@ours.network/fleet 1.1.0-nightly.8 → 1.1.0

package/dist/rooms-tasks/task-state.d.ts

@@ -1,12 +1,18 @@
-import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent } from './types.js';
+import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase } from './types.js';
 export declare const tasksDir: () => string;
 export declare class TaskStateError extends Error {
 }
+/**
+ * Accepted deletion is the per-task epoch guard: once pending, every lifecycle
+ * mutation, terminal settlement, and room publication must fail boundedly.
+ */
+export declare function assertNoPendingDeletion(task: TaskRecord): void;
 export interface CreateTaskInput {
     title: string;
     brief?: string;
     brief_file?: string;
     template?: TaskTemplateRef;
+    execution_plan?: TaskRecord['execution_plan'];
     origin: TaskOrigin;
     idempotency_key?: string;
     start?: boolean;
@@ -16,9 +22,11 @@ export interface CreateTaskInput {
 }
 export declare function createTask(input: CreateTaskInput): TaskRecord;
 export declare function getTask(id: string): TaskRecord;
+export declare function updateTaskExecutionPlan(id: string, executionPlan: NonNullable<TaskRecord['execution_plan']>): TaskRecord;
 export declare function listTasks(filter?: {
     state?: TaskState | TaskState[];
     listId?: string;
+    includeDeleting?: boolean;
 }): TaskRecord[];
 export declare function moveTaskToList(id: string, listId: string): TaskRecord;
 export declare function findByIdempotencyKey(key: string): TaskRecord | undefined;
@@ -43,5 +51,109 @@ export declare function failTask(id: string, error: string): TaskRecord;
 export declare function updateTaskRoom(id: string, roomId: string, roomIdentityCid: string): TaskRecord;
 export declare function updateTaskTemplate(id: string, template: TaskTemplateRef): TaskRecord;
 export declare function updateTaskMembers(id: string, members: TaskMemberRole[]): TaskRecord;
-/** Remove a completed task from Fleet's backlog. Missing tasks are an idempotent no-op. */
-export declare function deleteTask(id: string): boolean;
+/**
+ * Lenient read for deletion settlement and status surfaces: a broken list
+ * reference must never make a task unreadable or undeletable. Missing records
+ * throw the canonical task-not-found error; other read failures propagate.
+ */
+export declare function getDeletingTask(id: string): TaskRecord;
+/** Cheap durable deletion-epoch probe for room/member publication guards. */
+export declare function taskDeletionState(id: string): 'none' | 'pending' | 'absent';
+/**
+ * Durable, surface-independent audit evidence for a permanent deletion. The
+ * receipt outlives the task record: written with the acceptance intent, and
+ * completed before settlement is reported. Metadata only — never brief or
+ * room content.
+ */
+export interface TaskDeletionReceipt {
+    schema_version: 1;
+    task_id: string;
+    title: string;
+    accepted_at: string;
+    actor: TaskDeletionActor;
+    original_state: TaskState;
+    room_id?: string;
+    member_count: number;
+    settled_at?: string;
+    result?: 'deleted';
+}
+export declare const deletionReceiptsDir: () => string;
+export declare function readTaskDeletionReceipt(id: string): TaskDeletionReceipt | undefined;
+/**
+ * Ensure the acceptance receipt exists before any cleanup side effect,
+ * backfilling it from the durable intent (heals a crash between the intent
+ * write and the receipt write). Fails closed: a receipt write error aborts
+ * settlement rather than deleting resources without audit evidence.
+ */
+export declare function ensureTaskDeletionReceipt(id: string): void;
+/** Record settlement on the receipt; idempotent, tolerant of legacy absence. */
+export declare function completeTaskDeletionReceipt(id: string): void;
+export type TaskDeletionAcceptance = {
+    status: 'accepted' | 'pending';
+    task: TaskRecord;
+} | {
+    status: 'already_absent';
+};
+/**
+ * Persist the first-wins durable deletion intent. Accepts every lifecycle
+ * state, takes precedence over a pending terminal intent, and never touches
+ * remote resources. Repeat requests while pending re-arm settlement; a request
+ * for a missing record reports the idempotent already-absent outcome.
