ace-overseer 0.17.0 → 0.18.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 860e9ff0d0d664c563c1fa9139d5f0d18b2e4c869239424e881dd2a018ad12bc
-  data.tar.gz: 55c0694f24f3a4d8ea9492df5f552e42fb2171cc75bd848988b642171f1b1e3c
+  metadata.gz: d3fe6826e192a1bb720405c3b53d7fa5f61faeb3bf382ecdef6bfddcc3497c69
+  data.tar.gz: e46d2230ef2aac4b5e3c6eea8b3545d25efcdcc9b9481220a2efb6c922ff6102
 SHA512:
-  metadata.gz: 6bb2d12eb03983cc5b10f9b71f72fea46c25c39e6394e02060a9e505767400d2a57a1da1794140235a9e1b6f0f01fa01f89287755b5d7af6490497312e1375ed
-  data.tar.gz: 830f8f444002616d28121d391b95d85cc50a07c18b6bf0f63a4e7186d332cb7a118d7b3ef059e7d11d24e7e37f37a2305eeb15bcda5a63ecc2fc42469dd5f204
+  metadata.gz: 4b02701a464f6717a60095b7c29e4e05fa86a80a96885805c378a6fd7d26b265badc57ba17d318a7142364571729916edf15f23ac61bc66c2a96fd10ddf0a01a
+  data.tar.gz: 533d1502fc901da26569f44aa31e085489b639eac47418dba12b9f97e3987fee7fbb6d572dd8ff3ff57908accbc0f1355ab76a5bf043dc52cad880d8a641aea4

data/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.18.2] - 2026-10-02
+
+### Technical
+- Follow the ace-assign 0.61 release line for journal-backed service effects.
+- Updated the ace-tmux dependency to the 0.18 adapter release line.
+
+## [0.18.1] - 2026-10-01
+
+### Technical
+- Follow the ace-assign 0.60 release line for durable review campaign evidence.
+
+## [0.18.0] - 2026-09-29
+
+### Added
+- Preservation manifest for prune: `ace-overseer prune --preservation FILE` accepts a strict `version: 1` YAML manifest declaring cross-repository destinations (source repo/base/head, destination repo/base/head/branch); entries are resolved to exact commits, and duplicate, self-destination, or unmatched entries fail before any apply action.
+- Git preservation proofs on the actual prune path: accepted-ancestor containment against the surviving base branch, or verified-destination proof by full-tree equality or exact path-by-path transition (paths, modes, symlinks, binary content) across separate bases. Patch-range proofs require the independently recorded attempt baseline (`base_head`), and the baseline itself must survive on an accepted ref; empty or truncated ranges are never proof.
+- Fail-closed Lab prune classification: `ace-overseer prune WORK --runtime lab` requires an authoritative terminal Work state plus preservation data (`repo`/`head`/`branch`) provable in the hosted repository; apply re-reads state immediately before `lab work destroy` and blocked Works are never destroyed.
+
+### Changed
+- BREAKING: `--force` no longer removes unsafe worktrees; it only skips the confirmation for already-safe candidates. Missing, failed or ambiguous preservation evidence, dirty tracked or untracked files, active or uncertain attempts, unreadable lifecycle state, and failed rechecks now always block deletion -- including under `--yes` and `--quiet`.
+- Prune preview is read-only (no stale-metadata mutation); apply holds a durable lifecycle exclusion shared with assignment/driver/work-on start paths from final evidence reads through removal, deletes the worktree without force or untracked suppression, and deletes the branch only after re-verifying its tip identity. Removal is recorded so later starts fail closed instead of recreating a deleted identity.
+- Assignment cache prune requires the durable evidence ref (`refs/ace/execution`, never deleted) to confirm every attempt terminal for managed assignments; only the assignment cache directory is removed.
+- Unmatched explicit prune targets are errors, apply exits nonzero when any candidate is blocked or removal fails (independent safe candidates still complete), quiet mode suppresses progress but never failure signaling, and dry-run performs the same proof classification with no cleanup side effects.
+
 ## [0.17.0] - 2026-09-29
 
