@ours.network/fleet 1.1.0-nightly.9 → 1.1.1

package/dist/application/task-room-service.js

@@ -1,16 +1,53 @@
 import { readFileSync } from 'node:fs';
-import { createHash } from 'node:crypto';
 import { ConfigError, loadConfig } from '../config.js';
 import { CoworkProtocolError, CoworkUnavailableError, createCoworkAdapter, } from '../rooms-tasks/cowork-adapter.js';
 import { getBinPath, provisionMembers } from '../rooms-tasks/provision.js';
 import { activateRoom, advanceSaga, createRoomRecord, getRoomRecord, listRoomRecords, setOwnerSeat, setSagaError, } from '../rooms-tasks/room-state.js';
-import { activateTask, blockTask as persistBlockTask, createTask as persistTask, deleteTask as persistDeleteTask, getTask as readTask, listTasks as readTasks, moveTaskToList, reviewTask as persistReviewTask, startTask as transitionTask, TaskStateError, unblockTask as persistUnblockTask, updateTaskRoom, updateTaskTemplate, } from '../rooms-tasks/task-state.js';
+import { activateTask, blockTask as persistBlockTask, createTask as persistTask, getDeletingTask, getTask as readTask, listTasks as readTasks, taskDeletionState, moveTaskToList, reviewTask as persistReviewTask, startTask as transitionTask, TaskStateError, unblockTask as persistUnblockTask, updateTaskRoom, updateTaskTemplate, updateTaskExecutionPlan, } from '../rooms-tasks/task-state.js';
 import { createTaskListLocked, DEFAULT_TASK_LIST_ID, deleteTaskListRecordLocked, readTaskLists, renameTaskListLocked, resolveTaskList, TaskListError, withTaskListsLock, } from '../rooms-tasks/task-lists.js';
-import { recordFleetAuditPresentation } from '../fleet-command-audit.js';
-import { hashTemplate, listTemplates, resolveTemplate, snapshotTemplate } from '../rooms-tasks/templates.js';
+import { hashTemplate, listTemplates, resolveTemplate, sealTemplateSnapshot, snapshotTemplate } from '../rooms-tasks/templates.js';
+import { acquireLaunchSnapshotLock, releaseLaunchSnapshot } from '../rooms-tasks/launch-snapshot.js';
+import { hashMemberOverrides, prepareExecutionPlan } from '../rooms-tasks/member-overrides.js';
+import { recordFleetAuditPresentation, recordFleetAuditResource, } from '../fleet-command-audit.js';
 import { acceptManagedRoomClose, deleteLegacyClosedRooms, deleteManagedRoom, recordManagedRoomCloseError, } from '../rooms-tasks/close.js';
-import { acceptTaskTerminalIntent, recordTaskTerminalIntentError, settleTaskTerminalIntent, } from '../rooms-tasks/terminal.js';
-import { TASK_CANCELLABLE_STATES, TASK_TERMINAL_STATES } from '../rooms-tasks/types.js';
+import { acceptTaskTerminalIntent, recordTaskTerminalIntentError, settleTaskTerminalIntent, TASK_OPERATION_LOCK_STALE_MS, taskOperationLockPath, } from '../rooms-tasks/terminal.js';
+import { acceptTaskDeletion, recordTaskDeletionError, settleTaskDeletion, } from '../rooms-tasks/deletion.js';
+import { withFileLock } from '../atomic-file.js';
+import { launchFleetWorker } from '../rooms-tasks/external-worker.js';
+import { storedRoomLaunchPolicy, TASK_CANCELLABLE_STATES, TASK_TERMINAL_STATES } from '../rooms-tasks/types.js';
+import { deriveTaskRoomName } from '../rooms-tasks/task-room-name.js';
+const OWNER_ROOM_COMMANDS = ['list-members', 'remove-member'];
+/** Repairable terminal observation derived entirely from durable Task/Room state. */
+export function recordTaskProvisioningOutcome(outcome) {
+    const room = outcome.room;
+    recordFleetAuditResource('task', outcome.task.task_id);
+    if (room)
+        recordFleetAuditResource('room', room.room_id);
+    if (outcome.kind === 'ready' && room)
+        recordFleetAuditPresentation({
+            kind: 'task', operation: 'work', eventId: `task-ready:${room.activated_at ?? room.created_at}`,
+            id: outcome.task.task_id, title: outcome.task.title,
+            previousState: 'provisioning', newState: 'active', revision: room.activated_at ?? room.created_at,
+            list: outcome.task.list_name ?? 'default', roomId: room.room_id, roomName: room.room_name,
+            template: outcome.launch.template,
+            agents: room.member_seats.map(member => ({ name: member.role_name, role: member.cowork_role,
+                configuration: member.launch?.presentation })),
+        });
+    if (outcome.kind === 'failed')
+        recordFleetAuditPresentation({
+            kind: 'lifecycle_failure', resource: 'Task', id: outcome.task.task_id,
+            label: outcome.task.title,
+            state: outcome.task.state, category: 'provision_failed',
+            eventId: outcome.task.ended_at ?? room?.created_at ?? outcome.task.created_at,
+        });
+    if (outcome.kind === 'in_progress')
+        recordFleetAuditPresentation({
+            kind: 'lifecycle_failure', resource: 'Task', id: outcome.task.task_id,
+            label: outcome.task.title,
+            state: outcome.task.state, category: 'provision_pending',
+            eventId: room?.created_at ?? outcome.task.created_at,
+        });
+}
 export class TaskRoomApplicationError extends Error {
     code;
     fields;
@@ -21,102 +58,95 @@ export class TaskRoomApplicationError extends Error {
         this.name = 'TaskRoomApplicationError';
     }
 }
-function launchSelection(definition, key) {
-    const selected = definition?.[key];
-    if (!selected || typeof selected !== 'object' || Array.isArray(selected))
-        return undefined;
-    const value = selected;
-    if (value.kind === 'ref' && typeof value.id === 'string')
-        return `ref:${value.id} (reference)`;
-    if (value.kind === 'inline' && typeof value.fingerprint === 'string')
-        return `inline:${value.fingerprint} (inline)`;
-    return undefined;
-}
-function launchPermissions(definition) {
-    const selected = definition?.permissions;
-    if (!selected || typeof selected !== 'object' || Array.isArray(selected))
-        return undefined;
-    const value = selected;
-    const fields = ['approval', 'filesystem', 'unattended'].flatMap(key => typeof value[key] === 'string' ? [`${key}=${value[key]}`] : []);
-    return fields.length ? fields.join(',') : undefined;
-}
-function roomParticipants(room) {
-    return [...room.member_seats].sort((a, b) => a.role_name.localeCompare(b.role_name)).map(seat => ({
-        name: seat.role_name, id: seat.identity_cid,
-        brain: launchSelection(seat.launch?.agent_definition, 'brain'),
-        role: launchSelection(seat.launch?.agent_definition, 'role') ?? seat.cowork_role,
-        permissions: launchPermissions(seat.launch?.agent_definition),
-    }));
-}
-function taskAgents(task) {
-    const room = task.room_id ? getRoomRecord(task.room_id) : undefined;
-    const seats = new Map(room?.member_seats.map(seat => [seat.role_name, seat]) ?? []);
-    return [...task.member_roles].sort((a, b) => a.name.localeCompare(b.name)).map(member => {
-        const seat = seats.get(member.name);
-        return { name: member.name, brain: launchSelection(seat?.launch?.agent_definition, 'brain'),
-            role: launchSelection(seat?.launch?.agent_definition, 'role') ?? member.cowork_role,
-            permissions: launchPermissions(seat?.launch?.agent_definition) };
