@ours.network/fleet 1.1.0-nightly.12 → 1.1.0-nightly.13

package/dist/owner-channel/commands.d.ts

@@ -17,6 +17,8 @@ export interface OwnerFleetOps {
     closeRoom(roomId: string): Promise<void>;
     /** Resume a task terminal intent outside the caller role's supervisor lifecycle. */
     settleTask(taskId: string): Promise<void>;
+    /** Settle an accepted task deletion outside the caller role's supervisor lifecycle. */
+    settleTaskDeletion(taskId: string): Promise<void>;
     recoverTask(taskId: string): Promise<void>;
 }
 /**
@@ -84,7 +86,8 @@ export interface OwnerCommandContext {
     blockTask(taskId: string, reason: string): TaskRecord;
     unblockTask(taskId: string): TaskRecord;
     reviewTask(taskId: string): TaskRecord;
-    deleteTask(taskId: string): boolean;
+    /** Accept a permanent any-state deletion, acknowledge it, then launch the external delete worker. */
+    deleteTask(taskId: string): Promise<void>;
     listRoomQueries(filter?: {
         state?: 'active' | 'provisioning';
     }): ReturnType<TaskRoomApplicationService['listRooms']>;

package/dist/owner-channel/commands.js

@@ -36,7 +36,7 @@ function isKnownOwnerTaskState(message) {
         /^task is not blocked$/u,
         new RegExp(`^task ${SAFE_ID_WORD} already has a conflicting '(?:done|cancelled)' terminal intent$`, 'u'),
         new RegExp(`^task ${SAFE_ID_WORD} is already in terminal state '${TASK_STATE_WORD}'$`, 'u'),
-        new RegExp(`^cannot delete a '${TASK_STATE_WORD}' task; only 'done' tasks can be deleted$`, 'u'),
+        new RegExp(`^task ${SAFE_ID_WORD} is pending deletion; run 'ours-fleet task delete ${SAFE_ID_WORD} ${SAFE_ID_WORD}' to retry cleanup$`, 'u'),
     ].some(pattern => pattern.test(message));
 }
 function isKnownOwnerRoomState(message) {
@@ -461,11 +461,7 @@ export const ownerCommands = [
                     case 'delete': {
                         if (rest.length !== 2 || rest[0] !== rest[1])
                             throw new OwnerCommandUsageError('destructive: /task delete <id> <id> — provide the task ID twice');
-                        const deleted = ctx.deleteTask(rest[0]);
-                        await ctx.reply(renderMarkdownResult({
-                            icon: '🗑️', title: deleted ? 'Task deleted' : 'Task already absent',
-                            fields: [{ label: 'ID', value: rest[0], kind: 'code' }],
-                        }));
+                        await ctx.deleteTask(rest[0]);
                         break;
                     }
                     case 'recover': {
@@ -734,6 +730,7 @@ export function fleetCliOps(role, configPath) {
         }),
         closeRoom: roomId => launchFleetWorker(['room', '_delete', roomId], `room-delete-${roomId}`, configPath),
         settleTask: taskId => launchFleetWorker(['task', '_settle', taskId], `task-settle-${taskId}`, configPath),
+        settleTaskDeletion: taskId => launchFleetWorker(['task', '_settle_delete', taskId], `task-delete-${taskId}`, configPath),
         recoverTask: taskId => launchFleetWorker(['task', '_recover', taskId], `task-recover-${taskId}`, configPath),
     };
 }

package/dist/rooms-tasks/cli.js

@@ -29,13 +29,14 @@ function commandArgv(command) {
         root = root.parent;
     return root.rawArgs ?? process.argv.slice(2);
 }
-import { getTask, activateTask, TaskStateError, } from './task-state.js';
+import { getTask, getDeletingTask, activateTask, TaskStateError, } from './task-state.js';
 import { createRoomRecord, getRoomRecord, advanceSaga, setOwnerSeat, setSagaError, activateRoom, RoomStateError, } from './room-state.js';
 import { createCoworkAdapter, CoworkProtocolError } from './cowork-adapter.js';
 import { markdownCode, markdownProse, renderMarkdownFailure, renderMarkdownList, renderMarkdownResult, roomStatus, taskStatus, } from './markdown.js';
 import { TaskRoomApplicationError, TaskRoomApplicationService } from '../application/task-room-service.js';
 import { TaskListError } from './task-lists.js';
 import { recordFleetAuditFailure, recordFleetAuditPresentation, recordFleetAuditResource, } from '../fleet-command-audit.js';
+import { renderAgentConfiguration } from '../lifecycle-summary.js';
