@ours.network/fleet 1.1.0-nightly.9 → 1.1.0

package/dist/rooms-tasks/close.d.ts

@@ -1,5 +1,6 @@
 import { withFileLock } from '../atomic-file.js';
-import type { CoworkAdapter } from './cowork-adapter.js';
+import { type TempLifecycleDeps } from '../temp-lifecycle.js';
+import { type CoworkAdapter } from './cowork-adapter.js';
 import type { RoomMemberSeat, RoomOrchestrationRecord } from './types.js';
 export interface RoomCloseDeps {
     inspectMember?(seat: RoomMemberSeat): Promise<{
@@ -11,6 +12,13 @@ export interface RoomCloseDeps {
     removeIdentity?(seat: RoomMemberSeat): Promise<void>;
     lock?: typeof withFileLock;
 }
+export declare function inspectMember(seat: RoomMemberSeat): Promise<{
+    launchId: string;
+}>;
+export declare function waitForLivenessAbsent(role: string, launchId: string, lifecycleDeps?: TempLifecycleDeps): Promise<void>;
+/** Report whether any daemon identity — under any name — carries this exact CID. */
+export declare function identityCidPresent(cid: string): Promise<boolean>;
+export declare function removeExactMemberIdentity(seat: RoomMemberSeat): Promise<void>;
 /** One forward-only room close saga shared by every Fleet entry point. */
 export declare function acceptManagedRoomClose(roomId: string): Promise<RoomOrchestrationRecord>;
 export declare function recordManagedRoomCloseError(roomId: string, error: string, recoveryHint: string): Promise<RoomOrchestrationRecord>;

package/dist/rooms-tasks/close.js

@@ -5,6 +5,7 @@ import { attachOursClient } from '@ours.network/sdk/client';
 import { withFileLock } from '../atomic-file.js';
 import { agentDir, stateRoot } from '../paths.js';
 import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempSupervisorLiveness, } from '../temp-lifecycle.js';
+import { CoworkProtocolError } from './cowork-adapter.js';
 import { advanceMemberRetirement, advanceRoomClose, beginRoomClose, closeRoom, deleteRoomRecord, getRoomRecord, listRoomRecords, setRoomCloseError, } from './room-state.js';
 const CLOSE_LOCK_STALE_MS = 5 * 60_000;
 const STOP_POLLS = 50;
@@ -26,7 +27,7 @@ function exactMemberIdentity(seat) {
         throw new Error(`room member '${seat.role_name}' temp state binds identity '${identity}'; refusing mismatched retirement`);
     }
 }
-async function inspectMember(seat) {
+export async function inspectMember(seat) {
     exactMemberIdentity(seat);
     const supervisor = readTempSupervisor(agentDir(seat.role_name, true));
     if (!supervisor || supervisor.role !== seat.role_name) {
@@ -34,7 +35,7 @@ async function inspectMember(seat) {
     }
     return { launchId: supervisor.launchId };
 }
-async function waitForLivenessAbsent(role, launchId, lifecycleDeps = {}) {
+export async function waitForLivenessAbsent(role, launchId, lifecycleDeps = {}) {
     const dir = agentDir(role, true);
     const sleep = lifecycleDeps.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
     for (let attempt = 0; attempt < STOP_POLLS; attempt++) {
@@ -66,9 +67,16 @@ async function withIdentityClient(work) {
     }
 }
 function listedIdentity(rows, name) {
-    return rows.find(row => row.name === name);
+    return rows.find((row) => row.name === name && 'cid' in row);
 }
-async function removeExactMemberIdentity(seat) {
+/** Report whether any daemon identity — under any name — carries this exact CID. */
+export async function identityCidPresent(cid) {
+    return withIdentityClient(async (client) => {
+        const rows = await client.listIdentities();
+        return rows.some(row => 'cid' in row && row.cid.toLowerCase() === cid.toLowerCase());
+    });
+}
+export async function removeExactMemberIdentity(seat) {
     await withIdentityClient(async (client) => {
         const before = listedIdentity(await client.listIdentities(), seat.role_name);
         if (!before)
@@ -163,7 +171,7 @@ export async function closeManagedRoom(input) {
             return closeRoom(input.roomId);
         }
         catch (error) {
-            setRoomCloseError(input.roomId, errorText(error), `Retry 'ours-fleet room delete ${input.roomId} ${input.roomId}' or run room recover.`);
+            setRoomCloseError(input.roomId, errorText(error), `Retry 'ours-fleet room delete ${input.roomId} ${input.roomId}'.`);
             throw error;
         }
     }, {}, CLOSE_LOCK_STALE_MS);
@@ -172,7 +180,15 @@ export async function closeManagedRoom(input) {
 export async function deleteLegacyClosedRooms(input) {
     const deleted = [];
     for (const room of listRoomRecords({ state: 'closed' })) {
-        await input.cowork.deleteRoom(room.room_id);
+        try {
+            await input.cowork.deleteRoom(room.room_id);
+        }
+        catch (error) {
+            // The retained Fleet record is the legacy state being migrated. If the
+            // exact Cowork room is already absent, the desired deletion is complete.
+            if (!(error instanceof CoworkProtocolError && error.code === 'not_found'))
+                throw error;
+        }
         deleteRoomRecord(room.room_id);
         deleted.push(room.room_id);
     }
@@ -185,7 +201,7 @@ export async function deleteManagedRoom(input) {
         await input.cowork.deleteRoom(input.roomId);
     }
     catch (error) {
-        setRoomCloseError(input.roomId, errorText(error), `Retry 'ours-fleet room delete ${input.roomId} ${input.roomId}' or run room recover.`);
+        setRoomCloseError(input.roomId, errorText(error), `Retry 'ours-fleet room delete ${input.roomId} ${input.roomId}'.`);
         throw error;
     }
     deleteRoomRecord(input.roomId);

