@ours.network/fleet 1.2.0-nightly.2 → 1.2.0-nightly.21

package/dist/rooms-tasks/provision.js

@@ -1,3 +1,5 @@
+import { readRoomReadiness } from '../agent-ours/service.js';
+import { ensureWorkspace, validateWorkspace } from './workspace.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { join } from 'node:path';
@@ -13,7 +15,7 @@ import { readLaunchSnapshot, redactLaunchDefinition } from './launch-snapshot.js
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from '../fleet-proxy.js';
 import { controlRequest } from '../session/control.js';
 import { SessionControlError } from '../session/types.js';
-import { closeManagedRoom } from './close.js';
+import { closeManagedRoom, roomCloseLockPath, CLOSE_LOCK_STALE_MS } from './close.js';
 import { withFileLock } from '../atomic-file.js';
 import { TASK_OPERATION_LOCK_STALE_MS, taskOperationLockPath } from './terminal.js';
 import { TaskStateError, taskDeletionState } from './task-state.js';
@@ -115,6 +117,7 @@ function settingsFor(member, cfg, sealed) {
 }
 function roomTask(input, member, settings, members, roomIdentityCid, ownerSeatCid, anonymous) {
     return buildRoomMemberTask({
+        workspace: getRoomRecord(input.roomId)?.workspace?.path,
         taskId: input.taskId,
         roomId: input.roomId,
         roomIdentityCid,
@@ -128,7 +131,7 @@ function roomTask(input, member, settings, members, roomIdentityCid, ownerSeatCi
             cowork_role: member.coworkRole,
             persona: settings.persona,
         },
-        roster: members.map(candidate => ({
+        roster: [...(input.append ? (getRoomRecord(input.roomId)?.member_seats ?? []).filter(seat => !members.some(m => m.name === seat.role_name)).map(seat => ({ name: seat.role_name, coworkRole: seat.cowork_role })) : []), ...members].map(candidate => ({
             role_name: candidate.name,
             cowork_role: candidate.coworkRole,
         })),
@@ -141,6 +144,10 @@ function launchMatches(dir, member, actionId, taskSha, roomId, roomIdentityCid,
     try {
         const role = parse(readFileSync(`${dir}/role.yaml`, 'utf8'));
         const startup = role.roomMemberStartup;
+        const workspace = getRoomRecord(roomId)?.workspace;
+        if (workspace && (role.cwd !== workspace.path
+            || JSON.stringify(startup?.workspace) !== JSON.stringify(workspace)))
+            return false;
         return role.identity === member.name
             && startup?.room_id === roomId
             && startup.room_identity_cid === roomIdentityCid
@@ -149,8 +156,7 @@ function launchMatches(dir, member, actionId, taskSha, roomId, roomIdentityCid,
             && (startup.anonymous ?? false) === anonymous
             && sha256Text(startup.task ?? '') === taskSha
             && (expectedInviteId === undefined || startup.invite_id === expectedInviteId)
-            && typeof startup.invite === 'string'
-            && startup.invite.length > 0;
+            && startup.invite === '';
     }
     catch {
         return false;
@@ -234,25 +240,9 @@ async function retainRunningLaunch(input) {
     }
     return false;
 }
-/**
- * Member-launch publication window: for a task-bound room, the durable launch
- * intent, spawn, and launch record publish under the common task-operation
- * lock so an accepted deletion linearizes strictly before (bounded abort — no
- * spawn happens) or strictly after (the seat's launch record is visible to
- * deletion retirement). The lock is held per member only, never across
- * seat-wait loops.
- */
 async function launchMember(input) {
-    const taskId = input.provision.taskId;
-    if (!taskId)
-        return launchMemberUnlocked(input);
-    return withFileLock(taskOperationLockPath(taskId), () => {
-        if (taskDeletionState(taskId) !== 'none')
-            throw new Error(`task ${taskId} is pending deletion; aborting member launch for ${input.member.name}`);
-        return launchMemberUnlocked(input);
-    }, {}, TASK_OPERATION_LOCK_STALE_MS);
-}
-async function launchMemberUnlocked(input) {
+    // provisionMembers holds the task and room lifecycle locks through every launch.
