@prjct.app/pi-team 0.5.7 → 0.6.1

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## [0.6.1](https://github.com/prjct-app/pi-team/compare/v0.6.0...v0.6.1) (2026-09-11)
+
+### Bug Fixes
+
+* preserve mailbox locks across rolling upgrades ([3509903](https://github.com/prjct-app/pi-team/commit/3509903026205a0a3d00fcd52eecb3b970ba4d7b))
+
+## [0.6.0](https://github.com/prjct-app/pi-team/compare/v0.5.7...v0.6.0) (2026-09-10)
+
+### Features
+
+* manage team and member lifecycle ([0a60766](https://github.com/prjct-app/pi-team/commit/0a607661f447fa0d78bb0c100da65f68e1cf947b))
+
+### Bug Fixes
+
+* exclude current session from teammate discovery ([a4f340b](https://github.com/prjct-app/pi-team/commit/a4f340bad2a979216f2e8ef579b456355ace7003))
+
 ## [0.5.7](https://github.com/prjct-app/pi-team/compare/v0.5.6...v0.5.7) (2026-09-10)
 
 ### Bug Fixes

package/README.md

@@ -80,9 +80,13 @@ reloaded. `/new` and `/fork` start unaffiliated sessions on purpose.
 | Command | Meaning |
 | --- | --- |
 | `/team create shop` | Create explicitly; does not join automatically |
+| `/team delete shop` | Permanently delete an inactive team after confirmation |
+| `/team rename-team shop store` | Rename a team after every member is offline |
 | `/team join shop backend` | Register this session and enable automatic reception |
 | `/team list` | List teams; refresh team-name completion |
-| `/team members` | Show aliases, cwd, and idle/busy/paused/offline status |
+| `/team members` | Show other aliases, cwd, and idle/busy/paused/offline status; excludes this session |
+| `/team remove backend` | Remove an offline alias and interrupt its unresolved work after confirmation |
+| `/team rename-member backend api` | Rename your own alias, or an offline teammate, while preserving its history and queued work |
 | `/team status` | Show every unresolved requester → assignee relationship |
 | `/team wake [message]` | Queue an actionable check-in for every other teammate |
 | `/team send backend Implement login` | Queue a request that can start work |
@@ -95,18 +99,24 @@ reloaded. `/new` and `/fork` start unaffiliated sessions on purpose.
 Names and aliases are 1–48 lowercase letters, digits, or hyphens, starting with a
 letter. Unknown teams are rejected, never implicitly created; duplicate live
 aliases are rejected. Sending to an offline **known** alias queues until someone
-rejoins it. Tab completion covers subcommands, discovered teams, and teammates.
+rejoins it. Removing that alias instead settles every unresolved request involving
+it; incoming requests produce an interrupted result so their requesters stop waiting.
+Renaming an alias rewrites its message addresses so queued work follows the new
+name. Team deletion and rename require every member to be offline, and destructive
+operations require confirmation. Tab completion covers subcommands, discovered
+teams, and teammates.
 
 ## Agent tools
 
-- `team_members` — discover teammates and their status.
+- `team_members` — discover other teammates and their status; excludes this session.
 - `team_send` — send `{ to, kind: "request" | "note", subject, body }`.
 - `team_status` — outstanding work: what you emitted and is unresolved, what is
   queued for you, results awaiting your review, and third-party team activity.
 
 Tools cannot create teams, join, resume reception, change permissions, or launch
-terminals; they require membership you established. A request returns **queued**,
-never "task completed".
+terminals; they require membership you established. Discovery results and recipient
+autocomplete exclude the current session, and sending to yourself is rejected at
+the mailbox boundary. A request returns **queued**, never "task completed".
 
 ## How delivery works
 
@@ -170,11 +180,13 @@ defaults, not user-configurable yet.
 | --- | --- |
 | A request stays queued | Run `/team status`. The recipient may be busy, paused, offline, missing a model, or typing. After five minutes, review turns chase it or surface the blockage. |
 | `Team auto-turn limit reached` | Five automatic turns ran without user input. Review the transcript, then `/team resume`. |
+| `Message not claimed by this session` | The durable claim changed before settlement. Review for partial effects, then `/reload` or leave and rejoin before `/team resume`. After updating pi-team, reload every live teammate so all sessions use the same runtime. |
 | `Membership expired or replaced` | Another live session took your alias. Rejoin, choosing a new alias if the old one is in use. |
 | `Recipient inbox full` / `Sender inbox full` | Fifty unsettled deliveries per member, one slot reserved per outstanding request. Let the teammate drain; notes need no reservation. |
 | `Team history full (500 records)` | At capacity; history is never deleted. Create a fresh team and rejoin. |
 | Repeated storage warnings | Conflicts retry automatically and never pause reception. If one persists, check that the teams directory is on a local disk and report it. |
 | A teammate went offline mid-task | Its claimed work is interrupted and the emitter receives that result; it is not replayed. Review the worktree, then resend explicitly. |
+| Work remains queued for an alias that will not return | Use `/team remove <alias>` to interrupt and settle its unresolved work, or `/team rename-member <alias> <new-alias>` to preserve the queue under a replacement alias. |
 
 ## Development
 

package/docs/architecture.md

@@ -22,10 +22,17 @@ hard-links it into a bounded `revisions/` history, and atomically renames it int
 place, so a concurrent read sees either the whole previous record or the whole
 next one. The history doubles as recovery evidence for an interrupted write.
 