 ### Added
@@ -380,7 +404,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [0.4.17] - 2026-03-02
 
 ### Changed
-- Replace `ace-taskflow` dependency with `ace-task` — migrate `WorkOnOrchestrator` and `PruneSafetyChecker` to use `Ace::Task::Organisms::TaskManager` API
+- Replace `ace-taskflow` dependency with `ace-task` -- migrate `WorkOnOrchestrator` and `PruneSafetyChecker` to use `Ace::Task::Organisms::TaskManager` API
 - Remove bare `require "ace/taskflow"` import, add `require "ace/task"`
 
 ## [0.4.16] - 2026-02-26
@@ -470,14 +494,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [0.4.2] - 2026-02-19
 
 ### Added
-- Orchestrator subtask expansion for `work-on-tasks` preset — when a task is an orchestrator with subtasks, `AssignmentLauncher` expands subtask refs into individual foreach steps (e.g., `work-on-272.01`, `work-on-272.02`) instead of a single `work-on-272` step
+- Orchestrator subtask expansion for `work-on-tasks` preset -- when a task is an orchestrator with subtasks, `AssignmentLauncher` expands subtask refs into individual foreach steps (e.g., `work-on-272.01`, `work-on-272.02`) instead of a single `work-on-272` step
 - `extract_subtask_refs` helper in `WorkOnOrchestrator` to extract subtask numbers from orchestrator task data
 - `subtask_refs:` keyword argument on `AssignmentLauncher#launch` for passing expanded subtask references
 
 ## [0.4.1] - 2026-02-19
 
 ### Added
-- `--watch` / `-w` option for `status` command — auto-refreshing dashboard with ANSI screen clear
+- `--watch` / `-w` option for `status` command -- auto-refreshing dashboard with ANSI screen clear
 - Two-tier refresh: fast interval (15s default) refreshes assignment data only, slow interval (5min default) does full git/PR refresh
 - `collect_assignments_only` method on `WorktreeContextCollector` for lightweight assignment-only collection with cached git data
 - `collect_quick` method on `StatusCollector` to reuse previous snapshot's git data while refreshing assignments
@@ -487,7 +511,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [0.4.0] - 2026-02-19
 
 ### Added
-- Progress bar visualization in assignment sub-rows — filled/empty bar segments alongside numeric counts
+- Progress bar visualization in assignment sub-rows -- filled/empty bar segments alongside numeric counts
 - Current step name display for running assignments (e.g., `implement` shown dimmed after progress)
 - Header row and separator line above hierarchical dashboard for column labeling
 - Blank line separators between location groups for visual breathing room
@@ -499,7 +523,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [0.3.1] - 2026-02-19
 
 ### Changed
-- Hierarchical status display — location header rows with assignment sub-rows replace flat single-row format
+- Hierarchical status display -- location header rows with assignment sub-rows replace flat single-row format
 - `WorkContext` model uses `assignments` array instead of singular `assignment_status` + `assignment_count`
 - `WorktreeContextCollector` loads all assignments via `AssignmentDiscoverer` instead of only active via `AssignmentExecutor`
 - `StatusFormatter` emits two row types: location header (basename + PR + Git) and indented assignment sub-rows (ID + name + state + progress)
@@ -513,7 +537,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [0.3.0] - 2026-02-19
 
 ### Added
-- Assignment-aware status display — main branch appears in `status` when it has active assignments
+- Assignment-aware status display -- main branch appears in `status` when it has active assignments
 - Assignment count shown in Assign column when location has multiple assignments (e.g., `abc12 (3)`)
 - `--assignment` / `-a` option for `prune` command to remove a specific assignment's cache directory
 - `AssignmentPruneCandidate` model for assignment-level prune safety checking
@@ -533,16 +557,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- `TmuxWindowOpener` delegates entirely to `ace-tmux window` CLI — no longer manages session names, window names, or presets
+- `TmuxWindowOpener` delegates entirely to `ace-tmux window` CLI -- no longer manages session names, window names, or presets
 - Remove `tmux_session_name`, `window_name_format`, and `window_preset` config options
-- Remove `WindowNameFormatter` atom — window naming is ace-tmux's responsibility
+- Remove `WindowNameFormatter` atom -- window naming is ace-tmux's responsibility
 - `PruneOrchestrator` uses worktree path basename for window cleanup instead of formatted names
 