+    assertProvisioningOpen(input.provision);
     const { provision, member, settings, startup } = input;
     const seat = getRoomRecord(provision.roomId).member_seats
         .find(candidate => candidate.role_name === member.name);
@@ -274,6 +264,7 @@ async function launchMemberUnlocked(input) {
     try {
         const launched = await spawnRoomMember({
             name: member.name,
+            configPath: provision.configPath,
             temp: true,
             identity: member.name,
             agentDefinition: settings.definition,
@@ -345,7 +336,16 @@ function reconcileMemberSeats(roomId, members, observed, ownerSeatCid) {
         && seat.seat_state === 'active');
     const seats = current.member_seats.map(seat => {
         const member = members.find(candidate => candidate.name === seat.role_name);
+        if (!member)
+            return seat;
+        const readiness = readRoomReadiness(current.room_identity_cid, member.name);
+        if (!readiness || readiness.room !== roomId || readiness.invite !== seat.invite_id) {
+            complete = false;
+            return seat;
+        }
         const found = exactCoworkSeat(observed, member, seat.invite_id);
+        if (found && found.identity_cid !== readiness.cid)
+            throw new Error('Cowork seat CID does not match supervisor provisioned identity');
         if (!found || found.seat_state !== 'active') {
             complete = false;
             return seat;
@@ -364,9 +364,41 @@ function assertCoworkRoomPolicy(room, expectedAnonymous) {
     if ((room.anonymous ?? false) !== expectedAnonymous)
         throw new Error(`Cowork anonymity (${String(room.anonymous ?? false)}) does not match Fleet's durable Room policy (${String(expectedAnonymous)})`);
 }
+function assertProvisioningOpen(input) {
+    if (input.taskId && getTask(input.taskId).terminal_intent)
+        throw new Error(`task ${input.taskId} has an accepted terminal intent; refusing to provision members`);
+    const room = getRoomRecord(input.roomId);
+    if (room?.state === 'closing' || room?.state === 'closed')
+        throw new Error(`room ${input.roomId} is ${room.state}; refusing to provision members`);
+}
 export async function provisionMembers(input) {
+    // Same lock order as terminal/deletion settlement. Serialize concurrent retries
+    // and standalone retirement as well as member publication. Seat waits are bounded.
+    const run = () => withFileLock(roomCloseLockPath(input.roomId), () => {
+        assertProvisioningOpen(input);
+        if (input.append) {
+            const task = input.taskId ? getTask(input.taskId) : undefined;
+            const room = getRoomRecord(input.roomId);
+            if (!task || !['active', 'review'].includes(task.state) || task.blocked || room?.state !== 'active'
+                || room.task_id !== task.task_id || room.room_identity_cid !== task.room_identity_cid)
+                throw new Error('Adding an agent requires the exact active, unblocked task room');
+            const names = expandMembers(input.template, shortId(task.task_id)).map(m => m.name);
+            if (room.member_seats.some(seat => names.includes(seat.role_name)))
+                throw new Error('Member slot is already recorded; inspect its existing launch');
+            if (room.member_seats.some(seat => seat.seat_state !== 'active'))
+                throw new Error('Existing member admission must finish before adding an agent');
+        }
+        if (!getRoomRecord(input.roomId))
+            throw new Error(`room ${input.roomId} is missing; refusing provisioning`);
+        return provisionMembersUnlocked(input);
+    }, {}, CLOSE_LOCK_STALE_MS);
+    return input.taskId
+        ? withFileLock(taskOperationLockPath(input.taskId), run, {}, TASK_OPERATION_LOCK_STALE_MS)
+        : run();
+}
+async function provisionMembersUnlocked(input) {
     const { cfg, cowork, roomId, taskId, template } = input;
-    // Deletion-epoch pre-check; each member launch re-checks under the lock.