package/dist/rooms-tasks/config.js

@@ -1,7 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
-import { ROOMS_KEYS as RK, ROOMS_OWNER_KEYS as ROK, ROOMS_COWORK_KEYS as RCK, ROOMS_DEFAULTS_KEYS as RDK, TASKS_KEYS as TK, TEMPLATE_KEYS as TPK, TEMPLATE_MEMBER_KEYS as TMK, } from './types.js';
-import { isSensitiveConfigKey } from '../sensitive-config.js';
+import { ROOMS_KEYS as RK, ROOMS_OWNER_KEYS as ROK, ROOMS_COWORK_KEYS as RCK, ROOMS_DEFAULTS_KEYS as RDK, TASKS_KEYS as TK, TEMPLATE_KEYS as TPK, TEMPLATE_MEMBER_KEYS as TMK, TEMPLATE_ROOM_KEYS as TRK, } from './types.js';
 const isPlainObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
 const CID_RE = /^[0-9a-fA-F]{64}$/;
 export class RoomsTasksConfigError extends Error {
@@ -133,39 +132,31 @@ export function validateRoomTemplatesConfig(raw, path) {
                 throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].role: required string`);
             if (!Number.isInteger(m.count) || m.count < 1)
                 throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].count: required positive integer`);
-            if (!isPlainObject(m.agent))
-                throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].agent: required mapping`);
-            const agentKeys = Object.keys(m.agent);
-            const isRef = agentKeys.length === 1 && typeof m.agent.ref === 'string';
-            const isDefinition = agentKeys.includes('role') && agentKeys.includes('brain');
-            if (!isRef && !isDefinition)
-                throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].agent: must be {ref} or canonical {role, brain, ...}`);
-            const containsSensitive = (value) => Array.isArray(value)
-                ? value.some(containsSensitive)
-                : Boolean(value && typeof value === 'object' && Object.entries(value)
-                    .some(([key, child]) => isSensitiveConfigKey(key) || containsSensitive(child)));
-            if (isDefinition && containsSensitive(m.agent))
-                throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].agent: inline sensitive configuration cannot be persisted; use references`);
-            if (isDefinition) {
-                const definition = m.agent;
-                const brain = isPlainObject(definition.brain) && isPlainObject(definition.brain.inline)
-                    ? definition.brain.inline : undefined;
-                if (definition.env !== undefined || definition.owner_channel !== undefined
-                    || definition.auth_proxy !== undefined || brain?.harness_options !== undefined
-                    || brain?.session_options !== undefined)
-                    throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].agent: secret-capable inline fields cannot be persisted; use references`);
-            }
+            if (m.agent !== undefined)
+                throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].agent: persistent Agent references are no longer allowed; use agent_template: <ID>`);
+            if (typeof m.agent_template !== 'string' || !m.agent_template.trim())
+                throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].agent_template: required non-blank Agent Template ID`);
             return {
                 slot: m.slot,
                 role: m.role,
                 count: m.count,
-                agent: structuredClone(m.agent),
+                agent_template: m.agent_template,
             };
         });
+        const slots = new Set();
+        for (const member of members) {
+            if (slots.has(member.slot))
+                throw new RoomsTasksConfigError(path, `room_templates.${name}.members: duplicate slot '${member.slot}'`);
+            slots.add(member.slot);
+        }
         let room;
         if (tplRaw.room !== undefined) {
             if (!isPlainObject(tplRaw.room))
                 throw new RoomsTasksConfigError(path, `room_templates.${name}.room: must be a mapping`);
+            rejectUnknown(tplRaw.room, TRK, path, `room_templates.${name}.room`);
+            for (const key of TRK)
+                if (tplRaw.room[key] !== undefined && typeof tplRaw.room[key] !== 'boolean')
+                    throw new RoomsTasksConfigError(path, `room_templates.${name}.room.${key}: must be a boolean`);
             room = {
                 quiet_membership: tplRaw.room.quiet_membership,
                 anonymous: tplRaw.room.anonymous,