+ *
+ * Low-level record mutation only. Callers serialize acceptance with settlement
+ * through deletion.ts, which holds the common task-operation lock.
+ */
+export declare function beginTaskDeletionIntent(id: string, actor: TaskDeletionActor): TaskDeletionAcceptance;
+/** Record an actionable settlement failure; the task stays hidden and recoverable. */
+export declare function setTaskDeletionError(id: string, error: string, recoveryHint: string): TaskRecord;
+/** Marker proving a member never launched, mirroring close.ts's short path. */
+export declare const DELETION_MEMBER_NEVER_LAUNCHED = "never-launched";
+/** Marker proving absence verified against temp state AND the CID-wide identity scan. */
+export declare const DELETION_MEMBER_ABSENT_VERIFIED = "absent-verified";
+/**
+ * Advance a member retirement cursor carried by the deletion intent. Only
+ * adjacent forward transitions are legal — plus the explicit
+ * pending → identity_absent short path proved by the 'never-launched' marker —
+ * so no managed agent can be claimed retired without the full evidence chain.
+ * launch_id and archive_path are immutable once recorded; same-phase retries
+ * are idempotent but must not change evidence.
+ */
+export declare function advanceTaskDeletionMember(id: string, name: string, phase: TaskDeletionMemberPhase, launchId?: string, archivePath?: string): TaskRecord;
+interface SeatEvidence {
+    role_name: string;
+    identity_cid?: string;
+    retirement?: {
+        phase: TaskDeletionMemberPhase;
+        launch_id: string;
+        archive_path?: string;
+    };
+}
+/**
+ * Durably register cursors for late-provisioned members before retirement
+ * begins: provisioning publishes room seats before updateTaskMembers, so the
+ * acceptance snapshot can be empty while live seats exist. Seats without a
+ * recorded identity CID are not registered here — until a CID is recorded
+ * there is no managed identity to orphan, and the room record still carries
+ * those seats through the close saga that follows.
+ */
+export declare function upsertTaskDeletionMembersFromSeats(id: string, seats: ReadonlyArray<SeatEvidence>): TaskRecord;
+/**
+ * The pre-room-delete checkpoint: import completed retirement evidence from
+ * room seats into the deletion cursors, so a crash between room-record
+ * deletion and task unlink retries from durable cursors instead of
+ * reconstructing consumed evidence. Call ONLY after closeManagedRoom has
+ * completed retirement and BEFORE cowork.deleteRoom/deleteRoomRecord.
+ *
+ * The room saga is trusted for phase jumps, but partial or corrupt retained
+ * records must not become false success: every seat must be identity_absent;
+ * a real launch requires archive evidence; an identity-less seat is accepted
+ * only via the never-launched proof.
+ */
+export declare function importTaskDeletionRetirementEvidence(id: string, seats: ReadonlyArray<SeatEvidence>): TaskRecord;
+/**
+ * Physically remove a deletion-pending task record. Settlement-only: callers
+ * must have completed member retirement and room cleanup first. Missing
+ * records are the idempotent already-settled outcome.
+ */
+export declare function unlinkDeletedTask(id: string): boolean;
+export {};

package/dist/rooms-tasks/task-state.js

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
-import { TASK_TERMINAL_STATES, TASK_CANCELLABLE_STATES } from './types.js';
+import { storedRoomLaunchPolicy, TASK_TERMINAL_STATES, TASK_CANCELLABLE_STATES } from './types.js';
 import { DEFAULT_TASK_LIST_ID, readTaskLists } from './task-lists.js';
 export const tasksDir = () => join(stateRoot(), 'tasks');
 function taskPath(id) { return join(tasksDir(), `${id}.json`); }
@@ -116,11 +116,27 @@ function assertNoPendingTerminalIntent(task) {
         throw new TaskStateError(`task ${task.task_id} has a pending '${task.terminal_intent.kind}' terminal intent`);
     }
 }
+/**
+ * Accepted deletion is the per-task epoch guard: once pending, every lifecycle
+ * mutation, terminal settlement, and room publication must fail boundedly.