 class TaskRoomPublicError extends Error {
     code;
     fields;
@@ -152,7 +153,7 @@ function isKnownTaskStateMessage(message) {
         new RegExp(`^task ${SAFE_ID_WORD} is not tied to room ${SAFE_ID_WORD}$`, 'u'),
         new RegExp(`^task ${SAFE_ID_WORD} has no terminal intent$`, 'u'),
         new RegExp(`^task ${SAFE_ID_WORD} reached terminal state '${TASK_STATE_WORD}' outside its intent$`, 'u'),
-        new RegExp(`^cannot delete a '${TASK_STATE_WORD}' task; only 'done' tasks can be deleted$`, 'u'),
+        new RegExp(`^task ${SAFE_ID_WORD} is pending deletion; run 'ours-fleet task delete ${SAFE_ID_WORD} ${SAFE_ID_WORD}' to retry cleanup$`, 'u'),
     ].some(pattern => pattern.test(message));
 }
 function isKnownRoomStateMessage(message) {
@@ -240,6 +241,14 @@ const taskActionMarkdown = (title, task, fields = []) => {
         ],
     });
 };
+/**
+ * Shared launch-configuration line for CLI member listings. Pre-upgrade seats
+ * without a captured presentation keep the minimal listing rather than
+ * claiming resolved facts. Output is already escaped (markdownItems boundary).
+ */
+function seatConfigurationSuffix(presentation) {
+    return presentation ? ` — ${renderAgentConfiguration(presentation)}` : '';
+}
 function safeSelectionSummary(definition, kind) {
     const selected = definition?.[kind];
     if (!selected || typeof selected !== 'object' || Array.isArray(selected))
@@ -279,6 +288,7 @@ function auditTask(operation, task, previousState, newState = task.state, revisi
         recordFleetAuditResource('room', task.room_id);
     const room = task.room_id ? getRoomRecord(task.room_id) : undefined;
     const definitions = new Map(room?.member_seats.map(seat => [seat.role_name, seat.launch?.agent_definition]) ?? []);
+    const presentations = new Map(room?.member_seats.map(seat => [seat.role_name, seat.launch?.presentation]) ?? []);
     const semanticOperation = operation === 'recover'
         ? newState === 'active' ? 'work' : newState === 'done' ? 'done'
             : newState === 'cancelled' ? 'cancel' : undefined
@@ -294,7 +304,8 @@ function auditTask(operation, task, previousState, newState = task.state, revisi
             brain: safeSelectionSummary(definitions.get(member.name), 'brain'),
             role: safeSelectionSummary(definitions.get(member.name), 'role') === 'unresolved'
                 ? member.cowork_role : safeSelectionSummary(definitions.get(member.name), 'role'),
-            permissions: safePermissionsSummary(definitions.get(member.name)) })) });
+            permissions: safePermissionsSummary(definitions.get(member.name)),
+            configuration: presentations.get(member.name) })) });
 }
 function auditRoom(operation, room, previousState, newState = room.state) {
     if (previousState === newState)
@@ -314,7 +325,8 @@ function auditRoom(operation, room, previousState, newState = room.state) {
             brain: safeSelectionSummary(member.launch?.agent_definition, 'brain'),
             role: safeSelectionSummary(member.launch?.agent_definition, 'role') === 'unresolved'
                 ? member.cowork_role : safeSelectionSummary(member.launch?.agent_definition, 'role'),
-            permissions: safePermissionsSummary(member.launch?.agent_definition) })) });
+            permissions: safePermissionsSummary(member.launch?.agent_definition),
+            configuration: member.launch?.presentation })) });
 }
 const roomActionMarkdown = (title, room, fields = []) => {
     recordFleetAuditResource('room', room.room_id);
@@ -365,6 +377,49 @@ async function launchTaskSettleWorker(taskId, configPath) {
         eventId: task.terminal_intent?.accepted_at ?? task.created_at });
     return { task, timedOut: true };
 }
+/** Launch the deletion settle worker and wait boundedly for physical absence. */
+async function launchTaskDeleteWorker(taskId, configPath) {
+    const readDeletion = () => {
+        try {
+            const task = getDeletingTask(taskId);
+            return { present: true, errorAt: task.deletion?.error_at, error: task.deletion?.error };
+        }
+        catch (error) {
+            // Only proven physical absence counts as deleted; anything else propagates.