package/dist/rooms-tasks/cowork-adapter.d.ts

@@ -33,6 +33,7 @@ export interface CoworkRoomInfo {
     identity_cid: string;
     room_name: string;
     state: 'provisioning' | 'active' | 'closing' | 'closed';
+    anonymous: boolean;
     seats: CoworkSeatInfo[];
     goal?: string;
     briefing?: string;
@@ -72,6 +73,10 @@ export interface CoworkAdapter {
         role: string;
         text: string;
     }): Promise<CoworkRoleBriefingInfo>;
+    setRoleCommands(roomId: string, opts: {
+        role: string;
+        commands: Array<'list-members' | 'remove-member'>;
+    }): Promise<void>;
     getHistory(roomId: string, opts?: {
         after?: number;
         limit?: number;

package/dist/rooms-tasks/cowork-adapter.js

@@ -47,6 +47,11 @@ function roomState(value, operation) {
         throw new CoworkProtocolError(operation, 'room state is invalid');
     return value;
 }
+function boolean(value, operation, label) {
+    if (typeof value !== 'boolean')
+        throw new CoworkProtocolError(operation, `${label} must be a boolean`);
+    return value;
+}
 function seatState(value, operation) {
     if (value !== 'pending' && value !== 'active' && value !== 'removed')
         throw new CoworkProtocolError(operation, 'seat state is invalid');
@@ -86,6 +91,7 @@ function projectRoom(value, operation) {
         identity_cid: text(room.identity_cid, operation, 'room.identity_cid'),
         room_name: string(room.room_name, operation, 'room.room_name'),
         state: roomState(room.state, operation),
+        anonymous: room.anonymous === undefined ? false : boolean(room.anonymous, operation, 'room.anonymous'),
         seats: room.seats.map((seat) => projectSeat(seat, operation)),
         role_briefings: projectedBriefings,
         ...(typeof mission?.goal === 'string' ? { goal: mission.goal } : {}),
@@ -384,6 +390,13 @@ export function createCoworkAdapter(options = {}) {
                 throw new CoworkProtocolError('room.participants', 'result must be an array');
             return result.map((seat) => projectSeat(seat, 'room.participants'));
         },
+        async setRoleCommands(roomId, opts) {
+            const result = await call('room.command.role.set', {
+                room_id: roomId, role: opts.role, commands: opts.commands,
+            });
+            if (!Array.isArray(result))
+                throw new CoworkProtocolError('room.command.role.set', 'result must be an array');
+        },
         async recoverRoom(roomId) {
             // Cowork performs packet/state reconciliation during daemon recovery.
             // Its `room.recover` RPC is specifically invite-receipt recovery, so a