-    });
-}
-function roomFailureEventId(room) {
-    const evidence = `${room.created_at}\0${room.saga.phase}\0${room.saga.step_index}\0${room.saga.error ?? ''}`;
-    return `sha256:${createHash('sha256').update(evidence).digest('hex')}`;
+export function resolveRoomLaunchPolicy(template, override) {
+    const anonymous = override ?? template?.room?.anonymous ?? false;
+    return { anonymous };
 }
 /** Exact extraction of the previously CLI-owned task create/start behavior. */
 export class TaskRoomApplicationService {
     configurationPath;
     deps;
-    recovery;
     constructor(configurationPath, deps = {}) {
         this.configurationPath = configurationPath;
         this.deps = deps;
     }
     async createTask(request) {
         const cfg = (this.deps.loadConfiguration ?? loadConfig)(this.configurationPath);
-        const template = this.createTemplate(cfg, request.template, request.noRoom);
-        const ref = template && {
-            name: template.name, version: template.version, content_hash: template.content_hash,
-        };
+        let template = this.createTemplate(cfg, request.template, request.noRoom);
+        if (request.noRoom && request.anonymous !== undefined)
+            throw new ConfigError('--anonymous/--no-anonymous cannot be combined with --no-room');
+        const roomPolicy = resolveRoomLaunchPolicy(template, request.anonymous);
+        let launchDefinitions;
+        let executionPlan;
+        let preparedPlan;
+        if (template) {
+            const definition = resolveTemplate(template.name, cfg.roomTemplates ?? {});
+            preparedPlan = prepareExecutionPlan(definition, cfg, request.members ?? {});
+            launchDefinitions = preparedPlan.launchDefinitions;
+        }
         const brief = request.briefFile ? readFileSync(request.briefFile, 'utf8') : request.brief;
-        let task = await withTaskListsLock(() => {
-            const list = resolveTaskList(request.list ?? 'default');
-            return persistTask({
-                title: request.title, brief, brief_file: request.briefFile, template: ref,
-                origin: request.origin, idempotency_key: request.idempotencyKey,
-                start: !request.backlog, no_room: request.noRoom, listId: list.list_id,
+        const unlock = preparedPlan ? acquireLaunchSnapshotLock() : undefined;
+        let sealedHash;
+        let task;
+        try {
+            if (preparedPlan) {
+                template = sealTemplateSnapshot(preparedPlan.snapshot, cfg.agentTemplates ?? {}, preparedPlan.launchDefinitions);
+                sealedHash = template.launch_snapshot_hash;
+                executionPlan = { schema_version: 1, snapshot: template, room_policy: roomPolicy,
+                    overrides: preparedPlan.overrides,
+                    overrides_hash: preparedPlan.overridesHash,
+                    plan_hash: preparedPlan.planHash };
+            }
+            const ref = template && { name: template.name, version: template.version, content_hash: template.content_hash };
+            task = await withTaskListsLock(() => {
+                const list = resolveTaskList(request.list ?? 'default');
+                return persistTask({
+                    title: request.title, brief, brief_file: request.briefFile, template: ref,
+                    execution_plan: executionPlan,
+                    origin: request.origin, idempotency_key: request.idempotencyKey,
+                    start: !request.backlog, no_room: request.noRoom, listId: list.list_id,
+                });
             });
-        });
-        recordFleetAuditPresentation({ kind: 'task', operation: 'create', id: task.task_id,
-            title: task.title, previousState: 'none', newState: task.state, revision: task.created_at,
-            list: task.list_name ?? 'default', roomId: task.room_id,
-            template: task.template ? `${task.template.name}@${task.template.version}` : undefined,
-            agents: [] });
+        }
+        catch (error) {
+            unlock?.();
+            if (sealedHash)
+                releaseLaunchSnapshot(sealedHash);
+            throw error;
+        }
+        unlock?.();
+        const ref = template && { name: template.name, version: template.version, content_hash: template.content_hash };
+        // A successful create-and-start launch is recorded once by
+        // recordTaskProvisioningOutcome after the linked Room and seats are ready.
+        // Backlog and no-room tasks retain their direct Task lifecycle notice.
+        if (request.backlog || request.noRoom)
+            recordFleetAuditPresentation({ kind: 'task', operation: 'create', id: task.task_id,
+                title: task.title, previousState: 'none', newState: task.state, revision: task.created_at,
+                list: task.list_name ?? 'default', roomId: task.room_id,
+                template: task.template ? `${task.template.name}@${task.template.version}` : undefined,
+                agents: [] });
         if (!request.backlog && !request.noRoom && ref && !task.room_id) {
             try {
                 const room = await this.provisionRoom(cfg, task, template, created => {
                     task = updateTaskRoom(task.task_id, created.room_id, created.room_identity_cid);
-                });
+                }, launchDefinitions, roomPolicy);
                 task = readTask(task.task_id);
-                if (task.state === 'active' && room.state === 'active')
-                    recordFleetAuditPresentation({ kind: 'task', operation: 'work', id: task.task_id,
-                        title: task.title, previousState: 'provisioning', newState: task.state,
-                        revision: getRoomRecord(task.room_id)?.activated_at ?? task.started_at ?? task.created_at,
-                        list: task.list_name ?? 'default', roomId: task.room_id,
-                        template: task.template ? `${task.template.name}@${task.template.version}` : undefined,
-                        agents: taskAgents(task) });
-                else
-                    recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Task', id: task.task_id,
-                        state: task.state, category: 'provision_pending', eventId: roomFailureEventId(room) });
+                void room;
             }
             catch (error) {
                 if (error instanceof CoworkUnavailableError)
                     persistBlockTask(task.task_id, 'Cowork management socket is unavailable');
-                recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Task',
-                    id: task.task_id, state: readTask(task.task_id).state, category: 'provision_failed',
-                    eventId: task.room_id ? roomFailureEventId(getRoomRecord(task.room_id)) : task.created_at });
-                throw error;
+                // Once the durable Room exists, provisioning errors are resumable
+                // saga state. Return that explicit state so the command can launch a
+                // continuation and report the durable in-progress outcome.