+    // The common task-operation lock protects this epoch through all member launches.
     if (taskId && taskDeletionState(taskId) !== 'none')
         throw new Error(`task ${taskId} is pending deletion; refusing to provision members`);
     const prefix = taskId ? shortId(taskId) : `room-${shortId(roomId)}`;
@@ -378,6 +410,12 @@ export async function provisionMembers(input) {
     const existing = getRoomRecord(roomId);
     if (!existing?.room_identity_cid)
         throw new Error(`room ${roomId} has no pinned room identity CID`);
+    if (existing.workspace) {
+        validateWorkspace(existing.workspace, taskId ? 'task' : 'room', taskId ?? roomId);
+        ensureWorkspace(existing.workspace);
+        for (const setting of settings.values())
+            setting.definition.cwd = existing.workspace.path;
+    }
     const roomIdentityCid = existing.room_identity_cid;
     const ownerSeatCid = existing.owner_seat_cid ?? null;
     const roomPolicy = storedRoomLaunchPolicy(existing.room_policy);
@@ -385,22 +423,23 @@ export async function provisionMembers(input) {
     const resuming = members.length > 0
         && members.every(member => persistedNames.has(member.name));
     if (!resuming) {
-        advanceSaga(roomId, 'create_members', 3);
-        updateMemberSeats(roomId, members.map(member => {
-            const memberSettings = settings.get(member.name);
-            const evidence = launchDefinition(memberSettings.definition);
-            return ({
-                role_name: member.name,
-                slot: member.slot,
-                cowork_role: member.coworkRole,
-                seat_state: 'pending',
-                launch: { state: 'pending', attempt: 0,
-                    agent_definition: evidence.projection, agent_fingerprint: evidence.fingerprint,
-                    agent_template: memberSettings.template,
-                    agent_template_hash: memberSettings.templateHash,
-                    updated_at: new Date().toISOString() },
-            });
-        }));
+        if (!input.append)
+            advanceSaga(roomId, 'create_members', 3);
+        updateMemberSeats(roomId, [...(input.append ? existing.member_seats : []), ...members.map(member => {
+                const memberSettings = settings.get(member.name);
+                const evidence = launchDefinition(memberSettings.definition);
+                return ({
+                    role_name: member.name,
+                    slot: member.slot,
+                    cowork_role: member.coworkRole,
+                    seat_state: 'pending',
+                    launch: { state: 'pending', attempt: 0,
+                        agent_definition: evidence.projection, agent_fingerprint: evidence.fingerprint,
+                        agent_template: memberSettings.template,
+                        agent_template_hash: memberSettings.templateHash,
+                        updated_at: new Date().toISOString() },
+                });
+            })], input.append ? template : undefined);
     }
     else {
         for (const member of members) {
@@ -418,7 +457,8 @@ export async function provisionMembers(input) {
         now: input.startupWait?.now ?? Date.now,
         sleep: input.startupWait?.sleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms))),
     };
-    advanceSaga(roomId, 'join_role_groups', 4);
+    if (!input.append)
+        advanceSaga(roomId, 'join_role_groups', 4);
     try {
         const initialRoom = await cowork.recoverRoom(roomId);
         assertCoworkRoomPolicy(initialRoom, roomPolicy.anonymous);
@@ -439,17 +479,31 @@ export async function provisionMembers(input) {
                 provision: input, member, settings: settings.get(member.name), task, roomIdentityCid,
             }))
                 continue;
+            // A previous failed launch keeps its invite pointer durably. Never
+            // overwrite that requirement until the supported revoke has succeeded;
+            // a transport failure must fence subsequent invite issuance too.