package/dist/rooms-tasks/deletion.d.ts

@@ -0,0 +1,51 @@
+import { type RoomCloseDeps } from './close.js';
+import { type CoworkAdapter } from './cowork-adapter.js';
+import { type TaskDeletionAcceptance } from './task-state.js';
+import type { TaskDeletionActor, TaskRecord } from './types.js';
+export { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
+type DeletionCowork = Pick<CoworkAdapter, 'closeRoom' | 'deleteRoom'>;
+export interface TaskDeletionSettleDeps {
+    roomClose?: RoomCloseDeps;
+    /** Test seam for the temp-state existence proof. */
+    hasTempState?(name: string): boolean;
+    /** Test seam for the CID-wide daemon identity scan. */
+    identityCidPresent?(cid: string): Promise<boolean>;
+}
+export interface TaskDeletionSettleResult {
+    task_id: string;
+    deleted: boolean;
+    /** Lifecycle state observed before unlink, for completion audit. */
+    previous_state?: TaskRecord['state'];
+    /** Title observed before unlink, for completion audit. */
+    title?: string;
+}
+/**
+ * Accept a permanent task deletion under the common task-operation lock so it
+ * serializes against terminal settlement, recovery, and the room-publication
+ * window. Acceptance is durable before any side effect and never requires
+ * Cowork availability; settlement runs separately and converges through
+ * retries.
+ */
+export declare function acceptTaskDeletion(taskId: string, actor: TaskDeletionActor): Promise<TaskDeletionAcceptance>;
+/** Persist a settlement failure under the same task-operation lock. */
+export declare function recordTaskDeletionError(taskId: string, error: string, recoveryHint: string): Promise<TaskRecord>;
+/**
+ * Converge an accepted deletion to physical absence in two lock-ordered
+ * stages. Cleanup stage (task-operation lock): per surviving room record,
+ * register late seats → close saga (retires members) → durable evidence
+ * checkpoint → tolerant remote delete → local record delete; then
+ * cursor-based retirement for members with no room record and tolerant remote
+ * close+delete of a recorded room whose local record is gone. Finalization
+ * stage (launch-snapshot lock → task-operation lock, matching the global
+ * provisioning order): re-verify quiescence, delete the owned launch snapshot
+ * while excluding only this deleting task from the reference scan, and unlink
+ * the task record LAST — every crash seam leaves the hidden intent
+ * recoverable. Failures are recorded on the intent; the task stays hidden and
+ * recoverable, never falsely settled.
+ */
+export declare function settleTaskDeletion(input: {
+    taskId: string;
+    /** Lazy: resolved only when room work exists, so no-room tasks settle without Cowork config. */
+    cowork: () => DeletionCowork;
+    deps?: TaskDeletionSettleDeps;
+}): Promise<TaskDeletionSettleResult>;