+                const current = readTask(task.task_id);
+                if (!current.room_id || !getRoomRecord(current.room_id))
+                    throw error;
+                task = current;
             }
         }
+        if (!request.backlog && !request.noRoom && task.room_id)
+            recordTaskProvisioningOutcome(this.taskProvisioningOutcome(task.task_id));
         return task;
     }
     async createRoom(request) {
@@ -127,51 +157,28 @@ export class TaskRoomApplicationService {
             const definition = resolveTemplate(request.template, cfg.roomTemplates ?? {});
             if (!definition)
                 throw new TaskRoomApplicationError('template_not_found', `template not found: ${request.template}`, { template: request.template });
-            template = snapshotTemplate(definition);
+            if (request.members && Object.keys(request.members).length) {
+                const prepared = prepareExecutionPlan(definition, cfg, request.members);
+                template = prepared.snapshot;
+                const roomPolicy = resolveRoomLaunchPolicy(template, request.anonymous);
+                return this.provisionRoom(cfg, { title: request.name, brief, goal: request.goal }, template, () => { }, prepared.launchDefinitions, roomPolicy);
+            }
+            template = snapshotTemplate(definition, cfg.agentTemplates);
         }
+        const roomPolicy = resolveRoomLaunchPolicy(template, request.anonymous);
         return this.provisionRoom(cfg, {
             title: request.name, brief, goal: request.goal,
-        }, template, () => { });
+        }, template, () => { }, undefined, roomPolicy);
     }
     async startTask(input) {
-        const cfg = (this.deps.loadConfiguration ?? loadConfig)(this.configurationPath);
-        let task = transitionTask(input.taskId);
-        recordFleetAuditPresentation({ kind: 'task', operation: 'start', id: task.task_id,
-            title: task.title, previousState: 'backlog', newState: task.state,
-            revision: task.started_at ?? task.created_at, list: task.list_name ?? 'default',
-            template: task.template ? `${task.template.name}@${task.template.version}` : undefined,
-            agents: [] });
-        if (task.template && !task.room_id) {
-            const template = this.existingTemplate(cfg, task);
-            try {
-                const room = await this.provisionRoom(cfg, task, template, created => {
-                    task = updateTaskRoom(task.task_id, created.room_id, created.room_identity_cid);
-                });
-                task = readTask(task.task_id);
-                if (task.state === 'active' && room.state === 'active')
-                    recordFleetAuditPresentation({ kind: 'task', operation: 'work', id: task.task_id,
-                        title: task.title, previousState: 'provisioning', newState: task.state,
-                        revision: getRoomRecord(task.room_id)?.activated_at ?? task.started_at ?? task.created_at,
-                        list: task.list_name ?? 'default', roomId: task.room_id,
-                        template: task.template ? `${task.template.name}@${task.template.version}` : undefined,
-                        agents: taskAgents(task) });
-                else
-                    recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Task', id: task.task_id,
-                        state: task.state, category: 'provision_pending', eventId: roomFailureEventId(room) });
-            }
-            catch (error) {
-                const failed = task.room_id ? getRoomRecord(task.room_id) : undefined;
-                recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Task', id: task.task_id,
-                    state: readTask(task.task_id).state, category: 'provision_failed',
-                    eventId: failed ? roomFailureEventId(failed) : task.created_at });
-                throw error;
-            }
-        }
-        return task;
+        const result = await this.ensureTaskWork(input);
+        if (result.status !== 'already_active')
+            recordTaskProvisioningOutcome(this.taskProvisioningOutcome(result.task.task_id));
+        return result.task;
     }
     listTasks(filter) {
         const listId = filter?.list === undefined ? undefined : resolveTaskList(filter.list).list_id;
-        return readTasks({ state: filter?.state, listId });
+        return readTasks({ state: filter?.state, listId, includeDeleting: filter?.includeDeleting });
     }
     listTaskLists() { return readTaskLists(); }
     groupedTasks(filter) {
@@ -215,6 +222,55 @@ export class TaskRoomApplicationService {
         const task = readTask(taskId);
         return { task, orchestration: task.room_id ? getRoomRecord(task.room_id) : undefined };
     }
+    taskProvisioningOutcome(taskId) {
+        const task = readTask(taskId);
+        const room = task.room_id ? getRoomRecord(task.room_id) : undefined;
+        const expected = room?.template_snapshot?.members.reduce((sum, member) => sum + member.count, 0)
+            ?? task.execution_plan?.snapshot.members.reduce((sum, member) => sum + member.count, 0) ?? 0;
+        const active = room?.member_seats.filter(seat => seat.seat_state === 'active').length ?? 0;
+        const launched = room?.member_seats.filter(seat => seat.launch?.state === 'launched').length ?? 0;
+        const failed = task.state === 'failed' || room?.saga.phase === 'failed';
+        const ready = task.state === 'active' && room?.state === 'active'
+            && active === expected && launched === expected;
+        const blocker = task.outcome?.summary ?? task.blocked?.reason ?? room?.saga.error;
+        const nextAction = room?.provisioning_detail === 'waiting_owner_authorization'
+            ? `Restore ours-cowork, then run ours-fleet task start ${task.task_id}.`
+            : room?.provisioning_detail === 'waiting_owner_invite'
+                ? `Rotate rooms.owner.public_invite, then run ours-fleet task start ${task.task_id}.`
+                : room?.provisioning_detail === 'owner_cid_mismatch'
+                    ? `Verify rooms.owner.expected_cid, rotate the Owner invite, then run ours-fleet task start ${task.task_id}.`
+                    : room?.provisioning_detail === 'waiting_cowork'
+                        ? `Restore ours-cowork, then run ours-fleet task start ${task.task_id}.`
+                        : failed
+                            ? `Correct the blocker, then run ours-fleet task start ${task.task_id}.`
+                            : undefined;
+        return {
+            kind: failed ? 'failed' : ready ? 'ready' : 'in_progress', task, room,
+            launch: {
+                ...(room?.template_snapshot
+                    ? { template: `${room.template_snapshot.name}@${room.template_snapshot.version}` }
+                    : task.template ? { template: `${task.template.name}@${task.template.version}` } : {}),
+                anonymous: storedRoomLaunchPolicy(room?.room_policy ?? task.execution_plan?.room_policy).anonymous,
+                owner_attached: Boolean(room?.owner_seat_cid),
+            },
+            members: { expected, active, launched },
+            ...(blocker ? { blocker } : {}),
+            ...(nextAction ? { next_action: nextAction } : {}),
+        };
+    }
+    async awaitTaskProvisioning(input) {
+        const now = this.deps.now ?? Date.now;
+        const sleep = this.deps.sleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms)));
+        const deadline = now() + (input.waitMs ?? 60_000);
+        for (;;) {
+            const outcome = this.taskProvisioningOutcome(input.taskId);
+            if (outcome.kind !== 'in_progress' || now() >= deadline) {
+                recordTaskProvisioningOutcome(outcome);
+                return outcome;
+            }
+            await sleep(100);
+        }
+    }
     blockTask(input) {
         return persistBlockTask(input.taskId, input.reason);
     }
@@ -224,8 +280,93 @@ export class TaskRoomApplicationService {
     reviewTask(input) {
         return persistReviewTask(input.taskId);
     }
-    deleteTask(input) {
-        return persistDeleteTask(input.taskId);
+    deletionActor(actor) {
+        if (actor.kind === 'local_control')
+            return { kind: 'local_control', surface: actor.surface };
+        if (actor.kind === 'authenticated_owner')
+            return { kind: 'authenticated_owner', surface: 'messenger', cid: actor.cid };
+        throw new Error('internal workers cannot originate a task deletion acceptance');
+    }
+    /** Accept a permanent deletion in any lifecycle state; audit at acceptance. */
+    async requestTaskDeletion(input) {
+        const result = await acceptTaskDeletion(input.taskId, this.deletionActor(input.actor));
+        if (result.status === 'accepted') {
+            const task = result.task;
+            recordFleetAuditPresentation({ kind: 'task', operation: 'delete', id: task.task_id,
+                title: task.title, previousState: task.state, newState: 'deleting',
+                revision: task.deletion?.accepted_at ?? task.created_at, list: task.list_name ?? 'default',
+                roomId: task.room_id,
+                template: task.template ? `${task.template.name}@${task.template.version}` : undefined,
+                agents: [] });
+        }
+        return result;
+    }
+    /** Worker entry: converge an accepted deletion; Cowork is resolved lazily. */
+    async settleTaskDeletion(input) {
+        const result = await settleTaskDeletion({
+            taskId: input.taskId,
+            cowork: () => {
+                // Config resolves only when room work exists: a no-room deletion must
+                // settle even with missing or invalid rooms configuration.