+ */
+export function assertNoPendingDeletion(task) {
+    if (task.deletion?.status === 'pending') {
+        throw new TaskStateError(`task ${task.task_id} is pending deletion; run 'ours-fleet task delete ${task.task_id} ${task.task_id}' to retry cleanup`);
+    }
+}
 export function createTask(input) {
     const key = input.idempotency_key ?? randomUUID();
     const existing = findByIdempotencyKey(key);
-    if (existing)
+    if (existing) {
+        const existingPlan = existing.execution_plan?.plan_hash;
+        const requestedPlan = input.execution_plan?.plan_hash;
+        const existingPolicy = storedRoomLaunchPolicy(existing.execution_plan?.room_policy);
+        const requestedPolicy = storedRoomLaunchPolicy(input.execution_plan?.room_policy);
+        if (existingPlan !== requestedPlan || JSON.stringify(existingPolicy) !== JSON.stringify(requestedPolicy))
+            throw new TaskStateError(`idempotency key '${key}' was already used with a different execution plan`);
         return existing;
+    }
     const state = input.start === false ? 'backlog' : 'provisioning';
     const record = {
         task_id: generateTaskId(),
@@ -130,6 +146,7 @@ export function createTask(input) {
         brief_file: input.brief_file,
         state,
         template: input.template,
+        execution_plan: input.execution_plan,
         no_room: input.no_room || undefined,
         room_id: input.room_id,
         member_roles: [],
@@ -142,6 +159,25 @@ export function createTask(input) {
     return readTask(record.task_id);
 }
 export function getTask(id) { return withTaskLock(id, () => readTask(id)); }
+export function updateTaskExecutionPlan(id, executionPlan) {
+    return withTaskLock(id, () => {
+        const task = readTask(id);
+        assertNoPendingDeletion(task);
+        if (task.execution_plan) {
+            if (task.execution_plan.plan_hash !== executionPlan.plan_hash)
+                throw new TaskStateError(`task ${id} execution plan mismatch`);
+            const before = storedRoomLaunchPolicy(task.execution_plan.room_policy);
+            const after = storedRoomLaunchPolicy(executionPlan.room_policy);
+            if (task.room_id && JSON.stringify(before) !== JSON.stringify(after))
+                throw new TaskStateError(`task ${id} Room launch policy cannot change after Room creation`);
+        }
+        task.execution_plan = executionPlan;
+        task.template = { name: executionPlan.snapshot.name, version: executionPlan.snapshot.version,
+            content_hash: executionPlan.snapshot.content_hash };
+        writeTask(task);
+        return readTask(id);
+    });
+}
 export function listTasks(filter) {
     const dir = tasksDir();
     if (!existsSync(dir))
@@ -154,6 +190,8 @@ export function listTasks(filter) {
         try {
             const id = f.slice(0, -5);
             const t = withTaskLock(id, () => presentTask(JSON.parse(readFileSync(join(dir, f), 'utf8'))));
+            if (t.deletion?.status === 'pending' && !filter?.includeDeleting)
+                continue;
             if ((!states || states.includes(t.state)) && (!filter?.listId || t.list_id === filter.listId))
                 tasks.push(t);
         }
@@ -166,6 +204,7 @@ export function listTasks(filter) {
 export function moveTaskToList(id, listId) {
     return withTaskLock(id, () => {
         const task = readTask(id);
+        assertNoPendingDeletion(task);
         task.list_id = listId;
         writeTask(task);
         return readTask(id);
@@ -177,6 +216,7 @@ export function findByIdempotencyKey(key) {
 export function startTask(id) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         assertTransition(t.state, 'provisioning');
         t.state = 'provisioning';
@@ -188,6 +228,7 @@ export function startTask(id) {
 export function activateTask(id) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         assertTransition(t.state, 'active');
         t.state = 'active';
@@ -199,6 +240,7 @@ export function activateTask(id) {
 export function blockTask(id, reason) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         if (TASK_TERMINAL_STATES.includes(t.state))
             throw new TaskStateError(`cannot block a '${t.state}' task`);
@@ -210,6 +252,7 @@ export function blockTask(id, reason) {
 export function unblockTask(id) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         if (!t.blocked)
             throw new TaskStateError('task is not blocked');
@@ -221,6 +264,7 @@ export function unblockTask(id) {
 export function reviewTask(id) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         assertTransition(t.state, 'review');
         t.state = 'review';
@@ -232,6 +276,7 @@ export function reviewTask(id) {
 export function completeTask(id, outcome) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         assertTransition(t.state, 'done');
         t.state = 'done';
@@ -246,6 +291,7 @@ export function completeTask(id, outcome) {
