@ours.network/fleet 1.2.0-nightly.2 → 1.2.0-nightly.21

package/dist/rooms-tasks/task-state.js

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
+import { planWorkspace, ensureWorkspace } from './workspace.js';
 import { storedRoomLaunchPolicy, TASK_TERMINAL_STATES, TASK_CANCELLABLE_STATES } from './types.js';
 import { DEFAULT_TASK_LIST_ID, readTaskLists } from './task-lists.js';
 export const tasksDir = () => join(stateRoot(), 'tasks');
@@ -125,21 +126,32 @@ export function assertNoPendingDeletion(task) {
         throw new TaskStateError(`task ${task.task_id} is pending deletion; run 'ours-fleet task delete ${task.task_id} ${task.task_id}' to retry cleanup`);
     }
 }
+function creationPlan(plan, layout) {
+    return JSON.stringify([plan?.plan_hash ?? null, storedRoomLaunchPolicy(plan?.room_policy) ?? null,
+        layout ? `${layout.name}@${layout.definition_hash}` : null]);
+}
 export function createTask(input) {
     const key = input.idempotency_key ?? randomUUID();
-    const existing = findByIdempotencyKey(key);
+    const existing = listTasks({ includeDeleting: true }).find(task => task.idempotency_key === key);
+    const requestedPlan = creationPlan(input.execution_plan, input.layout);
     if (existing) {
-        const existingPlan = existing.execution_plan?.plan_hash;
-        const requestedPlan = input.execution_plan?.plan_hash;
-        const existingPolicy = storedRoomLaunchPolicy(existing.execution_plan?.room_policy);
-        const requestedPolicy = storedRoomLaunchPolicy(input.execution_plan?.room_policy);
-        if (existingPlan !== requestedPlan || JSON.stringify(existingPolicy) !== JSON.stringify(requestedPolicy))
+        // After a Backlog plan edit the current plan differs from the one created; retries compare the original request.
+        if ((existing.creation_plan ?? creationPlan(existing.execution_plan, existing.layout)) !== requestedPlan)
             throw new TaskStateError(`idempotency key '${key}' was already used with a different execution plan`);
-        return existing;
+        return withTaskLock(existing.task_id, () => {
+            const fresh = readTask(existing.task_id);
+            assertNoPendingDeletion(fresh);
+            if (fresh.workspace)
+                ensureWorkspace(fresh.workspace);
+            return fresh;
+        });
     }
+    if (input.layout && (input.execution_plan || input.no_room || input.room_id))
+        throw new TaskStateError('a layout task cannot also use a room template, no-room mode or a room');
     const state = input.start === false ? 'backlog' : 'provisioning';
+    const taskId = generateTaskId();
     const record = {
-        task_id: generateTaskId(),
+        task_id: taskId,
         list_id: input.listId ?? DEFAULT_TASK_LIST_ID,
         title: input.title,
         brief: input.brief,
@@ -148,14 +160,18 @@ export function createTask(input) {
         template: input.template,
         execution_plan: input.execution_plan,
         no_room: input.no_room || undefined,
+        ...(input.layout ? { layout: { name: input.layout.name, run_id: `task-${taskId}`, definition_hash: input.layout.definition_hash } } : {}),
         room_id: input.room_id,
         member_roles: [],
         origin: input.origin,
         idempotency_key: key,
+        creation_plan: requestedPlan,
         created_at: new Date().toISOString(),
         started_at: state === 'provisioning' ? new Date().toISOString() : undefined,
     };
+    record.workspace = planWorkspace('task', record.task_id);
     writeTask(record);
+    ensureWorkspace(record.workspace);
     return readTask(record.task_id);
 }
 export function getTask(id) { return withTaskLock(id, () => readTask(id)); }
@@ -505,7 +521,8 @@ function writeDeletionReceiptForIntent(stored) {
         actor: deletion.actor,
         original_state: stored.state,
         room_id: deletion.room_id,
-        member_count: deletion.members.length,
+        member_count: deletion.members.length + (deletion.archived_absences?.length ?? 0),
+        ...(deletion.archived_absences?.length ? { archived_absences: deletion.archived_absences } : {}),
     };
     replaceFileAtomically(deletionReceiptPath(stored.task_id), JSON.stringify(receipt, null, 2) + '\n');
 }
@@ -525,14 +542,10 @@ export function ensureTaskDeletionReceipt(id) {
             writeDeletionReceiptForIntent(stored);
     });
 }
-/** Record settlement on the receipt; idempotent, tolerant of legacy absence. */
+/** Erase the in-flight receipt; also heals a crash after task unlink. */