+            if (currentSeat.invite_id) {
+                const observed = await cowork.getRoom(roomId);
+                if (!observed || observed.identity_cid !== roomIdentityCid)
+                    throw new Error('cannot verify room before failed-attempt invite cleanup');
+                if (observed.seats.some(seat => seat.invite_id === currentSeat.invite_id
+                    && seat.seat_state !== 'removed'))
+                    throw new Error('failed-attempt invite has an admitted seat; reconcile before replacing the member');
+                await cowork.revokeInvite(roomId, currentSeat.invite_id);
+            }
             const issued = await cowork.issueInvite(roomId, {
                 mode: 'one_time', role: member.coworkRole, min_accepts: 1,
             });
-            const seats = getRoomRecord(roomId).member_seats.map(seat => seat.role_name === member.name ? { ...seat, invite_id: issued.invite_id } : seat);
-            updateMemberSeats(roomId, seats);
             try {
+                assertProvisioningOpen(input);
+                const seats = getRoomRecord(roomId).member_seats.map(seat => seat.role_name === member.name ? { ...seat, invite_id: issued.invite_id } : seat);
+                updateMemberSeats(roomId, seats);
                 await launchMember({
                     provision: input,
                     member,
                     settings: settings.get(member.name),
                     startup: {
+                        workspace: existing.workspace,
                         room_id: roomId,
                         room_identity_cid: roomIdentityCid,
                         identity_name: member.name,
@@ -463,7 +517,12 @@ export async function provisionMembers(input) {
                 });
             }
             catch (error) {
-                await cowork.revokeInvite(roomId, issued.invite_id).catch(() => { });
+                try {
+                    await cowork.revokeInvite(roomId, issued.invite_id);
+                }
+                catch (cleanupError) {
+                    throw new AggregateError([error, cleanupError], 'member launch failed and invite cleanup is unresolved; retry must revoke the retained requirement first');
+                }
                 throw error;
             }
         }
@@ -484,20 +543,23 @@ export async function provisionMembers(input) {
         }
         throw error;
     }
-    advanceSaga(roomId, 'wait_seats', 5);
+    if (!input.append)
+        advanceSaga(roomId, 'wait_seats', 5);
     const deadline = policy.now() + policy.timeoutMs;
     let delay = policy.initialDelayMs;
     for (;;) {
         const remote = await cowork.recoverRoom(roomId);
         assertCoworkRoomPolicy(remote, roomPolicy.anonymous);
         const reconciled = reconcileMemberSeats(roomId, members, remote.seats, ownerSeatCid ?? undefined);
-        if (reconciled.complete)
+        if (reconciled.complete && remote.state === 'active')
             break;
         if (policy.now() >= deadline) {
-            advanceSaga(roomId, 'wait_seats', 5, 'waiting_seats');
+            if (!input.append)
+                advanceSaga(roomId, 'wait_seats', 5, 'waiting_seats');
             return getRoomRecord(roomId);
         }
-        advanceSaga(roomId, 'wait_seats', 5, 'waiting_seats');
+        if (!input.append)
+            advanceSaga(roomId, 'wait_seats', 5, 'waiting_seats');
         await policy.sleep(delay);
         delay = Math.min(policy.maxDelayMs, Math.max(delay + 1, delay * 2));
     }
@@ -522,15 +584,87 @@ export async function provisionMembers(input) {
             };
         });
         updateTaskMembers(taskId, taskMembers);
-        if (getTask(taskId).blocked)
+        if (!input.append && getTask(taskId).blocked)
             unblockTask(taskId);
     }
+    if (input.append)
+        return getRoomRecord(roomId);
     advanceSaga(roomId, 'activate', 6);
     const record = activateRoom(roomId);
     if (taskId)
         activateTask(taskId);
     return record;
 }
+/** Reconcile proven, admitted launches without any spawn, archive, invite or recovery path. */
+export async function reconcileExistingTaskMembers(input) {
+    return withFileLock(taskOperationLockPath(input.taskId), async () => {
+        const task = getTask(input.taskId);
+        if (!['provisioning', 'active'].includes(task.state) || task.terminal_intent || taskDeletionState(input.taskId) !== 'none'
+            || !task.room_id)
+            throw new Error('task is not open for existing-member reconciliation');
+        const roomId = task.room_id;
+        return withFileLock(roomCloseLockPath(roomId), async () => {
