@ours.network/fleet 1.2.0-nightly.5 → 1.2.0-nightly.50

package/dist/rooms-tasks/member-startup.js

@@ -7,6 +7,8 @@ export function buildRoomMemberTask(input) {
         `Fleet Task ${input.taskId ?? '(standalone)'} — ${member.cowork_role} in room ${input.roomId}`,
         '',
     ];
+    if (input.workspace)
+        lines.push(`Task-owned workspace: ${input.workspace}`, 'Start and keep all execution artifacts, dependency checkouts, and Git worktrees inside this workspace.', 'Clone repositories inside this workspace before adding worktrees; never attach to an external Git common directory.', 'Use distinct per-agent branches/directories for concurrent edits. Configured cwd is source context, not artifact ownership.', 'Completion, cancellation and room retirement retain artifacts. Only explicit owner deletion removes them.', 'Do not delete the workspace or its ownership marker yourself.', '');
     if (input.goal)
         lines.push(`Goal: ${input.goal}`);
     if (input.brief)

package/dist/rooms-tasks/provision.d.ts

@@ -3,6 +3,7 @@ import type { RoomOrchestrationRecord, TemplateSnapshot } from './types.js';
 import { type FleetConfig } from '../config.js';
 export declare function getBinPath(): string;
 export interface ProvisionMembersInput {
+    configPath?: string;
     cfg: FleetConfig;
     cowork: CoworkAdapter;
     roomId: string;
@@ -12,6 +13,8 @@ export interface ProvisionMembersInput {
     brief?: string;
     goal?: string;
     startupWait?: Partial<StartupWaitPolicy>;
+    /** Append only the supplied new slots to an already active room. */
+    append?: boolean;
 }
 export interface StartupWaitPolicy {
     timeoutMs: number;
@@ -21,6 +24,17 @@ export interface StartupWaitPolicy {
     sleep(ms: number): Promise<void>;
 }
 export declare function provisionMembers(input: ProvisionMembersInput): Promise<RoomOrchestrationRecord>;
+/** Reconcile proven, admitted launches without any spawn, archive, invite or recovery path. */
+export declare function reconcileExistingTaskMembers(input: {
+    taskId: string;
+    checkOnly?: boolean;
+    cowork: Pick<CoworkAdapter, 'getRoom'>;
+    expectedLaunches: ReadonlyArray<{
+        role_name: string;
+        launch_id: string;
+        identity_cid: string;
+    }>;
+}): Promise<RoomOrchestrationRecord>;
 export declare function cleanupMembers(input: {
     roomId: string;
     taskId?: string;

package/dist/rooms-tasks/provision.js

@@ -1,4 +1,5 @@
 import { readRoomReadiness } from '../agent-ours/service.js';
+import { ensureWorkspace, validateWorkspace } from './workspace.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { join } from 'node:path';
@@ -14,7 +15,7 @@ import { readLaunchSnapshot, redactLaunchDefinition } from './launch-snapshot.js
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from '../fleet-proxy.js';
 import { controlRequest } from '../session/control.js';
 import { SessionControlError } from '../session/types.js';
-import { closeManagedRoom } from './close.js';
+import { closeManagedRoom, roomCloseLockPath, CLOSE_LOCK_STALE_MS } from './close.js';
 import { withFileLock } from '../atomic-file.js';
 import { TASK_OPERATION_LOCK_STALE_MS, taskOperationLockPath } from './terminal.js';
 import { TaskStateError, taskDeletionState } from './task-state.js';
@@ -116,6 +117,7 @@ function settingsFor(member, cfg, sealed) {
 }
 function roomTask(input, member, settings, members, roomIdentityCid, ownerSeatCid, anonymous) {
     return buildRoomMemberTask({
+        workspace: getRoomRecord(input.roomId)?.workspace?.path,
         taskId: input.taskId,
         roomId: input.roomId,
         roomIdentityCid,
@@ -129,7 +131,7 @@ function roomTask(input, member, settings, members, roomIdentityCid, ownerSeatCi
             cowork_role: member.coworkRole,
             persona: settings.persona,
         },
-        roster: members.map(candidate => ({
+        roster: [...(input.append ? (getRoomRecord(input.roomId)?.member_seats ?? []).filter(seat => !members.some(m => m.name === seat.role_name)).map(seat => ({ name: seat.role_name, coworkRole: seat.cowork_role })) : []), ...members].map(candidate => ({
             role_name: candidate.name,
             cowork_role: candidate.coworkRole,
         })),
@@ -142,6 +144,10 @@ function launchMatches(dir, member, actionId, taskSha, roomId, roomIdentityCid,
     try {
         const role = parse(readFileSync(`${dir}/role.yaml`, 'utf8'));
         const startup = role.roomMemberStartup;
+        const workspace = getRoomRecord(roomId)?.workspace;
+        if (workspace && (role.cwd !== workspace.path
+            || JSON.stringify(startup?.workspace) !== JSON.stringify(workspace)))
+            return false;
         return role.identity === member.name
             && startup?.room_id === roomId
             && startup.room_identity_cid === roomIdentityCid
@@ -234,25 +240,9 @@ async function retainRunningLaunch(input) {
     }
     return false;
 }
-/**
- * Member-launch publication window: for a task-bound room, the durable launch
- * intent, spawn, and launch record publish under the common task-operation
- * lock so an accepted deletion linearizes strictly before (bounded abort — no
- * spawn happens) or strictly after (the seat's launch record is visible to
- * deletion retirement). The lock is held per member only, never across
- * seat-wait loops.
