@ours.network/fleet 2.2.6 → 2.3.0

package/dist/rooms-tasks/task-lists.js

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
+import { claimPrefix, ensureMissionKeyRegistry, normalizeMissionPrefix, readMissionKeyRegistry, suggestMissionPrefix, tombstoneListPrefixes, unavailablePrefixes, withMissionKeysLock, writeMissionKeyRegistry, } from './mission-keys.js';
 export const DEFAULT_TASK_LIST_ID = 'default';
 export const TASK_LIST_NAME_MAX_CODE_POINTS = 64;
 const CREATED_AT = '1970-01-01T00:00:00.000Z';
@@ -17,9 +18,11 @@ export class TaskListError extends Error {
 export const taskListsPath = () => join(stateRoot(), 'task-lists.json');
 export const taskListsLockPath = () => join(stateRoot(), 'task-lists.lock');
 export const withTaskListsLock = (fn) => withFileLock(taskListsLockPath(), fn);
-const defaultList = () => ({
-    list_id: DEFAULT_TASK_LIST_ID, name: 'default', built_in: true, created_at: CREATED_AT,
-});
+const defaultList = () => {
+    const prefix = readMissionKeyRegistry()?.default_prefix;
+    return { list_id: DEFAULT_TASK_LIST_ID, name: 'default', built_in: true, created_at: CREATED_AT,
+        ...(prefix ? { prefix } : {}) };
+};
 const compareNames = (a, b) => {
     if (a.list_id === DEFAULT_TASK_LIST_ID)
         return b.list_id === DEFAULT_TASK_LIST_ID ? 0 : -1;
@@ -60,21 +63,60 @@ export function resolveTaskList(name, lists = readTaskLists()) {
         throw new TaskListError('list_not_found', `task list not found: ${normalized}`);
     return found;
 }
-/** Caller must hold withTaskListsLock. */
-export function createTaskListLocked(name) {
+/**
+ * Server suggestion for a new list's prefix; convenience only, validated again
+ * on create.
+ */
+export function suggestTaskListPrefix(name) {
+    const registry = readMissionKeyRegistry() ?? ensureMissionKeyRegistry();
+    return suggestMissionPrefix(typeof name === 'string' ? name : '', unavailablePrefixes(registry));
+}
+/**
+ * Caller must hold withTaskListsLock. The prefix registry is written before
+ * the list row, so a crash leaves at worst an orphan reservation that only an
+ * explicit reclaim can reuse; a key is never reissued.
+ */
+export function createTaskListLocked(name, prefix) {
     const normalized = normalizeTaskListName(name);
     if (normalized === 'default')
         throw new TaskListError('reserved_name', "'default' is a reserved built-in list");
     const lists = readTaskLists();
     if (lists.some(item => item.name === normalized))
         throw new TaskListError('duplicate_name', `task list already exists: ${normalized}`);
+    const explicit = prefix !== undefined && prefix !== '';
+    const requested = explicit ? normalizeMissionPrefix(prefix) : undefined;
     const record = {
         list_id: `list_${randomUUID().replace(/-/g, '')}`, name: normalized,
         built_in: false, created_at: new Date().toISOString(),
     };
+    withMissionKeysLock(() => {
+        const registry = ensureMissionKeyRegistry();
+        record.prefix = requested ?? suggestMissionPrefix(normalized, unavailablePrefixes(registry));
+        claimPrefix(registry, record.list_id, record.prefix, explicit);
+        writeMissionKeyRegistry(registry);
+    });
     writeTaskLists([...lists, record]);
     return record;
 }
+/**
+ * Caller must hold withTaskListsLock. Issued keys keep their old prefix; the
+ * previous prefix stays reserved to this list.