+            if (error instanceof TaskStateError && /task not found/.test(error.message))
+                return { present: false };
+            throw error;
+        }
+    };
+    const before = readDeletion();
+    if (!before.present)
+        return { deleted: true, timedOut: false };
+    try {
+        await launchFleetWorker(['task', '_settle_delete', taskId], `task-delete-${taskId}`, configPath);
+    }
+    catch (error) {
+        await taskRoomService(configPath).recordDeletionError({
+            actor: { kind: 'local_control', surface: 'cli' }, taskId, error: errorText(error),
+            recoveryHint: `External delete worker failed to start. Retry task delete ${taskId} ${taskId}.`,
+        }).catch(() => { });
+        recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Task', id: taskId,
+            state: 'deleting', category: 'settlement_failed', eventId: new Date().toISOString() });
+        throw error;
+    }
+    const deadline = Date.now() + PUBLIC_SETTLE_WAIT_MS;
+    while (Date.now() < deadline) {
+        const current = readDeletion();
+        if (!current.present)
+            return { deleted: true, timedOut: false };
+        if (current.errorAt !== before.errorAt && current.error) {
+            throw new TaskStateError(current.error);
+        }
+        await sleep(PUBLIC_SETTLE_POLL_MS);
+    }
+    recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Task', id: taskId,
+        state: 'deleting', category: 'settlement_pending', eventId: new Date().toISOString() });
+    return { deleted: false, timedOut: true };
+}
 async function launchRoomDeleteWorker(roomId, configPath) {
     const previousErrorAt = getRoomRecord(roomId)?.close?.error_at;
     try {
@@ -831,7 +886,9 @@ export function registerTaskCommands(parent, cOpt) {
                 ],
                 sections: [
                     ...(t.member_roles.length ? [{
-                            heading: 'Members', markdownItems: t.member_roles.map(m => `${markdownCode(m.name)} — ${markdownProse(m.cowork_role)} — ${markdownCode(m.identity_cid)}`),
+                            heading: 'Members', markdownItems: t.member_roles.map(m => `${markdownCode(m.name)} — ${markdownProse(m.cowork_role)} — ${markdownCode(m.identity_cid)}`
+                                + seatConfigurationSuffix(room?.member_seats
+                                    .find(seat => seat.role_name === m.name)?.launch?.presentation)),
                         }] : []),
                     ...(room ? roomStartupSections(room) : []),
                 ],
@@ -1030,28 +1087,46 @@ export function registerTaskCommands(parent, cOpt) {
         }
     });
     cOpt(taskCmd.command('delete <id> <confirm-id>'))
-        .description('delete a done task from the backlog (requires ID twice for confirmation)')
+        .description('permanently delete a task in any lifecycle state (requires ID twice for confirmation)')
         .option('--json', 'JSON output')
-        .action((id, confirmId, opts) => {
+        .action(async (id, confirmId, opts) => {
         try {
             if (id !== confirmId)
                 throw taskRoomPublicError('task_confirmation_mismatch');
-            let prior;
-            try {
-                prior = getTask(id);
-            }
-            catch { /* idempotent already-absent delete */ }
-            const deleted = taskRoomService().deleteTask({
+            const accepted = await taskRoomService(opts.configuration).requestTaskDeletion({
                 actor: { kind: 'local_control', surface: 'cli' }, taskId: id,
             });
-            if (prior)
-                auditTask('delete', prior, prior.state, 'deleted');
+            if (accepted.status === 'already_absent') {
+                if (opts.json) {
+                    console.log(JSON.stringify({
+                        schema_version: 1, task_id: id, deleted: false, already_absent: true,
+                    }, null, 2));
+                    return;
+                }
+                console.log(renderMarkdownResult({
+                    icon: '🗑️', title: 'Task already absent',
+                    fields: [{ label: 'ID', value: id, kind: 'code' }],
+                }));
+                return;
+            }
+            const settled = await launchTaskDeleteWorker(id, opts.configuration);
             if (opts.json) {
-                console.log(JSON.stringify({ schema_version: 1, task_id: id, deleted }, null, 2));
+                console.log(JSON.stringify({
+                    schema_version: 1, task_id: id, accepted: true,
+                    deleted: settled.deleted, pending: settled.timedOut,
+                }, null, 2));
+                return;
+            }
+            if (!settled.deleted) {
+                console.log(renderMarkdownFailure({
+                    kind: 'pending', subject: `task delete ${id} ${id}`,
+                    detail: 'The deletion was accepted and cleanup is still settling.',
+                    action: `Re-run ours-fleet task delete ${id} ${id} or ours-fleet task recover ${id}.`,