+            const current = getRoomRecord(roomId);
+            if (!current || !['provisioning', 'active'].includes(current.state) || current.close
+                || current.task_id !== input.taskId || !current.room_identity_cid
+                || task.room_identity_cid !== current.room_identity_cid)
+                throw new Error('room is not open for existing-member reconciliation');
+            const names = new Set(input.expectedLaunches.map(seat => seat.role_name));
+            if (!names.size || names.size !== input.expectedLaunches.length
+                || current.member_seats.length !== names.size
+                || current.member_seats.some(seat => !names.has(seat.role_name)))
+                throw new Error('expected launch roster does not match the persisted room');
+            const remote = await input.cowork.getRoom(roomId);
+            if (!remote || remote.room_id !== roomId || remote.identity_cid !== current.room_identity_cid
+                || remote.state !== 'active')
+                throw new Error('Cowork room is not the exact active room');
+            assertCoworkRoomPolicy(remote, storedRoomLaunchPolicy(current.room_policy).anonymous);
+            if (current.owner_seat_cid && !remote.seats.some(seat => seat.identity_cid === current.owner_seat_cid && seat.seat_state === 'active'))
+                throw new Error('expected Owner seat is not active');
+            const seats = [];
+            for (const seat of current.member_seats) {
+                const expected = input.expectedLaunches.find(item => item.role_name === seat.role_name);
+                const launch = seat.launch;
+                if (seat.seat_state === 'removed' || !seat.invite_id || launch?.state !== 'launched'
+                    || launch.launch_id !== expected.launch_id || !launch.action_id || !launch.mission_sha256
+                    || (seat.identity_cid && seat.identity_cid !== expected.identity_cid))
+                    throw new Error('persisted member launch does not match reconciliation evidence');
+                const dir = agentDir(seat.role_name, true);
+                if (!launchMatches(dir, { name: seat.role_name, coworkRole: seat.cowork_role }, launch.action_id, launch.mission_sha256, roomId, current.room_identity_cid, seat.invite_id, storedRoomLaunchPolicy(current.room_policy).anonymous))
+                    throw new Error('member startup provenance mismatch');
+                const supervisor = readTempSupervisor(dir);
+                if (!supervisor || supervisor.role !== seat.role_name || supervisor.launchId !== expected.launch_id
+                    || await tempSupervisorLiveness(dir) !== 'running')
+                    throw new Error('expected member supervisor is not running');
+                const ready = readRoomReadiness(current.room_identity_cid, seat.role_name);
+                const matches = remote.seats.filter(item => item.display_name === seat.role_name
+                    && item.seat_state !== 'removed');
+                const found = matches[0];
+                if (!ready || ready.room !== roomId || ready.invite !== seat.invite_id
+                    || ready.cid !== expected.identity_cid || matches.length !== 1 || !found
+                    || found.identity_cid !== expected.identity_cid || found.role !== seat.cowork_role
+                    || found.seat_state !== 'active' || found.invite_id !== seat.invite_id)
+                    throw new Error('member readiness or authenticated Cowork seat mismatch');
+                seats.push({ ...seat, identity_cid: expected.identity_cid, seat_state: 'active' });
+            }
+            if (input.checkOnly)
+                return current;
+            // No mutation until the complete roster has passed; these writes are replayable
+            // under the same task/room lifecycle locks if interrupted between files.
+            updateMemberSeats(roomId, seats);
+            updateTaskMembers(input.taskId, seats.map(seat => ({ name: seat.role_name,
+                identity_cid: seat.identity_cid, slot: seat.slot, cowork_role: seat.cowork_role })));
+            if (getTask(input.taskId).blocked)
+                unblockTask(input.taskId);
+            if (current.state !== 'active')
+                advanceSaga(roomId, 'activate', 6);
+            const activated = current.state === 'active' ? getRoomRecord(roomId) : activateRoom(roomId);
+            if (task.state !== 'active')
+                activateTask(input.taskId);
+            return activated;
+        }, {}, TASK_OPERATION_LOCK_STALE_MS);