 export function cancelTask(id) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         if (!TASK_CANCELLABLE_STATES.includes(t.state))
             throw new TaskStateError(`cannot cancel a '${t.state}' task`);
@@ -263,6 +309,7 @@ function sameOutcome(left, right) {
 export function beginTaskTerminalIntent(id, input) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         const existing = t.terminal_intent;
         if (existing) {
             if (existing.kind !== input.kind || existing.room_id !== input.roomId
@@ -316,6 +363,7 @@ export function setTaskTerminalIntentError(id, error, recoveryHint) {
 export function finishTaskTerminalIntent(id) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         const intent = t.terminal_intent;
         if (!intent)
             throw new TaskStateError(`task ${id} has no terminal intent`);
@@ -346,6 +394,7 @@ export function finishTaskTerminalIntent(id) {
 export function failTask(id, error) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         assertTransition(t.state, 'failed');
         t.state = 'failed';
@@ -359,6 +408,7 @@ export function failTask(id, error) {
 export function updateTaskRoom(id, roomId, roomIdentityCid) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         t.room_id = roomId;
         t.room_identity_cid = roomIdentityCid;
@@ -369,6 +419,7 @@ export function updateTaskRoom(id, roomId, roomIdentityCid) {
 export function updateTaskTemplate(id, template) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         t.template = template;
         writeTask(t);
@@ -378,31 +429,330 @@ export function updateTaskTemplate(id, template) {
 export function updateTaskMembers(id, members) {
     return withTaskLock(id, () => {
         const t = readTask(id);
+        assertNoPendingDeletion(t);
         assertNoPendingTerminalIntent(t);
         t.member_roles = members;
         writeTask(t);
         return t;
     });
 }
-/** Remove a completed task from Fleet's backlog. Missing tasks are an idempotent no-op. */
-export function deleteTask(id) {
+function presentTaskLenient(record) {
+    try {
+        return presentTask(record);
+    }
+    catch {
+        // A broken list reference must never make a task undeletable.
+        const listId = record.list_id ?? DEFAULT_TASK_LIST_ID;
+        return { ...record, list_id: listId, list_name: listId === DEFAULT_TASK_LIST_ID ? 'default' : listId };
+    }
+}
+/**
+ * Lenient read for deletion settlement and status surfaces: a broken list
+ * reference must never make a task unreadable or undeletable. Missing records
+ * throw the canonical task-not-found error; other read failures propagate.
+ */
+export function getDeletingTask(id) {
     return withTaskLock(id, () => {
         assertCanonicalTaskId(id);
-        const p = taskPath(id);
-        let task;
         try {
-            task = JSON.parse(readFileSync(p, 'utf8'));
+            return presentTaskLenient(JSON.parse(readFileSync(taskPath(id), 'utf8')));
         }
         catch (error) {
             if (isNotFoundError(error))
-                return false;
+                throw new TaskStateError(`task not found: ${id}`);
+            throw error;
+        }
+    });
+}
+/** Cheap durable deletion-epoch probe for room/member publication guards. */
+export function taskDeletionState(id) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        try {
+            const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+            return stored.deletion?.status === 'pending' ? 'pending' : 'none';
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                return 'absent';
+            throw error;
+        }
+    });
+}
+export const deletionReceiptsDir = () => join(stateRoot(), 'deletion-receipts');
+function deletionReceiptPath(id) {
+    return join(deletionReceiptsDir(), `${id}.json`);
+}
+export function readTaskDeletionReceipt(id) {
+    assertCanonicalTaskId(id);
+    try {
+        return JSON.parse(readFileSync(deletionReceiptPath(id), 'utf8'));
+    }
+    catch (error) {
+        if (isNotFoundError(error))
+            return undefined;
+        throw error;
+    }
+}
+function writeDeletionReceiptForIntent(stored) {
+    const deletion = stored.deletion;
+    mkdirSync(deletionReceiptsDir(), { recursive: true });
+    const receipt = {
+        schema_version: 1,
+        task_id: stored.task_id,
+        title: stored.title.slice(0, 256),
+        accepted_at: deletion.accepted_at,
+        actor: deletion.actor,
+        original_state: stored.state,
+        room_id: deletion.room_id,
+        member_count: deletion.members.length,
+    };
+    replaceFileAtomically(deletionReceiptPath(stored.task_id), JSON.stringify(receipt, null, 2) + '\n');
+}
+/**
+ * Ensure the acceptance receipt exists before any cleanup side effect,
+ * backfilling it from the durable intent (heals a crash between the intent
+ * write and the receipt write). Fails closed: a receipt write error aborts
+ * settlement rather than deleting resources without audit evidence.