+ */
+export function setTaskListPrefixLocked(listName, prefix) {
+    const lists = readTaskLists();
+    const current = resolveTaskList(listName, lists);
+    if (current.built_in)
+        throw new TaskListError('default_immutable', "the 'default' list prefix is set by tasks.default_prefix");
+    const next = normalizeMissionPrefix(prefix);
+    withMissionKeysLock(() => {
+        const registry = ensureMissionKeyRegistry();
+        claimPrefix(registry, current.list_id, next, true);
+        writeMissionKeyRegistry(registry);
+    });
+    const updated = { ...current, prefix: next };
+    writeTaskLists(lists.map(item => item.list_id === current.list_id ? updated : item));
+    return updated;
+}
 /** Caller must hold withTaskListsLock. */
 export function renameTaskListLocked(currentName, nextName) {
     const lists = readTaskLists();
@@ -92,5 +134,18 @@ export function renameTaskListLocked(currentName, nextName) {
 }
 /** Caller must hold withTaskListsLock. */
 export function deleteTaskListRecordLocked(listId) {
+    if (readMissionKeyRegistry())
+        withMissionKeysLock(() => {
+            const registry = readMissionKeyRegistry();
+            tombstoneListPrefixes(registry, listId);
+            writeMissionKeyRegistry(registry);
+        });
     writeTaskLists(readTaskLists().filter(item => item.list_id !== listId));
 }
+/** Caller holds withTaskListsLock; persists prefixes assigned by migration. */
+export function writeTaskListPrefixesLocked(prefixes) {
+    const lists = readTaskLists().map(item => prefixes.has(item.list_id) && !item.built_in
+        ? { ...item, prefix: prefixes.get(item.list_id) } : item);
+    writeTaskLists(lists);
+    return readTaskLists();
+}

package/dist/rooms-tasks/task-room-name.d.ts

@@ -8,5 +8,10 @@
 export declare const COWORK_ROOM_IDENTITY_PREFIX = "ours-cowork:";
 export declare const COWORK_IDENTITY_NAME_MAX_CODE_POINTS = 64;
 export declare const TASK_ROOM_NAME_MAX_CODE_POINTS: number;
-/** Canonical Cowork room name for a Fleet task; never mutates the task title. */
-export declare function deriveTaskRoomName(title: string, taskId: string): string;
+/**
+ * Canonical Cowork room name for a Fleet task; never mutates the task title.
+ * With a mission key the key leads (`MSN-1 Title [id]`), so it survives the
+ * room-identity cut; the canonical suffix keeps the name unique on a daemon
+ * shared by several Fleets.
+ */
+export declare function deriveTaskRoomName(title: string, taskId: string, missionKey?: string): string;

package/dist/rooms-tasks/task-room-name.js

@@ -49,13 +49,22 @@ function graphemeBound(value, maxCodePoints) {
     }
     return result.trimEnd();
 }
-/** Canonical Cowork room name for a Fleet task; never mutates the task title. */
-export function deriveTaskRoomName(title, taskId) {
+const MISSION_KEY_PATTERN = /^[A-Z][A-Z0-9]{0,5}-[1-9][0-9]{0,8}$/;
+/**
+ * Canonical Cowork room name for a Fleet task; never mutates the task title.
+ * With a mission key the key leads (`MSN-1 Title [id]`), so it survives the
+ * room-identity cut; the canonical suffix keeps the name unique on a daemon
+ * shared by several Fleets.
+ */
+export function deriveTaskRoomName(title, taskId, missionKey) {
     if (!TASK_ID_PATTERN.test(taskId))
         throw new Error(`invalid canonical task ID: ${taskId}`);
+    if (missionKey !== undefined && !MISSION_KEY_PATTERN.test(missionKey))
+        throw new Error(`invalid mission key: ${missionKey}`);
+    const lead = missionKey ? `${missionKey} ` : '';
     const suffix = ` [${taskId}]`;
-    const titleBudget = TASK_ROOM_NAME_MAX_CODE_POINTS - Array.from(suffix).length;
+    const titleBudget = TASK_ROOM_NAME_MAX_CODE_POINTS - Array.from(lead + suffix).length;
     const readable = sanitizeTitle(title);
     const bounded = graphemeBound(readable || FALLBACK_TITLE, titleBudget) || FALLBACK_TITLE;
-    return `${bounded}${suffix}`;
+    return `${lead}${bounded}${suffix}`;
 }

package/dist/rooms-tasks/task-state.d.ts

@@ -1,5 +1,6 @@
 import type { ArchivedMemberAbsence } from './types.js';
 import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase, TaskNotificationEvent } from './types.js';
+import { type LabelCandidate } from './member-naming.js';
 import { type TaskNotificationManifest } from './notification-manifest.js';
 export declare const tasksDir: () => string;
 export declare class TaskStateError extends Error {
@@ -59,8 +60,47 @@ export interface CreateTaskInput {
     };
     room_id?: string;
     listId?: string;
+    /** Submitted list name; resolved only after receipt replay, so a renamed or deleted list cannot reallocate. */
+    list?: string;
 }
+/**
+ * Create a task, or replay an earlier create with the same idempotency key.
