@ours.network/fleet 1.0.3 → 1.0.4

package/dist/cli.js

@@ -7,20 +7,21 @@ import { createInterface } from 'node:readline';
 import { Command } from 'commander';
 import { VERSION } from './version.js';
 import { analyzeInstalls, buildInfo, buildLabel, discoverInstalls, runningLabel, } from './provenance.js';
-import { agentDir, agentsRoot, tmpRoot, logsRoot, deriveXdgRuntimeDir, watchdogsRoot } from './paths.js';
-import { findRole, loadConfig, ROLE_NAME_RE } from './config.js';
+import { agentDir, agentsRoot, tmpRoot, logsRoot, deriveXdgRuntimeDir } from './paths.js';
+import { findRole, loadConfig } from './config.js';
 import { formatDuration } from './duration.js';
 import { resolvedPlan } from './resolved-plan.js';
 import { Tmux, tmuxArgs } from './tmux.js';
 import { pickBackend } from './supervisor/index.js';
-import { up, down, restartRoles, rmRole } from './ops.js';
+import { up, down } from './ops.js';
 import { readRestartLedger, runSupervised, runTemp } from './runner.js';
 import { executeWatchdogRun, runWatchdogAgent } from './watchdog/run.js';
 import { readSchedulerState, resetSchedulerState, runScheduler } from './watchdog/scheduler.js';
 import { partitionRestartNames } from './watchdog/config.js';
 import { WatchdogServiceManager } from './watchdog/service.js';
 import { acquireRunLock, latestReport, listRuns, readReport, releaseRunLock, reportsDir, } from './watchdog/store.js';
-import { lastProvenance, spawnDryRun, spawnPermanent, spawnTemp, } from './spawn.js';
+import { watchdogAddressable } from './watchdog/query.js';
+import { lastProvenance } from './spawn.js';
 import { stringify } from 'yaml';
 import { resolvedRolePlan } from './resolved-plan.js';
 import { creationBuildNote, formatProvenance, readProvenance } from './creation.js';
@@ -39,6 +40,11 @@ import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from './fleet-prox
 import './harness/claude-code.js'; // registers the claude-code adapter
 import './harness/codex.js'; // registers the codex adapter
 import { registerTemplateCommands, registerTaskCommands, registerRoomCommands } from './rooms-tasks/cli.js';
+import { RoleCreationService } from './application/role-creation-service.js';
+import { RoleRemovalService } from './application/role-removal-service.js';
+import { RoleRepository } from './application/role-repository.js';
+import { FleetQueryService } from './application/fleet-query-service.js';
+import { executeRestartBatch, RoleLifecycleService, } from './application/role-command-service.js';
 // sudo/su shells lack XDG_RUNTIME_DIR, breaking every systemctl/journalctl
 // --user child (supervisor commands, logs, doctor). Derive it before dispatch. (#9)
 deriveXdgRuntimeDir();
@@ -54,6 +60,12 @@ const deps = () => ({
     log: l => console.log(l),
     watchdogService: new WatchdogServiceManager(),
 });
+const roleLifecycle = (configPath, operationDeps) => {
+    const repository = new RoleRepository({ configPath });
+    const query = new FleetQueryService({ repository, supervisor: operationDeps.backend });
+    return new RoleLifecycleService({ repository, ops: operationDeps, configPath,
+        status: async (roleId) => (await query.detail(roleId)).status });
+};
 const die = (e) => { console.error(String(e instanceof Error ? e.message : e)); process.exit(1); };
 /** Exec a child with our stdio (logs/attach). */
 const passthrough = (cmd, args) => new Promise(resolve => {
@@ -333,8 +345,11 @@ cOpt(program.command('restart [names...]').description('re-sync config + bounce,
         }
         // Bare `restart` (no names) restarts every role — that meaning must
         // survive even though filtering an empty array also yields [].