+                }));
                 return;
             }
             console.log(renderMarkdownResult({
-                icon: '🗑️', title: deleted ? 'Task deleted' : 'Task already absent',
+                icon: '🗑️', title: 'Task deleted',
                 fields: [{ label: 'ID', value: id, kind: 'code' }],
             }));
         }
@@ -1070,6 +1145,25 @@ export function registerTaskCommands(parent, cOpt) {
             const app = taskRoomService(opts.configuration);
             const actor = { kind: 'local_control', surface: 'cli' };
             const begin = await app.beginTaskRecovery({ actor, taskId: id });
+            if (begin.kind === 'deletion_worker_required') {
+                const settled = await launchTaskDeleteWorker(id, opts.configuration);
+                const payload = { schema_version: 1, task_id: id, deleted: settled.deleted };
+                if (opts.json) {
+                    console.log(JSON.stringify(payload, null, 2));
+                    return;
+                }
+                console.log(settled.deleted
+                    ? renderMarkdownResult({
+                        icon: '🗑️', title: 'Task deletion completed by recovery',
+                        fields: [{ label: 'ID', value: id, kind: 'code' }],
+                    })
+                    : renderMarkdownFailure({
+                        kind: 'pending', subject: `task recover ${id}`,
+                        detail: 'The task is pending deletion and cleanup is still settling.',
+                        action: `Run ours-fleet task delete ${id} ${id} to retry.`,
+                    }));
+                return;
+            }
             const recovered = begin.kind === 'terminal_worker_required'
                 ? await (async () => {
                     const settled = await launchTaskSettleWorker(id, opts.configuration);
@@ -1148,6 +1242,35 @@ export function registerTaskCommands(parent, cOpt) {
             dieTaskRoom(e);
         }
     });
+    cOpt(taskCmd.command('_settle_delete <id>', { hidden: true }))
+        .description('internal: settle a previously accepted task deletion')
+        .option('--json', 'JSON output')
+        .action(async (id, opts) => {
+        try {
+            const app = taskRoomService(opts.configuration);
+            const result = await app.settleTaskDeletion({
+                actor: { kind: 'internal_worker', surface: 'cli' }, taskId: id,
+            });
+            if (opts.json) {
+                console.log(JSON.stringify({ schema_version: 1, ...result }, null, 2));
+                return;
+            }
+            console.log(renderMarkdownResult({
+                icon: '🗑️', title: result.deleted ? 'Task deletion settled' : 'Task already absent',
+                fields: [{ label: 'ID', value: id, kind: 'code' }],
+            }));
+        }
+        catch (e) {
+            await taskRoomService(opts.configuration).recordDeletionError({
+                actor: { kind: 'internal_worker', surface: 'cli' }, taskId: id,
+                error: errorText(e),
+                recoveryHint: `External delete worker failed. Retry task delete ${id} ${id}.`,
+            }).catch(() => { });
+            if (opts.json)
+                die(e);
+            dieTaskRoom(e);
+        }
+    });
     cOpt(taskCmd.command('_recover <id>', { hidden: true }))
         .description('internal: settle and continue task recovery')
         .option('--json', 'JSON output')
@@ -1156,6 +1279,11 @@ export function registerTaskCommands(parent, cOpt) {
         const actor = { kind: 'internal_worker', surface: 'cli' };
         try {
             const begin = await app.beginTaskRecovery({ actor, taskId: id });
+            if (begin.kind === 'deletion_worker_required') {
+                const settled = await app.settleTaskDeletion({ actor, taskId: id });
+                console.log(JSON.stringify({ schema_version: 1, deletion: settled }, null, 2));
+                return;
+            }
             const result = begin.kind === 'terminal_worker_required'
                 ? await (async () => {
                     try {
@@ -1375,7 +1503,9 @@ export function registerRoomCommands(parent, cOpt) {
                 ],
                 sections: [
                     ...(cowork.seats.length ? [{
-                            heading: 'Members', markdownItems: cowork.seats.map(s => `${markdownCode(s.identity_cid)} — ${markdownProse(s.role)} — ${markdownProse(s.seat_state)}`),
+                            heading: 'Members', markdownItems: cowork.seats.map(s => `${markdownCode(s.identity_cid)} — ${markdownProse(s.role)} — ${markdownProse(s.seat_state)}`
+                                + seatConfigurationSuffix(r?.member_seats
+                                    .find(seat => seat.identity_cid === s.identity_cid)?.launch?.presentation)),
                         }] : []),
                     ...(r ? roomStartupSections(r) : []),
                 ],
@@ -1437,7 +1567,9 @@ export function registerRoomCommands(parent, cOpt) {