-Writers compare-and-swap on the revision under a short-lived sibling lock.
-A conflict fails fast and the caller retries against a fresh read, so many agents
-write concurrently instead of queueing behind a team-wide lock. A lock abandoned
-by a crashed writer is reclaimed after ten seconds.
+Writers compare-and-swap on the revision under a short-lived per-team lock in
+`~/.pi/agent/teams/.locks/`. Keeping the lock outside the team directory lets
+rename and deletion fence stale publishers without allowing them to recreate a
+moved directory. Normal publications also acquire the pre-0.6 compatibility
+lock beside `state.json`, after the stable lock. This overlap is required while
+sessions from both sides of the lock migration remain alive during a rolling
+reload; without it, two versions could publish the same next revision and lose
+a claim. The compatibility lock is opened without creating its parent, so a
+stale writer still cannot resurrect a deleted team. A conflict fails fast and
+the caller retries against a fresh read. A lock abandoned by a crashed writer
+is reclaimed after ten seconds.
 
 Because every publication renames a **new inode** into place, readers can safely
 cache a parsed record keyed on `(inode, size, mtime)`: a write by any process
@@ -41,14 +48,16 @@ and never touch `state.json`.
 These files are deliberately non-durable: the atomic rename is kept, both fsyncs
 are not. Presence expires after 30 seconds and is rewritten every 2, so a write
 lost to a crash only makes a member look offline sooner — never alive longer.
-A member is also considered gone as soon as its recorded process has exited.
+A member is also considered gone as soon as its recorded process has exited. A
+heartbeat never creates a missing parent directory, so one already in flight
+cannot resurrect a team after rename or deletion.
 
 ## Request lifecycle
 
 A request is queued, claimed when the recipient is idle, worked on, and settled
-with a result delivered back to the emitter. The recipient compacts before
-accepting another team turn; the emitter verifies the result against its original
-request and replies in-thread only if something is missing.
+with a result delivered back to the emitter. Once settlement is durable, the
+recipient can accept another team turn; the emitter verifies the result against
+its original request and replies in-thread only if something is missing.
 
 States are `pending`, `processing`, `completed`, `interrupted`, and `seen`
 (notes already displayed).
@@ -59,13 +68,31 @@ A session that dies holding a claim would otherwise leave its requester waiting
 forever, so peers interrupt the claim on its behalf and the requester receives an
 `interrupted` result.
 
-Members are never removed from the record — leaving only marks them offline — so
-"someone is offline" is permanently true once anyone has ever left and cannot be
-used to decide when to sweep. A snapshot instead reports `sweepable`, true only
-when a member the record still counts as connected is actually dead **and** still
-holds a claim, which is the only case where sweeping changes anything. Everything
-else degrades correctly without it: rejoining re-admits a stale alias on its own,
-and displayed status comes from presence rather than the record.
+Leaving marks a member offline but retains its address and history so the same
+alias can rejoin. Therefore "someone is offline" is not enough to decide when to
+sweep. A snapshot instead reports `sweepable`, true only when a member the record
+still counts as connected is actually dead **and** still holds a claim, which is
+the only case where sweeping changes anything. Everything else degrades correctly
+without it: rejoining re-admits a stale alias on its own, and displayed status
+comes from presence rather than the record.
+
+## Team and member lifecycle
+
+Lifecycle changes are user-only commands; agents receive no tool that can delete
+or rename identities. Removing a member is allowed only while it is offline. The
+operation removes the roster entry, cancels unresolved work emitted by that alias,
+and turns requests addressed to it into interrupted results for their requesters.
+Renaming rewrites every message endpoint so pending work and history follow the new
+alias. A live session may rename itself; only offline peers can be renamed by
+another member. Ownership tokens fence the old alias after either operation.
+
+Team rename and deletion require every recorded member to be offline. They acquire
+stable locks for both names in lexical order, preventing deadlock and fencing
+concurrent joins or publishers. Rename moves the directory first and then writes a
+new revision with the new team name. If the process stops between those steps,
+repeating the same rename recognizes and completes that partial state. Deletion
+first moves the directory to a hidden tombstone and then recursively removes it,
+so readers never observe a partially deleted public team directory.
 
 ## Context budget
 
@@ -92,12 +119,16 @@ Consequences worth knowing:
 - Each `team_status` call is a point-in-time snapshot. Earlier results in the
   same conversation are stale but cannot be retracted, which is why each one is
   kept small.
+- Teammate discovery, status rosters, `/team members`, and recipient completion
+  omit the current alias. The mailbox independently rejects self-addressed
+  messages, so a stale UI or direct tool call cannot create a self-reply loop.
 
 ## Recovery and guarantees
 
-Ownership tokens fence out replaced sessions. Pending messages survive
-disconnection. Claimed work is marked interrupted on disconnect or rejoin and is
-**not automatically replayed**, since edits may already have happened.
+Ownership tokens fence out replaced, renamed, or removed sessions. Pending
+messages survive disconnection and alias/team rename. Claimed work is marked
+interrupted on disconnect or rejoin and is **not automatically replayed**, since
+edits may already have happened.
 