 ## [0.2.16] - 2026-02-19
 
 ### Changed
 
-- `TmuxWindowOpener` no longer manages tmux sessions — delegates entirely to ace-tmux `WindowManager` for window creation, session detection, and dedup
+- `TmuxWindowOpener` no longer manages tmux sessions -- delegates entirely to ace-tmux `WindowManager` for window creation, session detection, and dedup
 
 ## [0.2.15] - 2026-02-19
 
@@ -559,7 +583,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [0.2.13] - 2026-02-19
 
 ### Added
-- Progress callbacks (`on_progress:`) for `work-on` and `prune` orchestrators — one-line status output per step
+- Progress callbacks (`on_progress:`) for `work-on` and `prune` orchestrators -- one-line status output per step
 - Prune now displays safe/skipped candidates with reasons before the "Continue?" confirmation prompt
 
 ### Changed

data/docs/usage.md

@@ -69,14 +69,31 @@ Arguments:
 Options:
 
 - `--assignment`, `-a`: prune a specific assignment by ID
-- `--force`, `-f`: force-remove unsafe worktrees
+- `--force`, `-f`: skip the interactive confirmation for already-safe candidates; never bypasses preservation, dirtiness, lifecycle or revalidation blocks
 - `--yes`, `-y`: skip interactive confirmation
-- `--dry-run`: list prune candidates only
-- `--runtime`: `tmux` (default) or `lab`; Lab accepts dry-run only and delegates destruction to the exact `lab work destroy WORK --confirm` command
-- `--quiet`, `-q`: suppress non-essential output
+- `--dry-run`: run the same proof classification as apply, changing no worktrees, refs, assignment state or metadata (a dry-run receipt is not reusable authorization)
+- `--preservation FILE`: YAML manifest (`version: 1`, `candidates:`) declaring cross-repository destinations for migrated work; a claim to verify, never proof by itself
+- `--runtime`: `tmux` (default) or `lab`
+- `--quiet`, `-q`: suppress progress output; blocked/failed results still print and signal through the exit code
 - `--debug`, `-d`: show debug output
 - `--help`, `-h`: show help
 
+### Prune safety (enforced)
+
+Every candidate is deleted only after executed proofs; missing, failed or
+ambiguous evidence preserves the candidate, and `--force`/`--yes` never
+override a block:
+
+- Preservation: source HEAD is contained in the surviving accepted base branch, or a declared destination is verified -- accepted on its surviving destination branch -- with full-tree equality or an exact content transition (paths, modes, symlinks, binary content) across separate bases. Patch-range proofs additionally require the independently recorded attempt baseline, and that baseline itself must survive on an accepted ref.
+
+- No active writer: recorded attempts must be terminal (active or uncertain attempts block; unreadable attempt state blocks); assignment/driver/start paths and prune share a durable exclusion that survives removal of the target, so no second writer can enter during deletion; dirty tracked or untracked files are work and block deletion, even with `--force`.
+
+- Assignment cache: cleanup removes only the assignment cache directory after the durable journal evidence (`refs/ace/execution`, never deleted) confirms every attempt terminal; the journal checkout is never removed.
+
+- Exit codes: dry-run always exits 0 (blocked candidates are listed); apply exits nonzero when any selected candidate is blocked or removal fails, while independent safe candidates still complete.
+
+- Unmatched explicit targets are errors; empty automatic selection is a no-op; cancelled confirmation deletes nothing.
+
 ## Example Flows
 
 Start task work: `ace-overseer work-on --task 8q4.t.umu.1`.
@@ -85,6 +102,25 @@ Check dashboard: `ace-overseer status`.
 
 Preview then prune: `ace-overseer prune --dry-run`, then `ace-overseer prune --yes`.
 
