@ours.network/fleet 1.2.0-nightly.2 → 1.2.0-nightly.21

package/dist/rooms-tasks/add-member.d.ts

@@ -0,0 +1,48 @@
+import type { FleetConfig } from '../config.js';
+import { TaskStateError } from './task-state.js';
+import { provisionMembers } from './provision.js';
+import type { CoworkAdapter } from './cowork-adapter.js';
+export declare class MemberAdditionRejected extends TaskStateError {
+    readonly accepted = false;
+}
+export interface AddMemberRequest {
+    requestId: string;
+    slot: string;
+    role: string;
+    brain: string;
+    agentTemplate: string;
+}
+export declare function memberAddition(taskId: string, requestId: string): {
+    requestId: string;
+    taskId: string;
+    roleId: string;
+    state: "running" | "succeeded" | "attention" | "failed";
+    error?: string;
+} | {
+    state: string;
+    error: string;
+    requestId: string;
+    taskId: string;
+    roleId: string;
+};
+export declare function requestMemberAddition(input: {
+    taskId: string;
+    request: AddMemberRequest;
+    cfg: FleetConfig;
+    cowork: CoworkAdapter;
+    configPath?: string;
+    binPath: string;
+    provision?: typeof provisionMembers;
+}): Promise<{
+    requestId: string;
+    taskId: string;
+    roleId: string;
+    state: "running" | "succeeded" | "attention" | "failed";
+    error?: string;
+} | {
+    state: string;
+    error: string;
+    requestId: string;
+    taskId: string;
+    roleId: string;
+}>;

package/dist/rooms-tasks/add-member.js

@@ -0,0 +1,83 @@
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
+import { canonicalJson } from '../canonical-json.js';
+import { stateRoot } from '../paths.js';
+import { getTask, TaskStateError } from './task-state.js';
+import { getRoomRecord } from './room-state.js';
+import { prepareExecutionPlan } from './member-overrides.js';
+import { sealTemplateSnapshot } from './templates.js';
+import { provisionMembers } from './provision.js';
+export class MemberAdditionRejected extends TaskStateError {
+    accepted = false;
+}
+const running = new Set();
+function pathFor(taskId, requestId) {
+    if (!/^[a-z0-9]{10,40}$/.test(taskId) || !/^[a-zA-Z0-9_-]{8,80}$/.test(requestId))
+        throw new TaskStateError('Invalid task or request ID');
+    return join(stateRoot(), 'member-additions', taskId, requestId + '.json');
+}
+export function memberAddition(taskId, requestId) {
+    getTask(taskId);
+    const path = pathFor(taskId, requestId);
+    if (!existsSync(path))
+        throw new TaskStateError('Member request not found');
+    const receipt = JSON.parse(readFileSync(path, 'utf8'));
+    const { hash, ...view } = receipt;
+    return receipt.state === 'running' && !running.has(path) ? { ...view, state: 'attention', error: 'The server stopped observing this launch. Inspect the existing agent before any recovery.' } : view;
+}
+export async function requestMemberAddition(input) {
+    const { request: r, taskId } = input;
+    if (!r || typeof r.slot !== 'string' || !/^[A-Za-z][A-Za-z0-9_-]{0,31}$/.test(r.slot)
+        || ![r.role, r.brain, r.agentTemplate].every(v => typeof v === 'string' && v.length > 0 && v.length <= 128))
+        // No receipt lookup has happened yet: this request ID may already be accepted.