 export function completeTaskDeletionReceipt(id) {
-    const receipt = readTaskDeletionReceipt(id);
-    if (!receipt || receipt.settled_at)
-        return;
-    receipt.settled_at = new Date().toISOString();
-    receipt.result = 'deleted';
-    replaceFileAtomically(deletionReceiptPath(id), JSON.stringify(receipt, null, 2) + '\n');
+    assertCanonicalTaskId(id);
+    rmSync(deletionReceiptPath(id), { force: true });
 }
 /**
  * Persist the first-wins durable deletion intent. Accepts every lifecycle
@@ -551,8 +564,10 @@ export function beginTaskDeletionIntent(id, actor) {
             stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
         }
         catch (error) {
-            if (isNotFoundError(error))
+            if (isNotFoundError(error)) {
+                completeTaskDeletionReceipt(id);
                 return { status: 'already_absent' };
+            }
             throw error;
         }
         if (stored.deletion?.status === 'pending') {
@@ -688,10 +703,10 @@ export function upsertTaskDeletionMembersFromSeats(id, seats) {
  *
  * The room saga is trusted for phase jumps, but partial or corrupt retained
  * records must not become false success: every seat must be identity_absent;
- * a real launch requires archive evidence; an identity-less seat is accepted
- * only via the never-launched proof.
+ * a real launch requires archive evidence; an identity-less seat requires
+ * never-launched proof or a freshly verified archived-absence checkpoint.
  */
-export function importTaskDeletionRetirementEvidence(id, seats) {
+export function importTaskDeletionRetirementEvidence(id, seats, proofs = []) {
     return withTaskLock(id, () => {
         assertCanonicalTaskId(id);
         const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
@@ -702,12 +717,29 @@ export function importTaskDeletionRetirementEvidence(id, seats) {
             const evidence = seat.retirement;
             if (evidence?.phase !== 'identity_absent')
                 throw new TaskStateError(`task ${id} deletion cannot checkpoint member '${seat.role_name}' before completed retirement`);
-            const neverLaunched = evidence.launch_id === DELETION_MEMBER_NEVER_LAUNCHED;
+            const neverLaunched = evidence.launch_id === DELETION_MEMBER_NEVER_LAUNCHED
+                || evidence.launch_id === DELETION_MEMBER_ABSENT_VERIFIED || evidence.absence_verified === true;
             if (!neverLaunched && evidence.archive_path === undefined)
                 throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' retirement evidence lacks its archive`);
             if (!seat.identity_cid) {
-                if (neverLaunched)
-                    continue; // provably never held a managed identity
+                if (neverLaunched) {
+                    stored.deletion.absent_members ??= [];
+                    if (!stored.deletion.absent_members.includes(seat.role_name))
+                        stored.deletion.absent_members.push(seat.role_name);
+                    continue;
+                }
+                const proof = proofs.find(value => value.name === seat.role_name);
+                if (proof && proof.launch_id === evidence.launch_id && proof.archive_path === evidence.archive_path
+                    && proof.launch_id === seat.launch?.launch_id && proof.action_id === seat.launch?.action_id) {
+                    const existing = stored.deletion.archived_absences?.find(value => value.name === proof.name);
+                    if (existing && (existing.launch_id !== proof.launch_id || existing.action_id !== proof.action_id
+                        || existing.archive_path !== proof.archive_path))
+                        throw new TaskStateError('Archived absence checkpoint ownership is immutable');
+                    stored.deletion.archived_absences ??= [];
+                    if (!existing)
+                        stored.deletion.archived_absences.push({ ...proof });
+                    continue;
+                }
                 throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' has retirement evidence but no identity CID`);
             }
             let cursor = findCursorForSeat(id, stored, seat);
@@ -729,9 +761,23 @@ export function importTaskDeletionRetirementEvidence(id, seats) {
             cursor.updated_at = now;
         }
         writeTask(stored);
+        writeDeletionReceiptForIntent(stored);
         return presentTaskLenient(stored);
     });
 }
+/** Settlement-only checkpoint, under the task-operation lock after fresh archive verification.