+                const cfg = (this.deps.loadConfiguration ?? loadConfig)(this.configurationPath);
+                if (!cfg.rooms)
+                    throw new ConfigError('rooms: configuration is required before deleting task rooms');
+                return this.deps.cowork ? this.deps.cowork(cfg)
+                    : createCoworkAdapter({ configPath: cfg.rooms.cowork?.config });
+            },
+        });
+        if (result.deleted && result.previous_state) {
+            recordFleetAuditPresentation({ kind: 'task', operation: 'delete', id: result.task_id,
+                title: result.title, previousState: result.previous_state, newState: 'deleted',
+                revision: new Date().toISOString(), list: 'default', roomId: undefined,
+                template: undefined, agents: [] });
+        }
+        return result;
+    }
+    /**
+     * Launch the external deletion worker outside the caller's lifecycle and
+     * wait boundedly for physical absence. Timeouts and launch failures report
+     * a pending, recoverable state — never success. A concurrent worker that
+     * already removed the record reads as settled.
+     */
+    async launchTaskDeletionWorker(input) {
+        const launch = this.deps.launchDeletionWorker
+            ?? ((taskId) => launchFleetWorker(['task', '_settle_delete', taskId], `task-delete-${taskId}`, this.configurationPath));
+        const errorAtBefore = (() => {
+            try {
+                return getDeletingTask(input.taskId).deletion?.error_at;
+            }
+            catch {
+                return undefined;
+            }
+        })();
+        try {
+            await launch(input.taskId);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            await recordTaskDeletionError(input.taskId, message, `External delete worker failed to start. Repeat the delete request for ${input.taskId}.`).catch(() => { });
+            return { deleted: false, pending: true, error: message };
+        }
+        const now = this.deps.now ?? Date.now;
+        const sleep = this.deps.sleep
+            ?? ((ms) => new Promise(resolve => { setTimeout(resolve, ms); }));
+        const deadline = now() + (input.waitMs ?? 10_000);
+        while (now() < deadline) {
+            if (taskDeletionState(input.taskId) === 'absent')
+                return { deleted: true, pending: false };
+            try {
+                const current = getDeletingTask(input.taskId).deletion;
+                if (current?.error_at !== errorAtBefore && current?.error)
+                    return { deleted: false, pending: true, error: current.error };
+            }
+            catch { /* re-checked as absence on the next iteration */ }
+            await sleep(100);
+        }
+        return { deleted: false, pending: true };
+    }
+    recordDeletionError(input) {
+        return recordTaskDeletionError(input.taskId, input.error, input.recoveryHint);
     }
     async completeTask(input) {
         const task = readTask(input.taskId);
@@ -263,33 +404,63 @@ export class TaskRoomApplicationService {
     recordSettlementError(input) {
         return recordTaskTerminalIntentError(input.taskId, input.error, input.recoveryHint);
     }
-    async beginTaskRecovery(input) {
-        const config = (this.deps.loadConfiguration ?? loadConfig)(this.configurationPath);
-        this.recovery = { taskId: input.taskId, config };
-        const task = readTask(input.taskId);
-        if (task.terminal_intent?.status === 'pending')
-            return { kind: 'terminal_worker_required', taskId: input.taskId };
-        return { kind: 'final', result: await this.continueTaskRecovery({
-                actor: input.actor, taskId: input.taskId, terminalTimedOut: false,
-            }) };
-    }
-    async continueTaskRecovery(input) {
-        if (!this.recovery || this.recovery.taskId !== input.taskId)
-            throw new Error('task recovery continuation requires a matching begin');
-        const recovery = this.recovery;
-        this.recovery = undefined;
-        const cfg = recovery.config;
+    async continueTaskProvisioning(input) {
+        const cfg = (this.deps.loadConfiguration ?? loadConfig)(this.configurationPath);
         let task = readTask(input.taskId);
         let room = task.room_id ? getRoomRecord(task.room_id) : undefined;
-        const issues = input.terminalTimedOut ? [{ code: 'terminal_pending' }] : [];
+        const issues = [];
         if (task.state !== 'provisioning')
             return {
-                kind: TASK_TERMINAL_STATES.includes(task.state) ? 'terminal' : 'no_op', task, room, issues,
+                kind: 'no_op', task, room, issues,
             };
+        if (!room) {
+            if (!task.template)
+                return {
+                    kind: 'provisioning_non_resumable', task, room, issues, reason: 'missing_room',
+                };
+            try {
+                const template = task.execution_plan?.snapshot ?? this.existingTemplate(cfg, task);
+                const roomPolicy = task.execution_plan
+                    ? storedRoomLaunchPolicy(task.execution_plan.room_policy)
+                    : resolveRoomLaunchPolicy(template, undefined);
+                await this.provisionRoom(cfg, task, template, created => {
+                    task = updateTaskRoom(task.task_id, created.room_id, created.room_identity_cid);
+                }, undefined, roomPolicy);
+                task = readTask(task.task_id);
+                room = task.room_id ? getRoomRecord(task.room_id) : undefined;
+                return { kind: 'provisioning_resumed', task, room, issues: [{ code: 'provisioning_resumed' }] };
+            }
+            catch (error) {
+                issues.push({ code: 'resume_failed', error: error instanceof Error ? error.message : String(error) });
+                return { kind: 'provisioning_resume_failed', task, room, issues };
+            }
+        }
+        if (room.saga.phase === 'attach_owner'
+            || room.provisioning_detail === 'waiting_owner_authorization'
+            || room.provisioning_detail === 'waiting_owner_invite'
+            || room.provisioning_detail === 'owner_cid_mismatch') {
+            try {
+                await this.reconcileProvisioningOwner(cfg, room.room_id);
+                task = readTask(task.task_id);
+                room = getRoomRecord(room.room_id);
+                if (task.state === 'active' && room?.state === 'active')
+                    return {
+                        kind: 'provisioning_resumed', task, room, issues: [{ code: 'provisioning_resumed' }],
+                    };
+            }
+            catch (error) {
+                issues.push({ code: 'resume_failed', error: error instanceof Error ? error.message : String(error) });
+                return { kind: 'provisioning_resume_failed', task, room, issues };
+            }
+        }
         if (!room)
-            return { kind: 'provisioning_non_resumable', task, room, issues, reason: 'missing_room' };
+            return {
+                kind: 'provisioning_non_resumable', task, room, issues, reason: 'missing_room',
+            };
         if (room.provisioning_detail === 'waiting_cowork')
             issues.push({ code: 'waiting_cowork' });
+        if (room.provisioning_detail === 'waiting_owner_authorization')
+            issues.push({ code: 'waiting_owner_authorization' });
         if (room.provisioning_detail === 'waiting_owner_invite')
             issues.push({ code: 'waiting_owner_invite' });
         if (room.provisioning_detail === 'owner_cid_mismatch')
@@ -326,6 +497,50 @@ export class TaskRoomApplicationService {
             return { kind: 'provisioning_resume_failed', task, room, issues };
         }
     }
+    async reconcileProvisioningOwner(cfg, roomId) {
+        if (!cfg.rooms)
+            throw new ConfigError('rooms: configuration is required before creating or querying rooms');
+        const cowork = this.deps.cowork ? this.deps.cowork(cfg)
+            : createCoworkAdapter({ configPath: cfg.rooms.cowork?.config });