+        throw new TaskStateError('Slot, Role, Brain and Agent Template are required');
+    const path = pathFor(taskId, r.requestId);
+    const hash = createHash('sha256').update(canonicalJson(r)).digest('hex');
+    mkdirSync(join(stateRoot(), 'member-additions', taskId), { recursive: true, mode: 0o700 });
+    return withFileLock(path + '.lock', async () => {
+        if (existsSync(path)) {
+            const old = JSON.parse(readFileSync(path, 'utf8'));
+            if (old.hash !== hash)
+                throw new TaskStateError('Request ID was already used with different settings');
+            return memberAddition(taskId, r.requestId);
+        }
+        const task = getTask(taskId);
+        const room = task.room_id && getRoomRecord(task.room_id);
+        if (!room || !['active', 'review'].includes(task.state) || task.terminal_intent || task.blocked || room.state !== 'active'
+            || room.task_id !== taskId || room.room_identity_cid !== task.room_identity_cid)
+            throw new MemberAdditionRejected('Adding an agent requires an active, unblocked task room');
+        const roleId = `${taskId.slice(0, 8)}-${r.slot}-1`;
+        if (room.member_seats.some(s => s.role_name === roleId))
+            throw new MemberAdditionRejected('This member slot already exists');
+        const plan = (() => {
+            try {
+                return prepareExecutionPlan({ name: 'additional-member', version: 1, description: 'Additional task participant',
+                    contract: room.template_snapshot?.contract, members: [{ slot: r.slot, role: r.role, count: 1, agent_template: r.agentTemplate }] }, input.cfg, { [r.slot]: { role: r.role, brain: r.brain } });
+            }
+            catch (error) {
+                throw new MemberAdditionRejected(error instanceof Error ? error.message : 'Invalid member configuration');
+            }
+        })();
+        const template = sealTemplateSnapshot(plan.snapshot, input.cfg.agentTemplates ?? {}, plan.launchDefinitions);
+        const receipt = { taskId, requestId: r.requestId, roleId, hash, state: 'running' };
+        const save = () => replaceFileAtomically(path, JSON.stringify(receipt) + '\n', 0o600);
+        save();
+        running.add(path);
+        void (input.provision ?? provisionMembers)({ cfg: input.cfg, cowork: input.cowork, configPath: input.configPath, binPath: input.binPath,
+            taskId, roomId: room.room_id, template, goal: task.title, brief: task.brief, append: true }).then(result => {
+            const seat = result.member_seats.find(s => s.role_name === roleId);
+            receipt.state = seat?.seat_state === 'active' && getTask(taskId).member_roles.some(m => m.name === roleId) ? 'succeeded' : 'attention';
+            if (receipt.state === 'attention')
+                receipt.error = 'Admission is not confirmed. Inspect the existing launch; no automatic retry was made.';
+        }).catch(() => { receipt.state = 'failed'; receipt.error = 'Member launch failed. Inspect the task and agent logs before recovery.'; })
+            .finally(() => { try {
+            save();
+        }
+        finally {
+            running.delete(path);
+        } }).catch(() => { running.delete(path); });
+        return memberAddition(taskId, r.requestId);
+    });
+}

package/dist/rooms-tasks/archived-absence.d.ts

@@ -0,0 +1,8 @@
+import type { ArchivedMemberAbsence, RoomMemberSeat } from './types.js';
+/** Revalidate live facts; a persisted timestamp is never cleanup authority. */
+export declare function verifyArchivedAbsence(proof: ArchivedMemberAbsence): Promise<void>;
+/** After the verified archive has been consumed by explicit workspace deletion,
+ * still fence replacement live state and a recreated daemon identity on every retry.
+ */
+export declare function verifyArchivedMemberStillAbsent(proof: ArchivedMemberAbsence): Promise<void>;
+export declare function proveArchivedAbsence(seat: RoomMemberSeat): Promise<ArchivedMemberAbsence>;

package/dist/rooms-tasks/archived-absence.js

@@ -0,0 +1,48 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { agentDir } from '../paths.js';
+import { tempArchiveForLaunch, tempArchiveForCreationAction, tempSupervisorLiveness } from '../temp-lifecycle.js';
+import { assertMemberIdentityAbsent } from './close.js';
+/** Revalidate live facts; a persisted timestamp is never cleanup authority. */
+export async function verifyArchivedAbsence(proof) {
+    const absent = () => {
+        if (existsSync(agentDir(proof.name, true)))
+            throw new Error('Archived member has replacement live state');
+    };
+    absent();
+    const archive = tempArchiveForLaunch(proof.name, proof.launch_id);
+    const action = tempArchiveForCreationAction(proof.name, proof.action_id);
+    if (!archive || archive !== proof.archive_path || action?.path !== archive
+        || action.launchId !== proof.launch_id
+        || readFileSync(join(archive, '.identity'), 'utf8').trim() !== proof.name)
+        throw new Error('Archived member absence ownership proof mismatch');
+    if (await tempSupervisorLiveness(archive) !== 'stopped')
+        throw new Error('Archived member supervisor absence is not proven');
+    await verifyArchivedMemberStillAbsent(proof);
+}
+/** After the verified archive has been consumed by explicit workspace deletion,
+ * still fence replacement live state and a recreated daemon identity on every retry.