+ * Production callers hold `task-lists.lock`; allocation itself is serialized
+ * by the innermost mission-keys lock. Ordering: high-water mark → reserved
+ * receipt → key ledger → task row → receipt `created`. Every crash cut leaves
+ * a gap or a resumable receipt, never a duplicate or a resurrected task.
+ */
 export declare function createTask(input: CreateTaskInput): TaskRecord;
+/**
+ * Resolve a canonical task ID or a mission key (any case) to the canonical
+ * ID. Callers authenticate before resolving. A deleted key resolves to its
+ * canonical ID only with `allowDeleted` (idempotent DELETE replay); every
+ * other use gets a stable `task_deleted` error and never another task.
+ */
+export declare function resolveTaskRef(ref: string, options?: {
+    allowDeleted?: boolean;
+}): string;
+/**
+ * Durable role-scoped names for members of a keyed task. Returns undefined
+ * for a task without a mission key (legacy derivation applies). Existing
+ * allocations are returned unchanged; new ones are persisted under the task
+ * lock before the caller launches anything. `assertAvailable` runs for new
+ * names only; a conflict persists nothing and fails safely.
+ */
+export declare function allocateTaskMemberNames(id: string, requests: Array<{
+    allocationKey: string;
+    candidates: LabelCandidate[];
+}>, assertAvailable?: (name: string) => void): string[] | undefined;
+/** Recorded allocation name for `allocationKey`, without allocating. */
+export declare function recordedMemberName(id: string, allocationKey: string): string | undefined;
+/**
+ * Assign prefixes and keys to historical lists and tasks, then seed or repair
+ * receipts, ledger entries and frozen agent names for every row. Caller holds
+ * `task-lists.lock` (every production path does); per row the lock order is
+ * task lock → mission-keys lock, the same as deletion acceptance. Re-runnable:
+ * every step is idempotent, and `keys_migrated` is written only at the end.
+ */
+export declare function migrateMissionKeysLocked(configuredDefault?: string): void;
 export declare function getTask(id: string): TaskRecord;
 export declare function updateTaskExecutionPlan(id: string, executionPlan: NonNullable<TaskRecord['execution_plan']>): TaskRecord;
 export declare function listTasks(filter?: {

package/dist/rooms-tasks/task-state.js

@@ -2,12 +2,14 @@ import { publishFleetResourceCommit } from '../application/resource-observer.js'
 import { existsSync, linkSync, lstatSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, rmSync, renameSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { replaceFileAtomically, withSynchronousFileLock } from '../atomic-file.js';
+import { fsyncDirectory, replaceFileAtomically, withSynchronousFileLock } from '../atomic-file.js';
 import { incarnationEnded, processIncarnation } from '../process-incarnation.js';
 import { stateRoot } from '../paths.js';
 import { planWorkspace, ensureWorkspace } from './workspace.js';
 import { storedRoomLaunchPolicy, TASK_TERMINAL_STATES, TASK_CANCELLABLE_STATES } from './types.js';
-import { DEFAULT_TASK_LIST_ID, readTaskLists } from './task-lists.js';
+import { DEFAULT_TASK_LIST_ID, readTaskLists, resolveTaskList, writeTaskListPrefixesLocked } from './task-lists.js';
+import { activePrefixFor, canonicalFingerprint, claimPrefix, ensureKeyLedger, ensureMissionKeyRegistry, issueNextKey, MissionKeyError, observeIssuedKey, parseMissionKeyRef, readCreationReceipt, readKeyLedger, readMissionKeyRegistry, suggestMissionPrefix, unavailablePrefixes, withMissionKeysLock, writeCreationReceipt, writeMissionKeyRegistry, } from './mission-keys.js';
+import { allocateName, freezeLegacyMemberNaming, ownEntry } from './member-naming.js';
 import { queueMissionCleanup, withManifestRooms } from './notification-manifest.js';
 export const tasksDir = () => join(stateRoot(), 'tasks');
 function taskPath(id) { return join(tasksDir(), `${id}.json`); }
@@ -157,7 +159,8 @@ function readTask(id) {
         throw new TaskStateError(`task not found: ${id}`);
     return presentTask(JSON.parse(readFileSync(p, 'utf8')));
 }
-function writeTask(record) {
+/** `durable` refuses unless the rename is known durable (agent names are reserved before launch). */
+function writeTask(record, options = {}) {
     mkdirSync(tasksDir(), { recursive: true });
     const persisted = { ...record };
     delete persisted.list_name;
@@ -175,7 +178,7 @@ function writeTask(record) {
         if (!previous || status(previous) !== status(record)) {