+ * From here retries still verify live absence, but owned archives may be consumed.
+ */
+export function beginTaskWorkspaceCleanup(id) {
+    withTaskLock(id, () => {
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending'
+            || stored.deletion.members.some(member => member.phase !== 'identity_absent'))
+            throw new TaskStateError('Task is not ready for workspace cleanup');
+        stored.deletion.workspace_cleanup_started_at ??= new Date().toISOString();
+        writeTask(stored);
+    });
+}
 /**
  * Physically remove a deletion-pending task record. Settlement-only: callers
  * must have completed member retirement and room cleanup first. Missing
@@ -762,3 +808,87 @@ export function unlinkDeletedTask(id) {
         return true;
     });
 }
+/** Called only after current temp and exact identity absence have been checked. */
+export function settleAbsentTaskDeletionMember(id, name) {
+    withTaskLock(id, () => {
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError('Task is not deleting');
+        const member = stored.deletion.members.find(value => value.name === name);
+        if (!member)
+            throw new TaskStateError('Unknown deletion member');
+        member.phase = 'identity_absent';
+        member.launch_id ??= DELETION_MEMBER_ABSENT_VERIFIED;
+        member.updated_at = new Date().toISOString();
+        writeTask(stored);
+    });
+}
+/** Room-only erasure keeps the parent Task but removes its dead room/member links. */
+export function detachDeletedRoom(taskId, roomId) {
+    withTaskLock(taskId, () => {
+        if (!existsSync(taskPath(taskId)))
+            return;
+        const stored = JSON.parse(readFileSync(taskPath(taskId), 'utf8'));
+        if (stored.room_id !== roomId || stored.deletion?.status === 'pending')
+            return;
+        delete stored.room_id;
+        delete stored.room_identity_cid;
+        stored.member_roles = [];
+        writeTask(stored);
+    });
+}
+/** A completed room may consume its archives while other task members still retire. */
+export function beginTaskArchiveCleanup(id) {
+    withTaskLock(id, () => {
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending')
+            throw new TaskStateError('Task is not deleting');
+        stored.deletion.workspace_cleanup_started_at ??= new Date().toISOString();
+        writeTask(stored);
+    });
+}
+/** Metadata-only edit; compare under the task lock to prevent lost updates. */
+/**
+ * Choose, change or clear a Backlog task's Room Layout before it starts.
+ * `expected` is the layout name the caller saw (null = none); a different
+ * current choice is a stale edit. Choosing a layout drops the sealed room
+ * template plan; the caller releases the returned launch snapshot hash.
+ */
+export function updateTaskLayout(id, expected, next) {
+    return withTaskLock(id, () => {
+        const task = readTask(id);
+        assertNoPendingDeletion(task);
+        assertNoPendingTerminalIntent(task);
+        if (task.state !== 'backlog' || task.room_id)
+            throw new TaskStateError(`task ${id} has started; its room layout is fixed (state '${task.state}')`);
+        const current = task.layout?.name ?? null;
+        // A replay of the same choice is idempotent (and refreshes the pinned source hash).
+        if (current !== expected && current !== (next?.name ?? null))
+            throw new TaskStateError(`task ${id} room layout changed to '${current ?? 'one room'}'; reload before changing it`);
+        const releasedSnapshot = next ? task.execution_plan?.snapshot.launch_snapshot_hash : undefined;
+        if (next) {
+            task.layout = { name: next.name, run_id: `task-${task.task_id}`, definition_hash: next.definition_hash };
+            delete task.execution_plan;
+            delete task.template;
+            delete task.no_room;
+        }
+        else
+            delete task.layout;
+        task.room_plan_changed_at = new Date().toISOString();
+        writeTask(task);
+        return { task: readTask(id), ...(releasedSnapshot ? { releasedSnapshot } : {}) };
+    });
+}
+export function updateTaskBrief(id, brief, expectedBrief) {
+    assertCanonicalTaskId(id);
+    return withTaskLock(id, () => {
+        const task = readTask(id);
+        assertNoPendingDeletion(task);
+        assertNoPendingTerminalIntent(task);
+        if ((task.brief ?? '') !== expectedBrief && task.brief !== brief)
+            throw new TaskStateError('Description changed elsewhere. Reload the task before saving.');
+        task.brief = brief;
+        writeTask(task);
+        return task;
+    });
+}

package/dist/rooms-tasks/types.d.ts

@@ -73,6 +73,13 @@ export interface TaskDeletionMemberCursor {
  * evidence. While pending, the task is hidden from normal operation and every
  * lifecycle mutation or room publication is rejected.