+ */
+export async function verifyArchivedMemberStillAbsent(proof) {
+    const absent = () => {
+        if (existsSync(agentDir(proof.name, true)))
+            throw new Error('Archived member has replacement live state');
+    };
+    absent();
+    await assertMemberIdentityAbsent({
+        role_name: proof.name, slot: 'archived', cowork_role: 'archived', seat_state: 'removed',
+    });
+    absent();
+}
+export async function proveArchivedAbsence(seat) {
+    if (seat.identity_cid || seat.retirement?.phase !== 'identity_absent'
+        || !seat.launch?.launch_id || !seat.launch.action_id
+        || seat.launch.launch_id !== seat.retirement.launch_id || !seat.retirement.archive_path)
+        throw new Error('Missing exact archived member absence evidence');
+    const proof = {
+        name: seat.role_name, launch_id: seat.launch.launch_id, action_id: seat.launch.action_id,
+        archive_path: seat.retirement.archive_path, checked_at: new Date().toISOString(),
+    };
+    await verifyArchivedAbsence(proof);
+    return proof;
+}

package/dist/rooms-tasks/cli.js

@@ -75,6 +75,11 @@ async function presentDetachedProvisioningOutcome(outcome) {
 function taskRoomPublicFailure(error) {
     const f = error.fields;
     switch (error.code) {
+        case 'task_not_ready': return {
+            legacy: `task readiness ${f.readiness}: ${f.reason}`, kind: 'state',
+            detail: `Task ${f.task} readiness is ${f.readiness}: ${f.reason}${f.member ? ` (${f.member})` : ''}.`,
+            action: 'Ask Fleet Coordinator to inspect room and member status and choose supported recovery. Do not blindly relaunch agents or reuse invites.',
+        };
         case 'task_confirmation_mismatch': return {
             legacy: 'confirmation ID must match task ID', kind: 'usage',
             detail: 'The two task IDs must match.', action: 'Repeat the same task ID twice.',
@@ -515,10 +520,10 @@ function taskRoomService(configuration) {
 function allTemplates(cfg) {
     return cfg.roomTemplates ?? {};
 }
-function coworkFor(cfg) {
+function coworkFor(cfg, options) {
     if (!cfg.rooms)
         throw new ConfigError('rooms: configuration is required before creating or querying rooms');
-    return createCoworkAdapter({ configPath: cfg.rooms.cowork?.config });
+    return createCoworkAdapter({ configPath: cfg.rooms.cowork?.config, ...options });
 }
 function resolveRoomTemplate(cfg, name) {
     if (!name)
@@ -827,16 +832,18 @@ export function registerTaskCommands(parent, cOpt) {
             dieTaskRoom(e);
         }
     });
-    taskCmd.command('show <id>')
+    cOpt(taskCmd.command('show <id>'))
         .description('show task details')
         .option('--json', 'JSON output')
         .action(async (id, opts) => {
         try {
-            const service = taskRoomService();
+            const service = taskRoomService(opts.configuration);
             const { task: t, orchestration: room } = service.getTask(id);
+            const readiness = t.state === 'active' ? await service.observeTaskReadiness(id) : undefined;
             if (opts.json) {
                 console.log(JSON.stringify({
                     schema_version: 1, task: t, orchestration: room ?? null,
+                    ...(readiness ? { readiness } : {}),
                 }, null, 2));
                 return;
             }
@@ -846,6 +853,8 @@ export function registerTaskCommands(parent, cOpt) {
                     { label: 'ID', value: t.task_id, kind: 'code' },
                     { label: 'Title', value: t.title },
                     { label: 'Status', value: taskStatus(t.state), kind: 'markdown' },
+                    ...(readiness ? [{ label: 'Readiness', value: readiness.state },
+                        ...('reason' in readiness ? [{ label: 'Reason', value: readiness.reason }] : [])] : []),
                     ...(t.blocked ? [{ label: 'Blocked', value: t.blocked.reason }] : []),
                     ...(t.template ? [{ label: 'Template', value: `${t.template.name}@${t.template.version}`, kind: 'code' }] : []),
                     ...(t.room_id ? [{ label: 'Room', value: t.room_id, kind: 'code' }] : []),