+Prune migrated work with a declared destination:
+
+```bash
+mkdir -p .ace-local/prune
+cat > .ace-local/prune/destinations.yml <<'YAML'
+version: 1
+candidates:
+  - worktree_path: /abs/path/.ace-wt/task.230
+    source_repo: /abs/path
+    source_base: <base-sha>
+    source_head: <head-sha>
+    destination_repo: /abs/successor
+    destination_base: <dest-base-sha>
+    destination_head: <accepted-head-sha>
+    destination_branch: refs/heads/main
+YAML
+ace-overseer prune task.230 --preservation .ace-local/prune/destinations.yml --dry-run
+```
+
 ## Lab Runtime
 
 Lab commands are available only where `/usr/local/bin/lab` is installed. ACE
@@ -98,7 +134,7 @@ does not read Lab credentials and does not call Podman or Herdr directly.
 - `ace-overseer prompt --work WORK --file PATH`: forward prompt text from a file to the Work pane. Piped stdin is also supported; prompt text is never passed as a process argument.
 - `ace-overseer review --work WORK --pr NUMBER`: prepare an exact-head admin review checkout and pane.
 - `ace-overseer stop --work WORK`: stop the assigned process without destroying Work state.
-- `ace-overseer prune WORK... --runtime lab --dry-run`: preview exact Work destruction commands; rerun with `--yes` to delegate each destruction to Lab.
+- `ace-overseer prune WORK... --runtime lab --dry-run`: classify each Work -- documented terminal state, no in-flight work, and preservation data (`repo`/`head`/`branch`) provable in the hosted repository. Apply with `--yes` re-verifies state immediately before delegating each destruction to `lab work destroy WORK --confirm`; blocked Works are never destroyed and the run exits nonzero. The raw Lab CLI cannot make the state check and the destruction atomic, so this adapter reports the path unsupported and preserves the Work; only a Lab surface with an atomic guarded destroy delegates.
 
 Example:
 

data/handbook/workflow-instructions/overseer.wf.md

@@ -6,10 +6,9 @@ doc-type: workflow
 title: Overseer Workflow
 purpose: Binding process contract for the overseer lifecycle (work-on, status, prune) with executed-check contracts for prune safety and status truth.
 ace-docs:
-  last-updated: '2026-09-28'
-  last-checked: '2026-09-28'
+  last-updated: '2026-09-29'
+  last-checked: '2026-09-29'
 ---
-
 # Overseer Workflow
 