- */
 async function launchMember(input) {
-    const taskId = input.provision.taskId;
-    if (!taskId)
-        return launchMemberUnlocked(input);
-    return withFileLock(taskOperationLockPath(taskId), () => {
-        if (taskDeletionState(taskId) !== 'none')
-            throw new Error(`task ${taskId} is pending deletion; aborting member launch for ${input.member.name}`);
-        return launchMemberUnlocked(input);
-    }, {}, TASK_OPERATION_LOCK_STALE_MS);
-}
-async function launchMemberUnlocked(input) {
+    // provisionMembers holds the task and room lifecycle locks through every launch.
+    assertProvisioningOpen(input.provision);
     const { provision, member, settings, startup } = input;
     const seat = getRoomRecord(provision.roomId).member_seats
         .find(candidate => candidate.role_name === member.name);
@@ -274,6 +264,7 @@ async function launchMemberUnlocked(input) {
     try {
         const launched = await spawnRoomMember({
             name: member.name,
+            configPath: provision.configPath,
             temp: true,
             identity: member.name,
             agentDefinition: settings.definition,
@@ -345,6 +336,8 @@ function reconcileMemberSeats(roomId, members, observed, ownerSeatCid) {
         && seat.seat_state === 'active');
     const seats = current.member_seats.map(seat => {
         const member = members.find(candidate => candidate.name === seat.role_name);
+        if (!member)
+            return seat;
         const readiness = readRoomReadiness(current.room_identity_cid, member.name);
         if (!readiness || readiness.room !== roomId || readiness.invite !== seat.invite_id) {
             complete = false;
@@ -371,9 +364,41 @@ function assertCoworkRoomPolicy(room, expectedAnonymous) {
     if ((room.anonymous ?? false) !== expectedAnonymous)
         throw new Error(`Cowork anonymity (${String(room.anonymous ?? false)}) does not match Fleet's durable Room policy (${String(expectedAnonymous)})`);
 }
+function assertProvisioningOpen(input) {
+    if (input.taskId && getTask(input.taskId).terminal_intent)
+        throw new Error(`task ${input.taskId} has an accepted terminal intent; refusing to provision members`);
+    const room = getRoomRecord(input.roomId);
+    if (room?.state === 'closing' || room?.state === 'closed')
+        throw new Error(`room ${input.roomId} is ${room.state}; refusing to provision members`);
+}
 export async function provisionMembers(input) {
+    // Same lock order as terminal/deletion settlement. Serialize concurrent retries
+    // and standalone retirement as well as member publication. Seat waits are bounded.