@@ -1152,7 +1161,7 @@ export function registerTaskCommands(parent, cOpt) {
                 const app = taskRoomService(opts.configuration);
                 for (;;) {
                     const before = app.taskProvisioningOutcome(id);
-                    if (before.kind !== 'in_progress') {
+                    if (before.kind !== 'in_progress' || before.next_action) {
                         await presentDetachedProvisioningOutcome(before);
                         return;
                     }
@@ -1176,6 +1185,26 @@ export function registerTaskCommands(parent, cOpt) {
             dieTaskRoom(e);
         }
     });
+    cOpt(taskCmd.command('_layout <id> <operation> [room]', { hidden: true }))
+        .description('internal: run an accepted layout room operation (open, close-room, close)')
+        .option('--json', 'JSON output')
+        .option('--operation-id <id>', 'accepted operation ID; status updates apply only while it is current')
+        .action(async (id, operation, room, opts) => {
+        try {
+            if (!['open', 'close-room', 'close'].includes(operation))
+                throw new Error(`unknown layout operation: ${operation}`);
+            const view = await taskRoomService(opts.configuration).runTaskLayoutOperation({
+                actor: { kind: 'internal_worker', surface: 'cli' }, taskId: id,
+                operation: operation, room, operationId: opts.operationId,
+            });
+            console.log(JSON.stringify({ schema_version: 1, layout: view }, null, 2));
+        }
+        catch (e) {
+            if (opts.json)
+                die(e);
+            dieTaskRoom(e);
+        }
+    });
     cOpt(taskCmd.command('_settle_delete <id>', { hidden: true }))
         .description('internal: settle a previously accepted task deletion')
         .option('--json', 'JSON output')

package/dist/rooms-tasks/close.d.ts

@@ -2,6 +2,8 @@ import { withFileLock } from '../atomic-file.js';
 import { type TempLifecycleDeps } from '../temp-lifecycle.js';
 import { type CoworkAdapter } from './cowork-adapter.js';
 import type { RoomMemberSeat, RoomOrchestrationRecord } from './types.js';
+export declare const CLOSE_LOCK_STALE_MS: number;
+export declare function roomCloseLockPath(roomId: string): string;
 export interface RoomCloseDeps {
     inspectMember?(seat: RoomMemberSeat): Promise<{
         launchId: string;
@@ -19,12 +21,13 @@ export declare function waitForLivenessAbsent(role: string, launchId: string, li
 /** Report whether any daemon identity — under any name — carries this exact CID. */
 export declare function identityCidPresent(cid: string): Promise<boolean>;
 export declare function removeExactMemberIdentity(seat: RoomMemberSeat): Promise<void>;
+export declare function assertMemberIdentityAbsent(seat: RoomMemberSeat): Promise<void>;
 /** One forward-only room close saga shared by every Fleet entry point. */
 export declare function acceptManagedRoomClose(roomId: string): Promise<RoomOrchestrationRecord>;
 export declare function recordManagedRoomCloseError(roomId: string, error: string, recoveryHint: string): Promise<RoomOrchestrationRecord>;
 export declare function closeManagedRoom(input: {
     roomId: string;
-    cowork: Pick<CoworkAdapter, 'closeRoom'>;
+    cowork: Pick<CoworkAdapter, 'closeRoom'> & Partial<Pick<CoworkAdapter, 'getRoom'>>;
     deps?: RoomCloseDeps;
 }): Promise<RoomOrchestrationRecord>;
 export interface ManagedRoomDeleteResult {
@@ -38,6 +41,6 @@ export declare function deleteLegacyClosedRooms(input: {
 /** Retire live resources through the existing cursor, then delete retained state. */
 export declare function deleteManagedRoom(input: {
     roomId: string;
-    cowork: Pick<CoworkAdapter, 'closeRoom' | 'deleteRoom'>;
+    cowork: Pick<CoworkAdapter, 'closeRoom' | 'deleteRoom'> & Partial<Pick<CoworkAdapter, 'getRoom'>>;
     deps?: RoomCloseDeps;
 }): Promise<ManagedRoomDeleteResult>;

package/dist/rooms-tasks/close.js

@@ -1,16 +1,22 @@
+import { detachDeletedRoom } from './task-state.js';
+import { binderKey } from '../agent-ours/state.js';
+import { eraseMemberArtifacts } from './erasure.js';
+import { deleteWorkspace, assertWorkspaceDeletable } from './workspace.js';