package/dist/rooms-tasks/deletion.js

@@ -0,0 +1,217 @@
+import { existsSync } from 'node:fs';
+import { withFileLock } from '../atomic-file.js';
+import { agentDir } from '../paths.js';
+import { secureStoppedTempArchive, stopTempSupervisor } from '../temp-lifecycle.js';
+import { closeManagedRoom, identityCidPresent, inspectMember, removeExactMemberIdentity, waitForLivenessAbsent, } from './close.js';
+import { CoworkProtocolError } from './cowork-adapter.js';
+import { deleteRoomRecord, getRoomRecord, listRoomRecords } from './room-state.js';
+import { acquireLaunchSnapshotLock, releaseLaunchSnapshotForDeletingTask } from './launch-snapshot.js';
+import { TASK_OPERATION_LOCK_STALE_MS, taskOperationLockPath } from './terminal.js';
+import { advanceTaskDeletionMember, beginTaskDeletionIntent, completeTaskDeletionReceipt, ensureTaskDeletionReceipt, getDeletingTask, importTaskDeletionRetirementEvidence, setTaskDeletionError, TaskStateError, unlinkDeletedTask, upsertTaskDeletionMembersFromSeats, } from './task-state.js';
+export { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
+import { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
+/**
+ * Accept a permanent task deletion under the common task-operation lock so it
+ * serializes against terminal settlement, recovery, and the room-publication
+ * window. Acceptance is durable before any side effect and never requires
+ * Cowork availability; settlement runs separately and converges through
+ * retries.
+ */
+export function acceptTaskDeletion(taskId, actor) {
+    return withFileLock(taskOperationLockPath(taskId), () => beginTaskDeletionIntent(taskId, actor), {}, TASK_OPERATION_LOCK_STALE_MS);
+}
+/** Persist a settlement failure under the same task-operation lock. */
+export function recordTaskDeletionError(taskId, error, recoveryHint) {
+    return withFileLock(taskOperationLockPath(taskId), () => setTaskDeletionError(taskId, error, recoveryHint), {}, TASK_OPERATION_LOCK_STALE_MS);
+}
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Already-missing remote rooms are a settled outcome, not a failure. */
+function tolerantCowork(cowork) {
+    const tolerate = async (work) => {
+        try {
+            await work();
+        }
+        catch (error) {
+            if (error instanceof CoworkProtocolError && error.code === 'not_found')
+                return;
+            throw error;
+        }
+    };
+    return {
+        closeRoom: roomId => tolerate(() => cowork.closeRoom(roomId)),
+        deleteRoom: roomId => tolerate(() => cowork.deleteRoom(roomId)),
+    };
+}
+function cursorSeat(cursor) {
+    return {
+        role_name: cursor.name, identity_cid: cursor.identity_cid,
+        slot: cursor.name, cowork_role: 'member', seat_state: 'active',
+    };
+}
+/**
+ * Retire one member from its durable deletion cursor when no room record
+ * carries the seat: the same evidence chain as close.ts, resumed at the
+ * recorded phase. A member with no temp state is verified absent through the
+ * CID-wide identity scan; a same-name stranger identity is never touched, and
+ * the recorded CID surviving under any name blocks settlement.
+ */
+async function retireCursorMember(taskId, cursor, deps) {
+    let phase = cursor.phase;
+    let launchId = cursor.launch_id;
+    if (phase === 'identity_absent')
+        return;
+    const seat = cursorSeat(cursor);
+    const roomClose = deps.roomClose ?? {};
+    if (phase === 'pending') {
+        const hasState = (deps.hasTempState ?? (name => existsSync(agentDir(name, true))))(cursor.name);
+        if (!hasState) {
+            const present = await (deps.identityCidPresent ?? identityCidPresent)(cursor.identity_cid);
+            if (present) {
+                // Remove only an exact name+CID match; a stranger under the same name
