@ours.network/fleet 1.2.0-nightly.13 → 1.2.0-nightly.14

package/dist/rooms-tasks/deletion.js

@@ -1,3 +1,4 @@
+import { eraseMemberArtifacts } from './erasure.js';
 import { proveArchivedAbsence, verifyArchivedAbsence, verifyArchivedMemberStillAbsent } from './archived-absence.js';
 import { existsSync } from 'node:fs';
 import { withFileLock } from '../atomic-file.js';
@@ -5,12 +6,12 @@ import { agentDir } from '../paths.js';
 import { deleteWorkspace, assertWorkspaceDeletable } from './workspace.js';
 import { collectWorkspaceArchives } from './workspace-artifacts.js';
 import { secureStoppedTempArchive, stopTempSupervisor } from '../temp-lifecycle.js';
-import { closeManagedRoom, identityCidPresent, inspectMember, removeExactMemberIdentity, waitForLivenessAbsent, } from './close.js';
+import { closeManagedRoom, identityCidPresent, inspectMember, assertMemberIdentityAbsent, removeExactMemberIdentity, waitForLivenessAbsent, } from './close.js';
 import { CoworkProtocolError } from './cowork-adapter.js';
 import { deleteRoomRecord, getRoomRecord, listRoomRecords } from './room-state.js';
 import { acquireLaunchSnapshotLock, releaseLaunchSnapshotForDeletingTask } from './launch-snapshot.js';
 import { TASK_OPERATION_LOCK_STALE_MS, taskOperationLockPath } from './terminal.js';
-import { advanceTaskDeletionMember, beginTaskDeletionIntent, completeTaskDeletionReceipt, ensureTaskDeletionReceipt, getDeletingTask, importTaskDeletionRetirementEvidence, setTaskDeletionError, TaskStateError, beginTaskWorkspaceCleanup, unlinkDeletedTask, upsertTaskDeletionMembersFromSeats, } from './task-state.js';
+import { advanceTaskDeletionMember, settleAbsentTaskDeletionMember, beginTaskDeletionIntent, completeTaskDeletionReceipt, ensureTaskDeletionReceipt, getDeletingTask, importTaskDeletionRetirementEvidence, setTaskDeletionError, TaskStateError, beginTaskArchiveCleanup, unlinkDeletedTask, upsertTaskDeletionMembersFromSeats, } from './task-state.js';
 export { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
 import { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
 /**
@@ -43,6 +44,7 @@ function tolerantCowork(cowork) {
         }
     };
     return {
+        ...(cowork.getRoom ? { getRoom: cowork.getRoom.bind(cowork) } : {}),
         closeRoom: roomId => tolerate(() => cowork.closeRoom(roomId)),
         deleteRoom: roomId => tolerate(() => cowork.deleteRoom(roomId)),
     };
@@ -51,6 +53,7 @@ function cursorSeat(cursor) {
     return {
         role_name: cursor.name, identity_cid: cursor.identity_cid,
         slot: cursor.name, cowork_role: 'member', seat_state: 'active',
+        ...(cursor.launch_id ? { retirement: { phase: 'identity_absent', launch_id: cursor.launch_id, archive_path: cursor.archive_path, updated_at: cursor.updated_at } } : {}),
     };
 }
 /**
@@ -63,8 +66,15 @@ function cursorSeat(cursor) {
 async function retireCursorMember(taskId, cursor, deps) {
     let phase = cursor.phase;
     let launchId = cursor.launch_id;
-    if (phase === 'identity_absent')
+    if (phase === 'identity_absent') {
+        if (!deps.roomClose?.inspectMember) {
+            if ((deps.hasTempState ?? (name => existsSync(agentDir(name, true))))(cursor.name))
+                throw new Error('Retired deletion member has replacement live state');
+            if (await (deps.identityCidPresent ?? identityCidPresent)(cursor.identity_cid))
+                throw new Error('Retired deletion member identity reappeared');
+        }
         return;
+    }
     const seat = cursorSeat(cursor);
     const roomClose = deps.roomClose ?? {};
     if (phase === 'pending') {
@@ -88,7 +98,16 @@ async function retireCursorMember(taskId, cursor, deps) {
         phase = 'stop_requested';
         launchId = ownership.launchId;
     }
+    if (!roomClose.inspectMember && !existsSync(agentDir(cursor.name, true))) {
+        await (roomClose.removeIdentity ?? removeExactMemberIdentity)(seat);
+        if (existsSync(agentDir(cursor.name, true)))
+            throw new Error('Deletion member acquired replacement state');
+        settleAbsentTaskDeletionMember(taskId, cursor.name);
+        return;
+    }
     if (phase === 'stop_requested') {
+        if (!roomClose.inspectMember && (await inspectMember(seat)).launchId !== launchId)