-        if (names.length === 0 || roleNames.length > 0)
-            await restartRoles(cfg, roleNames, deps(), 'keep', opts.configuration);
+        if (names.length === 0 || roleNames.length > 0) {
+            const operationDeps = deps();
+            const lifecycle = roleLifecycle(opts.configuration, operationDeps);
+            await executeRestartBatch(lifecycle, { roleIds: roleNames, mode: 'keep', config: cfg });
+        }
     }
     catch (e) {
         die(e);
@@ -343,7 +358,10 @@ cOpt(program.command('restart [names...]').description('re-sync config + bounce,
 cOpt(program.command('force-restart [names...]').description('re-sync + bounce FRESH (context wiped)'))
     .action(async (names, opts) => {
     try {
-        await restartRoles(loadConfig(opts.configuration), names, deps(), 'fresh', opts.configuration);
+        const cfg = loadConfig(opts.configuration);
+        const operationDeps = deps();
+        const lifecycle = roleLifecycle(opts.configuration, operationDeps);
+        await executeRestartBatch(lifecycle, { roleIds: names, mode: 'fresh', config: cfg });
     }
     catch (e) {
         die(e);
@@ -963,12 +981,12 @@ cOpt(ownerAuthorizationCommand.command('revoke <Role> <contact-cid>')
  * store.ts's own `watchdogDir` choke-point guard (defense in depth).
  */
 function watchdogKnown(name, configPath) {
+    let configured = [];
     try {
-        if (loadConfig(configPath).watchdogs.some(w => w.name === name))
-            return true;
+        configured = loadConfig(configPath).watchdogs.map(w => w.name);
     }
     catch { /* config missing/broken: fall through to the store check */ }
-    return ROLE_NAME_RE.test(name) && existsSync(joinPath(watchdogsRoot(), name));
+    return watchdogAddressable(name, configured);
 }
 function renderHeldDownLine(state) {
     if (!state.heldDown)
@@ -1096,7 +1114,9 @@ cOpt(program.command('watchdog-report <name> [runId]')
 cOpt(program.command('rm <name>').description('stop + remove a role (temporary evidence is archived)'))
     .action(async (name, opts) => {
     try {
-        await rmRole(loadConfig(opts.configuration), name, deps());
+        await new RoleRemovalService({ configPath: opts.configuration, ops: deps() }).removeDirect({
+            actor: { kind: 'local_control', surface: 'cli' }, role: name,
+        });
     }
     catch (e) {
         die(e);
@@ -1152,8 +1172,11 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
         };
         if (o.json && !o.dryRun)
             throw new Error('--json is currently valid only with --dry-run');
+        const creationDeps = deps();
+        const creation = new RoleCreationService({ configPath: opts.configuration,
+            ops: creationDeps, binPath, journal: false });
         if (o.dryRun) {
-            const result = spawnDryRun(o);
+            const result = creation.previewSpawn({ origin: 'direct', options: o }).preview;
             if (o.json) {
                 process.stdout.write(`${JSON.stringify({
                     schemaVersion: result.schemaVersion,
@@ -1196,13 +1219,14 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
             console.log(`→ watch it: ours-fleet peek ${result.role}   |   attach: ours-fleet attach ${result.role}`);
             return;
         }
-        const plannedPermissionMode = effectivePermissionMode(spawnDryRun(o).resolvedRole);
+        const created = await creation.createDirect(o);
+        const plannedPermissionMode = effectivePermissionMode(created.plan.preview.resolvedRole);
         if (o.temp) {
-            const dir = await spawnTemp(o, binPath);
+            const dir = created.statePath;
             console.log(`spawned temp agent '${roleName}' (state: ${dir}; gone on exit/reboot)`);
         }
         else {
-            const file = await spawnPermanent(o, deps());
+            const file = created.statePath;
             console.log(`spawned '${roleName}' (config: ${file})`);
         }
         // The same provenance that was persisted, so what the operator reads now

package/dist/index.d.ts

@@ -19,7 +19,7 @@ export { RoleRepository } from './application/role-repository.js';
 export { FleetQueryService } from './application/fleet-query-service.js';
 export { AcpRoleSessionAdapter, TmuxRoleSessionAdapter } from './application/session-control.js';
 export { RoleCreationService } from './application/role-creation-service.js';