+    const run = () => withFileLock(roomCloseLockPath(input.roomId), () => {
+        assertProvisioningOpen(input);
+        if (input.append) {
+            const task = input.taskId ? getTask(input.taskId) : undefined;
+            const room = getRoomRecord(input.roomId);
+            if (!task || !['active', 'review'].includes(task.state) || room?.state !== 'active'
+                || room.task_id !== task.task_id || room.room_identity_cid !== task.room_identity_cid)
+                throw new Error('Adding an agent requires the exact active task room');
+            const names = expandMembers(input.template, shortId(task.task_id)).map(m => m.name);
+            if (room.member_seats.some(seat => names.includes(seat.role_name)))
+                throw new Error('Member slot is already recorded; inspect its existing launch');
+            if (room.member_seats.some(seat => seat.seat_state !== 'active'))
+                throw new Error('Existing member admission must finish before adding an agent');
+        }
+        if (!getRoomRecord(input.roomId))
+            throw new Error(`room ${input.roomId} is missing; refusing provisioning`);
+        return provisionMembersUnlocked(input);
+    }, {}, CLOSE_LOCK_STALE_MS);
+    return input.taskId
+        ? withFileLock(taskOperationLockPath(input.taskId), run, {}, TASK_OPERATION_LOCK_STALE_MS)
+        : run();
+}
+async function provisionMembersUnlocked(input) {
     const { cfg, cowork, roomId, taskId, template } = input;
-    // Deletion-epoch pre-check; each member launch re-checks under the lock.
+    // The common task-operation lock protects this epoch through all member launches.
     if (taskId && taskDeletionState(taskId) !== 'none')
         throw new Error(`task ${taskId} is pending deletion; refusing to provision members`);
     const prefix = taskId ? shortId(taskId) : `room-${shortId(roomId)}`;
@@ -385,6 +410,12 @@ export async function provisionMembers(input) {
     const existing = getRoomRecord(roomId);
     if (!existing?.room_identity_cid)
         throw new Error(`room ${roomId} has no pinned room identity CID`);
+    if (existing.workspace) {
+        validateWorkspace(existing.workspace, taskId ? 'task' : 'room', taskId ?? roomId);
+        ensureWorkspace(existing.workspace);
+        for (const setting of settings.values())
+            setting.definition.cwd = existing.workspace.path;
+    }
     const roomIdentityCid = existing.room_identity_cid;
     const ownerSeatCid = existing.owner_seat_cid ?? null;
     const roomPolicy = storedRoomLaunchPolicy(existing.room_policy);
@@ -392,22 +423,23 @@ export async function provisionMembers(input) {
     const resuming = members.length > 0
         && members.every(member => persistedNames.has(member.name));
     if (!resuming) {
-        advanceSaga(roomId, 'create_members', 3);
-        updateMemberSeats(roomId, members.map(member => {
-            const memberSettings = settings.get(member.name);
-            const evidence = launchDefinition(memberSettings.definition);
-            return ({
-                role_name: member.name,
-                slot: member.slot,
-                cowork_role: member.coworkRole,
-                seat_state: 'pending',
-                launch: { state: 'pending', attempt: 0,
-                    agent_definition: evidence.projection, agent_fingerprint: evidence.fingerprint,
-                    agent_template: memberSettings.template,
-                    agent_template_hash: memberSettings.templateHash,
-                    updated_at: new Date().toISOString() },
-            });
-        }));
+        if (!input.append)
+            advanceSaga(roomId, 'create_members', 3);
+        updateMemberSeats(roomId, [...(input.append ? existing.member_seats : []), ...members.map(member => {
+                const memberSettings = settings.get(member.name);
+                const evidence = launchDefinition(memberSettings.definition);
+                return ({
+                    role_name: member.name,
+                    slot: member.slot,
+                    cowork_role: member.coworkRole,
+                    seat_state: 'pending',
+                    launch: { state: 'pending', attempt: 0,
+                        agent_definition: evidence.projection, agent_fingerprint: evidence.fingerprint,
+                        agent_template: memberSettings.template,
+                        agent_template_hash: memberSettings.templateHash,
+                        updated_at: new Date().toISOString() },
+                });
+            })], input.append ? template : undefined);
     }
     else {
         for (const member of members) {
@@ -425,7 +457,8 @@ export async function provisionMembers(input) {
         now: input.startupWait?.now ?? Date.now,
         sleep: input.startupWait?.sleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms))),
     };
-    advanceSaga(roomId, 'join_role_groups', 4);
+    if (!input.append)
+        advanceSaga(roomId, 'join_role_groups', 4);
     try {
         const initialRoom = await cowork.recoverRoom(roomId);
         assertCoworkRoomPolicy(initialRoom, roomPolicy.anonymous);
@@ -446,17 +479,31 @@ export async function provisionMembers(input) {
                 provision: input, member, settings: settings.get(member.name), task, roomIdentityCid,
             }))
                 continue;
+            // A previous failed launch keeps its invite pointer durably. Never
+            // overwrite that requirement until the supported revoke has succeeded;
+            // a transport failure must fence subsequent invite issuance too.