+            throw new Error('Deletion member launch changed before stop');
         await (roomClose.requestStop
             ?? (async (role) => { await stopTempSupervisor(role); }))(cursor.name);
         await (roomClose.waitForLivenessAbsent ?? waitForLivenessAbsent)(cursor.name, launchId);
@@ -140,8 +159,6 @@ export async function settleTaskDeletion(input) {
             // aborts settlement (fail closed).
             ensureTaskDeletionReceipt(taskId);
             const records = listRoomRecords().filter(room => room.task_id === taskId);
-            if (task.deletion.workspace_cleanup_started_at && records.length)
-                throw new TaskStateError(`task ${taskId} room records reappeared after workspace cleanup began`);
             const recordIds = new Set(records.map(room => room.room_id));
             const recordedRoomId = task.deletion.room_id ?? task.room_id;
             const needsCowork = records.length > 0 || recordedRoomId !== undefined;
@@ -153,8 +170,15 @@ export async function settleTaskDeletion(input) {
                 const seats = closed?.member_seats ?? record.member_seats;
                 const proofs = [];
                 for (const seat of seats) {
-                    if (!seat.identity_cid && seat.retirement?.launch_id !== 'never-launched')
-                        proofs.push(await proveArchivedAbsence(seat));
+                    if (!seat.identity_cid && !seat.retirement?.absence_verified && !['never-launched', 'absent-verified'].includes(seat.retirement?.launch_id ?? '')) {
+                        const prior = task.deletion.archived_absences?.find(proof => proof.name === seat.role_name);
+                        if (task.deletion.workspace_cleanup_started_at && prior && !existsSync(prior.archive_path)) {
+                            await verifyArchivedMemberStillAbsent(prior);
+                            proofs.push(prior);
+                        }
+                        else
+                            proofs.push(await proveArchivedAbsence(seat));
+                    }
                 }
                 // No await between the last live-state fence and durable checkpoint.
                 for (const proof of proofs) {
@@ -166,7 +190,9 @@ export async function settleTaskDeletion(input) {
                 importTaskDeletionRetirementEvidence(taskId, seats, proofs);
                 await cowork.deleteRoom(record.room_id);
                 for (const proof of proofs)
-                    await verifyArchivedAbsence(proof);
+                    await (task.deletion.workspace_cleanup_started_at && !existsSync(proof.archive_path) ? verifyArchivedMemberStillAbsent : verifyArchivedAbsence)(proof);
+                beginTaskArchiveCleanup(taskId);
+                await eraseMemberArtifacts('room', record.room_id, seats, [record.room_id]);
                 for (const proof of proofs)
                     if (existsSync(agentDir(proof.name, true)))
                         throw new Error('Archived member replacement before room unlink');
@@ -216,11 +242,17 @@ export async function settleTaskDeletion(input) {
             for (const proof of task.deletion.archived_absences ?? [])
                 if (existsSync(agentDir(proof.name, true)))
                     throw new Error('Archived member replacement before task unlink');
+            for (const name of task.deletion.absent_members ?? []) {
+                if (existsSync(agentDir(name, true)))
+                    throw new Error('Absent member acquired replacement state');
+                await assertMemberIdentityAbsent({ role_name: name, slot: name, cowork_role: 'member', seat_state: 'removed' });
+            }
             if (cleanup.snapshotHash)
                 releaseLaunchSnapshotForDeletingTask(cleanup.snapshotHash, taskId);
+            await eraseMemberArtifacts('task', taskId, task.deletion.members.map(cursorSeat), task.deletion.room_id ? [task.deletion.room_id] : []);
             if (task.workspace) {
                 assertWorkspaceDeletable(task.workspace, 'task', taskId);
-                beginTaskWorkspaceCleanup(taskId);
+                beginTaskArchiveCleanup(taskId);
                 collectWorkspaceArchives(task.workspace);
                 deleteWorkspace(task.workspace, 'task', taskId);
             }