-export { RoleCommandService } from './application/role-command-service.js';
+export { RoleCommandService, RoleLifecycleService } from './application/role-command-service.js';
 export { StructuredLogService } from './application/log-service.js';
 export { roleCapabilities } from './application/capabilities.js';
 export { FleetError, normalizeError } from './application/errors.js';

package/dist/index.js

@@ -15,7 +15,7 @@ export { RoleRepository } from './application/role-repository.js';
 export { FleetQueryService } from './application/fleet-query-service.js';
 export { AcpRoleSessionAdapter, TmuxRoleSessionAdapter } from './application/session-control.js';
 export { RoleCreationService } from './application/role-creation-service.js';
-export { RoleCommandService } from './application/role-command-service.js';
+export { RoleCommandService, RoleLifecycleService } from './application/role-command-service.js';
 export { StructuredLogService } from './application/log-service.js';
 export { roleCapabilities } from './application/capabilities.js';
 export { FleetError, normalizeError } from './application/errors.js';

package/dist/owner-channel/channel.d.ts

@@ -19,6 +19,8 @@ export interface OwnerChannelOptions {
     client?: OursOps;
     /** Test seam; production uses the detached ours-fleet CLI (`fleetCliOps`). */
     fleet?: OwnerFleetOps;
+    /** Read-only restart validation; production uses the shared lifecycle service. */
+    prepareRestart?: (role: string, mode: 'keep' | 'fresh') => Promise<void>;
     /** Forwarded to fleet CLI invocations spawned for owner commands. */
     configPath?: string;
     /** Deterministic clock/process seams for binder handoff tests. */
@@ -164,6 +166,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private binder?;
     private binderOwnedInternally;
     private readonly fleetOps;
+    private readonly prepareRestart;
     constructor(options: OwnerChannelOptions);
     start(): Promise<void>;
     drain(): Promise<void>;
@@ -222,7 +225,9 @@ export declare class OwnerChannel implements OwnerChannelHandle {
      * before an external worker starts a saga that can retire this process.
      */
     private closeRoomFromOwner;
+    private recoverRoomFromOwner;
     /** Carry a task terminal request through a worker that survives this role. */
+    private recoverTaskFromOwner;
     private terminalTaskFromOwner;
     /** Code-point-safe tail of the worklog, or undefined when there is none. */
     private readWorklogTail;

package/dist/owner-channel/channel.js

@@ -4,9 +4,15 @@ import { mkdir, readFile, readdir, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { DEFAULT_OWNER_ATTACHMENT_MIME, canonicalCid, } from '../config.js';
 import { replaceFileAtomically } from '../atomic-file.js';
-import { ACP_CANCEL_DEADLINE_EXCEEDED, SessionControlError, interruptOutcome, } from '../session/types.js';
+import { TaskRoomApplicationService } from '../application/task-room-service.js';
+import { RoleLifecycleService } from '../application/role-command-service.js';
+import { RoleRepository } from '../application/role-repository.js';
+import { FleetQueryService } from '../application/fleet-query-service.js';
+import { interruptSession, queueSessionPrompt } from '../application/session-mutations.js';
+import { pickBackend } from '../supervisor/index.js';
+import { ACP_CANCEL_DEADLINE_EXCEEDED, SessionControlError, } from '../session/types.js';
 import { VERSION } from '../version.js';
-import { renderMarkdownFailure, renderMarkdownResult, taskStatus, } from '../rooms-tasks/markdown.js';
+import { renderMarkdownFailure, renderMarkdownResult, roomStatus, taskStatus, } from '../rooms-tasks/markdown.js';
 import { dispatchOwnerCommand, fleetCliOps, isOwnerCommandText, } from './commands.js';
 import { OURS_BOUND_ELSEWHERE, OursSdkClient, oursErrorCode, } from './ours-client.js';
 import { ownerNotices, } from './notices.js';
@@ -74,10 +80,21 @@ export class OwnerChannel {
     binder;
     binderOwnedInternally = false;
     fleetOps;
+    prepareRestart;
     constructor(options) {
         this.options = options;
         this.client = options.client ?? new OursSdkClient(options.env, line => options.log(`[${options.role}] owner channel ${line}`));
         this.fleetOps = options.fleet ?? fleetCliOps(options.role, options.configPath);
+        this.prepareRestart = options.prepareRestart ?? (async (role, mode) => {
