@bermudi/pi-delegate 0.1.13 → 0.1.14

package/isolated-workspace.ts

@@ -3,11 +3,28 @@ import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import type { ResolvedTask, TaskIntegration, TaskResult } from "./types.ts";
+import { mapConcurrent } from "./concurrency.ts";
+import { revalidateFileAttribution } from "./file-tracking.ts";
+import {
+  observeQuarantineSafety,
+  sessionQuarantineOf,
+} from "./session-quarantine.ts";
+import type {
+  FileAttribution,
+  ResolvedTask,
+  TaskIntegration,
+  TaskResult,
+} from "./types.ts";
 
 const GIT_TIMEOUT_MS = 5 * 60 * 1000;
+const PATH_CLASSIFICATION_CONCURRENCY = 16;
 const PROCESS_GRACE_MS = 500;
 let artifactBaseOverrideForTesting: string | undefined;
+let removeWorktreeHookForTesting:
+  | ((
+      destination: string,
+    ) => boolean | undefined | Promise<boolean | undefined>)
+  | undefined;
 
 /** @internal Keep tests out of the developer's real ~/.pi directory. */
 export function _setIsolatedArtifactRootForTesting(
@@ -16,6 +33,17 @@ export function _setIsolatedArtifactRootForTesting(
   artifactBaseOverrideForTesting = root;
 }
 
+/** @internal Deterministic failure/order seam for worktree cleanup tests. */
+export function _setRemoveWorktreeHookForTesting(
+  hook:
+    | ((
+        destination: string,
+      ) => boolean | undefined | Promise<boolean | undefined>)
+    | undefined,
+): void {
+  removeWorktreeHookForTesting = hook;
+}
+
 interface CommandResult {
   stdout: string;
   stderr: string;
@@ -97,6 +125,344 @@ function isWithin(root: string, candidate: string): boolean {
   );
 }
 