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+}
 export async function cleanupMembers(input) {
     const room = getRoomRecord(input.roomId);
     if (!room)

package/dist/rooms-tasks/room-state.d.ts

@@ -22,7 +22,7 @@ export declare function advanceSaga(id: string, phase: SagaPhase, stepIndex?: nu
 export declare function setSagaError(id: string, error: string, hint?: string, detail?: ProvisioningDetail): RoomOrchestrationRecord;
 export declare function setRoomIdentity(id: string, roomIdentityCid: string): RoomOrchestrationRecord;
 export declare function setOwnerSeat(id: string, ownerSeatCid: string, inviteFingerprint: string): RoomOrchestrationRecord;
-export declare function updateMemberSeats(id: string, seats: RoomMemberSeat[]): RoomOrchestrationRecord;
+export declare function updateMemberSeats(id: string, seats: RoomMemberSeat[], additionalTemplate?: import('./types.js').TemplateSnapshot): RoomOrchestrationRecord;
 export declare function updateRoomRoleBriefing(id: string, role: string, definition: RoomRoleBriefingDefinition): RoomOrchestrationRecord;
 export declare function updateRoomHistoryCursor(id: string, cursor: number): RoomOrchestrationRecord;
 export declare function updateMemberStartup(id: string, roleName: string, update: {
@@ -31,6 +31,8 @@ export declare function updateMemberStartup(id: string, roleName: string, update
 export declare function activateRoom(id: string): RoomOrchestrationRecord;
 export declare function closeRoom(id: string): RoomOrchestrationRecord;
 export declare function beginRoomClose(id: string): RoomOrchestrationRecord;
-export declare function advanceMemberRetirement(id: string, roleName: string, phase: MemberRetirementPhase, launchId: string, archivePath?: string): RoomOrchestrationRecord;
+export declare function advanceMemberRetirement(id: string, roleName: string, phase: MemberRetirementPhase, launchId: string, archivePath?: string, absenceVerified?: boolean): RoomOrchestrationRecord;
 export declare function advanceRoomClose(id: string, phase: RoomClosePhase): RoomOrchestrationRecord;
 export declare function setRoomCloseError(id: string, error: string, recoveryHint: string): RoomOrchestrationRecord;
+/** Settlement-only binding recovery; never publishes a seat or changes a launch. */
+export declare function recordRetirementMemberCids(id: string, recovered: ReadonlyArray<RoomMemberSeat>): RoomOrchestrationRecord;

package/dist/rooms-tasks/room-state.js

@@ -2,17 +2,28 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from 'node:f
 import { join } from 'node:path';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
+import { planWorkspace, ensureWorkspace } from './workspace.js';
+import { getTask } from './task-state.js';
 import { storedRoomLaunchPolicy } from './types.js';
 import { releaseLaunchSnapshot } from './launch-snapshot.js';
 export const roomsDir = () => join(stateRoot(), 'rooms');
-function roomPath(id) { return join(roomsDir(), `${id}.json`); }
+function roomPath(id) {
+    if (!/^[a-zA-Z0-9_-]{1,120}$/.test(id))
+        throw new RoomStateError('Invalid room ID');
+    return join(roomsDir(), `${id}.json`);
+}
 export class RoomStateError extends Error {
 }
 function readRoom(id) {
     const p = roomPath(id);
-    if (!existsSync(p))
-        throw new RoomStateError(`room not found: ${id}`);
-    return JSON.parse(readFileSync(p, 'utf8'));
+    try {
+        return JSON.parse(readFileSync(p, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            throw new RoomStateError(`room not found: ${id}`);
+        throw error;
+    }
 }
 function writeRoom(record) {
     mkdirSync(roomsDir(), { recursive: true });
@@ -25,6 +36,8 @@ export function createRoomRecord(input) {
         const requested = storedRoomLaunchPolicy(input.room_policy);
         if (JSON.stringify(before) !== JSON.stringify(requested))
             throw new RoomStateError(`room ${input.room_id} launch policy mismatch`);
+        if (existing.workspace)
+            ensureWorkspace(existing.workspace);
         return existing;
     }
     const record = {
@@ -40,15 +53,20 @@ export function createRoomRecord(input) {
         state: 'provisioning',
         created_at: new Date().toISOString(),
     };
+    record.workspace = input.task_id ? getTask(input.task_id).workspace : planWorkspace('room', input.room_id);
     writeRoom(record);
+    if (record.workspace)
+        ensureWorkspace(record.workspace);
     return record;
 }
 export function getRoomRecord(id) {
     try {
         return readRoom(id);
     }
-    catch {
-        return undefined;
+    catch (error) {
+        if (error instanceof RoomStateError && error.message === `room not found: ${id}`)