             const next = status(record), before = previous ? status(previous) : undefined;
             pending.push({ eventId: `task:${record.task_id}:${randomUUID()}`, taskId: record.task_id,
-                title: `Task ${!previous ? 'created' : 'updated'}: ${record.title}`.slice(0, 160),
+                title: `Task ${!previous ? 'created' : 'updated'}: ${taskLabel(record)}`.slice(0, 160),
                 body: `Task ${record.task_id}: ${before ? `${before} → ` : 'created in '}${next}.`,
                 target: { kind: 'task', taskId: record.task_id }, delivery: 'push-only' });
         }
@@ -188,9 +191,11 @@ function writeTask(record) {
         persisted.notification_events = pending;
     else
         delete persisted.notification_events;
-    replaceFileAtomically(taskPath(record.task_id), JSON.stringify(persisted, null, 2) + '\n');
+    replaceFileAtomically(taskPath(record.task_id), JSON.stringify(persisted, null, 2) + '\n', 0o600, {}, { durable: options.durable });
     publishFleetResourceCommit(taskPath(record.task_id));
 }
+/** Human label for notification titles: the mission key, when issued, precedes the title. */
+const taskLabel = (record) => record.key ? `${record.key} · ${record.title}` : record.title;
 /** Packages written before revisions existed count as revision 1; their next change becomes 2. No package is 0. */
 export const reviewRevision = (review) => review ? review.revision ?? 1 : 0;
 const contributionsChanged = (previous, record) => (record.progress ?? []).some(entry => !(previous.progress ?? []).some(old => old.id === entry.id))
@@ -203,12 +208,12 @@ function contributionEvents(previous, record) {
     for (const entry of record.progress ?? []) {
         if ((previous.progress ?? []).some(old => old.id === entry.id))
             continue;
-        events.push({ eventId: `task:${id}:progress:${entry.id}`, taskId: id, title: `Progress: ${record.title}`.slice(0, 160),
+        events.push({ eventId: `task:${id}:progress:${entry.id}`, taskId: id, title: `Progress: ${taskLabel(record)}`.slice(0, 160),
             body: (entry.text.trim() || 'New progress entry').slice(0, 512), target: { kind: 'task', taskId: id }, delivery: 'push-only' });
     }
     const revision = reviewRevision(record.review);
     if (revision > reviewRevision(previous.review))
-        events.push({ eventId: `task:${id}:review:${revision}`, taskId: id, title: `To review updated: ${record.title}`.slice(0, 160),
+        events.push({ eventId: `task:${id}:review:${revision}`, taskId: id, title: `To review updated: ${taskLabel(record)}`.slice(0, 160),
             body: `Task ${id}: the review package changed.`, target: { kind: 'task', taskId: id }, delivery: 'push-only' });
     return events;
 }
@@ -385,49 +390,270 @@ function creationPlan(plan, layout) {
     return JSON.stringify([plan?.plan_hash ?? null, storedRoomLaunchPolicy(plan?.room_policy) ?? null,
         layout ? `${layout.name}@${layout.definition_hash}` : null]);
 }
+const creationFingerprint = (input, plan) => canonicalFingerprint({
+    title: input.title, brief: input.brief, brief_file: input.brief_file, template: input.template,
+    plan, origin: input.origin, start: input.start !== false, no_room: input.no_room || undefined,
+    room_id: input.room_id, list: input.list ?? input.listId ?? DEFAULT_TASK_LIST_ID,
+});
+function recordFromReceipt(receipt, idempotencyKey) {
+    const input = receipt.input;
+    const listId = readTaskLists().some(item => item.list_id === receipt.list_id) ? receipt.list_id : DEFAULT_TASK_LIST_ID;
+    const state = input.start === false ? 'backlog' : 'provisioning';
+    const record = {
+        task_id: receipt.task_id, key: receipt.mission_key, list_id: listId,
+        title: input.title, brief: input.brief, brief_file: input.brief_file, state,
+        template: input.template, execution_plan: input.execution_plan, no_room: input.no_room || undefined,
+        ...(input.layout ? { layout: { name: input.layout.name, run_id: `task-${receipt.task_id}`, definition_hash: input.layout.definition_hash } } : {}),
+        room_id: input.room_id, member_roles: [], origin: input.origin,
+        idempotency_key: idempotencyKey, creation_plan: receipt.creation_plan,
+        created_at: input.created_at, started_at: state === 'provisioning' ? input.created_at : undefined,
+    };
+    record.workspace = input.workspace ?? planWorkspace('task', record.task_id);
+    return record;
+}
+/**
+ * Create a task, or replay an earlier create with the same idempotency key.