 This favours avoiding duplicate side effects over guaranteed execution. **There is
 no exactly-once guarantee** for filesystem changes or model actions: a crash after
@@ -137,8 +168,8 @@ or protection of secrets from other processes under the same OS user.
 ## Pi interfaces used
 
 `registerCommand`, `registerTool`, `sendMessage`, `appendEntry`, custom entry and
-message renderers, `setWidget`, `getEditorText`, `isIdle`, `hasPendingMessages`,
-`compact`, session lifecycle events, UI prompt events, `tool_result`,
+message renderers, `setWidget`, `getEditorText`, `confirm`, `isIdle`,
+`hasPendingMessages`, session lifecycle events, UI prompt events, `tool_result`,
 `message_end`, and `agent_settled`. All public and documented; no host internals
 are imported, no prototypes patched, and peer text is never shell-evaluated or
 expanded as file mentions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prjct.app/pi-team",
-  "version": "0.5.7",
+  "version": "0.6.1",
   "description": "Coordinate independent PI Agent sessions with local team messaging, queued tasks, and shared results.",
   "type": "module",
   "keywords": [

package/src/index.ts

@@ -7,8 +7,8 @@ import { Type } from 'typebox';
 import { StringEnum } from '@earendil-works/pi-ai';
 import { Mailbox, type Membership, type Message, type Outgoing, type Result, type Snapshot } from './mailbox.ts';
 
-const COMMANDS = ['create', 'join', 'list', 'members', 'status', 'wake', 'send', 'note', 'inbox', 'pause', 'resume', 'leave'];
-const HELP = '/team create <team> | join <team> <alias> | list | members | status | wake [message] | send <alias> <text> | note <alias> <text> | inbox | pause | resume | leave';
+const COMMANDS = ['create', 'delete', 'rename-team', 'join', 'list', 'members', 'remove', 'rename-member', 'status', 'wake', 'send', 'note', 'inbox', 'pause', 'resume', 'leave'];
+const HELP = '/team create <team> | delete <team> | rename-team <team> <new-team> | join <team> <alias> | list | members | remove <alias> | rename-member <alias> <new-alias> | status | wake [message] | send <alias> <text> | note <alias> <text> | inbox | pause | resume | leave';
 const TEAM_CHECK_IN = `Team check-in: report what you are working on, what remains, blockers, and your next concrete step.
 If you are waiting on another teammate, use team_send to ask them directly for the missing input.
 Do not stay idle: complete any pending work you can finish within the current user's authorization and project rules.
@@ -162,7 +162,7 @@ const INITIAL: Session = {
 
 /** Cleared on join, restore, and leave so a new membership starts unbiased. */
 const MEMBERSHIP_RESET = {
-  paused: false, leaving: false, closed: false,
+  paused: false, leaving: false, closed: false, aliases: [],
   budget: 0, lastReview: 0, quietReviews: 0, lastRevision: -1,
 } as const;
 
@@ -213,7 +213,7 @@ export function installTeam(pi: ExtensionAPI, options: { root?: string; pollMs?:
   }
   /** Forget the current membership without leaving the mailbox. */
   function forget() {
-    set(() => ({ member: undefined, active: undefined, leaving: false }));
+    set(() => ({ member: undefined, active: undefined, leaving: false, aliases: [] }));
     persist();
     showWidget(undefined);
   }
@@ -232,7 +232,7 @@ export function installTeam(pi: ExtensionAPI, options: { root?: string; pollMs?:
     const text = reason(error);
     if (text !== get().lastError) get().ctx?.ui.notify(`Team: ${text}`, 'warning');
     set(() => ({ lastError: text }));
-    if (text.includes('Membership expired or replaced')) {
+    if (text.includes('Membership expired or replaced') || text.startsWith('Unknown team "')) {
       stop();
       forget();
     }
@@ -273,7 +273,7 @@ export function installTeam(pi: ExtensionAPI, options: { root?: string; pollMs?:
       set(() => ({ lastHeartbeat: Date.now() }));
     }
     const snap = await box.snapshot(member);
-    set(() => ({ aliases: snap.members.map(m => m.alias) }));
+    set(() => ({ aliases: snap.members.filter(peer => peer.alias !== member.alias).map(peer => peer.alias) }));
     const inbox = snap.messages.filter(m => m.to === member.alias && m.state === 'pending');
     const pending = inbox.length;
     const { paused, active } = get();
@@ -375,11 +375,13 @@ export function installTeam(pi: ExtensionAPI, options: { root?: string; pollMs?:
   pi.registerMessageRenderer<{ outstanding?: { to: string; subject: string }[] }>('team-review', (message, { expanded }) => reviewView(message.details, expanded));
 