+            const backend = pickBackend();
+            const repository = new RoleRepository({ configPath: options.configPath });
+            const query = new FleetQueryService({ repository, supervisor: backend });
+            const lifecycle = new RoleLifecycleService({ repository,
+                ops: { backend, binPath: process.argv[1], log: options.log },
+                configPath: options.configPath,
+                status: async (roleId) => (await query.detail(roleId)).status });
+            await lifecycle.prepareRestart({ roleIds: [role], mode });
+        });
         this.state = new OwnerChannelState(join(options.stateDir, '.owner-channel-state.json'));
         this.authorizations = new OwnerAuthorizationState(join(options.stateDir, '.owner-channel-owners.json'), options.config.owners);
         this.conversations = new OwnerConversationState(join(options.stateDir, '.owner-channel-conversations.json'));
@@ -793,7 +810,7 @@ export class OwnerChannel {
             outbox = this.outboxDir(originWireId);
             await mkdir(outbox, { recursive: true, mode: 0o700 });
             const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
-            const queued = await this.options.session.queuePrompt(this.ownerAttachmentPrompt(sender, originWireId, requestId, admitted, group.caption), {
+            const queued = await queueSessionPrompt(this.options.session, this.ownerAttachmentPrompt(sender, originWireId, requestId, admitted, group.caption), {
                 interrupt: this.options.config.interrupt,
                 ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
                 origin: { kind: 'owner', requestId,
@@ -918,7 +935,7 @@ export class OwnerChannel {
         let queued;
         const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
         try {
-            queued = await this.options.session.queuePrompt(this.ownerPrompt(sender, text, wireId), {
+            queued = await queueSessionPrompt(this.options.session, this.ownerPrompt(sender, text, wireId), {
                 interrupt: this.options.config.interrupt,
                 ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
                 origin: { kind: 'owner', requestId, displayText: text },
@@ -977,7 +994,7 @@ export class OwnerChannel {
             harness: this.options.harness,
             version: VERSION,
             snapshot: () => this.options.session.snapshot(),
-            interrupt: async () => interruptOutcome(await this.options.session.interrupt('owner')),
+            interrupt: () => interruptSession(this.options.session, 'owner'),
             runHarnessCommand: command => this.runHarnessCommand(sender, command, wireId),
             restart: mode => this.restartSelf(sender, mode, wireId),
             comments: () => this.commentsState(),
@@ -990,7 +1007,37 @@ export class OwnerChannel {
             },
             fleetList: () => this.fleetOps.list(),
             closeRoom: roomId => this.closeRoomFromOwner(sender, roomId, wireId),
+            recoverRoom: roomId => this.recoverRoomFromOwner(sender, roomId, wireId),
             terminalTask: (taskId, kind, outcome) => this.terminalTaskFromOwner(sender, taskId, kind, outcome, wireId),
+            recoverTask: taskId => this.recoverTaskFromOwner(sender, taskId, wireId),
+            createTask: input => new TaskRoomApplicationService(this.options.configPath).createTask({
+                ...input,
+                actor: { kind: 'authenticated_owner', surface: 'messenger', cid: sender.id },
+            }),
+            startTask: taskId => new TaskRoomApplicationService(this.options.configPath).startTask({
+                actor: { kind: 'authenticated_owner', surface: 'messenger', cid: sender.id }, taskId,
+            }),
+            listTasks: filter => new TaskRoomApplicationService(this.options.configPath).listTasks(filter),
+            getTask: taskId => new TaskRoomApplicationService(this.options.configPath).getTask(taskId),
+            blockTask: (taskId, reason) => new TaskRoomApplicationService(this.options.configPath).blockTask({
+                actor: { kind: 'authenticated_owner', surface: 'messenger', cid: sender.id }, taskId, reason,
+            }),
+            unblockTask: taskId => new TaskRoomApplicationService(this.options.configPath).unblockTask({
+                actor: { kind: 'authenticated_owner', surface: 'messenger', cid: sender.id }, taskId,