package/dist/rooms-tasks/erasure.d.ts

@@ -0,0 +1,6 @@
+import type { RoomMemberSeat } from './types.js';
+/** Erase only proven launch artifacts. Each atomic rename transfers ownership to
+ * a random, durable tombstone before recursive removal can destroy its proof.
+ * The caller holds the task/room lifecycle lock and has retired all writers.
+ */
+export declare function eraseMemberArtifacts(owner: 'room' | 'task', id: string, seats: readonly RoomMemberSeat[], roomIds: readonly string[]): Promise<void>;

package/dist/rooms-tasks/erasure.js

@@ -0,0 +1,169 @@
+import { eraseResourcePresentations } from '../erased-resources.js';
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import { dirname, join, relative } from 'node:path';
+import { parse } from 'yaml';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { agentDir, stateRoot } from '../paths.js';
+import { readTempSupervisor, tempSupervisorLiveness, eraseTerminationEvents } from '../temp-lifecycle.js';
+import { assertSafeAncestors, auditWorkspaceGit } from './workspace.js';
+function entries(path) {
+    try {
+        return readdirSync(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+}
+function json(path) {
+    try {
+        if (!lstatSync(path).isFile() || lstatSync(path).isSymbolicLink())
+            return undefined;
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+}
+function fingerprint(path) {
+    const stat = lstatSync(path);
+    const files = stat.isDirectory() ? ['creation.json', '.temp-supervisor.json', '.identity', 'role.yaml', 'state.json', 'instance.json'] : [''];
+    const hash = createHash('sha256');
+    for (const file of files) {
+        const target = file ? join(path, file) : path;
+        if (existsSync(target)) {
+            if (!lstatSync(target).isFile() || lstatSync(target).isSymbolicLink())
+                throw new Error('Unsafe erasure proof');
+            hash.update(file).update(readFileSync(target));
+        }
+    }
+    return hash.digest('hex');
+}
+/** Erase only proven launch artifacts. Each atomic rename transfers ownership to
+ * a random, durable tombstone before recursive removal can destroy its proof.
+ * The caller holds the task/room lifecycle lock and has retired all writers.
+ */
+export async function eraseMemberArtifacts(owner, id, seats, roomIds) {
+    if (!/^[a-zA-Z0-9_-]{1,80}$/.test(id))
+        throw new Error('Invalid erasure owner');
+    const root = stateRoot();
+    const manifestPath = join(root, 'erasure', `${owner}-${id}.json`);
+    assertSafeAncestors(dirname(manifestPath));
+    let manifest = json(manifestPath);
+    const names = new Set(seats.map(s => s.role_name));
+    for (const name of names) {
+        if (!/^[a-zA-Z0-9_-]{1,120}$/.test(name))
+            throw new Error('Invalid erasure member');
+        if (existsSync(agentDir(name, true)))
+            throw new Error(`Member '${name}' still has live state during erasure`);
+    }
+    if (!manifest) {
+        const paths = [];
+        const launches = seats.flatMap(seat => {
+            const launchId = seat.launch?.launch_id ?? seat.retirement?.launch_id;
+            return launchId ? [{ role: seat.role_name, launchId }] : [];
+        });
+        const actions = new Map(seats.map(s => [s.role_name, new Set([s.launch?.action_id].filter((v) => !!v))]));
+        const recovery = join(root, 'recovery', 'temporary');
+        assertSafeAncestors(recovery);
+        for (const entry of entries(recovery)) {
+            const path = join(recovery, entry);
+            const stat = lstatSync(path);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                continue;
+            const supervisor = readTempSupervisor(path);
+            if (!supervisor || !names.has(supervisor.role))
+                continue;
+            const seat = seats.find(s => s.role_name === supervisor.role);
+            const creation = json(join(path, 'creation.json'));
+            let room;
+            const roleFile = join(path, 'role.yaml');
+            if (existsSync(roleFile) && lstatSync(roleFile).isFile() && !lstatSync(roleFile).isSymbolicLink()) {
+                const role = parse(readFileSync(roleFile, 'utf8'));
+                if (role?.name === supervisor.role)
+                    room = role.roomMemberStartup?.room_id;
+            }
+            const exactLaunch = seat.launch?.launch_id === supervisor.launchId || seat.retirement?.launch_id === supervisor.launchId;
+            const exactAction = creation?.role === supervisor.role && creation.creationActionId === seat.launch?.action_id;
+            // Older attempts belong only when the launch descriptor pins the room.