  */
+export interface ArchivedMemberAbsence {
+    name: string;
+    launch_id: string;
+    action_id: string;
+    archive_path: string;
+    checked_at: string;
+}
 export interface TaskDeletionIntent {
     status: 'pending';
     accepted_at: string;
@@ -80,13 +87,25 @@ export interface TaskDeletionIntent {
     room_id?: string;
     /** Snapshot of managed members at acceptance; the missing-room retirement evidence. */
     members: TaskDeletionMemberCursor[];
+    archived_absences?: ArchivedMemberAbsence[];
+    absent_members?: string[];
+    /** Archive proofs were verified before owned workspace cleanup may consume them. */
+    workspace_cleanup_started_at?: string;
     error?: string;
     error_at?: string;
     recovery_hint?: string;
     first_failure?: string;
     first_recovery_hint?: string;
 }
+export interface TaskLayoutLink {
+    name: string;
+    /** Deterministic `task-<task_id>` Room Layout run ID. */
+    run_id: string;
+    /** sha256 of the canonical source layout definition the run must snapshot. */
+    definition_hash: string;
+}
 export interface TaskRecord {
+    workspace?: import('./workspace.js').OwnedWorkspace;
     task_id: string;
     /** Stable organizational list identifier. Missing legacy values mean `default`. */
     list_id: string;
@@ -107,6 +126,12 @@ export interface TaskRecord {
         plan_hash: string;
     };
     no_room?: boolean;
+    /** Multi-room task: rooms and participants come from a Room Layout run. */
+    layout?: TaskLayoutLink;
+    /** Set when the room plan (layout or one-room template) was changed after creation, before start. */
+    room_plan_changed_at?: string;
+    /** Fingerprint of the room plan requested at creation; idempotent retries compare against it after later plan edits. */
+    creation_plan?: string;
     room_id?: string;
     room_identity_cid?: string;
     member_roles: TaskMemberRole[];
@@ -201,6 +226,7 @@ export type RoomHistoryEvidence = {
 };
 export type MemberRetirementPhase = 'stop_requested' | 'liveness_absent' | 'archive_secured' | 'identity_absent';
 export interface MemberRetirement {
+    absence_verified?: boolean;
     phase: MemberRetirementPhase;
     launch_id: string;
     updated_at: string;
@@ -227,12 +253,14 @@ export interface RoomMemberSeat {
     retirement?: MemberRetirement;
 }
 export interface RoomOrchestrationRecord {
+    workspace?: import('./workspace.js').OwnedWorkspace;
     room_id: string;
     room_identity_cid?: string;
     room_name: string;
     goal?: string;
     task_id?: string;
     template_snapshot?: TemplateSnapshot;
+    additional_member_templates?: TemplateSnapshot[];
     /** Resolved once at launch; legacy absence means non-anonymous. */
     room_policy?: RoomLaunchPolicy;
     saga: SagaCursor;

package/dist/rooms-tasks/workspace-artifacts.d.ts

@@ -0,0 +1,6 @@
+import { type OwnedWorkspace } from './workspace.js';
+/** Runtime control state stays in Fleet's live roster and recovery store. Its
+ * durable launch descriptor, not a name prefix or caller-supplied path, proves
+ * artifact ownership. Audit receipts/journals intentionally outlive deletion.
+ */
+export declare function collectWorkspaceArchives(workspace: OwnedWorkspace): void;

package/dist/rooms-tasks/workspace-artifacts.js

@@ -0,0 +1,93 @@
+import { lstatSync, mkdirSync, readdirSync, readFileSync, renameSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { parse } from 'yaml';
+import { stateRoot } from '../paths.js';
+import { assertSafeAncestors, auditWorkspaceGit, validateWorkspace, ensureWorkspace, WorkspaceError } from './workspace.js';
+/** Runtime control state stays in Fleet's live roster and recovery store. Its
+ * durable launch descriptor, not a name prefix or caller-supplied path, proves
+ * artifact ownership. Audit receipts/journals intentionally outlive deletion.