 ## Goal
@@ -79,7 +78,7 @@ ace-overseer prune --yes
 ```
 
 - Targeted: `ace-overseer prune <task-ref|folder>...` or `ace-overseer prune --assignment <assignment-id>`
-- Lab runtime: `ace-overseer prune <work-id>... --runtime lab --dry-run`, rerun with `--yes` to delegate each destruction to Lab.
+- Lab runtime: `ace-overseer prune <work-id>... --runtime lab --dry-run`, rerun with `--yes` to delegate each destruction to Lab. The raw Lab CLI cannot make the no-writer check and the destruction atomic, so it is classified unsupported and preserved; only a Lab surface with an atomic guarded destroy delegates.
 
 #### Prune safety (non-negotiable executed check)
 
@@ -101,43 +100,25 @@ candidate:
    plus content equivalence. A matching commit subject is never sufficient
    proof:
 
-   1. Declare the destination concretely: successor repository plus
-      branch/PR/commit that received the work.
-   2. Verify the destination actually accepted the work, executed in this
-      session:
-
-      ```bash
-      git -C <successor-repo> merge-base --is-ancestor <dest-ref> <dest-branch>
-      ```
-
-      rc=0 proves the destination landed on the declared branch (or read
-      the merged/accepted state from the forge hosting the PR).
-
-   3. Prove the destination carries the same work by content, not by
-      name. Pass with exactly one of:
-
-      - Tree/artifact equivalence -- the squashed result is the same
-        content:
-
-          ```bash
-          test "$(git -C <successor-repo> rev-parse '<dest-ref>^{tree}')" \
-            = "$(git rev-parse '<work-head>^{tree}')"
-          ```
-
-      - Patch equivalence -- the same changes, compared inside the
-        successor repository. Fetch the source proof refs first and
-        range-diff with separate source and destination bases:
-
-          ```bash
-          git -C <successor-repo> fetch <source-repo> <source-base> <work-head>
-          git -C <successor-repo> range-diff \
-            <source-base>...<work-head> <dest-base>...<dest-ref>
-          ```
-
-          with no substantive differences; or diff the normalized patches
-          (`git show --format=` output of each side) and require an empty
-          diff.
-
+   1. Declare the destination concretely in a preservation manifest
+      (`--preservation FILE`, schema in `docs/usage.md`): successor
+      repository, separate destination base/head, and the surviving
+      destination branch. The manifest is a claim to verify -- never
+      authorization or proof by itself.
+   2. Run `ace-overseer prune <target> --preservation FILE --dry-run`. The
+      tool executes the proof in this session: it verifies the declared
+      source identity against the live worktree (repo and current HEAD),
+      verifies the destination base/head are accepted on the surviving
+      destination branch, and proves content by full-tree equality or an
+      exact path-by-path transition (paths, modes, symlinks, binary
+      content) between separate bases. Never fetch proof refs into shared
+      repositories or worktrees, and never interpret diff-tool
+      output, commit titles, PR reports, or CI status as content proof.
+   3. Patch-range proof additionally requires the independently recorded
+      attempt baseline (`base_head`), and that baseline itself must be
+      preserved on a surviving accepted ref; without it only full-tree
+      equality or accepted ancestry proves preservation. Empty or
+      caller-truncated ranges are not evidence.
    4. Ambiguity preserves: conflicting hashes, an unverifiable destination,
       or a failed equivalence check means no proof -- block the prune per
       step 5.
@@ -151,9 +132,13 @@ candidate:
 
    For assignment-backed candidates also check `ace-assign status`; for Lab
    runtime candidates check `ace-overseer status --runtime lab`. A running
-   assignment, an in-flight Lab work, or any unaccounted writer blocks the
-   prune. Missing or unreadable lifecycle state counts as an active writer
-   -- preserve.
+   assignment, an active or uncertain attempt, an in-flight Lab work, or any
+   unaccounted writer blocks the prune. Missing or unreadable lifecycle
+   state counts as an active writer -- preserve. `ace-overseer prune`
+   enforces this itself: apply holds a durable exclusion shared with every
+   supported start path from final evidence reads through removal, so a
+   writer cannot start into a candidate being deleted, and a candidate that
+   changes after preview is re-blocked at the destructive boundary.
 
 4. A described or remembered proof is never sufficient -- run the commands
    and observe the results in this session.
@@ -161,18 +146,18 @@ candidate:
 5. Any commit without a proven copy, any failed or ambiguous equivalence,
    or any active-writer evidence **blocks the prune** for that worktree.
    Report the blocked candidate (ref, head SHA, missing proof) to the
-   operator; never silently drop it and never force past a failed proof.
-   Preserve on ambiguity.
+   operator; never silently drop it and never bypass a failed proof with
+   `--force`. Preserve on ambiguity.
 
 ## Non-Negotiable Contracts Summary
 
 | Contract     | Claim | Executed proof |
 |--------------|-------|----------------|