+        const remote = await cowork.recoverRoom(roomId);
+        const room = getRoomRecord(roomId);
+        if (!room)
+            throw new Error(`room ${roomId} has no durable orchestration record`);
+        if (room.state === 'closing' || room.state === 'closed')
+            throw new Error(`room ${roomId} is already ${room.state}`);
+        const policy = storedRoomLaunchPolicy(room.room_policy);
+        if ((remote.anonymous ?? false) !== policy.anonymous) {
+            const error = `Cowork anonymity (${String(remote.anonymous ?? false)}) does not match Fleet's durable Room policy (${String(policy.anonymous)})`;
+            setSagaError(roomId, error, 'Do not respawn members. Repair or upgrade Cowork, then retry the originating task.', 'waiting_cowork');
+            throw new Error(error);
+        }
+        if (room.owner_seat_cid) {
+            const ownerCid = room.owner_seat_cid.toLowerCase();
+            const ownerSeat = remote.seats.find(seat => seat.identity_cid.toLowerCase() === ownerCid && seat.seat_state !== 'removed');
+            if (ownerSeat)
+                await cowork.setRoleCommands(roomId, {
+                    role: ownerSeat.role, commands: [...OWNER_ROOM_COMMANDS],
+                });
+            if (room.saga.phase === 'attach_owner')
+                advanceSaga(roomId, 'create_members', 3);
+            return;
+        }
+        const expected = cfg.rooms.owner.expected_cid?.toLowerCase();
+        if (!expected)
+            throw new ConfigError('rooms.owner.expected_cid is required before continuing Owner-seat provisioning');
+        const existing = (await cowork.getSeats(roomId))
+            .find(seat => seat.identity_cid.toLowerCase() === expected && seat.seat_state !== 'removed');
+        if (!existing && !cfg.ownerInvite)
+            throw new ConfigError('rooms.owner: configure public_invite or public_invite_file before continuing task provisioning');
+        await cowork.setRoleCommands(roomId, {
+            role: existing?.role ?? cfg.rooms.owner.role, commands: [...OWNER_ROOM_COMMANDS],
+        });
+        const acceptedCid = existing?.identity_cid ?? (await cowork.acceptInvite(roomId, cfg.ownerInvite, {
+            role: cfg.rooms.owner.role, expected_cid: cfg.rooms.owner.expected_cid,
+        })).seat_cid;
+        setOwnerSeat(roomId, acceptedCid, cfg.ownerInviteFingerprint ?? '');
+        advanceSaga(roomId, 'create_members', 3);
+    }
     async acceptTerminal(taskId, kind, roomId, outcome) {
         const task = await acceptTaskTerminalIntent({ taskId, kind, roomId, outcome });
         return { task, settlementRequired: task.terminal_intent?.status === 'pending' && !!roomId };
@@ -345,11 +560,9 @@ export class TaskRoomApplicationService {
         const cfg = (this.deps.loadConfiguration ?? loadConfig)(this.configurationPath);
         return listTemplates(cfg.roomTemplates ?? {}).flatMap(template => {
             const issues = template.members.flatMap(member => {
-                if (!('ref' in member.agent))
-                    return [];
-                const ref = member.agent.ref;
-                return cfg.roles.some(role => role.name === ref)
-                    ? [] : [`member ${member.slot}: Agent ref '${ref}' not found`];
+                const ref = member.agent_template;
+                return cfg.agentTemplates?.[ref]
+                    ? [] : [`member ${member.slot}: Agent Template '${ref}' not found`];
             });
             return issues.length ? [{ template: `${template.name}@${template.version}`, issues }] : [];
         });
@@ -420,73 +633,6 @@ export class TaskRoomApplicationService {
     recordRoomSettlementError(input) {
         return recordManagedRoomCloseError(input.roomId, input.error, input.recoveryHint);
     }
-    async recoverRoom(input) {
-        const cfg = (this.deps.loadConfiguration ?? loadConfig)(this.configurationPath);
-        if (!cfg.rooms)
-            throw new ConfigError('rooms: configuration is required before creating or querying rooms');
-        const adapter = this.deps.cowork ? this.deps.cowork(cfg)
-            : createCoworkAdapter({ configPath: cfg.rooms.cowork?.config });
-        let orchestration = getRoomRecord(input.roomId);
-        if (orchestration?.state === 'closing' || orchestration?.state === 'closed')
-            return { kind: 'deletion_worker_required', roomId: input.roomId };
-        const room = await adapter.recoverRoom(input.roomId);
-        orchestration = getRoomRecord(input.roomId);
-        if (orchestration && !orchestration.owner_seat_cid
-            && (orchestration.provisioning_detail === 'waiting_owner_invite'
-                || orchestration.provisioning_detail === 'owner_cid_mismatch')) {
-            const expected = cfg.rooms.owner.expected_cid.toLowerCase();
-            const existing = (await adapter.getSeats(input.roomId))
-                .find(seat => seat.identity_cid.toLowerCase() === expected && seat.seat_state !== 'removed');
-            if (!existing && !cfg.ownerInvite)
-                throw new ConfigError('rooms.owner: configure public_invite or public_invite_file before recovery');
-            let acceptedCid = existing?.identity_cid;
-            if (!acceptedCid)
-                acceptedCid = (await adapter.acceptInvite(input.roomId, cfg.ownerInvite, {
-                    role: cfg.rooms.owner.role, expected_cid: cfg.rooms.owner.expected_cid,
-                })).seat_cid;
-            setOwnerSeat(input.roomId, acceptedCid, cfg.ownerInviteFingerprint ?? '');
-            orchestration = advanceSaga(input.roomId, 'create_members', 3);
-        }
-        const issues = [];
-        if (orchestration?.saga.error)
-            issues.push('A provisioning failure is recorded; inspect role logs for diagnostics.');
-        if (orchestration?.saga.recovery_hint)
-            issues.push('Recovery guidance is recorded; inspect role logs for diagnostics.');
-        if (orchestration?.provisioning_detail === 'waiting_cowork')
-            issues.push('Check ours-cowork service status');
-        if (orchestration?.provisioning_detail === 'waiting_owner_invite')
-            issues.push('Rotate rooms.owner.public_invite in config, then re-run recover');
-        if (orchestration?.provisioning_detail === 'waiting_seats')
-            issues.push('Inspect temporary member logs for invite acceptance, then re-run recover');
-        if (orchestration?.state === 'provisioning'
-            && ['create_members', 'join_role_groups', 'wait_seats', 'launch_work', 'activate'].includes(orchestration.saga.phase)
-            && orchestration.template_snapshot) {
-            try {
-                let template = orchestration.template_snapshot;
-                let brief;
-                let goal = orchestration.room_name;
-                if (orchestration.task_id) {
-                    const task = readTask(orchestration.task_id);
-                    if (!task.template || task.template.name !== template.name || task.template.version !== template.version
-                        || task.template.content_hash !== template.content_hash)
-                        throw new Error(`task ${task.task_id} template reference does not match room ${orchestration.room_id}'s durable snapshot`);
-                    brief = task.brief;
-                    goal = task.title;
-                }
-                await (this.deps.provisionMembers ?? provisionMembers)({ cfg, cowork: adapter,
-                    roomId: orchestration.room_id, taskId: orchestration.task_id, template,
-                    binPath: (this.deps.binPath ?? getBinPath)(), brief, goal });
-                orchestration = getRoomRecord(input.roomId);
-                return { kind: 'provisioning_resumed', room, orchestration,
-                    issues: ['Provisioning resumed successfully'] };
-            }
-            catch (error) {
-                issues.push(`Resume failed: ${error instanceof Error ? error.message : String(error)}`);
-                return { kind: 'provisioning_resume_failed', room, orchestration, issues };