+            if (currentSeat.invite_id) {
+                const observed = await cowork.getRoom(roomId);
+                if (!observed || observed.identity_cid !== roomIdentityCid)
+                    throw new Error('cannot verify room before failed-attempt invite cleanup');
+                if (observed.seats.some(seat => seat.invite_id === currentSeat.invite_id
+                    && seat.seat_state !== 'removed'))
+                    throw new Error('failed-attempt invite has an admitted seat; reconcile before replacing the member');
+                await cowork.revokeInvite(roomId, currentSeat.invite_id);
+            }
             const issued = await cowork.issueInvite(roomId, {
                 mode: 'one_time', role: member.coworkRole, min_accepts: 1,
             });
-            const seats = getRoomRecord(roomId).member_seats.map(seat => seat.role_name === member.name ? { ...seat, invite_id: issued.invite_id } : seat);
-            updateMemberSeats(roomId, seats);
             try {
+                assertProvisioningOpen(input);
+                const seats = getRoomRecord(roomId).member_seats.map(seat => seat.role_name === member.name ? { ...seat, invite_id: issued.invite_id } : seat);
+                updateMemberSeats(roomId, seats);
                 await launchMember({
                     provision: input,
                     member,
                     settings: settings.get(member.name),
                     startup: {
+                        workspace: existing.workspace,
                         room_id: roomId,
                         room_identity_cid: roomIdentityCid,
                         identity_name: member.name,
@@ -470,7 +517,12 @@ export async function provisionMembers(input) {
                 });
             }
             catch (error) {
-                await cowork.revokeInvite(roomId, issued.invite_id).catch(() => { });
+                try {
+                    await cowork.revokeInvite(roomId, issued.invite_id);
+                }
+                catch (cleanupError) {
+                    throw new AggregateError([error, cleanupError], 'member launch failed and invite cleanup is unresolved; retry must revoke the retained requirement first');
+                }
                 throw error;
             }
         }
@@ -491,20 +543,23 @@ export async function provisionMembers(input) {
         }
         throw error;
     }
-    advanceSaga(roomId, 'wait_seats', 5);
+    if (!input.append)
+        advanceSaga(roomId, 'wait_seats', 5);
     const deadline = policy.now() + policy.timeoutMs;
     let delay = policy.initialDelayMs;
     for (;;) {
         const remote = await cowork.recoverRoom(roomId);
         assertCoworkRoomPolicy(remote, roomPolicy.anonymous);
         const reconciled = reconcileMemberSeats(roomId, members, remote.seats, ownerSeatCid ?? undefined);
-        if (reconciled.complete)
+        if (reconciled.complete && remote.state === 'active')
             break;
         if (policy.now() >= deadline) {
-            advanceSaga(roomId, 'wait_seats', 5, 'waiting_seats');
+            if (!input.append)
+                advanceSaga(roomId, 'wait_seats', 5, 'waiting_seats');
             return getRoomRecord(roomId);
         }
-        advanceSaga(roomId, 'wait_seats', 5, 'waiting_seats');
+        if (!input.append)
+            advanceSaga(roomId, 'wait_seats', 5, 'waiting_seats');
         await policy.sleep(delay);
         delay = Math.min(policy.maxDelayMs, Math.max(delay + 1, delay * 2));
     }
@@ -529,15 +584,87 @@ export async function provisionMembers(input) {
             };
         });
         updateTaskMembers(taskId, taskMembers);
-        if (getTask(taskId).blocked)
+        if (!input.append && getTask(taskId).blocked)
             unblockTask(taskId);
     }
+    if (input.append)
+        return getRoomRecord(roomId);
     advanceSaga(roomId, 'activate', 6);
     const record = activateRoom(roomId);
     if (taskId)
         activateTask(taskId);
     return record;
 }
+/** Reconcile proven, admitted launches without any spawn, archive, invite or recovery path. */
+export async function reconcileExistingTaskMembers(input) {
+    return withFileLock(taskOperationLockPath(input.taskId), async () => {
+        const task = getTask(input.taskId);