+ * Production callers hold `task-lists.lock`; allocation itself is serialized
+ * by the innermost mission-keys lock. Ordering: high-water mark → reserved
+ * receipt → key ledger → task row → receipt `created`. Every crash cut leaves
+ * a gap or a resumable receipt, never a duplicate or a resurrected task.
+ */
 export function createTask(input) {
     const key = input.idempotency_key ?? randomUUID();
-    const existing = listTasks({ includeDeleting: true }).find(task => task.idempotency_key === key);
     const requestedPlan = creationPlan(input.execution_plan, input.layout);
-    if (existing) {
-        // After a Backlog plan edit the current plan differs from the one created; retries compare the original request.
-        if ((existing.creation_plan ?? creationPlan(existing.execution_plan, existing.layout)) !== requestedPlan)
-            throw new TaskStateError(`idempotency key '${key}' was already used with a different execution plan`);
-        return withTaskLock(existing.task_id, () => {
-            const fresh = readTask(existing.task_id);
-            assertNoPendingDeletion(fresh);
-            if (fresh.workspace)
-                ensureWorkspace(fresh.workspace);
-            return fresh;
-        });
-    }
     if (input.layout && (input.execution_plan || input.no_room || input.room_id))
         throw new TaskStateError('a layout task cannot also use a room template, no-room mode or a room');
-    const state = input.start === false ? 'backlog' : 'provisioning';
-    const taskId = generateTaskId();
-    const record = {
-        task_id: taskId,
-        list_id: input.listId ?? DEFAULT_TASK_LIST_ID,
-        title: input.title,
-        brief: input.brief,
-        brief_file: input.brief_file,
-        state,
-        template: input.template,
-        execution_plan: input.execution_plan,
-        no_room: input.no_room || undefined,
-        ...(input.layout ? { layout: { name: input.layout.name, run_id: `task-${taskId}`, definition_hash: input.layout.definition_hash } } : {}),
-        room_id: input.room_id,
-        member_roles: [],
-        origin: input.origin,
-        idempotency_key: key,
-        creation_plan: requestedPlan,
-        created_at: new Date().toISOString(),
-        started_at: state === 'provisioning' ? new Date().toISOString() : undefined,
-    };
-    record.workspace = planWorkspace('task', record.task_id);
-    writeTask(record);
-    ensureWorkspace(record.workspace);
-    return readTask(record.task_id);
+    migrateMissionKeysLocked();
+    const fingerprint = creationFingerprint(input, requestedPlan);
+    const outcome = withMissionKeysLock(() => {
+        const receipt = readCreationReceipt(key);
+        if (receipt) {
+            // Stable policy, unchanged from earlier releases: first write wins and only a different room
+            // plan conflicts. A resumed create uses the stored original input, never the retry's fields.
+            if (receipt.creation_plan !== undefined && receipt.creation_plan !== requestedPlan)
+                throw new TaskStateError(`idempotency key '${key}' was already used with a different execution plan`);
+            const present = existsSync(taskPath(receipt.task_id));
+            if (receipt.mission_key && (present || receipt.state === 'reserved'))
+                ensureKeyLedger(receipt.mission_key, receipt.task_id);
+            if (present) {
+                if (receipt.state === 'reserved')
+                    writeCreationReceipt(key, { ...receipt, state: 'created' });
+                return { kind: 'existing', taskId: receipt.task_id };
+            }
+            if (receipt.state !== 'reserved' || readTaskDeletionReceipt(receipt.task_id) || !receipt.input)
+                throw new MissionKeyError('task_deleted', `task ${receipt.mission_key ?? receipt.task_id} created with idempotency key '${key}' was deleted`);
+            writeTask(recordFromReceipt(receipt, key));
+            writeCreationReceipt(key, { ...receipt, state: 'created' });
+            return { kind: 'created', taskId: receipt.task_id };
+        }
+        // Rows written by an earlier release before migration completed.