-            }
-        }
-        return { kind: 'recovered', room, orchestration, issues };
-    }
     async finishTask(input) {
         let task = readTask(input.taskId);
         if (TASK_TERMINAL_STATES.includes(task.state))
@@ -500,81 +646,161 @@ export class TaskRoomApplicationService {
     async ensureTaskWork(input) {
         const cfg = (this.deps.loadConfiguration ?? loadConfig)(this.configurationPath);
         let task = readTask(input.taskId);
+        const recordedRoom = task.room_id ? getRoomRecord(task.room_id) : undefined;
+        const recordedPolicy = storedRoomLaunchPolicy(recordedRoom?.room_policy ?? task.execution_plan?.room_policy);
+        if (task.room_id && input.anonymous !== undefined && input.anonymous !== recordedPolicy.anonymous)
+            throw new TaskRoomApplicationError('template_mismatch', 'anonymous override does not match the existing Room launch policy', { room: task.room_id });
         if (TASK_TERMINAL_STATES.includes(task.state))
             throw new TaskRoomApplicationError('task_terminal', 'task terminal', { task: input.taskId, state: task.state });
+        const durableTemplate = task.room_id
+            ? getRoomRecord(task.room_id)?.template_snapshot ?? task.execution_plan?.snapshot
+            : task.execution_plan?.snapshot;
+        const templateRequestMatches = !input.template || (durableTemplate !== undefined
+            && (input.template === durableTemplate.name
+                || input.template === `${durableTemplate.name}@${durableTemplate.version}`));
+        const memberRequestMatches = input.members === undefined || (task.execution_plan !== undefined
+            && task.execution_plan.overrides_hash === hashMemberOverrides(input.members));
+        const durableRequestMatches = durableTemplate !== undefined
+            && templateRequestMatches && memberRequestMatches;
         if (task.state === 'active' && task.room_id) {
-            if (input.template) {
-                const definition = resolveTemplate(input.template, cfg.roomTemplates ?? {});
+            if (input.template || input.members) {
+                const pinned = durableTemplate;
+                if (!pinned)
+                    throw new TaskRoomApplicationError('template_mismatch', 'active task has no durable execution plan', { room: task.room_id });
+                if (durableRequestMatches)
+                    return { task, status: 'already_active' };
+                const templateName = input.template ?? pinned.name;
+                const definition = resolveTemplate(templateName, cfg.roomTemplates ?? {});
                 if (!definition)
-                    throw new TaskRoomApplicationError('template_not_found', 'template not found', { template: input.template });
-                const requested = snapshotTemplate(definition);
-                const pinned = getRoomRecord(task.room_id)?.template_snapshot ?? task.template;
-                if (pinned && (pinned.name !== requested.name || pinned.content_hash !== requested.content_hash))
+                    throw new TaskRoomApplicationError('template_not_found', 'template not found', { template: templateName });
+                const requested = prepareExecutionPlan(definition, cfg, input.members ?? {});
+                const pinnedPlanHash = task.execution_plan?.plan_hash ?? pinned.content_hash;
+                if (pinned.name !== requested.snapshot.name || pinnedPlanHash !== requested.planHash)
                     throw new TaskRoomApplicationError('template_mismatch', 'template mismatch', {
-                        requested: `${requested.name}@${requested.version}`, room: task.room_id,
+                        requested: `${requested.snapshot.name}@${requested.snapshot.version}`, room: task.room_id,
                         provisioned: `${pinned.name}@${pinned.version}`
                     });
             }
             return { task, status: 'already_active' };
         }
-        const room = task.room_id ? getRoomRecord(task.room_id) : undefined;
-        const durable = room?.template_snapshot;
+        let room = task.room_id ? getRoomRecord(task.room_id) : undefined;
+        const durable = room?.template_snapshot ?? task.execution_plan?.snapshot;
         if (durable && (!task.template || task.template.name !== durable.name
             || task.template.version !== durable.version || task.template.content_hash !== durable.content_hash))
-            throw new Error(`task ${task.task_id} template reference does not match room ${room.room_id}'s durable snapshot`);
+            throw new Error(`task ${task.task_id} template reference does not match its durable execution snapshot`);
         const templateName = input.template ?? durable?.name ?? task.template?.name
             ?? cfg.tasks?.default_room_template ?? cfg.rooms?.defaults?.template ?? 'single';
-        const definition = durable && !input.template ? undefined
+        const storedOverridesMatch = !!(durable && memberRequestMatches);
+        const definition = durable && durableRequestMatches ? undefined
             : resolveTemplate(templateName, cfg.roomTemplates ?? {});
-        if (input.template && !definition)
+        if (input.template && !definition && !durableRequestMatches)
             throw new TaskRoomApplicationError('template_not_found', 'template not found', { template: templateName });
         if (!durable && !definition)
             throw new TaskRoomApplicationError('template_not_found', 'template not found', { template: templateName });
-        const snapshot = durable ?? snapshotTemplate(definition);
+        let launchDefinitions;
+        let preparedPlan = !durable && definition
+            ? prepareExecutionPlan(definition, cfg, input.members ?? {}) : undefined;
+        let snapshot = durable ?? preparedPlan.snapshot;
+        const roomPolicy = input.anonymous !== undefined
+            ? resolveRoomLaunchPolicy(snapshot, input.anonymous)
+            : task.execution_plan
+                ? storedRoomLaunchPolicy(task.execution_plan.room_policy)
+                : resolveRoomLaunchPolicy(snapshot, undefined);
+        if (preparedPlan)
+            launchDefinitions = preparedPlan.launchDefinitions;
+        if (input.members && Object.keys(input.members).length && !storedOverridesMatch) {
+            if (!definition)
+                throw new TaskRoomApplicationError('template_mismatch', 'member overrides cannot change an existing Room execution plan');
+            const prepared = preparedPlan ?? prepareExecutionPlan(definition, cfg, input.members);
+            preparedPlan = prepared;
+            if (durable && prepared.planHash !== durable.content_hash)
+                throw new TaskRoomApplicationError('template_mismatch', 'member overrides do not match existing execution plan');
+            snapshot = prepared.snapshot;
+            launchDefinitions = prepared.launchDefinitions;
+        }
         if (durable && input.template && definition) {
-            const requested = snapshotTemplate(definition);
+            const requested = snapshotTemplate(definition, cfg.agentTemplates);
             if (requested.name !== durable.name || requested.content_hash !== durable.content_hash)
                 throw new TaskRoomApplicationError('template_mismatch', 'template mismatch', {
                     requested: `${requested.name}@${requested.version}`, room: room.room_id,
                     provisioned: `${durable.name}@${durable.version}`
                 });
         }
-        if (!input.template && task.template && snapshot.content_hash !== task.template.content_hash)
-            throw new TaskRoomApplicationError('task_template_drift', 'task template drift', {
-                template: `${task.template.name}@${task.template.version}`
-            });
+        if (!input.template && task.template && snapshot.content_hash !== task.template.content_hash) {
+            // Pre-execution-plan backlog records used the template-only hash. Accept
+            // that exact legacy pin once, then upgrade it to the complete sealed plan.