+        if (!['provisioning', 'active'].includes(task.state) || task.terminal_intent || taskDeletionState(input.taskId) !== 'none'
+            || !task.room_id)
+            throw new Error('task is not open for existing-member reconciliation');
+        const roomId = task.room_id;
+        return withFileLock(roomCloseLockPath(roomId), async () => {
+            const current = getRoomRecord(roomId);
+            if (!current || !['provisioning', 'active'].includes(current.state) || current.close
+                || current.task_id !== input.taskId || !current.room_identity_cid
+                || task.room_identity_cid !== current.room_identity_cid)
+                throw new Error('room is not open for existing-member reconciliation');
+            const names = new Set(input.expectedLaunches.map(seat => seat.role_name));
+            if (!names.size || names.size !== input.expectedLaunches.length
+                || current.member_seats.length !== names.size
+                || current.member_seats.some(seat => !names.has(seat.role_name)))
+                throw new Error('expected launch roster does not match the persisted room');
+            const remote = await input.cowork.getRoom(roomId);
+            if (!remote || remote.room_id !== roomId || remote.identity_cid !== current.room_identity_cid
+                || remote.state !== 'active')
+                throw new Error('Cowork room is not the exact active room');
+            assertCoworkRoomPolicy(remote, storedRoomLaunchPolicy(current.room_policy).anonymous);
+            if (current.owner_seat_cid && !remote.seats.some(seat => seat.identity_cid.toLowerCase() === current.owner_seat_cid.toLowerCase() && seat.seat_state === 'active'))
+                throw new Error('expected Owner seat is not active');
+            const seats = [];
+            for (const seat of current.member_seats) {
+                const expected = input.expectedLaunches.find(item => item.role_name === seat.role_name);
+                const launch = seat.launch;
+                if (seat.seat_state === 'removed' || !seat.invite_id || launch?.state !== 'launched'
+                    || launch.launch_id !== expected.launch_id || !launch.action_id || !launch.mission_sha256
+                    || (seat.identity_cid && seat.identity_cid !== expected.identity_cid))
+                    throw new Error('persisted member launch does not match reconciliation evidence');
+                const dir = agentDir(seat.role_name, true);
+                if (!launchMatches(dir, { name: seat.role_name, coworkRole: seat.cowork_role }, launch.action_id, launch.mission_sha256, roomId, current.room_identity_cid, seat.invite_id, storedRoomLaunchPolicy(current.room_policy).anonymous))
+                    throw new Error('member startup provenance mismatch');
+                const supervisor = readTempSupervisor(dir);
+                if (!supervisor || supervisor.role !== seat.role_name || supervisor.launchId !== expected.launch_id
+                    || await tempSupervisorLiveness(dir) !== 'running')
+                    throw new Error('expected member supervisor is not running');
+                const ready = readRoomReadiness(current.room_identity_cid, seat.role_name);
+                const matches = remote.seats.filter(item => item.display_name === seat.role_name
+                    && item.seat_state !== 'removed');
+                const found = matches[0];
+                if (!ready || ready.room !== roomId || ready.invite !== seat.invite_id
+                    || ready.cid !== expected.identity_cid || matches.length !== 1 || !found
+                    || found.identity_cid !== expected.identity_cid || found.role !== seat.cowork_role
+                    || found.seat_state !== 'active' || found.invite_id !== seat.invite_id)
+                    throw new Error('member readiness or authenticated Cowork seat mismatch');
+                seats.push({ ...seat, identity_cid: expected.identity_cid, seat_state: 'active' });
+            }
+            if (input.checkOnly)
+                return current;
+            // No mutation until the complete roster has passed; these writes are replayable
+            // under the same task/room lifecycle locks if interrupted between files.