   pi.registerTool({
-    name: 'team_members', label: 'Team members', description: 'List teammates and their status in the joined local team. Does not create agents.',
+    name: 'team_members', label: 'Team members', description: 'List other teammates and their status in the joined local team, excluding this session. Does not create agents.',
     parameters: Type.Object({}),
     async execute() {
-      const members = await queue(() => box.members(required()));
-      const safe = members.map(({ alias, cwd, status }) => ({ alias, cwd: excerptPath(cwd, MEMBER_CWD_EXCERPT), status }));
+      const current = required();
+      const members = await queue(() => box.members(current));
+      const safe = members.filter(member => member.alias !== current.alias)
+        .map(({ alias, cwd, status }) => ({ alias, cwd: excerptPath(cwd, MEMBER_CWD_EXCERPT), status }));
       return { content: [{ type: 'text', text: JSON.stringify(safe) }], details: {} };
     },
   });
@@ -425,18 +427,19 @@ export function installTeam(pi: ExtensionAPI, options: { root?: string; pollMs?:
         otherTeamWork: bounded(byAge(snap.flow.filter(item => item.from !== current.alias && item.to !== current.alias))
           .map(item => ({ from: item.from, to: item.to, subject: subject(item.subject), state: item.state,
             ageMinutes: age(item.created), assigneeStatus: status(item.to) }))),
-        teammates: snap.members.map(m => ({ alias: m.alias, status: m.status })),
+        teammates: snap.members.filter(member => member.alias !== current.alias)
+          .map(member => ({ alias: member.alias, status: member.status })),
       }) }], details: {} };
     },
   });
 
   pi.registerCommand('team', {
-    description: 'Local team messaging: create, join, list, members, status, wake, send, note, inbox, pause, resume, leave',
+    description: 'Local team messaging and lifecycle management',
     getArgumentCompletions(prefix) {
       const parts = prefix.split(/\s+/);
       const values = parts.length === 1 ? COMMANDS
-        : parts.length === 2 && parts[0] === 'join' ? get().teamNames
-        : parts.length === 2 && ['send', 'note'].includes(parts[0]) ? get().aliases
+        : parts.length === 2 && ['join', 'delete', 'rename-team'].includes(parts[0]) ? get().teamNames
+        : parts.length === 2 && ['send', 'note', 'remove', 'rename-member'].includes(parts[0]) ? get().aliases
         : [];
       const stem = parts.slice(0, -1).join(' ');
       return values.filter(v => v.startsWith(parts.at(-1) ?? '')).map(v => ({ value: `${stem ? stem + ' ' : ''}${v}`, label: v }));
@@ -456,6 +459,25 @@ export function installTeam(pi: ExtensionAPI, options: { root?: string; pollMs?:
               set(() => ({ teamNames }));
               ui.notify(`Created ${a}. Join with /team join ${a} <alias>.`, 'info'); break;
             }
+            case 'delete': {
+              if (!a || b) throw new Error('Usage: /team delete <team>');
+              if (get().member?.team === a) throw new Error('Leave this team before deleting it.');
+              if (!await ui.confirm('Delete team?', `Delete "${a}" and all of its members, messages, and history? This cannot be undone.`)) {
+                ui.notify('Team deletion cancelled.', 'info'); break;
+              }
+              await box.deleteTeam(a);
+              const teamNames = await box.teams();
+              set(() => ({ teamNames }));
+              ui.notify(`Deleted ${a}.`, 'info'); break;
+            }
+            case 'rename-team': {
+              if (!a || !b || rest.length) throw new Error('Usage: /team rename-team <team> <new-team>');
+              if (get().member?.team === a) throw new Error('Leave this team before renaming it.');
+              await box.renameTeam(a, b);
+              const teamNames = await box.teams();
+              set(() => ({ teamNames }));
+              ui.notify(`Renamed ${a} to ${b}.`, 'info'); break;
+            }
             case 'join': {
               if (get().member) throw new Error('Leave the current team before joining another.');
               if (!a || !b || rest.length) throw new Error('Usage: /team join <team> <alias>');
@@ -469,8 +491,42 @@ export function installTeam(pi: ExtensionAPI, options: { root?: string; pollMs?:
               set(() => ({ teamNames }));
               ui.notify(teamNames.join('\n') || 'No teams. Use /team create <team>.', 'info'); break;
             }
-            case 'members':
-              ui.notify((await box.members(required())).map(m => `${m.alias} · ${m.status} · ${m.cwd}`).join('\n'), 'info'); break;
+            case 'members': {
+              const current = required();
+              const teammates = (await box.members(current)).filter(member => member.alias !== current.alias);
+              ui.notify(teammates.map(member => `${member.alias} · ${member.status} · ${member.cwd}`).join('\n') || 'No teammates.', 'info'); break;
+            }
+            case 'remove': {
+              if (!a || b) throw new Error('Usage: /team remove <alias>');
+              const current = required();
+              const target = (await box.members(current)).find(candidate => candidate.alias === a);
+              if (!target) throw new Error(`Unknown teammate "${a}"`);
+              if (target.status !== 'offline') throw new Error(`Teammate "${a}" is active; ask them to leave first.`);
+              if (!await ui.confirm('Remove teammate?', `Remove "${a}" and interrupt every queued or active request involving that alias?`)) {
+                ui.notify('Teammate removal cancelled.', 'info'); break;
+              }
+              const result = await box.removeMember(current, a);
+              const aliases = (await box.members(current)).filter(member => member.alias !== current.alias)
+                .map(member => member.alias);
+              set(() => ({ aliases }));
+              ui.notify(`Removed ${a}; settled ${result.settled} unresolved item${result.settled === 1 ? '' : 's'}.`, 'info'); break;
+            }
+            case 'rename-member': {
+              if (!a || !b || rest.length) throw new Error('Usage: /team rename-member <alias> <new-alias>');
+              const current = required();
+              if (get().active && current.alias === a) throw new Error('Finish the current team task before renaming this session.');
+              const renamed = await box.renameMember(current, a, b);
+              const owner = current.alias === a ? renamed : current;
+              if (current.alias === a) {
+                set(() => ({ member: renamed }));
+                persist();
+              }
+              const aliases = (await box.members(owner)).filter(member => member.alias !== owner.alias)
+                .map(member => member.alias);
+              set(() => ({ aliases }));
+              enqueueTick();
+              ui.notify(`Renamed ${a} to ${b}.`, 'info'); break;
+            }
             case 'status': {
               const snap = await box.snapshot(required());
               const lines = flowLines(snap);