+ */
+export function ensureTaskDeletionReceipt(id) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${id} has no pending deletion`);
+        if (!readTaskDeletionReceipt(id))
+            writeDeletionReceiptForIntent(stored);
+    });
+}
+/** Record settlement on the receipt; idempotent, tolerant of legacy absence. */
+export function completeTaskDeletionReceipt(id) {
+    const receipt = readTaskDeletionReceipt(id);
+    if (!receipt || receipt.settled_at)
+        return;
+    receipt.settled_at = new Date().toISOString();
+    receipt.result = 'deleted';
+    replaceFileAtomically(deletionReceiptPath(id), JSON.stringify(receipt, null, 2) + '\n');
+}
+/**
+ * Persist the first-wins durable deletion intent. Accepts every lifecycle
+ * state, takes precedence over a pending terminal intent, and never touches
+ * remote resources. Repeat requests while pending re-arm settlement; a request
+ * for a missing record reports the idempotent already-absent outcome.
+ *
+ * Low-level record mutation only. Callers serialize acceptance with settlement
+ * through deletion.ts, which holds the common task-operation lock.
+ */
+export function beginTaskDeletionIntent(id, actor) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        let stored;
+        try {
+            stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                return { status: 'already_absent' };
             throw error;
         }
-        if (task.state !== 'done') {
-            throw new TaskStateError(`cannot delete a '${task.state}' task; only 'done' tasks can be deleted`);
+        if (stored.deletion?.status === 'pending') {
+            // Heal a crash between the intent write and the receipt write.
+            if (!readTaskDeletionReceipt(id))
+                writeDeletionReceiptForIntent(stored);
+            return { status: 'pending', task: presentTaskLenient(stored) };
+        }
+        const now = new Date().toISOString();
+        stored.deletion = {
+            status: 'pending',
+            accepted_at: now,
+            actor,
+            room_id: stored.room_id,
+            members: (stored.member_roles ?? []).map(member => ({
+                name: member.name, identity_cid: member.identity_cid, phase: 'pending', updated_at: now,
+            })),
+        };
+        writeTask(stored);
+        writeDeletionReceiptForIntent(stored);
+        return { status: 'accepted', task: presentTaskLenient(stored) };
+    });
+}
+/** Record an actionable settlement failure; the task stays hidden and recoverable. */
+export function setTaskDeletionError(id, error, recoveryHint) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${id} has no pending deletion`);
+        stored.deletion.first_failure ??= error;
+        stored.deletion.first_recovery_hint ??= recoveryHint;
+        stored.deletion.error = error;
+        const previousErrorAt = Date.parse(stored.deletion.error_at ?? '');
+        stored.deletion.error_at = new Date(Math.max(Date.now(), Number.isFinite(previousErrorAt) ? previousErrorAt + 1 : 0)).toISOString();
+        stored.deletion.recovery_hint = recoveryHint;
+        writeTask(stored);
+        return presentTaskLenient(stored);
+    });
+}
+const DELETION_MEMBER_PHASE_ORDER = {
+    pending: 0, stop_requested: 1, liveness_absent: 2, archive_secured: 3, identity_absent: 4,
+};
+/** Marker proving a member never launched, mirroring close.ts's short path. */
+export const DELETION_MEMBER_NEVER_LAUNCHED = 'never-launched';
+/** Marker proving absence verified against temp state AND the CID-wide identity scan. */
+export const DELETION_MEMBER_ABSENT_VERIFIED = 'absent-verified';
+/**
+ * Advance a member retirement cursor carried by the deletion intent. Only
+ * adjacent forward transitions are legal — plus the explicit
+ * pending → identity_absent short path proved by the 'never-launched' marker —
+ * so no managed agent can be claimed retired without the full evidence chain.