-| Prune safety | "The work is preserved and nothing is actively writing" | `git merge-base --is-ancestor <work-head> <base>` (rc=0), or verified destination + tree/artifact or patch equivalence; plus `ace-overseer status --format json` (assignment/Lab status where applicable) showing no active writer |
+| Prune safety | "The work is preserved and nothing is actively writing" | `git merge-base --is-ancestor <work-head> <base>` (rc=0), or a verified declared destination (--preservation) with tree/artifact or exact content-transition equivalence; plus the executed no-writer reconciliation (overseer/assignment/Lab status, terminal attempts, durable prune/start exclusion) |
 | Status truth | "The task is blocked on the owner" | An executable non-secret check run in this session; stale tasks closed/corrected in the same change |
 
 ## Success Criteria
 
 - Work starts only through `ace-overseer work-on` (or the Lab-runtime equivalent), never through ad-hoc manual worktree provisioning.
 - Every status review re-verified pending owner-blocked tasks with an executed check and corrected stale state in the same change.
-- Every pruned worktree/branch had an executed preservation proof (ancestor containment, or a verified destination with tree/artifact or patch equivalence) and an executed no-active-writer check; candidates without complete proof were reported as blocked, not removed.
+- Every pruned worktree/branch had an executed preservation proof (ancestor containment, or a verified destination with tree/artifact or exact content-transition equivalence) and an executed no-active-writer check; candidates without complete proof were reported as blocked, not removed; `--force` and `--yes` never bypassed a safety block.

data/lib/ace/overseer/cli/commands/prune.rb

@@ -7,24 +7,31 @@ module Ace
         class Prune < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
 
-          desc "Clean up completed task worktrees"
+          desc "Clean up completed task worktrees with executed preservation and no-writer proofs"
 
           argument :targets, required: false, type: :array, desc: "Task refs or folder names to prune"
 
           option :assignment, aliases: ["-a"], type: :string, desc: "Prune a specific assignment by ID"
-          option :force, aliases: ["-f"], type: :boolean, default: false, desc: "Force-remove unsafe worktrees"
+          option :force, aliases: ["-f"], type: :boolean, default: false,
+            desc: "Skip the confirmation prompt for already-safe candidates; never bypasses safety blocks"
           option :yes, aliases: ["-y"], type: :boolean, default: false, desc: "Skip confirmation"
-          option :dry_run, type: :boolean, default: false, desc: "Show candidates only"
-          option :quiet, aliases: ["-q"], type: :boolean, default: false, desc: "Suppress non-essential output"
+          option :dry_run, type: :boolean, default: false, desc: "Show candidates only (no cleanup side effects)"
+          option :quiet, aliases: ["-q"], type: :boolean, default: false,
+            desc: "Suppress progress output; failures still print and signal via exit code"
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
           option :runtime, default: "tmux", desc: "Runtime (tmux, lab)"
+          option :preservation, type: :string,
+            desc: "YAML manifest (version 1) declaring verified cross-repository destinations"
 
-          def initialize(orchestrator: nil, input: $stdin, output: $stdout, lab_client: nil)
+          def initialize(orchestrator: nil, input: $stdin, output: $stdout, lab_client: nil,
+            lab_safety_checker: nil, preservation_checker: nil)
             super()
             @orchestrator = orchestrator || Organisms::PruneOrchestrator.new
             @input = input
             @output = output
             @lab_client = lab_client || Molecules::LabClient.new
+            @lab_safety_checker = lab_safety_checker || Molecules::LabPruneSafetyChecker.new
+            @preservation_checker = preservation_checker || Molecules::GitPreservationChecker.new
           end
 
           def call(**options)
@@ -45,15 +52,22 @@ module Ace
               force: options[:force],
               targets: targets,
               assignment_id: options[:assignment],
+              preservation_manifest: options[:preservation],
               input: @input,
               output: @output,
               on_progress: progress
             )
 
-            return if options[:quiet]
-
             if options[:assignment]
               print_assignment_result(result)
+              return if options[:dry_run] || result[:aborted]
+
+              raise Ace::Support::Cli::Error, "Assignment #{options[:assignment]} is blocked: " \
+                "#{result[:assignment_candidate].reasons.join(", ")}" if result[:blocked]
+              unless result[:pruned_assignments].any?
+                raise Ace::Support::Cli::Error, "Failed to remove assignment #{options[:assignment]}"
+              end
+
               return
             end
 
@@ -62,14 +76,19 @@ module Ace
               return
             end
 
-            if result[:aborted]
-              puts "Prune aborted."
-              return
-            end
+            puts "Prune aborted." if result[:aborted]
+            return if result[:aborted]
 
             print_apply(result)