+            if (!(exactLaunch && (exactAction || !seat.launch?.action_id)) && !(room && roomIds.includes(room)))
+                continue;
+            if (existsSync(join(path, '.identity')) && readFileSync(join(path, '.identity'), 'utf8').trim() !== supervisor.role)
+                throw new Error('Archive identity mismatch during erasure');
+            if (await tempSupervisorLiveness(path) !== 'stopped')
+                throw new Error('Archive writer is not stopped');
+            if (creation?.role === supervisor.role && typeof creation.creationActionId === 'string')
+                actions.get(supervisor.role).add(creation.creationActionId);
+            auditWorkspaceGit(path);
+            launches.push({ role: supervisor.role, launchId: supervisor.launchId });
+            paths.push(path);
+        }
+        const privateRoot = join(root, 'private-ours');
+        assertSafeAncestors(privateRoot);
+        for (const entry of entries(privateRoot)) {
+            const path = join(privateRoot, entry);
+            if (!lstatSync(path).isDirectory() || lstatSync(path).isSymbolicLink())
+                continue;
+            if (entry === 'launches' || entry === 'room-inputs') {
+                for (const file of entries(path)) {
+                    const child = join(path, file), value = json(child);
+                    if (!value)
+                        continue;
+                    const launchOwned = entry === 'launches' && value.role === value.identity
+                        && actions.get(value.role)?.has(value.action);
+                    const roomOwned = entry === 'room-inputs' && roomIds.includes(value.room_id)
+                        && names.has(value.identity_name);
+                    const readyOwned = entry === 'room-inputs' && file.endsWith('.ready.json')
+                        && roomIds.includes(value.room) && seats.some(seat => seat.invite_id === value.invite && (!seat.identity_cid || seat.identity_cid === value.cid));
+                    if (launchOwned || roomOwned || readyOwned)
+                        paths.push(child);
+                }
+                continue;
+            }
+            const state = json(join(path, 'state.json')), instance = json(join(path, 'instance.json'));
+            if (state?.lifetime === 'temporary' && actions.get(state.name)?.has(state.action)
+                && instance?.role === state.name && instance?.temporary === true && instance?.instance === state.instance) {
+                auditWorkspaceGit(path);
+                paths.push(path);
+            }
+        }
+        manifest = { launches, version: 1, token: randomUUID(), paths, phases: {}, stamps: Object.fromEntries(paths.map(path => {
+                const stat = lstatSync(path);
+                return [path, { dev: stat.dev, ino: stat.ino, proof: fingerprint(path) }];
+            })) };
+        mkdirSync(dirname(manifestPath), { recursive: true, mode: 0o700 });
+        replaceFileAtomically(manifestPath, JSON.stringify(manifest));
+    }
+    if (manifest.version !== 1 || !/^[a-f0-9-]{36}$/.test(manifest.token) || !Array.isArray(manifest.paths))
+        throw new Error('Invalid erasure manifest');
+    for (const path of manifest.paths) {
+        const rel = relative(root, path);
+        if (!rel.startsWith('recovery/temporary/') && !rel.startsWith('private-ours/'))
+            throw new Error('Invalid erasure artifact path');
+        if (rel.split('/').includes('..'))
+            throw new Error('Invalid erasure artifact traversal');
+        assertSafeAncestors(dirname(path));
+        const tombstone = `${path}.erasing-${manifest.token}`;
+        if (manifest.phases[path] === 'removed')
+            continue;
+        if (existsSync(path) && !existsSync(tombstone) && manifest.phases[path] !== 'renamed') {
+            const stat = lstatSync(path), stamp = manifest.stamps[path];
+            if (stat.isSymbolicLink() || !stamp || stamp.dev !== stat.dev || stamp.ino !== stat.ino || stamp.proof !== fingerprint(path))
+                throw new Error('Erasure source ownership changed');
+            renameSync(path, tombstone);
+        }
+        manifest.phases[path] = 'renamed';
+        replaceFileAtomically(manifestPath, JSON.stringify(manifest));
+        rmSync(tombstone, { recursive: true, force: true });
+        manifest.phases[path] = 'removed';
+        replaceFileAtomically(manifestPath, JSON.stringify(manifest));
+    }
+    eraseResourcePresentations([{ kind: owner, id }, ...roomIds.map(id => ({ kind: 'room', id })),
+        ...seats.map(seat => ({ kind: 'agent', id: seat.role_name }))]);
+    eraseTerminationEvents(manifest.launches);
+    rmSync(manifestPath, { force: true });
+}