                 ],
                 sections: [{
                         heading: 'Members',
-                        ...(members.length ? { markdownItems: members.map(s => `${markdownCode(s.identity_cid)} — ${markdownProse(s.role)} — ${markdownProse(s.seat_state)}`) }
+                        ...(members.length ? { markdownItems: members.map(s => `${markdownCode(s.identity_cid)} — ${markdownProse(s.role)} — ${markdownProse(s.seat_state)}`
+                                + seatConfigurationSuffix(r?.member_seats
+                                    .find(seat => seat.identity_cid === s.identity_cid)?.launch?.presentation)) }
                             : { items: ['No members found.'] }),
                     }],
             }));

package/dist/rooms-tasks/close.d.ts

@@ -1,4 +1,5 @@
 import { withFileLock } from '../atomic-file.js';
+import { type TempLifecycleDeps } from '../temp-lifecycle.js';
 import { type CoworkAdapter } from './cowork-adapter.js';
 import type { RoomMemberSeat, RoomOrchestrationRecord } from './types.js';
 export interface RoomCloseDeps {
@@ -11,6 +12,13 @@ export interface RoomCloseDeps {
     removeIdentity?(seat: RoomMemberSeat): Promise<void>;
     lock?: typeof withFileLock;
 }
+export declare function inspectMember(seat: RoomMemberSeat): Promise<{
+    launchId: string;
+}>;
+export declare function waitForLivenessAbsent(role: string, launchId: string, lifecycleDeps?: TempLifecycleDeps): Promise<void>;
+/** Report whether any daemon identity — under any name — carries this exact CID. */
+export declare function identityCidPresent(cid: string): Promise<boolean>;
+export declare function removeExactMemberIdentity(seat: RoomMemberSeat): Promise<void>;
 /** One forward-only room close saga shared by every Fleet entry point. */
 export declare function acceptManagedRoomClose(roomId: string): Promise<RoomOrchestrationRecord>;
 export declare function recordManagedRoomCloseError(roomId: string, error: string, recoveryHint: string): Promise<RoomOrchestrationRecord>;

package/dist/rooms-tasks/close.js

@@ -27,7 +27,7 @@ function exactMemberIdentity(seat) {
         throw new Error(`room member '${seat.role_name}' temp state binds identity '${identity}'; refusing mismatched retirement`);
     }
 }
-async function inspectMember(seat) {
+export async function inspectMember(seat) {
     exactMemberIdentity(seat);
     const supervisor = readTempSupervisor(agentDir(seat.role_name, true));
     if (!supervisor || supervisor.role !== seat.role_name) {
@@ -35,7 +35,7 @@ async function inspectMember(seat) {
     }
     return { launchId: supervisor.launchId };
 }
-async function waitForLivenessAbsent(role, launchId, lifecycleDeps = {}) {
+export async function waitForLivenessAbsent(role, launchId, lifecycleDeps = {}) {
     const dir = agentDir(role, true);
     const sleep = lifecycleDeps.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
     for (let attempt = 0; attempt < STOP_POLLS; attempt++) {
@@ -69,7 +69,14 @@ async function withIdentityClient(work) {
 function listedIdentity(rows, name) {
     return rows.find(row => row.name === name);
 }
-async function removeExactMemberIdentity(seat) {
+/** Report whether any daemon identity — under any name — carries this exact CID. */
+export async function identityCidPresent(cid) {
+    return withIdentityClient(async (client) => {
+        const rows = await client.listIdentities();
+        return rows.some(row => row.cid?.toLowerCase() === cid.toLowerCase());
+    });
+}
+export async function removeExactMemberIdentity(seat) {
     await withIdentityClient(async (client) => {
         const before = listedIdentity(await client.listIdentities(), seat.role_name);
         if (!before)

package/dist/rooms-tasks/deletion.d.ts

@@ -0,0 +1,51 @@
+import { type RoomCloseDeps } from './close.js';
+import { type CoworkAdapter } from './cowork-adapter.js';
+import { type TaskDeletionAcceptance } from './task-state.js';
+import type { TaskDeletionActor, TaskRecord } from './types.js';
+export { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
+type DeletionCowork = Pick<CoworkAdapter, 'closeRoom' | 'deleteRoom'>;
+export interface TaskDeletionSettleDeps {
+    roomClose?: RoomCloseDeps;
+    /** Test seam for the temp-state existence proof. */
+    hasTempState?(name: string): boolean;
+    /** Test seam for the CID-wide daemon identity scan. */
+    identityCidPresent?(cid: string): Promise<boolean>;
+}
+export interface TaskDeletionSettleResult {
+    task_id: string;
+    deleted: boolean;
+    /** Lifecycle state observed before unlink, for completion audit. */
+    previous_state?: TaskRecord['state'];
+    /** Title observed before unlink, for completion audit. */
+    title?: string;
+}
+/**
+ * Accept a permanent task deletion under the common task-operation lock so it
+ * serializes against terminal settlement, recovery, and the room-publication
+ * window. Acceptance is durable before any side effect and never requires
+ * Cowork availability; settlement runs separately and converges through
+ * retries.