+ */
+export function collectWorkspaceArchives(workspace) {
+    validateWorkspace(workspace);
+    const root = join(stateRoot(), 'recovery', 'temporary');
+    assertSafeAncestors(root);
+    let entries;
+    try {
+        entries = readdirSync(root, { withFileTypes: true });
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return;
+        throw e;
+    }
+    const owned = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            continue;
+        const path = join(root, entry.name);
+        const roleFile = join(path, 'role.yaml');
+        let role;
+        try {
+            const s = lstatSync(roleFile);
+            if (!s.isFile() || s.isSymbolicLink())
+                continue;
+            role = parse(readFileSync(roleFile, 'utf8'));
+        }
+        catch {
+            continue;
+        } // no ownership proof: never adopt a foreign archive
+        const recorded = role?.roomMemberStartup?.workspace;
+        if (recorded?.owner !== workspace.owner || recorded.id !== workspace.id)
+            continue;
+        if (JSON.stringify(recorded) !== JSON.stringify(workspace))
+            throw new WorkspaceError('workspace archive ownership mismatch');
+        assertSafeAncestors(path);
+        const termination = join(path, 'termination.jsonl');
+        if (!lstatSync(termination).isFile() || lstatSync(termination).isSymbolicLink())
+            throw new WorkspaceError('unsafe workspace archive termination evidence');
+        const supervisorPath = join(path, '.temp-supervisor.json');
+        let supervisor;
+        try {
+            if (!lstatSync(supervisorPath).isFile() || lstatSync(supervisorPath).isSymbolicLink())
+                throw new WorkspaceError('unsafe workspace archive supervisor evidence');
+            supervisor = JSON.parse(readFileSync(supervisorPath, 'utf8'));
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        if (supervisor && (supervisor.role !== role.name || !supervisor.launchId))
+            throw new WorkspaceError('workspace archive launch ownership mismatch');
+        const terminated = readFileSync(termination, 'utf8').trim().split('\n').some(line => {
+            const value = JSON.parse(line);
+            return value.version === 1 && value.role === role.name
+                && value.launchId === supervisor?.launchId
+                && ['retired', 'reclaimed', 'failed'].includes(value.outcome);
+        });
+        if (!terminated || entry.name.endsWith('.retiring'))
+            throw new WorkspaceError('workspace archive retirement is incomplete');
+        auditWorkspaceGit(path);
+        owned.push(path);
+    }
+    // Preflight the entire set before mutation; task/room record remains until all succeed.
+    if (!owned.length)
+        return;
+    ensureWorkspace(workspace);
+    const destination = join(workspace.path, '.fleet-retired-agents');
+    assertSafeAncestors(destination);
+    mkdirSync(destination, { recursive: true, mode: 0o700 });
+    for (const path of owned) {
+        const target = join(destination, basename(path));
+        try {
+            lstatSync(target);
+            throw new WorkspaceError('archive collection destination exists');
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        // Atomic transfer before workspace deletion: a crash never loses ownership
+        // evidence halfway through recursively removing a global recovery archive.
+        renameSync(path, target);
+    }
+}

package/dist/rooms-tasks/workspace.d.ts

@@ -0,0 +1,26 @@
+/** Persisted before allocation. Never infer ownership from an Agent's cwd. */
+export interface OwnedWorkspace {
+    version: 1;
+    owner: 'task' | 'room';
+    id: string;
+    path: string;
+    token: string;
+}
+export declare class WorkspaceError extends Error {
+}
+export declare function assertSafeAncestors(path: string): void;
+export declare function planWorkspace(owner: OwnedWorkspace['owner'], id: string): OwnedWorkspace;
+export declare function validateWorkspace(w: OwnedWorkspace, owner?: "task" | "room", id?: string): void;
+/** Atomic directory publication; retry uses the durable token, never adopts another folder. */
+export declare function ensureWorkspace(w: OwnedWorkspace): string;
+/** Audit both directions of Git worktree registration, without executing repository config/hooks.
+ * All registrations and common dirs must be inside this workspace. Removing the complete
+ * workspace then removes their registries atomically with the owned repositories; never prune.