package/dist/rooms-tasks/room-state.d.ts

@@ -31,6 +31,8 @@ export declare function updateMemberStartup(id: string, roleName: string, update
 export declare function activateRoom(id: string): RoomOrchestrationRecord;
 export declare function closeRoom(id: string): RoomOrchestrationRecord;
 export declare function beginRoomClose(id: string): RoomOrchestrationRecord;
-export declare function advanceMemberRetirement(id: string, roleName: string, phase: MemberRetirementPhase, launchId: string, archivePath?: string): RoomOrchestrationRecord;
+export declare function advanceMemberRetirement(id: string, roleName: string, phase: MemberRetirementPhase, launchId: string, archivePath?: string, absenceVerified?: boolean): RoomOrchestrationRecord;
 export declare function advanceRoomClose(id: string, phase: RoomClosePhase): RoomOrchestrationRecord;
 export declare function setRoomCloseError(id: string, error: string, recoveryHint: string): RoomOrchestrationRecord;
+/** Settlement-only binding recovery; never publishes a seat or changes a launch. */
+export declare function recordRetirementMemberCids(id: string, recovered: ReadonlyArray<RoomMemberSeat>): RoomOrchestrationRecord;

package/dist/rooms-tasks/room-state.js

@@ -7,14 +7,23 @@ import { getTask } from './task-state.js';
 import { storedRoomLaunchPolicy } from './types.js';
 import { releaseLaunchSnapshot } from './launch-snapshot.js';
 export const roomsDir = () => join(stateRoot(), 'rooms');
-function roomPath(id) { return join(roomsDir(), `${id}.json`); }
+function roomPath(id) {
+    if (!/^[a-zA-Z0-9_-]{1,120}$/.test(id))
+        throw new RoomStateError('Invalid room ID');
+    return join(roomsDir(), `${id}.json`);
+}
 export class RoomStateError extends Error {
 }
 function readRoom(id) {
     const p = roomPath(id);
-    if (!existsSync(p))
-        throw new RoomStateError(`room not found: ${id}`);
-    return JSON.parse(readFileSync(p, 'utf8'));
+    try {
+        return JSON.parse(readFileSync(p, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            throw new RoomStateError(`room not found: ${id}`);
+        throw error;
+    }
 }
 function writeRoom(record) {
     mkdirSync(roomsDir(), { recursive: true });
@@ -54,8 +63,10 @@ export function getRoomRecord(id) {
     try {
         return readRoom(id);
     }
-    catch {
-        return undefined;
+    catch (error) {
+        if (error instanceof RoomStateError && error.message === `room not found: ${id}`)
+            return undefined;
+        throw error;
     }
 }
 /** Remove a terminal orchestration record from the live room inventory. */
@@ -211,7 +222,7 @@ export function beginRoomClose(id) {
 const RETIREMENT_ORDER = [
     'stop_requested', 'liveness_absent', 'archive_secured', 'identity_absent',
 ];
-export function advanceMemberRetirement(id, roleName, phase, launchId, archivePath) {
+export function advanceMemberRetirement(id, roleName, phase, launchId, archivePath, absenceVerified = false) {
     const r = readRoom(id);
     if (r.state !== 'closing')
         throw new RoomStateError(`room ${id} is not closing`);
@@ -228,6 +239,7 @@ export function advanceMemberRetirement(id, roleName, phase, launchId, archivePa
         throw new RoomStateError(`room ${id} member ${roleName} retirement cannot move backward to ${phase}`);
     }
     seat.retirement = {
+        ...(absenceVerified || previous?.absence_verified ? { absence_verified: true } : {}),
         phase,
         launch_id: launchId,
         updated_at: new Date().toISOString(),
@@ -280,3 +292,21 @@ export function setRoomCloseError(id, error, recoveryHint) {
     writeRoom(r);
     return r;
 }
+/** Settlement-only binding recovery; never publishes a seat or changes a launch. */
+export function recordRetirementMemberCids(id, recovered) {
+    const room = readRoom(id);
+    if (room.state !== 'closing')
+        throw new RoomStateError('Room is not closing');
+    for (const proof of recovered) {
+        const seat = room.member_seats.find(value => value.role_name === proof.role_name);
+        if (!seat || seat.launch?.action_id !== proof.launch?.action_id || seat.invite_id !== proof.invite_id)
+            throw new RoomStateError('Member changed during identity recovery');
+        if (!proof.identity_cid)
+            continue;
+        if (seat.identity_cid && seat.identity_cid.toLowerCase() !== proof.identity_cid.toLowerCase())
+            throw new RoomStateError('Member identity changed during recovery');
+        seat.identity_cid = proof.identity_cid;
+    }
+    writeRoom(room);
+    return room;
+}