+            }),
+            reviewTask: taskId => new TaskRoomApplicationService(this.options.configPath).reviewTask({
+                actor: { kind: 'authenticated_owner', surface: 'messenger', cid: sender.id }, taskId,
+            }),
+            deleteTask: taskId => new TaskRoomApplicationService(this.options.configPath).deleteTask({
+                actor: { kind: 'authenticated_owner', surface: 'messenger', cid: sender.id }, taskId,
+            }),
+            listRoomQueries: filter => new TaskRoomApplicationService(this.options.configPath).listRooms(filter),
+            getRoomQuery: id => new TaskRoomApplicationService(this.options.configPath).getRoomDetail(id),
+            listTemplateQueries: () => new TaskRoomApplicationService(this.options.configPath).listTemplates(),
+            getTemplateQuery: name => new TaskRoomApplicationService(this.options.configPath).getTemplate(name),
+            createRoom: input => new TaskRoomApplicationService(this.options.configPath).createRoom({
+                ...input, actor: { kind: 'authenticated_owner', surface: 'messenger', cid: sender.id },
+            }),
             recentEvents: limit => this.options.session.eventsSince(0).slice(-limit),
             readWorklogTail: maxChars => this.readWorklogTail(maxChars),
             reply: async (replyText) => { await this.send(sender.id, replyText, wireId); },
@@ -1009,7 +1056,7 @@ export class OwnerChannel {
     /** Queue raw slash text to the harness and report the turn's outcome. */
     async runHarnessCommand(sender, command, wireId) {
         const requestId = this.requestId(wireId);
-        const queued = await this.options.session.queuePrompt(command, {
+        const queued = await queueSessionPrompt(this.options.session, command, {
             origin: { kind: 'owner', requestId },
         });
         this.inFlight.add(wireId);
@@ -1036,6 +1083,7 @@ export class OwnerChannel {
      */
     async restartSelf(sender, mode, wireId) {
         const command = mode === 'fresh' ? '/force-restart' : '/restart';
+        await this.prepareRestart(this.options.role, mode);
         await this.send(sender.id, ownerNotices.restarting(this.options.role, command, mode), wireId);
         this.state.remember(wireId);
         this.options.log(`[${this.options.role}] owner requested ${command}`);
@@ -1046,8 +1094,9 @@ export class OwnerChannel {
      * before an external worker starts a saga that can retire this process.
      */
     async closeRoomFromOwner(sender, roomId, wireId) {
-        const { acceptManagedRoomClose, recordManagedRoomCloseError } = await import('../rooms-tasks/close.js');
-        await acceptManagedRoomClose(roomId);
+        const app = new TaskRoomApplicationService(this.options.configPath);
+        const actor = { kind: 'authenticated_owner', surface: 'messenger', cid: sender.id };
+        await app.requestRoomDeletion({ actor, roomId });
         await this.send(sender.id, renderMarkdownFailure({
             kind: 'pending', subject: `/room delete ${roomId} ${roomId}`,
             detail: 'The deletion request was accepted and is still being settled.',
@@ -1058,24 +1107,97 @@ export class OwnerChannel {
             await this.fleetOps.closeRoom(roomId);
         }
         catch (error) {
-            await recordManagedRoomCloseError(roomId, error instanceof Error ? error.message : String(error), `External delete worker failed to start. Retry /room delete ${roomId} ${roomId}.`);
+            await app.recordRoomSettlementError({ actor, roomId,
+                error: error instanceof Error ? error.message : String(error),
+                recoveryHint: `External delete worker failed to start. Retry /room delete ${roomId} ${roomId}.` });
             throw error;
         }
     }
+    async recoverRoomFromOwner(sender, roomId, wireId) {
+        const app = new TaskRoomApplicationService(this.options.configPath);
+        const actor = { kind: 'authenticated_owner', surface: 'messenger', cid: sender.id };
+        const result = await app.recoverRoom({ actor, roomId });
+        if (result.kind === 'deletion_worker_required') {
+            await this.send(sender.id, renderMarkdownFailure({ kind: 'pending',
+                subject: `/room recover ${roomId}`,
+                detail: 'The deletion recovery is still being settled.',
+                action: `Run /room recover ${roomId} if deletion remains pending.` }), wireId);