+import { collectWorkspaceArchives } from './workspace-artifacts.js';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { attachOursClient } from '@ours.network/sdk/client';
 import { withFileLock } from '../atomic-file.js';
 import { agentDir, stateRoot } from '../paths.js';
-import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempSupervisorLiveness, } from '../temp-lifecycle.js';
+import { readClientProfile } from '../client-profile.js';
+import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempSupervisorLiveness, tempArchiveForLaunch, tempArchiveForCreationAction, } from '../temp-lifecycle.js';
 import { CoworkProtocolError } from './cowork-adapter.js';
-import { advanceMemberRetirement, advanceRoomClose, beginRoomClose, closeRoom, deleteRoomRecord, getRoomRecord, listRoomRecords, setRoomCloseError, } from './room-state.js';
-const CLOSE_LOCK_STALE_MS = 5 * 60_000;
+import { advanceMemberRetirement, advanceRoomClose, beginRoomClose, closeRoom, deleteRoomRecord, getRoomRecord, listRoomRecords, setRoomCloseError, recordRetirementMemberCids, } from './room-state.js';
+export const CLOSE_LOCK_STALE_MS = 5 * 60_000;
 const STOP_POLLS = 50;
 const STOP_POLL_MS = 100;
-function roomCloseLockPath(roomId) {
+export function roomCloseLockPath(roomId) {
     return join(stateRoot(), 'locks', 'room-close', encodeURIComponent(roomId));
 }
 function errorText(error) {
@@ -19,6 +25,20 @@ function errorText(error) {
 function exactMemberIdentity(seat) {
     const dir = agentDir(seat.role_name, true);
     const identityPath = join(dir, '.identity');
+    if (existsSync(dir) && !existsSync(identityPath) && seat.launch?.action_id && seat.launch.launch_id) {
+        const supervisor = readTempSupervisor(dir);
+        let creation;
+        try {
+            creation = JSON.parse(readFileSync(join(dir, 'creation.json'), 'utf8'));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (supervisor?.role === seat.role_name && supervisor.launchId === seat.launch.launch_id
+            && creation?.role === seat.role_name && creation.creationActionId === seat.launch.action_id)
+            return;
+    }
     if (!existsSync(dir) || !existsSync(identityPath)) {
         throw new Error(`room member '${seat.role_name}' has no live Fleet temp-state identity proof; refusing retirement`);
     }
@@ -30,7 +50,8 @@ function exactMemberIdentity(seat) {
 export async function inspectMember(seat) {
     exactMemberIdentity(seat);
     const supervisor = readTempSupervisor(agentDir(seat.role_name, true));
-    if (!supervisor || supervisor.role !== seat.role_name) {
+    if (!supervisor || supervisor.role !== seat.role_name
+        || (seat.launch?.launch_id && supervisor.launchId !== seat.launch.launch_id)) {
         throw new Error(`room member '${seat.role_name}' has no exact Fleet supervisor ownership proof`);
     }
     return { launchId: supervisor.launchId };
@@ -54,16 +75,24 @@ export async function waitForLivenessAbsent(role, launchId, lifecycleDeps = {})
     throw new Error(`temporary role '${role}' did not reach proven stopped liveness`);
 }
 async function withIdentityClient(work) {
+    const profile = readClientProfile(process.env);
+    const leaseToken = `ours-fleet-room-close-${process.pid}-${randomUUID()}`;
     const client = await attachOursClient({
-        env: process.env,
-        leaseToken: `ours-fleet-room-close-${process.pid}-${randomUUID()}`,
-        clientPid: process.pid,
+        endpoint: profile.endpoint,
+        expectedInstanceId: profile.expectedInstanceId,
+        credentialPath: profile.credentialPath,
+        sessionMode: 'external', env: {}, leaseToken,
     });
     try {
         return await work(client);
     }
     finally {
-        await client.releaseLease().catch(() => { });
+        try {
+            await client.releaseLease().catch(() => { });
+        }
+        finally {
+            await client.close();
+        }
     }
 }
 function listedIdentity(rows, name) {
@@ -78,14 +107,19 @@ export async function identityCidPresent(cid) {
 }
 export async function removeExactMemberIdentity(seat) {
     await withIdentityClient(async (client) => {
-        const before = listedIdentity(await client.listIdentities(), seat.role_name);