package/src/mailbox.ts

@@ -1,9 +1,9 @@
 import { randomUUID } from 'node:crypto';
-import { lstat, mkdir, readdir, readFile, unlink } from 'node:fs/promises';
+import { lstat, mkdir, readdir, readFile, rename, rm, unlink } from 'node:fs/promises';
 import { join } from 'node:path';
 import { Value } from 'typebox/value';
 import { ResultSchema, StateSchema } from './schema.ts';
-import { envelope, publish, readRecord, readRecordCached, writeAtomic, type Record as StoreRecord } from './store.ts';
+import { envelope, publish, publishLocked, readRecord, readRecordCached, withFileLock, writeAtomic, type Record as StoreRecord } from './store.ts';
 
 export type Membership = { team: string; alias: string; session: string; token: string };
 export type Member = Membership & { cwd: string; pid: number; seen: number; status: 'idle' | 'busy' | 'paused' | 'offline' };
@@ -66,6 +66,23 @@ export class Mailbox {
 
   private path(team: string): string { return join(this.root, identifier(team)); }
   private recordPath(team: string): string { return join(this.path(team), 'state.json'); }
+  private lockPath(team: string): string { return join(this.root, '.locks', `${identifier(team)}.lock`); }
+  private async prepareRoot(): Promise<void> {
+    await privateDirectory(this.root);
+    await privateDirectory(join(this.root, '.locks'));
+  }
+  private async withTeamLocks<T>(teams: string[], action: () => Promise<T>): Promise<T> {
+    await this.prepareRoot();
+    const locks = [...new Set(teams.map(team => this.lockPath(team)))].sort();
+    const acquire = (index: number): Promise<T> => index === locks.length
+      ? action()
+      : withFileLock(locks[index], () => acquire(index + 1));
+    return acquire(0);
+  }
+  private recordOptions(team: string, payloadJson?: string) {
+    return { maxBytes: MAX_BYTES, lockPath: this.lockPath(team), ...(payloadJson ? { payloadJson } : {}) };
+  }
+
   private presencePath(team: string, alias: string): string {
     return join(this.path(team), 'presence', `${identifier(alias)}.json`);
   }
@@ -143,7 +160,7 @@ export class Mailbox {
    * read; business errors thrown by the action abort immediately.
    */
   private async mutate<T>(team: string, action: (state: State) => T): Promise<T> {
-    await privateDirectory(this.root);
+    await this.prepareRoot();
     try { await lstat(this.path(team)); }
     catch { throw new Error(`Unknown team "${team}". Use /team list or /team create.`); }
     await privateDirectory(this.path(team));
@@ -164,8 +181,7 @@ export class Mailbox {
       if (before === after) return result;
       if (!Value.Check(StateSchema, state)) throw new Error('Invalid mailbox format; refusing to write');
       try {
-        await publish(this.recordPath(team), record.revision, state, this.normalize(team),
-          { maxBytes: MAX_BYTES, payloadJson: after });
+        await publish(this.recordPath(team), record.revision, state, this.normalize(team), this.recordOptions(team, after));
         await Promise.all(swept.map(member => unlink(this.presencePath(team, member.alias)).catch(() => {})));
         return result;
       } catch (error) {
@@ -178,22 +194,106 @@ export class Mailbox {
   }
 
   async create(team: string): Promise<void> {
-    await privateDirectory(this.root);
-    try { await mkdir(this.path(team), { mode: 0o700 }); }
-    catch (error) {
-      if ((error as NodeJS.ErrnoException).code === 'EEXIST') throw new Error(`Team "${team}" already exists`);
-      throw error;
-    }
-    await publish(this.recordPath(team), 0, { version: 1, members: [], messages: [] } satisfies State,
-      this.normalize(team), { maxBytes: MAX_BYTES });
+    identifier(team);
+    await this.withTeamLocks([team], async () => {
+      const exists = await lstat(this.path(team)).then(() => true, error => {
+        if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false;
+        throw error;
+      });
+      if (exists) throw new Error(`Team "${team}" already exists`);
+      await mkdir(this.path(team), { mode: 0o700 });
+      try {
+        await publishLocked(this.recordPath(team), 0, { version: 1, members: [], messages: [] } satisfies State,
+          this.normalize(team), { maxBytes: MAX_BYTES });
+      } catch (error) {
+        await rm(this.path(team), { recursive: true, force: true });
+        throw error;
+      }
+    });
   }
 
   async teams(): Promise<string[]> {
-    await privateDirectory(this.root);
+    await this.prepareRoot();
     const entries = await readdir(this.root, { withFileTypes: true });
     return entries.filter(e => e.isDirectory() && /^[a-z][a-z0-9-]{0,47}$/.test(e.name)).map(e => e.name).sort();
   }
 