+        const legacy = listTasks({ includeDeleting: true }).find(task => task.idempotency_key === key);
+        if (legacy) {
+            if ((legacy.creation_plan ?? creationPlan(legacy.execution_plan, legacy.layout)) !== requestedPlan)
+                throw new TaskStateError(`idempotency key '${key}' was already used with a different execution plan`);
+            return { kind: 'existing', taskId: legacy.task_id };
+        }
+        const listId = input.listId ?? resolveTaskList(input.list ?? 'default').list_id;
+        const registry = ensureMissionKeyRegistry();
+        const missionKey = issueNextKey(registry, listId);
+        writeMissionKeyRegistry(registry);
+        const taskId = generateTaskId();
+        const stored = {
+            title: input.title, brief: input.brief, brief_file: input.brief_file, template: input.template,
+            execution_plan: input.execution_plan, origin: input.origin, start: input.start !== false,
+            no_room: input.no_room || undefined, layout: input.layout, room_id: input.room_id,
+            list: input.list ?? listId, created_at: new Date().toISOString(),
+            workspace: planWorkspace('task', taskId),
+        };
+        const reserved = { version: 1, task_id: taskId, mission_key: missionKey, list_id: listId,
+            fingerprint, input: stored, creation_plan: requestedPlan, state: 'reserved' };
+        writeCreationReceipt(key, reserved);
+        ensureKeyLedger(missionKey, taskId);
+        writeTask(recordFromReceipt(reserved, key));
+        writeCreationReceipt(key, { ...reserved, state: 'created' });
+        return { kind: 'created', taskId };
+    });
+    return withTaskLock(outcome.taskId, () => {
+        const fresh = readTask(outcome.taskId);
+        if (outcome.kind === 'existing')
+            assertNoPendingDeletion(fresh);
+        if (fresh.workspace)
+            ensureWorkspace(fresh.workspace);
+        return fresh;
+    });
+}
+/**
+ * Resolve a canonical task ID or a mission key (any case) to the canonical
+ * ID. Callers authenticate before resolving. A deleted key resolves to its
+ * canonical ID only with `allowDeleted` (idempotent DELETE replay); every
+ * other use gets a stable `task_deleted` error and never another task.
+ */
+export function resolveTaskRef(ref, options = {}) {
+    if (typeof ref !== 'string')
+        throw new TaskStateError('invalid task reference');
+    if (TASK_ID_PATTERN.test(ref))
+        return ref;
+    const key = parseMissionKeyRef(ref);
+    // Not a key: hand the reference on unchanged so existing not-found/validation errors stay exact.
+    if (!key)
+        return ref;
+    const entry = readKeyLedger(key);
+    if (!entry)
+        throw new TaskStateError(`task not found: ${key}`);
+    if (!options.allowDeleted && entry.state === 'deleted' && !existsSync(taskPath(entry.task_id)))
+        throw new MissionKeyError('task_deleted', `task ${key} was deleted`);
+    return entry.task_id;
+}
+/**
+ * Durable role-scoped names for members of a keyed task. Returns undefined
+ * for a task without a mission key (legacy derivation applies). Existing
+ * allocations are returned unchanged; new ones are persisted under the task
+ * lock before the caller launches anything. `assertAvailable` runs for new
+ * names only; a conflict persists nothing and fails safely.
+ */
+export function allocateTaskMemberNames(id, requests, assertAvailable = () => { }) {
+    assertCanonicalTaskId(id);
+    return withTaskLock(id, () => {
+        const task = readTask(id);
+        if (!task.key)
+            return undefined;
+        let naming = task.member_naming;
+        const names = [];
+        const fresh = [];
+        for (const request of requests) {
+            const result = allocateName(naming, task.key, request.allocationKey, request.candidates);
+            naming = result.naming;
+            names.push(result.allocation.name);
+            if (result.created)
+                fresh.push(result.allocation.name);
+        }
+        for (const name of fresh)
+            assertAvailable(name);
+        if (fresh.length) {
+            assertNoPendingDeletion(task);
+            task.member_naming = naming;
+            // A counter that a host crash could roll back would hand the same name out twice.