-          rescue => e
-            raise Ace::Support::Cli::Error.new(e.message)
+
+            blocked_count = Array(result[:unsafe]).length + Array(result[:blocked]).length +
+              Array(result[:failed]).length
+            return if blocked_count.zero?
+
+            raise Ace::Support::Cli::Error,
+              "#{blocked_count} candidate(s) blocked or failed; nothing unsafe was removed"
+          rescue Ace::Overseer::Error => e
+            raise Ace::Support::Cli::Error, e.message
           end
 
           private
@@ -77,23 +96,112 @@ module Ace
           def prune_lab(**options)
             raise Ace::Support::Cli::Error, "--assignment is not supported with Lab runtime; provide exact Work IDs" if options[:assignment]
             raise Ace::Support::Cli::Error, "--force is not supported with Lab runtime" if options[:force]
+            raise Ace::Support::Cli::Error, "--preservation is not supported with Lab runtime" if options[:preservation]
 
             works = Array(options[:targets]).map(&:to_s)
             raise Ace::Support::Cli::Error, "provide at least one exact Lab Work ID to prune" if works.empty?
 
-            if options[:dry_run]
-              return if options[:quiet]
+            classifications = if atomic_destroy_supported?
+              works.to_h do |work|
+                [work, @lab_safety_checker.check(
+                  lab_client: @lab_client,
+                  work_id: work,
+                  preservation_proof: lab_preservation_proof(work)
+                )]
+              end
+            else
+              # The raw Lab surface cannot make the no-writer check and the
+              # destruction atomic; claiming a probe was safe would be a
+              # lie, so the whole path is unsupported and preserved.
+              unsupported = Molecules::LabPruneSafetyChecker::Classification.new(
+                safe?: false,
+                reason: "lab runtime cannot make the no-writer check and destruction atomic; " \
+                  "preserve the Work instead"
+              )
+              works.to_h { |work| [work, unsupported] }
+            end
 
-              works.each { |work| puts "Would destroy Lab Work #{work}: /usr/local/bin/lab work destroy #{work} --confirm" }
+            if options[:dry_run]
+              print_lab_dry_run(classifications)
               return
             end
 
             raise Ace::Support::Cli::Error, "Lab prune requires --yes after reviewing --dry-run" unless options[:yes]
 
+            blocked = []
+            destroyed = []
             works.each do |work|
+              classification = classifications[work]
+              unless classification.safe?
+                blocked << [work, classification.reason]
+                next
+              end
+
+              # Guarded delegation: re-read the authoritative state
+              # immediately before destroy; a changed state aborts.
+              recheck = @lab_safety_checker.check(
+                lab_client: @lab_client,
+                work_id: work,
+                preservation_proof: lab_preservation_proof(work)
+              )
+              unless recheck.safe?
+                blocked << [work, "state changed before destroy: #{recheck.reason}"]
+                next
+              end
+
               result = @lab_client.call("work", "destroy", work, "--confirm", json: false)
+              destroyed << work
               puts result unless options[:quiet]
             end
+
+            blocked.each do |work, reason|
+              puts "Blocked: lab work #{work}: #{reason}"
+            end
+            puts "#{destroyed.length} lab work(s) destroyed." unless options[:quiet]
+            return if blocked.empty?
+
+            raise Ace::Support::Cli::Error, "#{blocked.length} lab work(s) blocked; nothing unsafe was destroyed"
+          end
+
+          # Delegation is only honest when the Lab surface itself can make
+          # the state check and the destruction atomic. The raw CLI adapter
+          # cannot, so it reports unsupported; adapters with an atomic
+          # guarded destroy opt in.
+          def atomic_destroy_supported?
+            @lab_client.respond_to?(:supports_atomic_destroy?) && @lab_client.supports_atomic_destroy?
+          end
+
+          # Preservation evidence for a Lab Work comes from the Work's own
+          # documented surviving identity (repo/head/branch). A surface that
+          # does not document it cannot prove preservation.
+          def lab_preservation_proof(work)
+            entry = @lab_client.work_entry(work)
+            return Models::PreservationProof.blocked("lab work #{work} not found in authoritative status") if entry.nil?
+
+            repo = entry["repo"].to_s
+            head = entry["head"].to_s
+            branch = entry["branch"].to_s
+            if repo.empty? || head.empty? || branch.empty? || !repo.start_with?("/")
+              return Models::PreservationProof.blocked(
+                "lab work #{work} does not document preservation data (repo/head/branch)"
+              )
+            end
+
+            accepted_base = @preservation_checker.accepted_base_for(repo)
+            @preservation_checker.ancestry_proof(repo: repo, head: head, accepted_base: accepted_base)