-        if (!before)
+        const rows = await client.listIdentities();
+        const before = listedIdentity(rows, seat.role_name);
+        if (!before) {
+            if (rows.some(row => row.name === seat.role_name || (seat.identity_cid && 'cid' in row
+                && row.cid.toLowerCase() === seat.identity_cid.toLowerCase())))
+                throw new Error(`room member '${seat.role_name}' identity absence is not proven`);
             return;
+        }
         if (!seat.identity_cid) {
-            throw new Error(`room member '${seat.role_name}' exists without a recorded authenticated CID; refusing removal`);
+            throw new Error(`room member '${seat.role_name}' exists without a recorded authenticated CID; identity absence is not proven; refusing removal`);
         }
         if (before.cid?.toLowerCase() !== seat.identity_cid.toLowerCase()) {
-            throw new Error(`room member '${seat.role_name}' identity CID mismatch: recorded ${seat.identity_cid}, found ${before.cid ?? 'none'}`);
+            throw new Error(`room member '${seat.role_name}' identity absence is not proven: CID mismatch: recorded ${seat.identity_cid}, found ${before.cid ?? 'none'}`);
         }
         try {
             await client.removeIdentity({ name: seat.role_name });
@@ -100,17 +134,59 @@ export async function removeExactMemberIdentity(seat) {
             if (after)
                 throw error;
         }
-        const after = listedIdentity(await client.listIdentities(), seat.role_name);
-        if (after) {
+        const after = await client.listIdentities();
+        if (after.some(row => row.name === seat.role_name || (seat.identity_cid && 'cid' in row
+            && row.cid.toLowerCase() === seat.identity_cid.toLowerCase()))) {
             throw new Error(`room member '${seat.role_name}' identity still exists after remove_identity`);
         }
     });
 }
+export async function assertMemberIdentityAbsent(seat) {
+    await withIdentityClient(async (client) => {
+        const rows = await client.listIdentities();
+        if (rows.some(row => row.name === seat.role_name ||
+            (seat.identity_cid && 'cid' in row && row.cid.toLowerCase() === seat.identity_cid.toLowerCase()))) {
+            throw new Error(`room member '${seat.role_name}' identity absence is not proven; refusing retirement`);
+        }
+    });
+}
 async function retireMember(roomId, seat, deps) {
     let room = getRoomRecord(roomId);
     let current = room.member_seats.find(candidate => candidate.role_name === seat.role_name);
     let retirement = current.retirement;
+    if (retirement?.phase === 'identity_absent') {
+        if (!deps.inspectMember) {
+            if (existsSync(agentDir(current.role_name, true)))
+                throw new Error('Retired member has replacement launch live state');
+            await assertMemberIdentityAbsent(current);
+        }
+        return;
+    }
     if (!retirement) {
+        if (!existsSync(agentDir(current.role_name, true)) && current.launch?.launch_id && current.launch.action_id) {
+            const archived = tempArchiveForLaunch(current.role_name, current.launch.launch_id);
+            const created = tempArchiveForCreationAction(current.role_name, current.launch.action_id);
+            if (archived && (!created || created.path !== archived || created.launchId !== current.launch.launch_id))
+                throw new Error('Archived member creation ownership mismatch');
+            if (archived && created?.path === archived && created.launchId === current.launch.launch_id) {
+                if (readFileSync(join(archived, '.identity'), 'utf8').trim() !== current.role_name)
+                    throw new Error(`room member '${current.role_name}' archive identity mismatch`);
+                if (await tempSupervisorLiveness(archived) !== 'stopped')
+                    throw new Error(`room member '${current.role_name}' archived supervisor is not proven stopped`);
+                // A terminated launch can archive itself before room retirement begins.
+                // Accept its exact durable provenance only when no identity needs removal.
