room state.', 'uncertain');
+        if (taskId)
+            blockTask(taskId, reason);
+        throw error;
+    }
+    advanceSaga(roomId, 'activate', 9);
     const record = activateRoom(roomId);
     if (taskId)
         activateTask(taskId);
@@ -235,14 +562,8 @@ export async function cleanupMembers(input) {
     const room = getRoomRecord(input.roomId);
     if (!room)
         return;
-    for (const seat of room.member_seats) {
-        await removeMemberIdentity(seat.role_name);
-    }
-    if (input.closeCoworkRoom && input.cowork) {
-        try {
-            await input.cowork.closeRoom(input.roomId);
-        }
-        catch { /* best-effort */ }
+    if (!input.closeCoworkRoom || !input.cowork) {
+        throw new Error('member cleanup requires the shared deterministic room-close saga and Cowork adapter');
     }
-    closeRoomRecord(input.roomId);
+    await closeManagedRoom({ roomId: input.roomId, cowork: input.cowork });
 }

package/dist/rooms-tasks/room-state.d.ts

@@ -1,4 +1,4 @@
-import type { RoomOrchestrationRecord, RoomOrchestrationState, SagaPhase, RoomMemberSeat, ProvisioningDetail } from './types.js';
+import type { RoomOrchestrationRecord, RoomOrchestrationState, SagaPhase, RoomMemberSeat, ProvisioningDetail, MemberRetirementPhase, RoomClosePhase, RoomRoleBriefingDefinition, RoomMemberLaunchState, RoomMemberBriefingState } from './types.js';
 export declare const roomsDir: () => string;
 export declare class RoomStateError extends Error {
 }
@@ -12,6 +12,8 @@ export interface CreateRoomInput {
 }
 export declare function createRoomRecord(input: CreateRoomInput): RoomOrchestrationRecord;
 export declare function getRoomRecord(id: string): RoomOrchestrationRecord | undefined;
+/** Remove a terminal orchestration record from the live room inventory. */
+export declare function deleteRoomRecord(id: string): void;
 export declare function listRoomRecords(filter?: {
     state?: RoomOrchestrationState | RoomOrchestrationState[];
 }): RoomOrchestrationRecord[];
@@ -20,5 +22,15 @@ export declare function setSagaError(id: string, error: string, hint?: string, d
 export declare function setRoomIdentity(id: string, roomIdentityCid: string): RoomOrchestrationRecord;
 export declare function setOwnerSeat(id: string, ownerSeatCid: string, inviteFingerprint: string): RoomOrchestrationRecord;
 export declare function updateMemberSeats(id: string, seats: RoomMemberSeat[]): RoomOrchestrationRecord;
+export declare function updateRoomRoleBriefing(id: string, role: string, definition: RoomRoleBriefingDefinition): RoomOrchestrationRecord;
+export declare function updateRoomHistoryCursor(id: string, cursor: number): RoomOrchestrationRecord;
+export declare function updateMemberStartup(id: string, roleName: string, update: {
+    launch?: RoomMemberLaunchState;
+    briefing?: RoomMemberBriefingState;
+}): RoomOrchestrationRecord;
 export declare function activateRoom(id: string): RoomOrchestrationRecord;
 export declare function closeRoom(id: string): RoomOrchestrationRecord;
+export declare function beginRoomClose(id: string): RoomOrchestrationRecord;
+export declare function advanceMemberRetirement(id: string, roleName: string, phase: MemberRetirementPhase, launchId: string, archivePath?: string): RoomOrchestrationRecord;
+export declare function advanceRoomClose(id: string, phase: RoomClosePhase): RoomOrchestrationRecord;
+export declare function setRoomCloseError(id: string, error: string, recoveryHint: string): RoomOrchestrationRecord;