+                // stays untouched and removeExactMemberIdentity refuses the mismatch.
+                // The recorded CID surviving under a different name throws below on
+                // its post-removal verification and blocks settlement.
+                await (roomClose.removeIdentity ?? removeExactMemberIdentity)(seat);
+                if (await (deps.identityCidPresent ?? identityCidPresent)(cursor.identity_cid))
+                    throw new TaskStateError(`deletion member '${cursor.name}' identity CID survives under another name; refusing to claim retirement`);
+            }
+            advanceTaskDeletionMember(taskId, cursor.name, 'identity_absent', DELETION_MEMBER_ABSENT_VERIFIED);
+            return;
+        }
+        const ownership = await (roomClose.inspectMember ?? inspectMember)(seat);
+        advanceTaskDeletionMember(taskId, cursor.name, 'stop_requested', ownership.launchId);
+        phase = 'stop_requested';
+        launchId = ownership.launchId;
+    }
+    if (phase === 'stop_requested') {
+        await (roomClose.requestStop
+            ?? (async (role) => { await stopTempSupervisor(role); }))(cursor.name);
+        await (roomClose.waitForLivenessAbsent ?? waitForLivenessAbsent)(cursor.name, launchId);
+        advanceTaskDeletionMember(taskId, cursor.name, 'liveness_absent');
+        phase = 'liveness_absent';
+    }
+    if (phase === 'liveness_absent') {
+        const archivePath = await (roomClose.secureArchive ?? secureStoppedTempArchive)(cursor.name, launchId);
+        advanceTaskDeletionMember(taskId, cursor.name, 'archive_secured', undefined, archivePath);
+        phase = 'archive_secured';
+    }
+    if (phase === 'archive_secured') {
+        await (roomClose.removeIdentity ?? removeExactMemberIdentity)(seat);
+        advanceTaskDeletionMember(taskId, cursor.name, 'identity_absent');
+    }
+}
+/**
+ * Converge an accepted deletion to physical absence in two lock-ordered
+ * stages. Cleanup stage (task-operation lock): per surviving room record,
+ * register late seats → close saga (retires members) → durable evidence
+ * checkpoint → tolerant remote delete → local record delete; then
+ * cursor-based retirement for members with no room record and tolerant remote
+ * close+delete of a recorded room whose local record is gone. Finalization
+ * stage (launch-snapshot lock → task-operation lock, matching the global
+ * provisioning order): re-verify quiescence, delete the owned launch snapshot
+ * while excluding only this deleting task from the reference scan, and unlink
+ * the task record LAST — every crash seam leaves the hidden intent
+ * recoverable. Failures are recorded on the intent; the task stays hidden and
+ * recoverable, never falsely settled.
+ */
+export async function settleTaskDeletion(input) {
+    const { taskId } = input;
+    const deps = input.deps ?? {};
+    const recoveryHint = `Re-run 'ours-fleet task delete ${taskId} ${taskId}'.`;
+    const cleanup = await withFileLock(taskOperationLockPath(taskId), async () => {
+        let task;
+        try {
+            task = getDeletingTask(taskId);
+        }
+        catch (error) {
+            if (error instanceof TaskStateError && /task not found/.test(error.message))
+                return { kind: 'already_absent' };
+            throw error;
+        }
+        if (task.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${taskId} has no pending deletion`);
+        try {
+            // Audit evidence precedes every side effect; a receipt write failure
+            // aborts settlement (fail closed).
+            ensureTaskDeletionReceipt(taskId);
+            const records = listRoomRecords().filter(room => room.task_id === taskId);
+            const recordIds = new Set(records.map(room => room.room_id));