+ */
+export declare function acceptTaskDeletion(taskId: string, actor: TaskDeletionActor): Promise<TaskDeletionAcceptance>;
+/** Persist a settlement failure under the same task-operation lock. */
+export declare function recordTaskDeletionError(taskId: string, error: string, recoveryHint: string): Promise<TaskRecord>;
+/**
+ * Converge an accepted deletion to physical absence in two lock-ordered
+ * stages. Cleanup stage (task-operation lock): per surviving room record,
+ * register late seats → close saga (retires members) → durable evidence
+ * checkpoint → tolerant remote delete → local record delete; then
+ * cursor-based retirement for members with no room record and tolerant remote
+ * close+delete of a recorded room whose local record is gone. Finalization
+ * stage (launch-snapshot lock → task-operation lock, matching the global
+ * provisioning order): re-verify quiescence, delete the owned launch snapshot
+ * while excluding only this deleting task from the reference scan, and unlink
+ * the task record LAST — every crash seam leaves the hidden intent
+ * recoverable. Failures are recorded on the intent; the task stays hidden and
+ * recoverable, never falsely settled.
+ */
+export declare function settleTaskDeletion(input: {
+    taskId: string;
+    /** Lazy: resolved only when room work exists, so no-room tasks settle without Cowork config. */
+    cowork: () => DeletionCowork;
+    deps?: TaskDeletionSettleDeps;
+}): Promise<TaskDeletionSettleResult>;

package/dist/rooms-tasks/deletion.js

@@ -0,0 +1,217 @@
+import { existsSync } from 'node:fs';
+import { withFileLock } from '../atomic-file.js';
+import { agentDir } from '../paths.js';
+import { secureStoppedTempArchive, stopTempSupervisor } from '../temp-lifecycle.js';
+import { closeManagedRoom, identityCidPresent, inspectMember, removeExactMemberIdentity, waitForLivenessAbsent, } from './close.js';
+import { CoworkProtocolError } from './cowork-adapter.js';
+import { deleteRoomRecord, getRoomRecord, listRoomRecords } from './room-state.js';
+import { acquireLaunchSnapshotLock, releaseLaunchSnapshotForDeletingTask } from './launch-snapshot.js';
+import { TASK_OPERATION_LOCK_STALE_MS, taskOperationLockPath } from './terminal.js';
+import { advanceTaskDeletionMember, beginTaskDeletionIntent, completeTaskDeletionReceipt, ensureTaskDeletionReceipt, getDeletingTask, importTaskDeletionRetirementEvidence, setTaskDeletionError, TaskStateError, unlinkDeletedTask, upsertTaskDeletionMembersFromSeats, } from './task-state.js';
+export { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
+import { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
+/**
+ * Accept a permanent task deletion under the common task-operation lock so it
+ * serializes against terminal settlement, recovery, and the room-publication
+ * window. Acceptance is durable before any side effect and never requires
+ * Cowork availability; settlement runs separately and converges through
+ * retries.