+            const legacyHash = definition
+                ? snapshotTemplate(definition, cfg.agentTemplates).content_hash : undefined;
+            if (task.template.content_hash !== legacyHash)
+                throw new TaskRoomApplicationError('task_template_drift', 'task template drift', {
+                    template: `${task.template.name}@${task.template.version}`
+                });
+        }
         if (task.room_id && room?.template_snapshot
             && (room.template_snapshot.name !== snapshot.name || room.template_snapshot.content_hash !== snapshot.content_hash))
             throw new TaskRoomApplicationError('template_mismatch', 'template mismatch', {
                 requested: `${snapshot.name}@${snapshot.version}`, room: task.room_id,
                 provisioned: `${room.template_snapshot.name}@${room.template_snapshot.version}`
             });
-        if (!task.template || task.template.name !== snapshot.name || task.template.content_hash !== snapshot.content_hash)
+        if (preparedPlan && !task.room_id) {
+            const unlock = acquireLaunchSnapshotLock();
+            let sealed;
+            try {
+                sealed = sealTemplateSnapshot(snapshot, cfg.agentTemplates ?? {}, launchDefinitions);
+                task = updateTaskExecutionPlan(task.task_id, { schema_version: 1, snapshot: sealed,
+                    room_policy: roomPolicy,
+                    overrides: preparedPlan.overrides, overrides_hash: preparedPlan.overridesHash,
+                    plan_hash: preparedPlan.planHash });
+                snapshot = sealed;
+            }
+            catch (error) {
+                unlock();
+                if (sealed?.launch_snapshot_hash)
+                    releaseLaunchSnapshot(sealed.launch_snapshot_hash);
+                throw error;
+            }
+            unlock();
+        }
+        else if (!task.room_id && task.execution_plan && input.anonymous !== undefined) {
+            task = updateTaskExecutionPlan(task.task_id, { ...task.execution_plan, room_policy: roomPolicy });
+        }
+        else if (!task.template || task.template.name !== snapshot.name || task.template.content_hash !== snapshot.content_hash)
             task = updateTaskTemplate(task.task_id, { name: snapshot.name, version: snapshot.version, content_hash: snapshot.content_hash });
         if (task.state === 'backlog') {
             task = transitionTask(task.task_id);
-            recordFleetAuditPresentation({ kind: 'task', operation: 'start', id: task.task_id,
-                title: task.title, previousState: 'backlog', newState: task.state,
-                revision: task.started_at ?? task.created_at, list: task.list_name ?? 'default',
-                template: `${snapshot.name}@${snapshot.version}`, agents: [] });
         }
         if (!task.room_id) {
             try {
                 await this.provisionRoom(cfg, task, snapshot, created => {
                     task = updateTaskRoom(task.task_id, created.room_id, created.room_identity_cid);
-                });
+                }, launchDefinitions, roomPolicy);
                 task = readTask(task.task_id);
             }
             catch (error) {
                 if (error instanceof CoworkUnavailableError)
                     persistBlockTask(task.task_id, 'Cowork management socket is unavailable');
-                recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Task',
-                    id: task.task_id, state: readTask(task.task_id).state, category: 'provision_failed',
-                    eventId: task.room_id ? roomFailureEventId(getRoomRecord(task.room_id)) : task.created_at });
-                throw error;
+                const current = readTask(task.task_id);
+                if (!current.room_id || !getRoomRecord(current.room_id))
+                    throw error;
+                task = current;
             }
         }
         else if (task.state === 'provisioning') {
+            if (room && (room.saga.phase === 'attach_owner'
+                || room.provisioning_detail === 'waiting_owner_authorization'
+                || room.provisioning_detail === 'waiting_owner_invite'
+                || room.provisioning_detail === 'owner_cid_mismatch')) {
+                try {
+                    await this.reconcileProvisioningOwner(cfg, room.room_id);
+                    room = getRoomRecord(room.room_id);
+                }
+                catch (error) {
+                    if (error instanceof CoworkUnavailableError)
+                        persistBlockTask(task.task_id, 'Cowork management socket is unavailable');
+                    task = readTask(task.task_id);
+                    return { task, status: 'in_progress' };
+                }
+            }
             if (!room || !['create_members', 'join_role_groups', 'wait_seats', 'launch_work', 'activate'].includes(room.saga.phase))
                 throw new TaskRoomApplicationError('task_non_resumable', 'task non-resumable', { task: task.task_id, room: task.room_id });
             try {
@@ -589,24 +815,11 @@ export class TaskRoomApplicationService {
             catch (error) {
                 if (error instanceof CoworkUnavailableError)
                     persistBlockTask(task.task_id, 'Cowork management socket is unavailable');
-                recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Task',
-                    id: task.task_id, state: readTask(task.task_id).state, category: 'provision_failed',
-                    eventId: roomFailureEventId(getRoomRecord(task.room_id)) });
-                throw error;
+                task = readTask(task.task_id);
             }
         }
         const resultingRoom = getRoomRecord(task.room_id);
-        if (task.state === 'active' && resultingRoom?.state === 'active')
-            recordFleetAuditPresentation({ kind: 'task', operation: 'work', id: task.task_id,
-                title: task.title, previousState: 'provisioning', newState: task.state,
-                revision: getRoomRecord(task.room_id)?.activated_at ?? task.started_at ?? task.created_at,
-                list: task.list_name ?? 'default', roomId: task.room_id,
-                template: task.template ? `${task.template.name}@${task.template.version}` : undefined,
-                agents: taskAgents(task) });
-        else if (resultingRoom)
-            recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Task',
-                id: task.task_id, state: task.state, category: 'provision_pending', eventId: roomFailureEventId(resultingRoom) });
-        return { task, status: 'ready' };
+        return { task, status: task.state === 'active' && resultingRoom?.state === 'active' ? 'ready' : 'in_progress' };
     }
     createTemplate(cfg, requested, noRoom) {
         if (noRoom)
@@ -619,17 +832,17 @@ export class TaskRoomApplicationService {
                 throw new TaskRoomApplicationError('template_not_found', `template not found: ${requested}`);
             return undefined;
         }
-        return snapshotTemplate(definition);
+        return snapshotTemplate(definition, cfg.agentTemplates);
     }
     existingTemplate(cfg, task) {
         const ref = task.template;
         const definition = resolveTemplate(ref.name, cfg.roomTemplates ?? {});
-        const snapshot = definition ? snapshotTemplate(definition) : undefined;
+        const snapshot = definition ? snapshotTemplate(definition, cfg.agentTemplates) : undefined;
         if (!snapshot || snapshot.content_hash !== ref.content_hash)
             throw new TaskRoomApplicationError('task_template_drift', `task template snapshot no longer matches ${ref.name}@${ref.version}`);
         return snapshot;
     }
-    async provisionRoom(cfg, task, template, onCreated) {
+    async provisionRoom(cfg, task, template, onCreated, launchDefinitions, policy = resolveRoomLaunchPolicy(template, undefined)) {
         const rooms = cfg.rooms;
         if (!rooms)
             throw new ConfigError('rooms: configuration is required');
@@ -641,26 +854,61 @@ export class TaskRoomApplicationService {
                 throw new ConfigError('rooms: configuration is required before creating or querying rooms');
             return createCoworkAdapter({ configPath: cfg.rooms.cowork?.config });
         })();
-        const created = await cowork.createRoom({
-            room_name: task.title, goal: task.goal?.trim() || task.title,
-            briefing: task.brief?.trim() || template?.contract?.trim() || task.goal?.trim() || task.title,
-            quiet_membership: template?.room?.quiet_membership,
-            anonymous: template?.room?.anonymous,
-        });
-        let room = createRoomRecord({
-            room_id: created.room_id, room_name: task.title, room_identity_cid: created.identity_cid,
-            task_id: task.task_id, template_snapshot: template,
-        });
-        recordFleetAuditPresentation({ kind: 'room', operation: 'create', id: room.room_id,
-            name: room.room_name, previousState: 'none', newState: 'provisioning',
-            revision: room.created_at, taskId: room.task_id,
-            template: room.template_snapshot ? `${room.template_snapshot.name}@${room.template_snapshot.version}` : undefined,
-            participants: [] });
-        onCreated(room);
+        const roomName = task.task_id ? deriveTaskRoomName(task.title, task.task_id) : task.title;
+        const unlockSnapshot = template ? acquireLaunchSnapshotLock() : undefined;
+        let launchTemplate;
+        let room;
+        try {
+            launchTemplate = template ? (template.launch_snapshot_hash ? template
+                : sealTemplateSnapshot(template, cfg.agentTemplates ?? {}, launchDefinitions)) : undefined;
+            // Room publication window: for a task-bound room, hold the common
+            // task-operation lock across remote creation, local record creation, and
+            // the task link, so an accepted deletion linearizes strictly before
+            // (bounded task_deleting abort) or strictly after (record visible to the
+            // deletion scan). Lock order stays launch-snapshot → task-operation.