+ */
+export declare function auditWorkspaceGit(path: string): void;
+/** Called only after all managed writers retire, under the owner's lifecycle lock.
+ * The tombstone is derived from the durable unguessable token. A crash during rm
+ * resumes that exact tombstone even if rm already removed its marker.
+ */
+export declare function assertWorkspaceDeletable(w: OwnedWorkspace, owner: OwnedWorkspace['owner'], id: string): void;
+export declare function deleteWorkspace(w: OwnedWorkspace, owner: OwnedWorkspace['owner'], id: string): void;

package/dist/rooms-tasks/workspace.js

@@ -0,0 +1,195 @@
+import { randomUUID } from 'node:crypto';
+import { lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { stateRoot } from '../paths.js';
+const MARKER = '.fleet-workspace.json';
+export class WorkspaceError extends Error {
+}
+function fail(message) { throw new WorkspaceError(`workspace: ${message}`); }
+function stat(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return undefined;
+        throw e;
+    }
+}
+export function assertSafeAncestors(path) {
+    const absolute = resolve(path);
+    let part = absolute;
+    for (;;) {
+        const s = stat(part);
+        if (s && (s.isSymbolicLink() || !s.isDirectory()))
+            fail(`unsafe directory ${part}`);
+        const parent = dirname(part);
+        if (parent === part)
+            break;
+        part = parent;
+    }
+}
+function root(owner) {
+    return resolve(stateRoot(), 'workspaces', owner === 'task' ? 'tasks' : 'rooms');
+}
+export function planWorkspace(owner, id) {
+    if (!/^[a-zA-Z0-9_-]{1,80}$/.test(id))
+        fail('invalid owner ID');
+    return { version: 1, owner, id, path: join(root(owner), id), token: randomUUID() };
+}
+export function validateWorkspace(w, owner = w.owner, id = w.id) {
+    if (w.version !== 1 || !['task', 'room'].includes(w.owner) || w.owner !== owner || w.id !== id
+        || !/^[a-zA-Z0-9_-]{1,80}$/.test(w.id)
+        || !/^[a-f0-9-]{36}$/.test(w.token) || !isAbsolute(w.path)
+        || w.path !== join(root(w.owner), w.id))
+        fail('invalid recorded ownership/path');
+    assertSafeAncestors(dirname(w.path));
+}
+function marked(path, w) {
+    assertSafeAncestors(path);
+    const marker = join(path, MARKER);
+    if (!stat(marker)?.isFile() || stat(marker)?.isSymbolicLink())
+        fail('missing/unsafe ownership marker');
+    const actual = JSON.parse(readFileSync(marker, 'utf8'));
+    if (JSON.stringify(actual) !== JSON.stringify(w))
+        fail('ownership marker mismatch');
+}
+function staging(w, phase) {
+    return join(dirname(w.path), `.${w.id}.${w.token}.${phase}`);
+}
+/** Atomic directory publication; retry uses the durable token, never adopts another folder. */
+export function ensureWorkspace(w) {
+    validateWorkspace(w);
+    if (stat(staging(w, 'deleting')))
+        fail('deletion already started');
+    if (stat(w.path)) {
+        marked(w.path, w);
+        return w.path;
+    }
+    mkdirSync(dirname(w.path), { recursive: true, mode: 0o700 });
+    assertSafeAncestors(dirname(w.path));
+    const stage = staging(w, 'provisioning');
+    if (!stat(stage))
+        mkdirSync(stage, { mode: 0o700 });
+    assertSafeAncestors(stage);
+    if (readdirSync(stage).length === 0)
+        writeFileSync(join(stage, MARKER), JSON.stringify(w), { flag: 'wx', mode: 0o600 });
+    marked(stage, w);
+    try {
+        renameSync(stage, w.path);
+    }
+    catch (error) {
+        // Another allocator may have published this exact durable intent.
+        if (!stat(w.path))
+            throw error;
+        marked(w.path, w);
+    }
+    return w.path;
+}
+function inside(base, path) {
+    const rel = relative(base, path);
+    return rel !== '' && rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+function ownedPointer(base, from, value) {
+    if (!value.trim() || /[\r\n]/.test(value.trim()))
+        fail('malformed git pointer');
+    const target = resolve(from, value.trim());
+    if (!inside(base, target))
+        fail(`foreign git metadata ${target}`);
+    assertSafeAncestors(dirname(target));
+    if (stat(target)?.isSymbolicLink())
+        fail(`symlink git metadata ${target}`);
+    return target;
+}
+/** Audit both directions of Git worktree registration, without executing repository config/hooks.