package/dist/rooms-tasks/task-state.d.ts

@@ -62,9 +62,8 @@ export declare function getDeletingTask(id: string): TaskRecord;
 export declare function taskDeletionState(id: string): 'none' | 'pending' | 'absent';
 /**
  * Durable, surface-independent audit evidence for a permanent deletion. The
- * receipt outlives the task record: written with the acceptance intent, and
- * completed before settlement is reported. Metadata only — never brief or
- * room content.
+ * receipt supports in-flight recovery only: written with acceptance intent,
+ * then erased before settlement is reported. It may contain a bounded title.
  */
 export interface TaskDeletionReceipt {
     schema_version: 1;
@@ -88,7 +87,7 @@ export declare function readTaskDeletionReceipt(id: string): TaskDeletionReceipt
  * settlement rather than deleting resources without audit evidence.
  */
 export declare function ensureTaskDeletionReceipt(id: string): void;
-/** Record settlement on the receipt; idempotent, tolerant of legacy absence. */
+/** Erase the in-flight receipt; also heals a crash after task unlink. */
 export declare function completeTaskDeletionReceipt(id: string): void;
 export type TaskDeletionAcceptance = {
     status: 'accepted' | 'pending';
@@ -129,6 +128,7 @@ interface SeatEvidence {
         action_id?: string;
     };
     retirement?: {
+        absence_verified?: boolean;
         phase: TaskDeletionMemberPhase;
         launch_id: string;
         archive_path?: string;
@@ -166,4 +166,10 @@ export declare function beginTaskWorkspaceCleanup(id: string): void;
  * records are the idempotent already-settled outcome.
  */
 export declare function unlinkDeletedTask(id: string): boolean;
+/** Called only after current temp and exact identity absence have been checked. */
+export declare function settleAbsentTaskDeletionMember(id: string, name: string): void;
+/** Room-only erasure keeps the parent Task but removes its dead room/member links. */
+export declare function detachDeletedRoom(taskId: string, roomId: string): void;
+/** A completed room may consume its archives while other task members still retire. */
+export declare function beginTaskArchiveCleanup(id: string): void;
 export {};