+            const publishRoom = async () => {
+                if (task.task_id) {
+                    const fresh = readTask(task.task_id);
+                    if (fresh.deletion?.status === 'pending')
+                        throw new TaskRoomApplicationError('task_deleting', `task ${task.task_id} is pending deletion`, { task: task.task_id });
+                }
+                const created = await cowork.createRoom({
+                    room_name: roomName, goal: task.goal?.trim() || task.title,
+                    briefing: task.brief?.trim() || launchTemplate?.contract?.trim() || task.goal?.trim() || task.title,
+                    quiet_membership: launchTemplate?.room?.quiet_membership,
+                    anonymous: policy.anonymous,
+                });
+                const record = createRoomRecord({
+                    room_id: created.room_id, room_name: roomName, room_identity_cid: created.identity_cid,
+                    task_id: task.task_id, template_snapshot: launchTemplate, room_policy: policy,
+                });
+                onCreated(record);
+                return record;
+            };
+            room = task.task_id
+                ? await withFileLock(taskOperationLockPath(task.task_id), publishRoom, {}, TASK_OPERATION_LOCK_STALE_MS)
+                : await publishRoom();
+        }
+        catch (error) {
+            unlockSnapshot?.();
+            if (launchTemplate?.launch_snapshot_hash)
+                releaseLaunchSnapshot(launchTemplate.launch_snapshot_hash);
+            throw error;
+        }
+        unlockSnapshot?.();
         room = advanceSaga(room.room_id, 'create_room', 1);
         if (attachOwner) {
+            room = advanceSaga(room.room_id, 'attach_owner', 2);
+            try {
+                await cowork.setRoleCommands(room.room_id, {
+                    role: rooms.owner.role, commands: [...OWNER_ROOM_COMMANDS],
+                });
+            }
+            catch (error) {
+                setSagaError(room.room_id, error instanceof Error ? error.message : String(error), 'Restore Cowork availability, then retry the originating task or room create command.', 'waiting_owner_authorization');
+                throw error;
+            }
             try {
-                room = advanceSaga(room.room_id, 'attach_owner', 2);
                 const accepted = await cowork.acceptInvite(room.room_id, cfg.ownerInvite, {
                     role: rooms.owner.role, expected_cid: rooms.owner.expected_cid,
                 });
@@ -669,40 +917,65 @@ export class TaskRoomApplicationService {
             catch (error) {
                 const mismatch = error instanceof CoworkProtocolError && /CID|expected/i.test(error.message);
                 setSagaError(room.room_id, error instanceof Error ? error.message : String(error), mismatch ? 'Verify rooms.owner.expected_cid and rotate the configured invite if necessary.'
-                    : 'Rotate rooms.owner.public_invite or public_invite_file, then run room recover.', mismatch ? 'owner_cid_mismatch' : 'waiting_owner_invite');
-                recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Room',
-                    id: room.room_id, state: getRoomRecord(room.room_id)?.state ?? 'provisioning',
-                    category: 'provision_failed', eventId: roomFailureEventId(getRoomRecord(room.room_id) ?? room) });
+                    : 'Rotate rooms.owner.public_invite or public_invite_file, then retry the originating task or room create command.', mismatch ? 'owner_cid_mismatch' : 'waiting_owner_invite');
+                if (!task.task_id)
+                    recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Room',
+                        id: room.room_id, label: room.room_name, state: room.state, category: 'provision_failed',
+                        eventId: room.created_at });
                 throw error;
             }
         }
         room = advanceSaga(room.room_id, 'create_members', 3);
-        if (template?.members.length)
+        if (launchTemplate && (launchTemplate.members.length > 0 || attachOwner))
             try {
                 room = await (this.deps.provisionMembers ?? provisionMembers)({
-                    cfg, cowork, roomId: room.room_id, taskId: task.task_id, template,
+                    cfg, cowork, roomId: room.room_id, taskId: task.task_id, template: launchTemplate,
                     binPath: (this.deps.binPath ?? getBinPath)(), brief: task.brief,
                     goal: task.task_id ? task.title : task.goal,
                 });
             }
             catch (error) {
-                const failed = getRoomRecord(room.room_id) ?? room;
-                recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Room', id: failed.room_id,
-                    state: failed.state, category: 'provision_failed', eventId: roomFailureEventId(failed) });
+                if (!task.task_id)
+                    recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Room',
+                        id: room.room_id, label: room.room_name, state: room.state, category: 'provision_failed',
+                        eventId: room.created_at });
                 throw error;
             }
+        else if (attachOwner) {
+            const now = this.deps.now ?? Date.now;
+            const sleep = this.deps.sleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms)));
+            const deadline = now() + 60_000;
+            for (;;) {
+                const seats = await cowork.getSeats(room.room_id);
+                if (room.owner_seat_cid && seats.some(seat => seat.identity_cid.toLowerCase() === room.owner_seat_cid.toLowerCase()
+                    && seat.seat_state === 'active')) {
+                    room = activateRoom(room.room_id);
+                    break;
+                }
+                if (now() >= deadline) {
+                    room = advanceSaga(room.room_id, 'wait_seats', 5, 'waiting_seats');
+                    break;
+                }
+                await sleep(250);
+            }
+        }
         else
             room = activateRoom(room.room_id);
-        if (room.state === 'active')
-            recordFleetAuditPresentation({ kind: 'room', operation: 'activate', id: room.room_id,
-                name: room.room_name, previousState: 'provisioning', newState: 'active',
-                revision: room.activated_at ?? room.created_at, taskId: room.task_id,
+        if (!task.task_id && room.state === 'active')
+            recordFleetAuditPresentation({
+                kind: 'room', operation: 'activate', eventId: `room-ready:${room.activated_at ?? room.created_at}`,
+                id: room.room_id, name: room.room_name, previousState: 'provisioning', newState: 'active',
+                revision: room.activated_at ?? room.created_at,
                 template: room.template_snapshot ? `${room.template_snapshot.name}@${room.template_snapshot.version}` : undefined,
-                participants: roomParticipants(room) });
-        else
-            recordFleetAuditPresentation({ kind: 'lifecycle_failure', resource: 'Room', id: room.room_id,
-                state: room.state, category: 'provision_pending', eventId: roomFailureEventId(room) });
-        if (task.task_id && !template?.members.length)
+                anonymous: policy.anonymous, memberCount: room.member_seats.length, ownerAttached: attachOwner,
+                participants: [],
+            });
+        if (!task.task_id && room.state !== 'active')
+            recordFleetAuditPresentation({
+                kind: 'lifecycle_failure', resource: 'Room', id: room.room_id, label: room.room_name,
+                state: room.state, category: 'provision_pending', eventId: room.created_at,
+            });
+        if (task.task_id && !launchTemplate?.members.length)
             activateTask(task.task_id);
         return room;
     }