+ */
+export function acceptTaskDeletion(taskId, actor) {
+    return withFileLock(taskOperationLockPath(taskId), () => beginTaskDeletionIntent(taskId, actor), {}, TASK_OPERATION_LOCK_STALE_MS);
+}
+/** Persist a settlement failure under the same task-operation lock. */
+export function recordTaskDeletionError(taskId, error, recoveryHint) {
+    return withFileLock(taskOperationLockPath(taskId), () => setTaskDeletionError(taskId, error, recoveryHint), {}, TASK_OPERATION_LOCK_STALE_MS);
+}
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Already-missing remote rooms are a settled outcome, not a failure. */
+function tolerantCowork(cowork) {
+    const tolerate = async (work) => {
+        try {
+            await work();
+        }
+        catch (error) {
+            if (error instanceof CoworkProtocolError && error.code === 'not_found')
+                return;
+            throw error;
+        }
+    };
+    return {
+        closeRoom: roomId => tolerate(() => cowork.closeRoom(roomId)),
+        deleteRoom: roomId => tolerate(() => cowork.deleteRoom(roomId)),
+    };
+}
+function cursorSeat(cursor) {
+    return {
+        role_name: cursor.name, identity_cid: cursor.identity_cid,
+        slot: cursor.name, cowork_role: 'member', seat_state: 'active',
+    };
+}
+/**
+ * Retire one member from its durable deletion cursor when no room record
+ * carries the seat: the same evidence chain as close.ts, resumed at the
+ * recorded phase. A member with no temp state is verified absent through the
+ * CID-wide identity scan; a same-name stranger identity is never touched, and
+ * the recorded CID surviving under any name blocks settlement.
+ */
+async function retireCursorMember(taskId, cursor, deps) {
+    let phase = cursor.phase;
+    let launchId = cursor.launch_id;
+    if (phase === 'identity_absent')
+        return;
+    const seat = cursorSeat(cursor);
+    const roomClose = deps.roomClose ?? {};
+    if (phase === 'pending') {
+        const hasState = (deps.hasTempState ?? (name => existsSync(agentDir(name, true))))(cursor.name);
+        if (!hasState) {
+            const present = await (deps.identityCidPresent ?? identityCidPresent)(cursor.identity_cid);
+            if (present) {
+                // Remove only an exact name+CID match; a stranger under the same name
+                // stays untouched and removeExactMemberIdentity refuses the mismatch.
+                // The recorded CID surviving under a different name throws below on
+                // its post-removal verification and blocks settlement.
+                await (roomClose.removeIdentity ?? removeExactMemberIdentity)(seat);
+                if (await (deps.identityCidPresent ?? identityCidPresent)(cursor.identity_cid))
+                    throw new TaskStateError(`deletion member '${cursor.name}' identity CID survives under another name; refusing to claim retirement`);
+            }
+            advanceTaskDeletionMember(taskId, cursor.name, 'identity_absent', DELETION_MEMBER_ABSENT_VERIFIED);
+            return;
+        }
+        const ownership = await (roomClose.inspectMember ?? inspectMember)(seat);
+        advanceTaskDeletionMember(taskId, cursor.name, 'stop_requested', ownership.launchId);
+        phase = 'stop_requested';
+        launchId = ownership.launchId;
+    }
+    if (phase === 'stop_requested') {
+        await (roomClose.requestStop
+            ?? (async (role) => { await stopTempSupervisor(role); }))(cursor.name);
+        await (roomClose.waitForLivenessAbsent ?? waitForLivenessAbsent)(cursor.name, launchId);
+        advanceTaskDeletionMember(taskId, cursor.name, 'liveness_absent');
+        phase = 'liveness_absent';
+    }
+    if (phase === 'liveness_absent') {
+        const archivePath = await (roomClose.secureArchive ?? secureStoppedTempArchive)(cursor.name, launchId);
+        advanceTaskDeletionMember(taskId, cursor.name, 'archive_secured', undefined, archivePath);
+        phase = 'archive_secured';
+    }
+    if (phase === 'archive_secured') {
+        await (roomClose.removeIdentity ?? removeExactMemberIdentity)(seat);
+        advanceTaskDeletionMember(taskId, cursor.name, 'identity_absent');
+    }
+}
+/**
+ * Converge an accepted deletion to physical absence in two lock-ordered
+ * stages. Cleanup stage (task-operation lock): per surviving room record,
+ * register late seats → close saga (retires members) → durable evidence
+ * checkpoint → tolerant remote delete → local record delete; then
+ * cursor-based retirement for members with no room record and tolerant remote
+ * close+delete of a recorded room whose local record is gone. Finalization
+ * stage (launch-snapshot lock → task-operation lock, matching the global
+ * provisioning order): re-verify quiescence, delete the owned launch snapshot
+ * while excluding only this deleting task from the reference scan, and unlink
+ * the task record LAST — every crash seam leaves the hidden intent
+ * recoverable. Failures are recorded on the intent; the task stays hidden and
+ * recoverable, never falsely settled.