+ * launch_id and archive_path are immutable once recorded; same-phase retries
+ * are idempotent but must not change evidence.
+ */
+export function advanceTaskDeletionMember(id, name, phase, launchId, archivePath) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${id} has no pending deletion`);
+        const cursor = stored.deletion.members.find(member => member.name === name);
+        if (!cursor)
+            throw new TaskStateError(`task ${id} deletion has no member cursor '${name}'`);
+        if (cursor.launch_id !== undefined && launchId !== undefined && launchId !== cursor.launch_id)
+            throw new TaskStateError(`task ${id} deletion member '${name}' launch ownership proof is immutable`);
+        if (cursor.archive_path !== undefined && archivePath !== undefined && archivePath !== cursor.archive_path)
+            throw new TaskStateError(`task ${id} deletion member '${name}' archive evidence is immutable`);
+        const step = DELETION_MEMBER_PHASE_ORDER[phase] - DELETION_MEMBER_PHASE_ORDER[cursor.phase];
+        const launch = cursor.launch_id ?? launchId;
+        if (step < 0)
+            throw new TaskStateError(`task ${id} deletion member '${name}' cannot move back from '${cursor.phase}' to '${phase}'`);
+        if (step === 0)
+            return presentTaskLenient(stored); // idempotent retry, evidence already verified
+        const neverLaunched = cursor.phase === 'pending' && phase === 'identity_absent'
+            && (launch === DELETION_MEMBER_NEVER_LAUNCHED || launch === DELETION_MEMBER_ABSENT_VERIFIED);
+        if (step !== 1 && !neverLaunched)
+            throw new TaskStateError(`task ${id} deletion member '${name}' cannot skip from '${cursor.phase}' to '${phase}' without evidence`);
+        if (launch === undefined)
+            throw new TaskStateError(`task ${id} deletion member '${name}' cannot reach '${phase}' without a launch ownership proof`);
+        if (phase === 'archive_secured' && (cursor.archive_path ?? archivePath) === undefined)
+            throw new TaskStateError(`task ${id} deletion member '${name}' cannot reach 'archive_secured' without archive evidence`);
+        cursor.phase = phase;
+        cursor.launch_id = launch;
+        if (archivePath !== undefined)
+            cursor.archive_path = archivePath;
+        cursor.updated_at = new Date().toISOString();
+        writeTask(stored);
+        return presentTaskLenient(stored);
+    });
+}
+function findCursorForSeat(id, stored, seat) {
+    const cursor = stored.deletion.members.find(member => member.name === seat.role_name);
+    if (cursor && seat.identity_cid
+        && cursor.identity_cid.toLowerCase() !== seat.identity_cid.toLowerCase())
+        throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' identity CID mismatch between cursor and room seat`);
+    return cursor;
+}
+/**
+ * Durably register cursors for late-provisioned members before retirement
+ * begins: provisioning publishes room seats before updateTaskMembers, so the
+ * acceptance snapshot can be empty while live seats exist. Seats without a
+ * recorded identity CID are not registered here — until a CID is recorded
+ * there is no managed identity to orphan, and the room record still carries
+ * those seats through the close saga that follows.
+ */
+export function upsertTaskDeletionMembersFromSeats(id, seats) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${id} has no pending deletion`);
+        const now = new Date().toISOString();
+        for (const seat of seats) {
+            if (!seat.identity_cid)
+                continue;
+            if (!findCursorForSeat(id, stored, seat)) {
+                stored.deletion.members.push({
+                    name: seat.role_name, identity_cid: seat.identity_cid, phase: 'pending', updated_at: now,
+                });
+            }
+        }
+        writeTask(stored);
+        return presentTaskLenient(stored);
+    });
+}
+/**
+ * The pre-room-delete checkpoint: import completed retirement evidence from
+ * room seats into the deletion cursors, so a crash between room-record
+ * deletion and task unlink retries from durable cursors instead of
+ * reconstructing consumed evidence. Call ONLY after closeManagedRoom has
+ * completed retirement and BEFORE cowork.deleteRoom/deleteRoomRecord.