+            return undefined;
+        throw error;
     }
 }
 /** Remove a terminal orchestration record from the live room inventory. */
@@ -110,9 +128,13 @@ export function setOwnerSeat(id, ownerSeatCid, inviteFingerprint) {
     writeRoom(r);
     return r;
 }
-export function updateMemberSeats(id, seats) {
+export function updateMemberSeats(id, seats, additionalTemplate) {
     const r = readRoom(id);
+    if (r.state === 'closing' || r.state === 'closed')
+        throw new RoomStateError(`room ${id} is ${r.state}; member provisioning is fenced`);
     r.member_seats = seats;
+    if (additionalTemplate)
+        r.additional_member_templates = [...(r.additional_member_templates ?? []), additionalTemplate];
     writeRoom(r);
     return r;
 }
@@ -135,6 +157,8 @@ const LAUNCH_ORDER = [
 ];
 export function updateMemberStartup(id, roleName, update) {
     const r = readRoom(id);
+    if (r.state === 'closing' || r.state === 'closed')
+        throw new RoomStateError(`room ${id} is ${r.state}; member provisioning is fenced`);
     const seat = r.member_seats.find(candidate => candidate.role_name === roleName);
     if (!seat)
         throw new RoomStateError(`room ${id} has no recorded member ${roleName}`);
@@ -151,6 +175,8 @@ export function updateMemberStartup(id, roleName, update) {
 }
 export function activateRoom(id) {
     const r = readRoom(id);
+    if (r.state === 'closing' || r.state === 'closed')
+        throw new RoomStateError(`room ${id} is ${r.state}; activation is fenced`);
     r.state = 'active';
     r.saga = { phase: 'completed', step_index: 0 };
     delete r.provisioning_detail;
@@ -198,7 +224,7 @@ export function beginRoomClose(id) {
 const RETIREMENT_ORDER = [
     'stop_requested', 'liveness_absent', 'archive_secured', 'identity_absent',
 ];
-export function advanceMemberRetirement(id, roleName, phase, launchId, archivePath) {
+export function advanceMemberRetirement(id, roleName, phase, launchId, archivePath, absenceVerified = false) {
     const r = readRoom(id);
     if (r.state !== 'closing')
         throw new RoomStateError(`room ${id} is not closing`);
@@ -215,6 +241,7 @@ export function advanceMemberRetirement(id, roleName, phase, launchId, archivePa
         throw new RoomStateError(`room ${id} member ${roleName} retirement cannot move backward to ${phase}`);
     }
     seat.retirement = {
+        ...(absenceVerified || previous?.absence_verified ? { absence_verified: true } : {}),
         phase,
         launch_id: launchId,
         updated_at: new Date().toISOString(),
@@ -267,3 +294,21 @@ export function setRoomCloseError(id, error, recoveryHint) {
     writeRoom(r);
     return r;
 }
+/** Settlement-only binding recovery; never publishes a seat or changes a launch. */
+export function recordRetirementMemberCids(id, recovered) {
+    const room = readRoom(id);
+    if (room.state !== 'closing')
+        throw new RoomStateError('Room is not closing');
+    for (const proof of recovered) {
+        const seat = room.member_seats.find(value => value.role_name === proof.role_name);
+        if (!seat || seat.launch?.action_id !== proof.launch?.action_id || seat.invite_id !== proof.invite_id)
+            throw new RoomStateError('Member changed during identity recovery');
+        if (!proof.identity_cid)
+            continue;
+        if (seat.identity_cid && seat.identity_cid.toLowerCase() !== proof.identity_cid.toLowerCase())
+            throw new RoomStateError('Member identity changed during recovery');
+        seat.identity_cid = proof.identity_cid;
+    }
+    writeRoom(room);
+    return room;
+}

package/dist/rooms-tasks/task-state.d.ts

@@ -1,3 +1,4 @@
+import type { ArchivedMemberAbsence } from './types.js';
 import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase } from './types.js';
 export declare const tasksDir: () => string;
 export declare class TaskStateError extends Error {
@@ -17,6 +18,10 @@ export interface CreateTaskInput {
     idempotency_key?: string;
     start?: boolean;
     no_room?: boolean;
+    layout?: {
+        name: string;
+        definition_hash: string;
+    };
     room_id?: string;
     listId?: string;
 }
@@ -61,9 +66,8 @@ export declare function getDeletingTask(id: string): TaskRecord;
 export declare function taskDeletionState(id: string): 'none' | 'pending' | 'absent';
 /**
  * Durable, surface-independent audit evidence for a permanent deletion. The
- * receipt outlives the task record: written with the acceptance intent, and
- * completed before settlement is reported. Metadata only — never brief or
- * room content.