+                await (deps.removeIdentity ?? removeExactMemberIdentity)(current);
+                await assertMemberIdentityAbsent(current);
+                const latest = getRoomRecord(roomId)?.member_seats.find(seat => seat.role_name === current.role_name);
+                if (existsSync(agentDir(current.role_name, true))
+                    || latest?.launch?.launch_id !== current.launch.launch_id
+                    || latest?.launch?.action_id !== current.launch.action_id
+                    || latest?.identity_cid !== current.identity_cid)
+                    throw new Error(`room member '${current.role_name}' changed during archived retirement proof`);
+                advanceMemberRetirement(roomId, current.role_name, 'identity_absent', current.launch.launch_id, archived);
+                return;
+            }
+        }
         if (current.launch?.state === 'pending' && current.launch.attempt === 0) {
             if (existsSync(agentDir(current.role_name, true))) {
                 throw new Error(`never-launched room member '${current.role_name}' unexpectedly has Fleet temp state`);
@@ -119,12 +195,31 @@ async function retireMember(roomId, seat, deps) {
             advanceMemberRetirement(roomId, current.role_name, 'identity_absent', 'never-launched');
             return;
         }
+        if (!deps.inspectMember && !existsSync(agentDir(current.role_name, true))) {
+            await (deps.removeIdentity ?? removeExactMemberIdentity)(current);
+            if (existsSync(agentDir(current.role_name, true)))
+                throw new Error(`room member '${current.role_name}' acquired replacement state during retirement`);
+            advanceMemberRetirement(roomId, current.role_name, 'identity_absent', 'absent-verified');
+            return;
+        }
         const ownership = await (deps.inspectMember ?? inspectMember)(current);
         room = advanceMemberRetirement(roomId, current.role_name, 'stop_requested', ownership.launchId);
         current = room.member_seats.find(candidate => candidate.role_name === seat.role_name);
         retirement = current.retirement;
     }
+    if (['stop_requested', 'liveness_absent', 'archive_secured'].includes(retirement.phase) && !deps.requestStop
+        && !existsSync(agentDir(current.role_name, true))) {
+        const archive = tempArchiveForLaunch(current.role_name, retirement.launch_id);
+        if (archive && await tempSupervisorLiveness(archive) !== 'stopped')
+            throw new Error('Archived supervisor is not proven stopped');
+        await (deps.removeIdentity ?? removeExactMemberIdentity)(current);
+        await assertMemberIdentityAbsent(current);
+        advanceMemberRetirement(roomId, current.role_name, 'identity_absent', retirement.launch_id, archive, !archive);
+        return;
+    }
     if (retirement.phase === 'stop_requested') {
+        if (!deps.inspectMember && (await inspectMember(current)).launchId !== retirement.launch_id)
+            throw new Error('Member launch changed before stop');
         await (deps.requestStop ?? (async (role) => { await stopTempSupervisor(role); }))(current.role_name);
         await (deps.waitForLivenessAbsent ?? waitForLivenessAbsent)(current.role_name, retirement.launch_id);
         room = advanceMemberRetirement(roomId, current.role_name, 'liveness_absent', retirement.launch_id);
@@ -154,19 +249,31 @@ export async function closeManagedRoom(input) {
     const lock = deps.lock ?? withFileLock;
     return lock(roomCloseLockPath(input.roomId), async () => {
         let room = beginRoomClose(input.roomId);
-        if (room.state === 'closed')
+        if (room.state === 'closed') {
+            if (!deps.inspectMember)
+                for (const seat of room.member_seats) {
+                    if (existsSync(agentDir(seat.role_name, true)))
+                        throw new Error('Closed room has replacement live state');
+                    await assertMemberIdentityAbsent(seat);
+                }
             return room;
+        }
         try {
             if (room.close?.phase === 'retire_members') {
+                room = await recoverMemberCids(room, input.cowork);
                 for (const seat of room.member_seats) {
-                    if (seat.retirement?.phase === 'identity_absent')
-                        continue;
                     await retireMember(input.roomId, seat, deps);
                 }
                 room = advanceRoomClose(input.roomId, 'close_cowork');
             }
             if (room.close?.phase === 'close_cowork') {
-                await input.cowork.closeRoom(input.roomId);
+                try {
+                    await input.cowork.closeRoom(input.roomId);
+                }
+                catch (error) {
+                    if (!(error instanceof CoworkProtocolError && error.code === 'not_found'))
+                        throw error;
+                }
             }
             return closeRoom(input.roomId);
         }
@@ -180,6 +287,9 @@ export async function closeManagedRoom(input) {
 export async function deleteLegacyClosedRooms(input) {
     const deleted = [];
     for (const room of listRoomRecords({ state: 'closed' })) {
+        // This compatibility sweep is retirement, never explicit workspace deletion.