+            this.state.remember(wireId);
+            try {
+                await this.fleetOps.closeRoom(roomId);
+            }
+            catch (error) {
+                await app.recordRoomSettlementError({ actor, roomId,
+                    error: error instanceof Error ? error.message : String(error),
+                    recoveryHint: `External delete worker failed to start. Retry /room delete ${roomId} ${roomId}.` });
+                throw error;
+            }
+            return;
+        }
+        const r = result.orchestration;
+        await this.send(sender.id, renderMarkdownResult({ icon: '🛟', title: 'Room recovery',
+            fields: [{ label: 'Room', value: result.room.room_id, kind: 'code' },
+                { label: 'Status', value: roomStatus(result.room.state), kind: 'markdown' },
+                ...(r ? [{ label: 'Saga', value: r.saga.phase, kind: 'code' }] : [])],
+            sections: result.issues.length ? [{ heading: 'Next steps', items: result.issues }]
+                : [{ heading: 'Result', items: ['No recovery action is needed.'] }] }), wireId);
+        this.state.remember(wireId);
+    }
     /** Carry a task terminal request through a worker that survives this role. */
+    async recoverTaskFromOwner(sender, taskId, wireId) {
+        const app = new TaskRoomApplicationService(this.options.configPath);
+        const actor = { kind: 'authenticated_owner', surface: 'messenger', cid: sender.id };
+        const begin = await app.beginTaskRecovery({ actor, taskId });
+        if (begin.kind === 'terminal_worker_required') {
+            await this.send(sender.id, renderMarkdownFailure({
+                kind: 'pending', subject: `/task recover ${taskId}`,
+                detail: 'The recovery request was accepted and is still being settled.',
+                action: `Run /task recover ${taskId} if it remains pending.`,
+            }), wireId);
+            this.state.remember(wireId);
+            try {
+                await this.fleetOps.recoverTask(taskId);
+            }
+            catch (error) {
+                await app.recordSettlementError({ actor, taskId,
+                    error: error instanceof Error ? error.message : String(error),
+                    recoveryHint: `External settle worker failed to start. Retry /task recover ${taskId}.` });
+                throw error;
+            }
+            return;
+        }
+        const { task, room, issues } = begin.result;
+        const hints = issues.map(issue => issue.code === 'waiting_cowork' ? 'Cowork socket unreachable'
+            : issue.code === 'waiting_owner_invite' ? 'Owner invite missing or invalid'
+                : issue.code === 'owner_cid_mismatch' ? 'Owner CID mismatch'
+                    : issue.code === 'member_failed' ? `Member failed at step ${issue.stepIndex}`
+                        : issue.code === 'resume_failed' ? `Resume failed: ${issue.error}`
+                            : issue.code === 'provisioning_resumed' ? 'Provisioning resumed successfully'
+                                : issue.code);
+        await this.send(sender.id, renderMarkdownResult({
+            icon: '🛟', title: 'Task recovery',
+            fields: [{ label: 'Task', value: task.task_id, kind: 'code' },
+                { label: 'Status', value: taskStatus(task.state), kind: 'markdown' },
+                ...(room ? [{ label: 'Room', value: room.room_id, kind: 'code' },
+                    { label: 'Room status', value: roomStatus(room.state), kind: 'markdown' },
+                    { label: 'Saga', value: room.saga.phase, kind: 'code' }] : [])],
+            sections: hints.length ? [{ heading: 'Next steps', items: hints }]
+                : [{ heading: 'Result', items: ['No automated recovery action is available.'] }],
+        }), wireId);
+        this.state.remember(wireId);
+    }
     async terminalTaskFromOwner(sender, taskId, kind, outcome, wireId) {
-        const { getTask } = await import('../rooms-tasks/task-state.js');
-        const { acceptTaskTerminalIntent, recordTaskTerminalIntentError, } = await import('../rooms-tasks/terminal.js');
-        const task = getTask(taskId);
-        const accepted = await acceptTaskTerminalIntent({
-            taskId, kind, roomId: task.room_id, outcome,
-        });
-        if (accepted.terminal_intent?.status === 'settled') {