+            writeTask(task, { durable: true });
+        }
+        else if (names.length) {
+            // Reused names may come from a write whose directory sync failed: make it durable before any launch.
+            fsyncDirectory(tasksDir());
+        }
+        return names;
+    });
+}
+/** Recorded allocation name for `allocationKey`, without allocating. */
+export function recordedMemberName(id, allocationKey) {
+    assertCanonicalTaskId(id);
+    if (!existsSync(taskPath(id)))
+        return undefined;
+    const row = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+    return ownEntry(row.member_naming?.allocations, allocationKey)?.name;
+}
+// ── One-time mission key migration ──────────────────────────────────────
+function listLedgerKeys() {
+    const dir = join(stateRoot(), 'mission-keys', 'keys');
+    if (!existsSync(dir))
+        return new Set();
+    return new Set(readdirSync(dir).filter(name => name.endsWith('.json')).map(name => name.slice(0, -5)));
+}
+/**
+ * Assign prefixes and keys to historical lists and tasks, then seed or repair
+ * receipts, ledger entries and frozen agent names for every row. Caller holds
+ * `task-lists.lock` (every production path does); per row the lock order is
+ * task lock → mission-keys lock, the same as deletion acceptance. Re-runnable:
+ * every step is idempotent, and `keys_migrated` is written only at the end.
+ */
+export function migrateMissionKeysLocked(configuredDefault) {
+    // Lock-free fast path: a completed migration with a matching default prefix needs no writes.
+    const current = readMissionKeyRegistry();
+    if (current?.keys_migrated && (configuredDefault === undefined || current.default_prefix === configuredDefault))
+        return;
+    const initial = ensureMissionKeyRegistry(configuredDefault);
+    if (initial.keys_migrated)
+        return;
+    // 1. Prefixes for lists that predate mission keys.
+    const assigned = withMissionKeysLock(() => {
+        const registry = readMissionKeyRegistry();
+        const prefixes = new Map();
+        for (const list of readTaskLists()) {
+            if (list.built_in)
+                continue;
+            const existing = activePrefixFor(registry, list.list_id);
+            const prefix = list.prefix ?? existing ?? suggestMissionPrefix(list.name, unavailablePrefixes(registry));
+            if (!existing)
+                claimPrefix(registry, list.list_id, prefix, false);
+            prefixes.set(list.list_id, prefix);
+        }
+        writeMissionKeyRegistry(registry);
+        return prefixes;
+    });
+    writeTaskListPrefixesLocked(assigned);
+    // 2. Reconcile every issued key before anything new is issued.
+    const rows = (existsSync(tasksDir()) ? readdirSync(tasksDir()) : [])
+        .filter(name => name.endsWith('.json')).map(name => name.slice(0, -5))
+        .filter(id => TASK_ID_PATTERN.test(id))
+        .map(id => ({ id, row: JSON.parse(readFileSync(taskPath(id), 'utf8')) }))
+        .sort((a, b) => (a.row.list_id ?? DEFAULT_TASK_LIST_ID).localeCompare(b.row.list_id ?? DEFAULT_TASK_LIST_ID)
+        || a.row.created_at.localeCompare(b.row.created_at) || a.id.localeCompare(b.id));
+    withMissionKeysLock(() => {
+        const registry = readMissionKeyRegistry();
+        for (const { row } of rows) {
+            if (row.key)
+                observeIssuedKey(registry, row.key, row.list_id ?? DEFAULT_TASK_LIST_ID);
+            const receipt = readCreationReceipt(row.idempotency_key);
+            if (receipt?.mission_key)
+                observeIssuedKey(registry, receipt.mission_key, receipt.list_id);
+        }
+        for (const key of listLedgerKeys())
+            observeIssuedKey(registry, key, DEFAULT_TASK_LIST_ID);
+        writeMissionKeyRegistry(registry);
+    });
+    // 3 + 4. Per row: reserve → receipt → ledger → keyed row, and repair every row.