+        if (room.workspace)
+            continue;
         try {
             await input.cowork.deleteRoom(room.room_id);
         }
@@ -196,14 +306,84 @@ export async function deleteLegacyClosedRooms(input) {
 }
 /** Retire live resources through the existing cursor, then delete retained state. */
 export async function deleteManagedRoom(input) {
-    await closeManagedRoom(input);
-    try {
-        await input.cowork.deleteRoom(input.roomId);
-    }
-    catch (error) {
-        setRoomCloseError(input.roomId, errorText(error), `Retry 'ours-fleet room delete ${input.roomId} ${input.roomId}'.`);
-        throw error;
+    if (getRoomRecord(input.roomId))
+        await closeManagedRoom(input);
+    return withFileLock(roomCloseLockPath(input.roomId), async () => {
+        try {
+            try {
+                await input.cowork.deleteRoom(input.roomId);
+            }
+            catch (error) {
+                // An earlier explicit delete may have removed the remote room before
+                // local filesystem cleanup failed. Never restore it or repeat creation.
+                if (!(error instanceof CoworkProtocolError && error.code === 'not_found'))
+                    throw error;
+            }
+            const retained = getRoomRecord(input.roomId);
+            if (retained?.workspace && !retained.task_id) {
+                assertWorkspaceDeletable(retained.workspace, 'room', input.roomId);
+                collectWorkspaceArchives(retained.workspace);
+                deleteWorkspace(retained.workspace, 'room', input.roomId);
+            }
+            if (retained)
+                await eraseMemberArtifacts('room', input.roomId, retained.member_seats, [input.roomId]);
+            if (retained?.task_id)
+                detachDeletedRoom(retained.task_id, input.roomId);
+            deleteRoomRecord(input.roomId);
+            return { room_id: input.roomId, deleted: true };
+        }
+        catch (error) {
+            if (getRoomRecord(input.roomId))
+                setRoomCloseError(input.roomId, errorText(error), `Fix the cleanup error and explicitly retry room delete ${input.roomId} ${input.roomId}.`);
+            throw error;
+        }
+    }, {}, CLOSE_LOCK_STALE_MS);
+}
+/** Recover only an authenticated seat tied to this exact room and issued invite.
+ * Display names and the current daemon name inventory are never binding proof.
+ */
+async function recoverMemberCids(room, cowork) {
+    if (!room.member_seats.some(seat => !seat.identity_cid))
+        return room;
+    const profile = room.member_seats.some(seat => seat.launch?.action_id) ? readClientProfile(process.env) : undefined;
+    let remote;
+    if (cowork.getRoom && room.room_identity_cid) {
+        try {
+            remote = await cowork.getRoom(room.room_id);
+        }
+        catch (error) {
+            if (!(error instanceof CoworkProtocolError && error.code === 'not_found'))
+                throw error;
+        }
+        if (remote && (remote.room_id !== room.room_id || remote.identity_cid.toLowerCase() !== room.room_identity_cid.toLowerCase()))
+            throw new Error('Room identity mismatch during deletion recovery');
     }
-    deleteRoomRecord(input.roomId);
-    return { room_id: input.roomId, deleted: true };
+    const seats = room.member_seats.map(seat => {
+        let runtimeCid;
+        if (profile && seat.launch?.action_id) {
+            const dir = join(stateRoot(), 'private-ours', binderKey(profile.expectedInstanceId, seat.role_name));
+            try {
+                const state = JSON.parse(readFileSync(join(dir, 'state.json'), 'utf8'));
+                const instance = JSON.parse(readFileSync(join(dir, 'instance.json'), 'utf8'));
+                if (state.name === seat.role_name && state.daemon === profile.expectedInstanceId
+                    && state.lifetime === 'temporary' && state.action === seat.launch.action_id
+                    && instance.role === seat.role_name && instance.temporary === true && instance.instance === state.instance)
+                    runtimeCid = state.cid;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        const matches = seat.invite_id ? remote?.seats.filter(value => value.invite_id === seat.invite_id && value.role === seat.cowork_role) ?? [] : [];
+        if (matches.length > 1)
+            throw new Error('Ambiguous authenticated member identity during deletion recovery');
+        const candidates = [seat.identity_cid, runtimeCid, matches[0]?.identity_cid].filter((v) => !!v);
+        if (candidates.some(cid => !/^[a-f0-9]{64}$/i.test(cid)))
+            throw new Error('Invalid authenticated member CID');
+        if (new Set(candidates.map(cid => cid.toLowerCase())).size > 1)
+            throw new Error('Contradictory authenticated member CID evidence');
+        return candidates.length ? { ...seat, identity_cid: candidates[0] } : seat;
+    });
+    return recordRetirementMemberCids(room.room_id, seats);
 }