+ * receipt supports in-flight recovery only: written with acceptance intent,
+ * then erased before settlement is reported. It may contain a bounded title.
  */
 export interface TaskDeletionReceipt {
     schema_version: 1;
@@ -74,6 +78,7 @@ export interface TaskDeletionReceipt {
     original_state: TaskState;
     room_id?: string;
     member_count: number;
+    archived_absences?: ArchivedMemberAbsence[];
     settled_at?: string;
     result?: 'deleted';
 }
@@ -86,7 +91,7 @@ export declare function readTaskDeletionReceipt(id: string): TaskDeletionReceipt
  * settlement rather than deleting resources without audit evidence.
  */
 export declare function ensureTaskDeletionReceipt(id: string): void;
-/** Record settlement on the receipt; idempotent, tolerant of legacy absence. */
+/** Erase the in-flight receipt; also heals a crash after task unlink. */
 export declare function completeTaskDeletionReceipt(id: string): void;
 export type TaskDeletionAcceptance = {
     status: 'accepted' | 'pending';
@@ -122,7 +127,12 @@ export declare function advanceTaskDeletionMember(id: string, name: string, phas
 interface SeatEvidence {
     role_name: string;
     identity_cid?: string;
+    launch?: {
+        launch_id?: string;
+        action_id?: string;
+    };
     retirement?: {
+        absence_verified?: boolean;
         phase: TaskDeletionMemberPhase;
         launch_id: string;
         archive_path?: string;
@@ -146,14 +156,39 @@ export declare function upsertTaskDeletionMembersFromSeats(id: string, seats: Re
  *
  * The room saga is trusted for phase jumps, but partial or corrupt retained
  * records must not become false success: every seat must be identity_absent;
- * a real launch requires archive evidence; an identity-less seat is accepted
- * only via the never-launched proof.
+ * a real launch requires archive evidence; an identity-less seat requires
+ * never-launched proof or a freshly verified archived-absence checkpoint.
  */
-export declare function importTaskDeletionRetirementEvidence(id: string, seats: ReadonlyArray<SeatEvidence>): TaskRecord;
+export declare function importTaskDeletionRetirementEvidence(id: string, seats: ReadonlyArray<SeatEvidence>, proofs?: ReadonlyArray<ArchivedMemberAbsence>): TaskRecord;
+/** Settlement-only checkpoint, under the task-operation lock after fresh archive verification.
+ * From here retries still verify live absence, but owned archives may be consumed.
+ */
+export declare function beginTaskWorkspaceCleanup(id: string): void;
 /**
  * Physically remove a deletion-pending task record. Settlement-only: callers
  * must have completed member retirement and room cleanup first. Missing
  * records are the idempotent already-settled outcome.
  */
 export declare function unlinkDeletedTask(id: string): boolean;
+/** Called only after current temp and exact identity absence have been checked. */
+export declare function settleAbsentTaskDeletionMember(id: string, name: string): void;
+/** Room-only erasure keeps the parent Task but removes its dead room/member links. */
+export declare function detachDeletedRoom(taskId: string, roomId: string): void;
+/** A completed room may consume its archives while other task members still retire. */
+export declare function beginTaskArchiveCleanup(id: string): void;
+/** Metadata-only edit; compare under the task lock to prevent lost updates. */
+/**
+ * Choose, change or clear a Backlog task's Room Layout before it starts.
+ * `expected` is the layout name the caller saw (null = none); a different
+ * current choice is a stale edit. Choosing a layout drops the sealed room
+ * template plan; the caller releases the returned launch snapshot hash.
+ */
+export declare function updateTaskLayout(id: string, expected: string | null, next: {
+    name: string;
+    definition_hash: string;
+} | null): {
+    task: TaskRecord;
+    releasedSnapshot?: string;
+};
+export declare function updateTaskBrief(id: string, brief: string, expectedBrief: string): TaskRecord;
 export {};