+ * All registrations and common dirs must be inside this workspace. Removing the complete
+ * workspace then removes their registries atomically with the owned repositories; never prune.
+ */
+export function auditWorkspaceGit(path) {
+    const device = lstatSync(path).dev;
+    const visit = (dir, admin = false) => {
+        admin ||= Boolean(stat(join(dir, 'HEAD')) && (stat(join(dir, 'objects')) || stat(join(dir, 'commondir'))));
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const p = join(dir, entry.name);
+            if (entry.isSymbolicLink()) {
+                if (admin || entry.name === '.git' || entry.name === 'commondir' || entry.name === 'gitdir')
+                    fail(`symlink git metadata ${p}`);
+                continue; // rm unlinks ordinary artifact symlinks, never follows them.
+            }
+            if (entry.isDirectory()) {
+                if (lstatSync(p).dev !== device)
+                    fail(`foreign mounted directory ${p}`);
+                visit(p, admin || entry.name === '.git');
+                continue;
+            }
+            if (!entry.isFile())
+                continue; // sockets/FIFOs in retired runtime state are unlinked, never opened
+            if (entry.name === '.git') {
+                const value = readFileSync(p, 'utf8').trim();
+                if (!value.startsWith('gitdir: '))
+                    fail(`invalid git file ${p}`);
+                const gitdir = ownedPointer(path, dir, value.slice(8));
+                if (!stat(gitdir)?.isDirectory())
+                    fail(`missing git directory ${gitdir}`);
+            }
+            // Git admin files, including bare repositories and submodules.
+            if (entry.name === 'commondir' && (admin || stat(join(dir, 'HEAD')))) {
+                const common = ownedPointer(path, dir, readFileSync(p, 'utf8'));
+                if (!stat(common)?.isDirectory())
+                    fail(`invalid git common directory ${common}`);
+            }
+            if (entry.name === 'gitdir' && (admin || stat(join(dir, 'commondir')))) {
+                const target = ownedPointer(path, dir, readFileSync(p, 'utf8'));
+                if (stat(target) && !stat(target)?.isFile())
+                    fail(`invalid worktree backlink ${target}`);
+            }
+        }
+    };
+    visit(path);
+}
+/** Called only after all managed writers retire, under the owner's lifecycle lock.
+ * The tombstone is derived from the durable unguessable token. A crash during rm
+ * resumes that exact tombstone even if rm already removed its marker.
+ */
+export function assertWorkspaceDeletable(w, owner, id) {
+    validateWorkspace(w, owner, id);
+    if (stat(w.path)) {
+        if (stat(staging(w, 'deleting')))
+            fail('both live and deleting workspace exist');
+        marked(w.path, w);
+        auditWorkspaceGit(w.path);
+    }
+    const pending = staging(w, 'provisioning');
+    if (stat(pending)) {
+        assertSafeAncestors(pending);
+        if (readdirSync(pending).length)
+            marked(pending, w);
+        if (readdirSync(pending).some(name => name !== MARKER))
+            fail('unexpected provisioning artifacts');
+    }
+    if (stat(staging(w, 'deleting')))
+        assertSafeAncestors(staging(w, 'deleting'));
+}
+export function deleteWorkspace(w, owner, id) {
+    assertWorkspaceDeletable(w, owner, id);
+    const tomb = staging(w, 'deleting');
+    const pending = staging(w, 'provisioning');
+    if (stat(w.path)) {
+        if (stat(tomb))
+            fail('both live and deleting workspace exist');
+        marked(w.path, w);
+        auditWorkspaceGit(w.path);
+        renameSync(w.path, tomb);
+    }
+    if (stat(pending)) {
+        if (readdirSync(pending).length)
+            marked(pending, w);
+        if (readdirSync(pending).some(name => name !== MARKER))
+            fail('unexpected provisioning artifacts');
+        rmSync(pending, { recursive: true });
+    }
+    if (stat(tomb)) {
+        assertSafeAncestors(tomb);
+        rmSync(tomb, { recursive: true });
+    }
+}