+  private async disconnectInactiveMembers(team: string, state: State): Promise<void> {
+    const presence = await this.readPresence(team);
+    const active = state.members.filter(member => member.status !== 'offline' && this.alive(member, presence));
+    if (active.length) throw new Error(`Team "${team}" has active member${active.length === 1 ? '' : 's'}: ${active.map(member => member.alias).join(', ')}`);
+    for (const member of state.members.filter(candidate => candidate.status !== 'offline')) this.disconnect(state, member);
+  }
+
+  private renameState(state: State, from: string, to: string): State {
+    return {
+      version: 1,
+      members: state.members.map(member => ({ ...member, team: member.team === from ? to : member.team })),
+      messages: state.messages.map(message => ({ ...message, team: message.team === from ? to : message.team })),
+    };
+  }
+
+  async renameTeam(from: string, to: string): Promise<void> {
+    identifier(from); identifier(to);
+    if (from === to) throw new Error('Choose a different team name.');
+    await this.withTeamLocks([from, to], async () => {
+      const sourceExists = await lstat(this.path(from)).then(() => true, error => {
+        if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false;
+        throw error;
+      });
+      const targetExists = await lstat(this.path(to)).then(() => true, error => {
+        if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false;
+        throw error;
+      });
+      // Recover the only partial state possible: the directory move completed,
+      // but the record still carries the old team name.
+      if (!sourceExists && targetExists) {
+        await privateDirectory(this.path(to));
+        const completed = await readRecord(this.recordPath(to), this.normalize(to), MAX_BYTES).catch(error => {
+          if ((error as Error).message === 'Invalid mailbox format: team mismatch') return undefined;
+          throw error;
+        });
+        if (completed) throw new Error(`Team "${from}" does not exist; "${to}" already exists.`);
+        const interrupted = await readRecord(this.recordPath(to), this.normalize(from), MAX_BYTES);
+        if (!interrupted) throw new Error(`Mailbox record for team "${to}" is missing; recovery required.`);
+        await this.disconnectInactiveMembers(to, interrupted.payload);
+        const recovered = this.renameState(interrupted.payload, from, to);
+        await publishLocked(this.recordPath(to), interrupted.revision, recovered, this.normalize(to),
+          { maxBytes: MAX_BYTES, currentNormalize: this.normalize(from) });
+        return;
+      }
+      if (!sourceExists) throw new Error(`Unknown team "${from}". Use /team list or /team create.`);
+      if (targetExists) throw new Error(`Team "${to}" already exists`);
+      await privateDirectory(this.path(from));
+      const record = await this.readState(from);
+      await this.disconnectInactiveMembers(from, record.payload);
+      await rename(this.path(from), this.path(to));
+      created.delete(this.path(from));
+      created.add(this.path(to));
+      const renamed = this.renameState(record.payload, from, to);
+      await publishLocked(this.recordPath(to), record.revision, renamed, this.normalize(to),
+        { maxBytes: MAX_BYTES, currentNormalize: this.normalize(from) });
+    });
+  }
+
+  async deleteTeam(team: string): Promise<void> {
+    identifier(team);
+    await this.withTeamLocks([team], async () => {
+      const exists = await lstat(this.path(team)).then(() => true, error => {
+        if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false;
+        throw error;
+      });
+      if (!exists) throw new Error(`Unknown team "${team}". Use /team list or /team create.`);
+      await privateDirectory(this.path(team));
+      const record = await this.readState(team);
+      await this.disconnectInactiveMembers(team, record.payload);
+      const tombstone = join(this.root, `.deleted-${team}-${randomUUID()}`);
+      await rename(this.path(team), tombstone);
+      created.delete(this.path(team));
+      await rm(tombstone, { recursive: true, force: true });
+    });
+  }
+
   async join(team: string, alias: string, session: string, cwd: string): Promise<Membership> {
     identifier(alias);
     const member = await this.mutate(team, state => {
@@ -217,9 +317,9 @@ export class Mailbox {
     return current;
   }
 
-  private async writePresence(member: Membership, status: 'idle' | 'busy' | 'paused'): Promise<void> {
+  private async writePresence(member: Membership, status: 'idle' | 'busy' | 'paused', createParent = true): Promise<void> {
     const text = JSON.stringify({ token: member.token, status, seen: Date.now() } satisfies Presence);
-    await writeAtomic(this.presencePath(member.team, member.alias), text, 'none');
+    await writeAtomic(this.presencePath(member.team, member.alias), text, 'none', createParent);
   }
 
   /** Lock-free heartbeat: touches only this member's own presence file. */
@@ -227,7 +327,9 @@ export class Mailbox {
     const record = await this.readState(member.team, true);
     const current = record.payload.members.find(m => m.alias === member.alias && m.token === member.token);
     if (!current || current.status === 'offline') throw new Error('Membership expired or replaced. Rejoin the team.');
-    await this.writePresence(member, status);
+    // A lifecycle operation can move/delete the team after the lock-free read.
+    // Never recreate that old directory from a late heartbeat.
+    await this.writePresence(member, status, false);
   }
 
   /**
@@ -276,6 +378,62 @@ export class Mailbox {
     await this.mutate(member.team, state => { this.owner(state, member); });
   }
 