+            const recordedRoomId = task.deletion.room_id ?? task.room_id;
+            const needsCowork = records.length > 0 || recordedRoomId !== undefined;
+            const cowork = needsCowork ? tolerantCowork(input.cowork()) : undefined;
+            for (const record of records) {
+                upsertTaskDeletionMembersFromSeats(taskId, record.member_seats);
+                await closeManagedRoom({ roomId: record.room_id, cowork: cowork, deps: deps.roomClose });
+                const closed = getRoomRecord(record.room_id);
+                importTaskDeletionRetirementEvidence(taskId, closed?.member_seats ?? record.member_seats);
+                await cowork.deleteRoom(record.room_id);
+                deleteRoomRecord(record.room_id);
+            }
+            // Members whose room record is gone (crash after record deletion, or
+            // legacy state): resume from the durable cursors.
+            for (const cursor of getDeletingTask(taskId).deletion.members) {
+                await retireCursorMember(taskId, cursor, deps);
+            }
+            // A recorded room without a local record may still be live remotely.
+            if (recordedRoomId && !recordIds.has(recordedRoomId) && !getRoomRecord(recordedRoomId)) {
+                await cowork.closeRoom(recordedRoomId);
+                await cowork.deleteRoom(recordedRoomId);
+            }
+            return {
+                kind: 'cleaned',
+                snapshotHash: task.execution_plan?.snapshot.launch_snapshot_hash,
+                previousState: task.state,
+                title: task.title,
+            };
+        }
+        catch (error) {
+            setTaskDeletionError(taskId, errorText(error), recoveryHint);
+            throw error;
+        }
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+    if (cleanup.kind === 'already_absent') {
+        // Heal a crash between unlink and receipt completion.
+        completeTaskDeletionReceipt(taskId);
+        return { task_id: taskId, deleted: false };
+    }
+    const finalize = () => withFileLock(taskOperationLockPath(taskId), () => {
+        try {
+            const task = getDeletingTask(taskId);
+            if (task.deletion?.status !== 'pending')
+                throw new TaskStateError(`task ${taskId} has no pending deletion`);
+            if (listRoomRecords().some(room => room.task_id === taskId))
+                throw new TaskStateError(`task ${taskId} room records reappeared during deletion finalization`);
+            if (task.deletion.members.some(member => member.phase !== 'identity_absent'))
+                throw new TaskStateError(`task ${taskId} has unretired members at deletion finalization`);
+            if (cleanup.snapshotHash)
+                releaseLaunchSnapshotForDeletingTask(cleanup.snapshotHash, taskId);
+            unlinkDeletedTask(taskId);
+        }
+        catch (error) {
+            setTaskDeletionError(taskId, errorText(error), recoveryHint);
+            throw error;
+        }
+        // After unlink the task can no longer carry errors; receipt completion is
+        // idempotent and the already-absent retry path heals a crash here.
+        completeTaskDeletionReceipt(taskId);
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+    if (cleanup.snapshotHash) {
+        // Global lock order: launch-snapshot lock → task-operation lock.
+        const releaseSnapshotLock = acquireLaunchSnapshotLock();
+        try {
+            await finalize();
+        }
+        finally {
+            releaseSnapshotLock();
+        }
+    }
+    else {
+        await finalize();
+    }
+    return {
+        task_id: taskId, deleted: true,
+        previous_state: cleanup.previousState, title: cleanup.title,
+    };
+}