package/dist/rooms-tasks/task-state.js

@@ -535,14 +535,10 @@ export function ensureTaskDeletionReceipt(id) {
             writeDeletionReceiptForIntent(stored);
     });
 }
-/** Record settlement on the receipt; idempotent, tolerant of legacy absence. */
+/** Erase the in-flight receipt; also heals a crash after task unlink. */
 export function completeTaskDeletionReceipt(id) {
-    const receipt = readTaskDeletionReceipt(id);
-    if (!receipt || receipt.settled_at)
-        return;
-    receipt.settled_at = new Date().toISOString();
-    receipt.result = 'deleted';
-    replaceFileAtomically(deletionReceiptPath(id), JSON.stringify(receipt, null, 2) + '\n');
+    assertCanonicalTaskId(id);
+    rmSync(deletionReceiptPath(id), { force: true });
 }
 /**
  * Persist the first-wins durable deletion intent. Accepts every lifecycle
@@ -561,8 +557,10 @@ export function beginTaskDeletionIntent(id, actor) {
             stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
         }
         catch (error) {
-            if (isNotFoundError(error))
+            if (isNotFoundError(error)) {
+                completeTaskDeletionReceipt(id);
                 return { status: 'already_absent' };
+            }
             throw error;
         }
         if (stored.deletion?.status === 'pending') {
@@ -712,12 +710,17 @@ export function importTaskDeletionRetirementEvidence(id, seats, proofs = []) {
             const evidence = seat.retirement;
             if (evidence?.phase !== 'identity_absent')
                 throw new TaskStateError(`task ${id} deletion cannot checkpoint member '${seat.role_name}' before completed retirement`);
-            const neverLaunched = evidence.launch_id === DELETION_MEMBER_NEVER_LAUNCHED;
+            const neverLaunched = evidence.launch_id === DELETION_MEMBER_NEVER_LAUNCHED
+                || evidence.launch_id === DELETION_MEMBER_ABSENT_VERIFIED || evidence.absence_verified === true;
             if (!neverLaunched && evidence.archive_path === undefined)
                 throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' retirement evidence lacks its archive`);
             if (!seat.identity_cid) {
-                if (neverLaunched)
-                    continue; // provably never held a managed identity
+                if (neverLaunched) {
+                    stored.deletion.absent_members ??= [];
+                    if (!stored.deletion.absent_members.includes(seat.role_name))
+                        stored.deletion.absent_members.push(seat.role_name);
+                    continue;
+                }
                 const proof = proofs.find(value => value.name === seat.role_name);
                 if (proof && proof.launch_id === evidence.launch_id && proof.archive_path === evidence.archive_path
                     && proof.launch_id === seat.launch?.launch_id && proof.action_id === seat.launch?.action_id) {
@@ -761,7 +764,7 @@ export function importTaskDeletionRetirementEvidence(id, seats, proofs = []) {
 export function beginTaskWorkspaceCleanup(id) {
     withTaskLock(id, () => {
         const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
-        if (stored.deletion?.status !== 'pending' || !stored.workspace
+        if (stored.deletion?.status !== 'pending'
             || stored.deletion.members.some(member => member.phase !== 'identity_absent'))
             throw new TaskStateError('Task is not ready for workspace cleanup');
         stored.deletion.workspace_cleanup_started_at ??= new Date().toISOString();
@@ -798,3 +801,42 @@ export function unlinkDeletedTask(id) {
         return true;
     });
 }
+/** Called only after current temp and exact identity absence have been checked. */
+export function settleAbsentTaskDeletionMember(id, name) {
+    withTaskLock(id, () => {
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError('Task is not deleting');
+        const member = stored.deletion.members.find(value => value.name === name);
+        if (!member)
+            throw new TaskStateError('Unknown deletion member');
+        member.phase = 'identity_absent';
+        member.launch_id ??= DELETION_MEMBER_ABSENT_VERIFIED;
+        member.updated_at = new Date().toISOString();
+        writeTask(stored);
+    });
+}
+/** Room-only erasure keeps the parent Task but removes its dead room/member links. */
+export function detachDeletedRoom(taskId, roomId) {
+    withTaskLock(taskId, () => {
+        if (!existsSync(taskPath(taskId)))
+            return;
+        const stored = JSON.parse(readFileSync(taskPath(taskId), 'utf8'));
+        if (stored.room_id !== roomId || stored.deletion?.status === 'pending')
+            return;
+        delete stored.room_id;
+        delete stored.room_identity_cid;
+        stored.member_roles = [];
+        writeTask(stored);
+    });
+}
+/** A completed room may consume its archives while other task members still retire. */
+export function beginTaskArchiveCleanup(id) {
+    withTaskLock(id, () => {
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError('Task is not deleting');
+        stored.deletion.workspace_cleanup_started_at ??= new Date().toISOString();
+        writeTask(stored);
+    });
+}