+    for (const { id } of rows) {
+        withTaskLock(id, () => withMissionKeysLock(() => {
+            if (!existsSync(taskPath(id)))
+                return;
+            const row = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+            const listId = row.list_id ?? DEFAULT_TASK_LIST_ID;
+            const deleting = row.deletion?.status === 'pending';
+            const prior = readCreationReceipt(row.idempotency_key);
+            let missionKey = row.key ?? prior?.mission_key;
+            if (!missionKey) {
+                const registry = readMissionKeyRegistry();
+                const effectiveList = activePrefixFor(registry, listId) ? listId : DEFAULT_TASK_LIST_ID;
+                missionKey = issueNextKey(registry, effectiveList);
+                writeMissionKeyRegistry(registry);
+            }
+            if (prior?.state !== 'deleted')
+                writeCreationReceipt(row.idempotency_key, {
+                    version: 1, task_id: id, mission_key: missionKey, list_id: listId,
+                    ...(prior?.fingerprint ? { fingerprint: prior.fingerprint, input: prior.input } : {}),
+                    creation_plan: row.creation_plan ?? creationPlan(row.execution_plan, row.layout),
+                    state: deleting ? 'deleted' : 'created',
+                });
+            ensureKeyLedger(missionKey, id, deleting ? 'deleted' : 'live');
+            // Buckets depend on the key's length: derive them from the reserved key, not a placeholder.
+            const naming = freezeLegacyMemberNaming({ ...row, key: missionKey });
+            if (row.key !== missionKey || naming !== row.member_naming) {
+                if (row.key !== missionKey) {
+                    row.key = missionKey;
+                    row.key_from_migration = true;
+                }
+                if (naming)
+                    row.member_naming = naming;
+                writeTask(row, { durable: true });
+            }
+        }));
+    }
+    // Rows a crashed or sync-failed earlier pass already renamed are skipped above: confirm them before completion.
+    if (rows.length)
+        fsyncDirectory(tasksDir());
+    withMissionKeysLock(() => {
+        const registry = readMissionKeyRegistry();
+        registry.keys_migrated = true;
+        writeMissionKeyRegistry(registry);
+    });
 }
 export function getTask(id) { return withTaskLock(id, () => readTask(id)); }
 export function updateTaskExecutionPlan(id, executionPlan) {
@@ -861,6 +1087,7 @@ export function beginTaskDeletionIntent(id, actor) {
         }
         if (stored.deletion?.status === 'pending') {
             // Heal a crash between the intent write and the receipt write.
+            tombstoneCreation(stored);
             if (!readTaskDeletionReceipt(id))
                 writeDeletionReceiptForIntent(stored);
             queueMissionCleanup(id, notificationRoomCids(stored));
@@ -876,6 +1103,8 @@ export function beginTaskDeletionIntent(id, actor) {
                 name: member.name, identity_cid: member.identity_cid, phase: 'pending', updated_at: now,
             })),
         };
+        // Tombstone the create receipt and key first, so no create retry can resurrect this task.
+        tombstoneCreation(stored);
         // The task write drops queued transitions; the cleanup intent then retires everything already delivered.
         writeTask(stored);
         queueMissionCleanup(id, notificationRoomCids(stored));
@@ -883,6 +1112,20 @@ export function beginTaskDeletionIntent(id, actor) {
         return { status: 'accepted', task: presentTaskLenient(stored) };
     });
 }
+/** Terminal `deleted` receipt and ledger state; seeds a receipt for rows that predate receipts. */
+function tombstoneCreation(stored) {
+    withMissionKeysLock(() => {
+        const receipt = readCreationReceipt(stored.idempotency_key);
+        const key = stored.key ?? receipt?.mission_key;
+        writeCreationReceipt(stored.idempotency_key, {
+            ...(receipt ?? { version: 1, task_id: stored.task_id, list_id: stored.list_id ?? DEFAULT_TASK_LIST_ID,
+                creation_plan: stored.creation_plan ?? creationPlan(stored.execution_plan, stored.layout) }),
+            mission_key: key, state: 'deleted',
+        });
+        if (key)
+            ensureKeyLedger(key, stored.task_id, 'deleted');
+    });
+}
 /** Record an actionable settlement failure; the task stays hidden and recoverable. */
 export function setTaskDeletionError(id, error, recoveryHint) {
     return withTaskLock(id, () => {