+  async removeMember(member: Membership, alias: string): Promise<{ settled: number }> {
+    identifier(alias);
+    const result = await this.mutate(member.team, state => {
+      const actor = this.owner(state, member);
+      const target = state.members.find(candidate => candidate.alias === alias);
+      if (!target) throw new Error(`Unknown teammate "${alias}"`);
+      if (target.alias === actor.alias) throw new Error('Use /team leave instead of removing yourself.');
+      if (target.status !== 'offline') throw new Error(`Teammate "${alias}" is active; ask them to leave first.`);
+      const affected = state.messages.filter(message =>
+        ['pending', 'processing'].includes(message.state) &&
+        (message.to === alias || (message.from === alias && message.kind === 'request')));
+      for (const message of affected) {
+        if (message.kind === 'request' && message.to === alias) {
+          this.finish(state, message, {
+            outcome: 'interrupted',
+            body: `Teammate "${alias}" was removed. Work was not automatically retried. Review before continuing.`,
+            files: [], tests: [],
+          });
+        } else {
+          message.state = message.kind === 'request' ? 'interrupted' : 'seen';
+          delete message.claim;
+        }
+      }
+      state.members = state.members.filter(candidate => candidate.alias !== alias);
+      return { settled: affected.length };
+    });
+    await unlink(this.presencePath(member.team, alias)).catch(() => {});
+    return result;
+  }
+
+  async renameMember(member: Membership, alias: string, nextAlias: string): Promise<Membership> {
+    identifier(alias); identifier(nextAlias);
+    if (alias === nextAlias) throw new Error('Choose a different teammate alias.');
+    const renamed = await this.mutate(member.team, state => {
+      const actor = this.owner(state, member);
+      const target = state.members.find(candidate => candidate.alias === alias);
+      if (!target) throw new Error(`Unknown teammate "${alias}"`);
+      if (state.members.some(candidate => candidate.alias === nextAlias)) throw new Error(`Alias "${nextAlias}" already exists.`);
+      if (target.alias !== actor.alias && target.status !== 'offline') {
+        throw new Error(`Teammate "${alias}" is active; only that session can rename itself.`);
+      }
+      target.alias = nextAlias;
+      if (target.token === actor.token) target.seen = Date.now();
+      for (const message of state.messages) {
+        if (message.from === alias) message.from = nextAlias;
+        if (message.to === alias) message.to = nextAlias;
+      }
+      return { team: target.team, alias: target.alias, session: target.session, token: target.token };
+    });
+    if (member.alias === alias) {
+      await this.writePresence(renamed, 'idle').catch(() => {});
+    }
+    await unlink(this.presencePath(member.team, alias)).catch(() => {});
+    return renamed;
+  }
+
   async leave(member: Membership): Promise<void> {
     await this.mutate(member.team, state => { this.disconnect(state, this.owner(state, member)); });
     await unlink(this.presencePath(member.team, member.alias)).catch(() => {});

package/src/store.ts

@@ -110,9 +110,8 @@ async function syncDirectory(path: string): Promise<void> {
 }
 
 /** Atomic last-writer-wins write for records without revision history (presence). */
-export async function writeAtomic(path: string, text: string, durability: Durability = 'full'): Promise<void> {
-  // Always: the presence directory does not exist before its first write.
-  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+export async function writeAtomic(path: string, text: string, durability: Durability = 'full', createParent = true): Promise<void> {
+  if (createParent) await mkdir(dirname(path), { recursive: true, mode: 0o700 });
   const tmp = `${path}.${randomUUID()}.tmp`;
   const handle = await open(tmp, 'wx', 0o600);
   try {
@@ -151,6 +150,17 @@ async function acquireLock(lockPath: string) {
   return await tryLock(lockPath) ?? (() => { throw locked(); })();
 }
 
+/** Run one storage operation while holding a caller-chosen private lock. */
+export async function withFileLock<T>(lockPath: string, action: () => Promise<T>, createParent = true): Promise<T> {
+  if (createParent) await mkdir(dirname(lockPath), { recursive: true, mode: 0o700 });
+  const lock = await acquireLock(lockPath);
+  try { return await action(); }
+  finally {
+    await lock.close();
+    await unlink(lockPath).catch(() => {});
+  }
+}
+
 async function pruneRevisions(dir: string, latest: number): Promise<void> {
   const revisionsDir = join(dir, 'revisions');
   const names = await readdir(revisionsDir).catch(() => [] as string[]);
@@ -162,6 +172,50 @@ async function pruneRevisions(dir: string, latest: number): Promise<void> {
   }
 }
 