+            updateMemberSeats(roomId, seats);
+            updateTaskMembers(input.taskId, seats.map(seat => ({ name: seat.role_name,
+                identity_cid: seat.identity_cid, slot: seat.slot, cowork_role: seat.cowork_role })));
+            if (getTask(input.taskId).blocked)
+                unblockTask(input.taskId);
+            if (current.state !== 'active')
+                advanceSaga(roomId, 'activate', 6);
+            const activated = current.state === 'active' ? getRoomRecord(roomId) : activateRoom(roomId);
+            if (task.state !== 'active')
+                activateTask(input.taskId);
+            return activated;
+        }, {}, TASK_OPERATION_LOCK_STALE_MS);
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+}
 export async function cleanupMembers(input) {
     const room = getRoomRecord(input.roomId);
     if (!room)

package/dist/rooms-tasks/room-state.d.ts

@@ -22,7 +22,7 @@ export declare function advanceSaga(id: string, phase: SagaPhase, stepIndex?: nu
 export declare function setSagaError(id: string, error: string, hint?: string, detail?: ProvisioningDetail): RoomOrchestrationRecord;
 export declare function setRoomIdentity(id: string, roomIdentityCid: string): RoomOrchestrationRecord;
 export declare function setOwnerSeat(id: string, ownerSeatCid: string, inviteFingerprint: string): RoomOrchestrationRecord;
-export declare function updateMemberSeats(id: string, seats: RoomMemberSeat[]): RoomOrchestrationRecord;
+export declare function updateMemberSeats(id: string, seats: RoomMemberSeat[], additionalTemplate?: import('./types.js').TemplateSnapshot): RoomOrchestrationRecord;
 export declare function updateRoomRoleBriefing(id: string, role: string, definition: RoomRoleBriefingDefinition): RoomOrchestrationRecord;
 export declare function updateRoomHistoryCursor(id: string, cursor: number): RoomOrchestrationRecord;
 export declare function updateMemberStartup(id: string, roleName: string, update: {
@@ -31,6 +31,8 @@ export declare function updateMemberStartup(id: string, roleName: string, update
 export declare function activateRoom(id: string): RoomOrchestrationRecord;
 export declare function closeRoom(id: string): RoomOrchestrationRecord;
 export declare function beginRoomClose(id: string): RoomOrchestrationRecord;
-export declare function advanceMemberRetirement(id: string, roleName: string, phase: MemberRetirementPhase, launchId: string, archivePath?: string): RoomOrchestrationRecord;
+export declare function advanceMemberRetirement(id: string, roleName: string, phase: MemberRetirementPhase, launchId: string, archivePath?: string, absenceVerified?: boolean): RoomOrchestrationRecord;
 export declare function advanceRoomClose(id: string, phase: RoomClosePhase): RoomOrchestrationRecord;
 export declare function setRoomCloseError(id: string, error: string, recoveryHint: string): RoomOrchestrationRecord;
+/** Settlement-only binding recovery; never publishes a seat or changes a launch. */
+export declare function recordRetirementMemberCids(id: string, recovered: ReadonlyArray<RoomMemberSeat>): RoomOrchestrationRecord;

package/dist/rooms-tasks/room-state.js

@@ -2,17 +2,28 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from 'node:f
 import { join } from 'node:path';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
+import { planWorkspace, ensureWorkspace } from './workspace.js';
+import { getTask } from './task-state.js';
 import { storedRoomLaunchPolicy } from './types.js';
 import { releaseLaunchSnapshot } from './launch-snapshot.js';
 export const roomsDir = () => join(stateRoot(), 'rooms');
-function roomPath(id) { return join(roomsDir(), `${id}.json`); }
+function roomPath(id) {
+    if (!/^[a-zA-Z0-9_-]{1,120}$/.test(id))
+        throw new RoomStateError('Invalid room ID');
+    return join(roomsDir(), `${id}.json`);
+}
 export class RoomStateError extends Error {
 }
 function readRoom(id) {
     const p = roomPath(id);
-    if (!existsSync(p))
-        throw new RoomStateError(`room not found: ${id}`);
-    return JSON.parse(readFileSync(p, 'utf8'));
+    try {
+        return JSON.parse(readFileSync(p, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            throw new RoomStateError(`room not found: ${id}`);
+        throw error;
+    }
 }
 function writeRoom(record) {
     mkdirSync(roomsDir(), { recursive: true });
@@ -25,6 +36,8 @@ export function createRoomRecord(input) {
         const requested = storedRoomLaunchPolicy(input.room_policy);
         if (JSON.stringify(before) !== JSON.stringify(requested))
             throw new RoomStateError(`room ${input.room_id} launch policy mismatch`);
+        if (existing.workspace)
+            ensureWorkspace(existing.workspace);
         return existing;
     }
     const record = {
@@ -40,15 +53,20 @@ export function createRoomRecord(input) {
         state: 'provisioning',
         created_at: new Date().toISOString(),
     };
+    record.workspace = input.task_id ? getTask(input.task_id).workspace : planWorkspace('room', input.room_id);