+ */
+export async function settleTaskDeletion(input) {
+    const { taskId } = input;
+    const deps = input.deps ?? {};
+    const recoveryHint = `Re-run 'ours-fleet task delete ${taskId} ${taskId}' or 'ours-fleet task recover ${taskId}'.`;
+    const cleanup = await withFileLock(taskOperationLockPath(taskId), async () => {
+        let task;
+        try {
+            task = getDeletingTask(taskId);
+        }
+        catch (error) {
+            if (error instanceof TaskStateError && /task not found/.test(error.message))
+                return { kind: 'already_absent' };
+            throw error;
+        }
+        if (task.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${taskId} has no pending deletion`);
+        try {
+            // Audit evidence precedes every side effect; a receipt write failure
+            // aborts settlement (fail closed).
+            ensureTaskDeletionReceipt(taskId);
+            const records = listRoomRecords().filter(room => room.task_id === taskId);
+            const recordIds = new Set(records.map(room => room.room_id));
+            const recordedRoomId = task.deletion.room_id ?? task.room_id;
+            const needsCowork = records.length > 0 || recordedRoomId !== undefined;
+            const cowork = needsCowork ? tolerantCowork(input.cowork()) : undefined;
+            for (const record of records) {
+                upsertTaskDeletionMembersFromSeats(taskId, record.member_seats);
+                await closeManagedRoom({ roomId: record.room_id, cowork: cowork, deps: deps.roomClose });
+                const closed = getRoomRecord(record.room_id);
+                importTaskDeletionRetirementEvidence(taskId, closed?.member_seats ?? record.member_seats);
+                await cowork.deleteRoom(record.room_id);
+                deleteRoomRecord(record.room_id);
+            }
+            // Members whose room record is gone (crash after record deletion, or
+            // legacy state): resume from the durable cursors.
+            for (const cursor of getDeletingTask(taskId).deletion.members) {
+                await retireCursorMember(taskId, cursor, deps);
+            }
+            // A recorded room without a local record may still be live remotely.
+            if (recordedRoomId && !recordIds.has(recordedRoomId) && !getRoomRecord(recordedRoomId)) {
+                await cowork.closeRoom(recordedRoomId);
+                await cowork.deleteRoom(recordedRoomId);
+            }
+            return {
+                kind: 'cleaned',
+                snapshotHash: task.execution_plan?.snapshot.launch_snapshot_hash,
+                previousState: task.state,
+                title: task.title,
+            };
+        }
+        catch (error) {
+            setTaskDeletionError(taskId, errorText(error), recoveryHint);
+            throw error;
+        }
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+    if (cleanup.kind === 'already_absent') {
+        // Heal a crash between unlink and receipt completion.
+        completeTaskDeletionReceipt(taskId);
+        return { task_id: taskId, deleted: false };
+    }
+    const finalize = () => withFileLock(taskOperationLockPath(taskId), () => {
+        try {
+            const task = getDeletingTask(taskId);
+            if (task.deletion?.status !== 'pending')
+                throw new TaskStateError(`task ${taskId} has no pending deletion`);
+            if (listRoomRecords().some(room => room.task_id === taskId))
+                throw new TaskStateError(`task ${taskId} room records reappeared during deletion finalization`);
+            if (task.deletion.members.some(member => member.phase !== 'identity_absent'))
+                throw new TaskStateError(`task ${taskId} has unretired members at deletion finalization`);
+            if (cleanup.snapshotHash)
+                releaseLaunchSnapshotForDeletingTask(cleanup.snapshotHash, taskId);
+            unlinkDeletedTask(taskId);
+        }
+        catch (error) {
+            setTaskDeletionError(taskId, errorText(error), recoveryHint);
+            throw error;
+        }
+        // After unlink the task can no longer carry errors; receipt completion is
+        // idempotent and the already-absent retry path heals a crash here.
+        completeTaskDeletionReceipt(taskId);
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+    if (cleanup.snapshotHash) {
+        // Global lock order: launch-snapshot lock → task-operation lock.
+        const releaseSnapshotLock = acquireLaunchSnapshotLock();
+        try {
+            await finalize();
+        }
+        finally {
+            releaseSnapshotLock();
+        }
+    }
+    else {
+        await finalize();
+    }
+    return {
+        task_id: taskId, deleted: true,
+        previous_state: cleanup.previousState, title: cleanup.title,
+    };
+}