+/**
+ * Publication body for callers that already hold the record's lock. It still
+ * checks the expected revision, but does not acquire or release a lock itself.
+ */
+export async function publishLocked<T>(
+  path: string, expectedRevision: number, payload: T, normalize: Normalize<T>,
+  options: { maxBytes: number; durability?: Durability; payloadJson?: string; currentNormalize?: Normalize<T> },
+): Promise<Record<T>> {
+  const durability = options.durability ?? 'full';
+  // Check the revision before creating a missing parent. A stale writer racing
+  // a team deletion must fail rather than recreate an empty ghost directory.
+  const current = await readRecord(path, options.currentNormalize ?? normalize, options.maxBytes);
+  const revision = current?.revision ?? 0;
+  if (revision !== expectedRevision) {
+    throw Object.assign(new Error(`Record changed before the write; current revision is ${revision}.`), { code: 'STALE_REVISION' });
+  }
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  const next = revision + 1;
+  // Supplied by callers that already serialized this exact object; it must
+  // equal JSON.stringify(payload). The record stays self-consistent either
+  // way, because the hash is taken over the string that gets embedded.
+  const payloadJson = options.payloadJson ?? JSON.stringify(payload);
+  const text = `{"schemaVersion":1,"revision":${next},"contentHash":"${sha256(payloadJson)}","payload":${payloadJson}}`;
+  if (Buffer.byteLength(text) > options.maxBytes) throw new Error('Record size limit exceeded.');
+  const historyPath = join(dirname(path), 'revisions', `${next}.json`);
+  const previous = await readRecord(historyPath, (raw: string) => envelope<T>(raw), options.maxBytes);
+  if (previous && (previous.revision !== next || (previous.payloadJson ?? JSON.stringify(previous.payload)) !== payloadJson)) {
+    throw new Error('An interrupted publication owns this revision; explicit recovery is required.');
+  }
+  if (!previous) await writeAtomic(historyPath, text, durability);
+  // Point `path` at the inode already holding the history copy: one write
+  // per publication, and the current record shares bytes with its revision.
+  const tmp = `${path}.${randomUUID()}.tmp`;
+  await link(historyPath, tmp);
+  try {
+    await rename(tmp, path);
+    if (durability === 'full') await syncDirectory(path);
+  } finally { await unlink(tmp).catch(() => {}); }
+  cache.delete(path);
+  counters.publishes++;
+  await pruneRevisions(dirname(path), next).catch(() => {});
+  return { revision: next, payload, payloadJson };
+}
+
 /**
  * Compare-and-swap publication. Fails fast with STALE_REVISION when the record
  * moved since the caller's read, or RECORD_LOCKED while another writer holds
@@ -169,45 +223,25 @@ async function pruneRevisions(dir: string, latest: number): Promise<void> {
  */
 export async function publish<T>(
   path: string, expectedRevision: number, payload: T, normalize: Normalize<T>,
-  options: { maxBytes: number; durability?: Durability; payloadJson?: string },
+  options: { maxBytes: number; durability?: Durability; payloadJson?: string; lockPath?: string },
 ): Promise<Record<T>> {
-  const durability = options.durability ?? 'full';
-  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-  const lockPath = `${path}.lock`;
-  const lock = await acquireLock(lockPath);
-  try {
+  const legacyLock = `${path}.lock`;
+  const primaryLock = options.lockPath ?? legacyLock;
+  // Releases before 0.6.0 lock the record path, while lifecycle-safe writers
+  // use the stable external team lock. During a rolling reload both versions
+  // can be alive, so new normal publications must intersect both lock sets or
+  // two writers can pass the revision check and publish the same next revision.
+  return withFileLock(primaryLock, async () => {
+    if (primaryLock === legacyLock) return publishLocked(path, expectedRevision, payload, normalize, options);
+    // Acquiring an in-directory compatibility lock must not recreate a team
+    // that a lifecycle operation deleted while this writer was waiting for the
+    // stable lock. Revision-zero creation is the only intentional exception.
     const current = await readRecord(path, normalize, options.maxBytes);
-    const revision = current?.revision ?? 0;
-    if (revision !== expectedRevision) {
-      throw Object.assign(new Error(`Record changed before the write; current revision is ${revision}.`), { code: 'STALE_REVISION' });
-    }
-    const next = revision + 1;
-    // Supplied by callers that already serialized this exact object; it must
-    // equal JSON.stringify(payload). The record stays self-consistent either
-    // way, because the hash is taken over the string that gets embedded.
-    const payloadJson = options.payloadJson ?? JSON.stringify(payload);
-    const text = `{"schemaVersion":1,"revision":${next},"contentHash":"${sha256(payloadJson)}","payload":${payloadJson}}`;
-    if (Buffer.byteLength(text) > options.maxBytes) throw new Error('Record size limit exceeded.');
-    const historyPath = join(dirname(path), 'revisions', `${next}.json`);
-    const previous = await readRecord(historyPath, (raw: string) => envelope<T>(raw), options.maxBytes);
-    if (previous && (previous.revision !== next || (previous.payloadJson ?? JSON.stringify(previous.payload)) !== payloadJson)) {
-      throw new Error('An interrupted publication owns this revision; explicit recovery is required.');
+    if (!current && expectedRevision !== 0) {
+      throw Object.assign(new Error('Record changed before the write; current revision is 0.'), { code: 'STALE_REVISION' });
     }
-    if (!previous) await writeAtomic(historyPath, text, durability);
-    // Point `path` at the inode already holding the history copy: one write
-    // per publication, and the current record shares bytes with its revision.
-    const tmp = `${path}.${randomUUID()}.tmp`;
-    await link(historyPath, tmp);
-    try {
-      await rename(tmp, path);
-      if (durability === 'full') await syncDirectory(path);
-    } finally { await unlink(tmp).catch(() => {}); }
-    cache.delete(path);
-    counters.publishes++;
-    await pruneRevisions(dirname(path), next).catch(() => {});
-    return { revision: next, payload, payloadJson };
-  } finally {
-    await lock.close();
-    await unlink(lockPath).catch(() => {});
-  }
+    if (!current) await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    return withFileLock(legacyLock,
+      () => publishLocked(path, expectedRevision, payload, normalize, options), false);
+  });
 }