     writeRoom(record);
+    if (record.workspace)
+        ensureWorkspace(record.workspace);
     return record;
 }
 export function getRoomRecord(id) {
     try {
         return readRoom(id);
     }
-    catch {
-        return undefined;
+    catch (error) {
+        if (error instanceof RoomStateError && error.message === `room not found: ${id}`)
+            return undefined;
+        throw error;
     }
 }
 /** Remove a terminal orchestration record from the live room inventory. */
@@ -110,9 +128,13 @@ export function setOwnerSeat(id, ownerSeatCid, inviteFingerprint) {
     writeRoom(r);
     return r;
 }
-export function updateMemberSeats(id, seats) {
+export function updateMemberSeats(id, seats, additionalTemplate) {
     const r = readRoom(id);
+    if (r.state === 'closing' || r.state === 'closed')
+        throw new RoomStateError(`room ${id} is ${r.state}; member provisioning is fenced`);
     r.member_seats = seats;
+    if (additionalTemplate)
+        r.additional_member_templates = [...(r.additional_member_templates ?? []), additionalTemplate];
     writeRoom(r);
     return r;
 }
@@ -135,6 +157,8 @@ const LAUNCH_ORDER = [
 ];
 export function updateMemberStartup(id, roleName, update) {
     const r = readRoom(id);
+    if (r.state === 'closing' || r.state === 'closed')
+        throw new RoomStateError(`room ${id} is ${r.state}; member provisioning is fenced`);
     const seat = r.member_seats.find(candidate => candidate.role_name === roleName);
     if (!seat)
         throw new RoomStateError(`room ${id} has no recorded member ${roleName}`);
@@ -151,6 +175,8 @@ export function updateMemberStartup(id, roleName, update) {
 }
 export function activateRoom(id) {
     const r = readRoom(id);
+    if (r.state === 'closing' || r.state === 'closed')
+        throw new RoomStateError(`room ${id} is ${r.state}; activation is fenced`);
     r.state = 'active';
     r.saga = { phase: 'completed', step_index: 0 };
     delete r.provisioning_detail;
@@ -198,7 +224,7 @@ export function beginRoomClose(id) {
 const RETIREMENT_ORDER = [
     'stop_requested', 'liveness_absent', 'archive_secured', 'identity_absent',
 ];
-export function advanceMemberRetirement(id, roleName, phase, launchId, archivePath) {
+export function advanceMemberRetirement(id, roleName, phase, launchId, archivePath, absenceVerified = false) {
     const r = readRoom(id);
     if (r.state !== 'closing')
         throw new RoomStateError(`room ${id} is not closing`);
@@ -215,6 +241,7 @@ export function advanceMemberRetirement(id, roleName, phase, launchId, archivePa
         throw new RoomStateError(`room ${id} member ${roleName} retirement cannot move backward to ${phase}`);
     }
     seat.retirement = {
+        ...(absenceVerified || previous?.absence_verified ? { absence_verified: true } : {}),
         phase,
         launch_id: launchId,
         updated_at: new Date().toISOString(),
@@ -267,3 +294,21 @@ export function setRoomCloseError(id, error, recoveryHint) {
     writeRoom(r);
     return r;
 }
+/** Settlement-only binding recovery; never publishes a seat or changes a launch. */
+export function recordRetirementMemberCids(id, recovered) {
+    const room = readRoom(id);
+    if (room.state !== 'closing')
+        throw new RoomStateError('Room is not closing');
+    for (const proof of recovered) {
+        const seat = room.member_seats.find(value => value.role_name === proof.role_name);
+        if (!seat || seat.launch?.action_id !== proof.launch?.action_id || seat.invite_id !== proof.invite_id)
+            throw new RoomStateError('Member changed during identity recovery');
+        if (!proof.identity_cid)
+            continue;
+        if (seat.identity_cid && seat.identity_cid.toLowerCase() !== proof.identity_cid.toLowerCase())
+            throw new RoomStateError('Member identity changed during recovery');
+        seat.identity_cid = proof.identity_cid;
+    }
+    writeRoom(room);
+    return room;
+}

package/dist/rooms-tasks/task-state.d.ts

@@ -1,3 +1,4 @@
+import type { ArchivedMemberAbsence } from './types.js';
 import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase } from './types.js';
 export declare const tasksDir: () => string;
 export declare class TaskStateError extends Error {
@@ -17,6 +18,10 @@ export interface CreateTaskInput {
     idempotency_key?: string;
     start?: boolean;
     no_room?: boolean;
+    layout?: {
+        name: string;
+        definition_hash: string;
+    };
     room_id?: string;
     listId?: string;
 }
@@ -61,9 +66,8 @@ export declare function getDeletingTask(id: string): TaskRecord;
 export declare function taskDeletionState(id: string): 'none' | 'pending' | 'absent';
 /**
  * Durable, surface-independent audit evidence for a permanent deletion. The
- * receipt outlives the task record: written with the acceptance intent, and
- * completed before settlement is reported. Metadata only — never brief or
- * room content.