+          rescue Ace::Overseer::Error => e
+            Models::PreservationProof.blocked("lab preservation evidence unavailable: #{e.message}")
+          end
+
+          def print_lab_dry_run(classifications)
+            puts "Lab prune classification:"
+            classifications.each do |work, classification|
+              if classification.safe?
+                puts "  #{work}: safe (terminal, preserved, no in-flight work)"
+              else
+                puts "  #{work}: BLOCKED — #{classification.reason}"
+              end
+            end
           end
 
           def print_assignment_result(result)
@@ -112,6 +220,7 @@ module Ace
             end
 
             if result[:blocked]
+              puts "Blocked: assignment #{candidate.assignment_id}: #{candidate.reasons.join(", ")}"
               return
             end
 
@@ -124,27 +233,36 @@ module Ace
           end
 
           def print_dry_run(result)
-            forced = Array(result[:forced])
             puts "Candidates for cleanup:"
-            if result[:safe].empty? && forced.empty?
+            if result[:safe].empty?
               puts "  (none)"
             else
               result[:safe].each do |candidate|
                 puts "  task.#{candidate.task_id} - #{candidate.worktree_path}"
               end
-              forced.each do |candidate|
-                puts "  task.#{candidate.task_id} - #{candidate.worktree_path} [FORCE]"
+            end
+            if result[:unsafe].any?
+              puts "Blocked candidates:"
+              result[:unsafe].each do |candidate|
+                puts "  task.#{candidate.task_id} - #{candidate.worktree_path}"
+                candidate.reasons.each { |reason| puts "    - #{reason}" }
               end
             end
             puts
-            total = result[:safe].length + forced.length
-            puts "#{total} worktree(s) can be pruned."
+            puts "#{result[:safe].length} worktree(s) can be pruned; " \
+              "#{result[:unsafe].length} blocked."
           end
 
           def print_apply(result)
             result[:pruned].each do |candidate|
               puts "Removed worktree task.#{candidate.task_id}"
             end
+            Array(result[:unsafe]).each do |candidate|
+              puts "Blocked: task.#{candidate.task_id}: #{candidate.reasons.join(", ")}"
+            end
+            Array(result[:blocked]).each do |entry|
+              puts "Blocked after recheck: task.#{entry[:candidate].task_id}: #{entry[:reasons].join(", ")}"
+            end
             result[:failed].each do |entry|
               puts "Failed to remove task.#{entry[:candidate].task_id}: #{entry[:error]}"
             end

data/lib/ace/overseer/models/assignment_prune_candidate.rb

@@ -4,18 +4,21 @@ module Ace
   module Overseer
     module Models
       class AssignmentPruneCandidate
-        attr_reader :assignment_id, :assignment_name, :assignment_state, :location_path, :reasons
+        attr_reader :assignment_id, :assignment_name, :assignment_state, :location_path,
+          :attempts_terminal, :reasons
 
-        def initialize(assignment_id:, assignment_name:, assignment_state:, location_path:, reasons: [])
+        def initialize(assignment_id:, assignment_name:, assignment_state:, location_path:,
+          attempts_terminal: true, reasons: [])
           @assignment_id = assignment_id.to_s.freeze
           @assignment_name = assignment_name.to_s.freeze
           @assignment_state = assignment_state.to_s.freeze
           @location_path = location_path.to_s.freeze
+          @attempts_terminal = attempts_terminal
           @reasons = reasons.map(&:to_s).freeze
         end
 
         def safe_to_prune?
-          assignment_state == "completed"
+          assignment_state == "completed" && attempts_terminal
         end
 
         def to_h
@@ -24,6 +27,7 @@ module Ace
             assignment_name: assignment_name,
             assignment_state: assignment_state,
             location_path: location_path,
+            attempts_terminal: attempts_terminal,
             reasons: reasons,
             safe_to_prune: safe_to_prune?
           }

data/lib/ace/overseer/models/preservation_proof.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Ace
+  module Overseer
+    module Models
+      # Outcome of a preservation proof for one prune candidate.
+      #
+      # A proof is preserved only through an executed Git identity: accepted
+      # ancestor containment, full-tree equality, or an exact content
+      # transition against a verified destination. Anything else — missing,
+      # failed or ambiguous evidence — is not preserved and carries the
+      # blocking reason.
+      class PreservationProof
+        attr_reader :method, :reason, :head
+
+        def initialize(preserved:, method: nil, reason: nil, head: nil)
+          @preserved = preserved
+          @method = method
+          @reason = reason
+          @head = head
+        end
+
+        def self.preserved(method, head: nil)
+          new(preserved: true, method: method, head: head)
+        end
+
+        def self.blocked(reason)
+          new(preserved: false, reason: reason)
+        end
+
+        def preserved?
+          @preserved
+        end
+      end
+    end
+  end
+end