+ *
+ * The room saga is trusted for phase jumps, but partial or corrupt retained
+ * records must not become false success: every seat must be identity_absent;
+ * a real launch requires archive evidence; an identity-less seat is accepted
+ * only via the never-launched proof.
+ */
+export function importTaskDeletionRetirementEvidence(id, seats) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${id} has no pending deletion`);
+        const now = new Date().toISOString();
+        for (const seat of seats) {
+            const evidence = seat.retirement;
+            if (evidence?.phase !== 'identity_absent')
+                throw new TaskStateError(`task ${id} deletion cannot checkpoint member '${seat.role_name}' before completed retirement`);
+            const neverLaunched = evidence.launch_id === DELETION_MEMBER_NEVER_LAUNCHED;
+            if (!neverLaunched && evidence.archive_path === undefined)
+                throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' retirement evidence lacks its archive`);
+            if (!seat.identity_cid) {
+                if (neverLaunched)
+                    continue; // provably never held a managed identity
+                throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' has retirement evidence but no identity CID`);
+            }
+            let cursor = findCursorForSeat(id, stored, seat);
+            if (!cursor) {
+                cursor = { name: seat.role_name, identity_cid: seat.identity_cid, phase: 'pending', updated_at: now };
+                stored.deletion.members.push(cursor);
+            }
+            if (DELETION_MEMBER_PHASE_ORDER[evidence.phase] < DELETION_MEMBER_PHASE_ORDER[cursor.phase])
+                continue;
+            if (cursor.launch_id !== undefined && cursor.launch_id !== evidence.launch_id)
+                throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' launch ownership proof is immutable`);
+            if (cursor.archive_path !== undefined && evidence.archive_path !== undefined
+                && cursor.archive_path !== evidence.archive_path)
+                throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' archive evidence is immutable`);
+            cursor.phase = evidence.phase;
+            cursor.launch_id = evidence.launch_id;
+            if (evidence.archive_path !== undefined)
+                cursor.archive_path = evidence.archive_path;
+            cursor.updated_at = now;
+        }
+        writeTask(stored);
+        return presentTaskLenient(stored);
+    });
+}
+/**
+ * Physically remove a deletion-pending task record. Settlement-only: callers
+ * must have completed member retirement and room cleanup first. Missing
+ * records are the idempotent already-settled outcome.
+ */
+export function unlinkDeletedTask(id) {
+    return withTaskLock(id, () => {
+        assertCanonicalTaskId(id);
+        let stored;
+        try {
+            stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                return false;
+            throw error;
         }
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${id} has no pending deletion`);
         try {
-            unlinkSync(p);
+            unlinkSync(taskPath(id));
         }
         catch (error) {
             if (isNotFoundError(error))

package/dist/rooms-tasks/templates.d.ts

@@ -1,5 +1,8 @@
 import type { TemplateDefinition, TemplateSnapshot } from './types.js';
+import type { AgentTemplateDefinition } from '../config.js';
 export declare function hashTemplate(t: TemplateDefinition): string;
-export declare function snapshotTemplate(t: TemplateDefinition): TemplateSnapshot;
+export declare function snapshotTemplate(t: TemplateDefinition, agentTemplates?: Record<string, AgentTemplateDefinition>): TemplateSnapshot;
+/** Explicit mutation boundary immediately before Task/Room plan persistence. */
+export declare function sealTemplateSnapshot(snapshot: TemplateSnapshot, agentTemplates: Record<string, AgentTemplateDefinition>, launchDefinitions?: Record<string, AgentTemplateDefinition>): TemplateSnapshot;
 export declare function resolveTemplate(name: string, customTemplates: Record<string, TemplateDefinition>): TemplateDefinition | undefined;
 export declare function listTemplates(customTemplates: Record<string, TemplateDefinition>): TemplateDefinition[];