+ * receipt supports in-flight recovery only: written with acceptance intent,
+ * then erased before settlement is reported. It may contain a bounded title.
  */
 export interface TaskDeletionReceipt {
     schema_version: 1;
@@ -74,6 +78,7 @@ export interface TaskDeletionReceipt {
     original_state: TaskState;
     room_id?: string;
     member_count: number;
+    archived_absences?: ArchivedMemberAbsence[];
     settled_at?: string;
     result?: 'deleted';
 }
@@ -86,7 +91,7 @@ export declare function readTaskDeletionReceipt(id: string): TaskDeletionReceipt
  * settlement rather than deleting resources without audit evidence.
  */
 export declare function ensureTaskDeletionReceipt(id: string): void;
-/** Record settlement on the receipt; idempotent, tolerant of legacy absence. */
+/** Erase the in-flight receipt; also heals a crash after task unlink. */
 export declare function completeTaskDeletionReceipt(id: string): void;
 export type TaskDeletionAcceptance = {
     status: 'accepted' | 'pending';
@@ -122,7 +127,12 @@ export declare function advanceTaskDeletionMember(id: string, name: string, phas
 interface SeatEvidence {
     role_name: string;
     identity_cid?: string;
+    launch?: {
+        launch_id?: string;
+        action_id?: string;
+    };
     retirement?: {
+        absence_verified?: boolean;
         phase: TaskDeletionMemberPhase;
         launch_id: string;
         archive_path?: string;
@@ -146,14 +156,39 @@ export declare function upsertTaskDeletionMembersFromSeats(id: string, seats: Re
  *
  * The room saga is trusted for phase jumps, but partial or corrupt retained
  * records must not become false success: every seat must be identity_absent;
- * a real launch requires archive evidence; an identity-less seat is accepted
- * only via the never-launched proof.
+ * a real launch requires archive evidence; an identity-less seat requires
+ * never-launched proof or a freshly verified archived-absence checkpoint.
  */
-export declare function importTaskDeletionRetirementEvidence(id: string, seats: ReadonlyArray<SeatEvidence>): TaskRecord;
+export declare function importTaskDeletionRetirementEvidence(id: string, seats: ReadonlyArray<SeatEvidence>, proofs?: ReadonlyArray<ArchivedMemberAbsence>): TaskRecord;
+/** Settlement-only checkpoint, under the task-operation lock after fresh archive verification.
+ * From here retries still verify live absence, but owned archives may be consumed.
+ */
+export declare function beginTaskWorkspaceCleanup(id: string): void;
 /**
  * Physically remove a deletion-pending task record. Settlement-only: callers
  * must have completed member retirement and room cleanup first. Missing
  * records are the idempotent already-settled outcome.
  */
 export declare function unlinkDeletedTask(id: string): boolean;
+/** Called only after current temp and exact identity absence have been checked. */
+export declare function settleAbsentTaskDeletionMember(id: string, name: string): void;
+/** Room-only erasure keeps the parent Task but removes its dead room/member links. */
+export declare function detachDeletedRoom(taskId: string, roomId: string): void;
+/** A completed room may consume its archives while other task members still retire. */
+export declare function beginTaskArchiveCleanup(id: string): void;
+/** Metadata-only edit; compare under the task lock to prevent lost updates. */
+/**
+ * Choose, change or clear a Backlog task's Room Layout before it starts.
+ * `expected` is the layout name the caller saw (null = none); a different
+ * current choice is a stale edit. Choosing a layout drops the sealed room
+ * template plan; the caller releases the returned launch snapshot hash.
+ */
+export declare function updateTaskLayout(id: string, expected: string | null, next: {
+    name: string;
+    definition_hash: string;
+} | null): {
+    task: TaskRecord;
+    releasedSnapshot?: string;
+};
+export declare function updateTaskBrief(id: string, brief: string, expectedBrief: string): TaskRecord;
 export {};