+        const app = new TaskRoomApplicationService(this.options.configPath);
+        const actor = { kind: 'authenticated_owner', surface: 'messenger', cid: sender.id };
+        const plan = kind === 'done'
+            ? await app.completeTask({ actor, taskId, outcome })
+            : await app.cancelTask({ actor, taskId });
+        if (!plan.settlementRequired) {
             await this.send(sender.id, renderMarkdownResult({
                 icon: '📋', title: 'Task terminal action complete',
                 fields: [
                     { label: 'ID', value: taskId, kind: 'code' },
-                    { label: 'Status', value: taskStatus(accepted.state), kind: 'markdown' },
+                    { label: 'Status', value: taskStatus(plan.task.state), kind: 'markdown' },
                 ],
             }), wireId);
             this.state.remember(wireId);
@@ -1091,7 +1213,10 @@ export class OwnerChannel {
             await this.fleetOps.settleTask(taskId);
         }
         catch (error) {
-            await recordTaskTerminalIntentError(taskId, error instanceof Error ? error.message : String(error), `External settle worker failed to start. Retry the identical task command or run task recover ${taskId}.`);
+            await app.recordSettlementError({
+                actor, taskId, error: error instanceof Error ? error.message : String(error),
+                recoveryHint: `External settle worker failed to start. Retry the identical task command or run task recover ${taskId}.`,
+            });
             throw error;
         }
     }

package/dist/owner-channel/commands.d.ts

@@ -1,6 +1,8 @@
 import type { InterruptOutcome, SessionEvent, SessionSnapshot } from '../session/types.js';
-import type { TaskOutcome, TaskTerminalIntent } from '../rooms-tasks/types.js';
+import type { RoomOrchestrationRecord, TaskOutcome, TaskRecord, TaskTerminalIntent } from '../rooms-tasks/types.js';
 import { type OwnerCommentsState } from './notices.js';
+import type { CreateRoomRequest, CreateTaskRequest, TaskRoomApplicationService } from '../application/task-room-service.js';
+import type { TaskState } from '../rooms-tasks/types.js';
 /**
  * Fleet-level effects a deterministic owner command may trigger. Production
  * uses the detached CLI (`fleetCliOps`); tests inject fakes so no command can
@@ -15,6 +17,7 @@ export interface OwnerFleetOps {
     closeRoom(roomId: string): Promise<void>;
     /** Resume a task terminal intent outside the caller role's supervisor lifecycle. */
     settleTask(taskId: string): Promise<void>;
+    recoverTask(taskId: string): Promise<void>;
 }
 /**
  * The narrow capability surface a command executor sees. Everything here is
@@ -47,8 +50,30 @@ export interface OwnerCommandContext {
     fleetList(): Promise<string>;
     /** Persist acceptance, acknowledge it, then launch the external close worker. */
     closeRoom(roomId: string): Promise<void>;
+    recoverRoom(roomId: string): Promise<void>;
     /** Persist terminal intent, acknowledge it, then launch the external settle worker. */
     terminalTask(taskId: string, kind: TaskTerminalIntent['kind'], outcome?: TaskOutcome): Promise<void>;
+    recoverTask(taskId: string): Promise<void>;
+    createTask(input: Omit<CreateTaskRequest, 'actor'>): Promise<TaskRecord>;
+    startTask(taskId: string): Promise<TaskRecord>;
+    listTasks(filter?: {
+        state?: TaskState | TaskState[];
+    }): TaskRecord[];
+    getTask(taskId: string): {
+        task: TaskRecord;
+        orchestration: RoomOrchestrationRecord | undefined;
+    };
+    blockTask(taskId: string, reason: string): TaskRecord;
+    unblockTask(taskId: string): TaskRecord;
+    reviewTask(taskId: string): TaskRecord;
+    deleteTask(taskId: string): boolean;
+    listRoomQueries(filter?: {
+        state?: 'active' | 'provisioning';
+    }): ReturnType<TaskRoomApplicationService['listRooms']>;
+    getRoomQuery(id: string): ReturnType<TaskRoomApplicationService['getRoomDetail']>;
+    listTemplateQueries(): ReturnType<TaskRoomApplicationService['listTemplates']>;
+    getTemplateQuery(name: string): ReturnType<TaskRoomApplicationService['getTemplate']>;
+    createRoom(input: Omit<CreateRoomRequest, 'actor'>): Promise<RoomOrchestrationRecord>;
     recentEvents(limit: number): SessionEvent[];
     readWorklogTail(maxChars: number): Promise<string | undefined>;
     reply(text: string): Promise<void>;