package/dist/rooms-tasks/external-worker.d.ts

@@ -1,3 +1,11 @@
+import type { FleetAuditPresentation } from '../fleet-command-audit.js';
+/** Lifecycle-only return path for a trusted worker; never authorizes a fresh Fleet attempt. */
+export declare const FLEET_WORKER_LIFECYCLE_STATE_DIR_ENV = "OURS_FLEET_WORKER_LIFECYCLE_STATE_DIR";
 export declare function fleetWorkerEnv(source?: NodeJS.ProcessEnv): Record<string, string>;
+/** Present a detached worker's durable outcome through the authenticated Owner sink. */
+export declare function presentFleetWorkerLifecycle(presentations: FleetAuditPresentation[], deps?: {
+    now(): number;
+    sleep(ms: number): Promise<void>;
+}): Promise<void>;
 /** Launch a Fleet CLI operation outside the caller's supervisor/session lifecycle. */
 export declare function launchFleetWorker(args: string[], operation: string, configPath?: string): Promise<void>;

package/dist/rooms-tasks/external-worker.js

@@ -1,18 +1,56 @@
 import { execFile, spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV } from '../fleet-proxy.js';
+import { controlRequest } from '../session/control.js';
+import { SessionControlError } from '../session/types.js';
+/** Lifecycle-only return path for a trusted worker; never authorizes a fresh Fleet attempt. */
+export const FLEET_WORKER_LIFECYCLE_STATE_DIR_ENV = 'OURS_FLEET_WORKER_LIFECYCLE_STATE_DIR';
+const LIFECYCLE_ACCEPT_TIMEOUT_MS = 10 * 60_000;
+const LIFECYCLE_RETRY_MS = 250;
 export function fleetWorkerEnv(source = process.env) {
     const inheritedKeys = [
         'HOME', 'PATH', 'XDG_RUNTIME_DIR', 'OURS_FLEET_HOME', 'OURS_CONFIG',
         'OURS_PORT', 'OURS_STATE_DIR', 'OURS_API_TOKEN', 'OURS_COWORK_CONFIG',
     ];
     const env = Object.fromEntries(inheritedKeys.flatMap(key => source[key] === undefined ? [] : [[key, source[key]]]));
+    const lifecycleStateDir = source[FLEET_WORKER_LIFECYCLE_STATE_DIR_ENV]
+        ?? source[FLEET_PROXY_STATE_DIR_ENV];
+    if (lifecycleStateDir)
+        env[FLEET_WORKER_LIFECYCLE_STATE_DIR_ENV] = lifecycleStateDir;
     // Explicit defense: trusted settle/recover/delete/close workers are effects
     // nested inside the outer audited command, never fresh agent attempts.
     delete env[FLEET_PROXY_STATE_DIR_ENV];
     delete env[FLEET_PROXY_CALLER_ENV];
     return env;
 }
+/** Present a detached worker's durable outcome through the authenticated Owner sink. */
+export async function presentFleetWorkerLifecycle(presentations, deps = {
+    now: Date.now, sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+}) {
+    const stateDir = process.env[FLEET_WORKER_LIFECYCLE_STATE_DIR_ENV];
+    if (!stateDir || !presentations.length)
+        return;
+    const deadline = deps.now() + LIFECYCLE_ACCEPT_TIMEOUT_MS;
+    for (;;) {
+        try {
+            const response = await controlRequest(stateDir, {
+                command: 'fleet_audit_present', audit: { presentations },
+            }, 15_000);
+            if (!response.ok)
+                throw new SessionControlError(response.kind ?? 'backend', response.error ?? 'detached Fleet lifecycle delivery failed');
+            return;
+        }
+        catch (error) {
+            // Missing token/socket and refused connect are classified before any
+            // request can cross the server boundary, so only this class is safe to
+            // retry. Timeout/backend/response failures may be uncertain and stop.
+            if (!(error instanceof SessionControlError)
+                || error.kind !== 'control-unavailable' || deps.now() >= deadline)
+                throw error;
+            await deps.sleep(LIFECYCLE_RETRY_MS);
+        }
+    }
+}
 /** Launch a Fleet CLI operation outside the caller's supervisor/session lifecycle. */
 export function launchFleetWorker(args, operation, configPath) {
     const cli = [process.argv[1], ...args, ...(configPath ? ['-c', configPath] : [])];

package/dist/rooms-tasks/launch-snapshot.d.ts

@@ -0,0 +1,19 @@
+import type { AgentTemplateDefinition } from '../config.js';
+/** Cross-process exclusion used from seal through durable Room publication. */
+export declare function acquireLaunchSnapshotLock(options?: {
+    beforePublish?: (claimPath: string, lockPath: string) => void;
+}): () => void;
+export declare function redactLaunchDefinition(value: unknown, key?: string): unknown;
+export declare function sealLaunchSnapshot(definitions: Record<string, AgentTemplateDefinition>): string;
+export declare function readLaunchSnapshot(hash: string): Record<string, AgentTemplateDefinition>;
+/** Delete a sealed snapshot only after no retained Task/Room record references it. */
+export declare function releaseLaunchSnapshot(hash: string): void;
+/**
+ * Deletion-finalization variant: the caller already holds the global
+ * launch-snapshot lock and is about to unlink the deletion-pending task
+ * `taskId`. The reference scan excludes exactly that task file — every other
+ * retained Task/Room reference still protects the snapshot. Deleting the
+ * snapshot BEFORE the task unlink keeps every crash seam recoverable: the
+ * hidden intent survives, and a retry sees the snapshot already absent.
+ */
+export declare function releaseLaunchSnapshotForDeletingTask(hash: string, taskId: string): void;