package/dist/rooms-tasks/types.d.ts

@@ -88,6 +88,7 @@ export interface TaskDeletionIntent {
     /** Snapshot of managed members at acceptance; the missing-room retirement evidence. */
     members: TaskDeletionMemberCursor[];
     archived_absences?: ArchivedMemberAbsence[];
+    absent_members?: string[];
     /** Archive proofs were verified before owned workspace cleanup may consume them. */
     workspace_cleanup_started_at?: string;
     error?: string;
@@ -212,6 +213,7 @@ export type RoomHistoryEvidence = {
 };
 export type MemberRetirementPhase = 'stop_requested' | 'liveness_absent' | 'archive_secured' | 'identity_absent';
 export interface MemberRetirement {
+    absence_verified?: boolean;
     phase: MemberRetirementPhase;
     launch_id: string;
     updated_at: string;

package/dist/temp-lifecycle.d.ts

@@ -44,6 +44,11 @@ export declare function makeTempSupervisorLauncher(options?: {
 }): SupervisorLauncher;
 export declare function markTempSupervisorActive(dir: string, pid?: number): Promise<void>;
 export declare function requestedTempStopReason(dir: string): 'operator-stop' | undefined;
+/** Explicit erasure removes only exact retired role/launch events. */
+export declare function eraseTerminationEvents(launches: ReadonlyArray<{
+    role: string;
+    launchId: string;
+}>): void;
 /** Move retired state out of the live roster without deleting any evidence. */
 export declare function archiveTempState(role: string, reason: TempTerminationReason, outcome: TempTerminationRecord['outcome'], detail: string, now?: Date): string | undefined;
 /** Resolve only an exact role+launch archive; names and timestamps are never proof. */

package/dist/temp-lifecycle.js

@@ -1,7 +1,7 @@
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { basename, join } from 'node:path';
-import { replaceFileAtomically, withFileLock } from './atomic-file.js';
+import { replaceFileAtomically, withFileLock, withSynchronousFileLock } from './atomic-file.js';
 import { realExec } from './exec.js';
 import { stateRoot, tmpRoot } from './paths.js';
 export const TEMP_SUPERVISOR_FILE = '.temp-supervisor.json';
@@ -133,18 +133,34 @@ function appendTermination(dir, record) {
     replaceFileAtomically(join(dir, TEMP_GLOBAL_TERMINATION_MARKER), line);
 }
 function appendGlobalTermination(line, checkExisting = false) {
-    mkdirSync(archiveRoot(), { recursive: true, mode: 0o700 });
-    const path = join(archiveRoot(), 'terminations.jsonl');
-    // Recovery may revisit a .retiring directory after a crash between the
-    // global append and final rename. Avoid duplicating that exact event.
-    if (checkExisting) {
-        try {
-            if (readFileSync(path, 'utf8').split('\n').includes(line.trimEnd()))
-                return;
+    withSynchronousFileLock(join(stateRoot(), 'locks', 'termination-journal'), () => {
+        mkdirSync(archiveRoot(), { recursive: true, mode: 0o700 });
+        const path = join(archiveRoot(), 'terminations.jsonl');
+        // Recovery may revisit a .retiring directory after a crash between the
+        // global append and final rename. Avoid duplicating that exact event.
+        if (checkExisting) {
+            try {
+                if (readFileSync(path, 'utf8').split('\n').includes(line.trimEnd()))
+                    return;
+            }
+            catch { /* the journal does not exist yet */ }
         }
-        catch { /* the journal does not exist yet */ }
-    }
-    appendFileSync(path, line, { mode: 0o600 });
+        appendFileSync(path, line, { mode: 0o600 });
+    });
+}
+/** Explicit erasure removes only exact retired role/launch events. */
+export function eraseTerminationEvents(launches) {
+    withSynchronousFileLock(join(stateRoot(), 'locks', 'termination-journal'), () => {
+        const path = join(archiveRoot(), 'terminations.jsonl');
+        if (!existsSync(path))
+            return;
+        const lines = readFileSync(path, 'utf8').split('\n').filter(Boolean);
+        const kept = lines.filter(line => {
+            const row = JSON.parse(line);
+            return !launches.some(launch => launch.role === row.role && launch.launchId === row.launchId);
+        });
+        replaceFileAtomically(path, kept.length ? kept.join('\n') + '\n' : '');
+    });
 }
 /** Pick a sibling path without overwriting evidence from an earlier attempt. */
 function collisionSafeArchivePaths(targetBase, retiringBase) {