+function errnoOf(error: unknown): string {
+  return error instanceof Error && "code" in error
+    ? String((error as NodeJS.ErrnoException).code ?? "UNKNOWN")
+    : "UNKNOWN";
+}
+
+function pathEntryExists(candidate: string): boolean {
+  try {
+    fs.lstatSync(candidate);
+    return true;
+  } catch (error) {
+    const code = errnoOf(error);
+    if (code === "ENOENT" || code === "ENOTDIR") return false;
+    console.error(
+      `[delegate] could not verify isolated recovery path ${JSON.stringify(candidate)} (errno=${code}); treating it as retained`,
+    );
+    return true;
+  }
+}
+
+function logPathCanonicalizationFailure(
+  candidate: string,
+  error: unknown,
+): void {
+  const safeCandidate = JSON.stringify(
+    candidate.length > 1_024
+      ? `${candidate.slice(0, 1_024)}…[truncated ${candidate.length - 1_024} chars]`
+      : candidate,
+  )
+    .replace(/\u2028/g, "\\u2028")
+    .replace(/\u2029/g, "\\u2029");
+  console.error(
+    `[delegate] could not canonicalize reported path ${safeCandidate} (errno=${errnoOf(error)}); retaining uncertain attribution`,
+  );
+}
+
+interface PhysicalReportedPath {
+  path: string;
+  /** The path crossed a symlink that could not be fully resolved, or path
+   * resolution itself failed. Such attribution must be retained rather than
+   * assumed to be an ordinary path inside the disposable worktree. */
+  uncertain: boolean;
+}
+
+/** Resolve symlinked ancestors even when the reported leaf no longer exists.
+ * The final component is followed only for explicit edit/write attribution:
+ * Git may instead be reporting a symlink node that was itself added or changed.
+ * Resolution failures are data, not reconciliation failures; callers retain
+ * uncertain attribution conservatively. */
+async function physicalReportedPath(
+  candidate: string,
+  followFinalSymlink: boolean,
+): Promise<PhysicalReportedPath> {
+  let cursor = followFinalSymlink ? candidate : path.dirname(candidate);
+  const suffix = followFinalSymlink ? [] : [path.basename(candidate)];
+
+  for (;;) {
+    try {
+      const physical = await fs.promises.realpath(cursor);
+      return { path: path.resolve(physical, ...suffix), uncertain: false };
+    } catch (error) {
+      const code =
+        error instanceof Error && "code" in error
+          ? (error as NodeJS.ErrnoException).code
+          : undefined;
+      if (code !== "ENOENT" && code !== "ENOTDIR") {
+        logPathCanonicalizationFailure(candidate, error);
+        return { path: candidate, uncertain: true };
+      }
+
+      // realpath reports ENOENT for a dangling symlink. Before walking up to
+      // an existing parent (which would incorrectly make it look internal),
+      // preserve the symlink's intended target and mark it uncertain.
+      let stat: fs.Stats | undefined;
+      try {
+        stat = await fs.promises.lstat(cursor);
+      } catch (lstatError) {
+        const lstatCode =
+          lstatError instanceof Error && "code" in lstatError
+            ? (lstatError as NodeJS.ErrnoException).code
+            : undefined;
+        if (lstatCode !== "ENOENT" && lstatCode !== "ENOTDIR") {
+          logPathCanonicalizationFailure(candidate, lstatError);
+          return { path: candidate, uncertain: true };
+        }
+      }
+      if (stat?.isSymbolicLink()) {
+        try {
+          const target = await fs.promises.readlink(cursor);
+          const intended = path.resolve(
+            path.dirname(cursor),
+            target,
+            ...suffix,
+          );
+          const resolved = await physicalReportedPath(intended, true);
+          return { path: resolved.path, uncertain: true };
+        } catch (error) {
+          const code = errnoOf(error);
+          if (code !== "ENOENT" && code !== "ENOTDIR") {
+            logPathCanonicalizationFailure(candidate, error);
+          }
+          return { path: candidate, uncertain: true };
+        }
+      }
+
+      const parent = path.dirname(cursor);
+      if (parent === cursor) {
+        return { path: candidate, uncertain: true };
+      }
+      suffix.unshift(path.basename(cursor));
+      cursor = parent;
+    }
+  }
+}
+
+function mapReportedPathToSource(
+  group: IsolatedGroup,
+  physicalWorkerRoot: string,
+  candidate: string,
+): string {
+  return isWithin(physicalWorkerRoot, candidate)
+    ? path.join(group.sourceRoot, path.relative(physicalWorkerRoot, candidate))
+    : candidate;
+}
+
+async function changedWorkerPaths(
+  workerRoot: string,
+  baselineCommit: string,
+): Promise<Set<string> | undefined> {
+  try {
+    const [tracked, untracked] = await Promise.all([
+      git(["diff", "--name-only", "-z", "--no-renames", baselineCommit, "--"], {
+        cwd: workerRoot,
+      }),
+      git(["ls-files", "--others", "--exclude-standard", "-z"], {
+        cwd: workerRoot,
+      }),
+    ]);
+    return new Set(
+      `${tracked.stdout}${untracked.stdout}`
+        .split("\0")
+        .filter(Boolean)
+        .map((relative) => path.resolve(workerRoot, relative)),
+    );
+  } catch (error) {
+    // Reporting is conservative when Git evidence cannot be reconstructed, but
+    // the missing evidence must be visible and attributable to its worker.
+    console.error(
+      `[delegate] failed to collect isolated Git change evidence for worker '${workerRoot}'`,
+      error,
+    );
+    return undefined;
+  }
+}
+
+async function classifyReportedFiles(
+  group: IsolatedGroup,
+  worker: IsolatedWorker,
+  result: TaskResult,
+): Promise<void> {
+  const physicalWorkerRoot = await fs.promises.realpath(worker.workerRoot);
+  const gitChanged = await changedWorkerPaths(
+    worker.workerRoot,
+    group.baselineCommit,
+  );
+  const structured = (result.fileAttributions ?? []).map(
+    revalidateFileAttribution,
+  );
+  const legacyCandidates = structured.length
+    ? []
+    : [
+        ...new Set(
+          (result.attributedFiles ?? []).map((candidate) =>
+            path.resolve(worker.cwd, candidate),
+          ),
+        ),
+      ];
+  const attributionByLexical = new Map(
+    structured.map((entry) => [path.resolve(entry.lexicalPath), entry]),
+  );
+  const legacySet = new Set(legacyCandidates);
+  const distinctPhysicalSnapshots = new Set(
+    structured
+      .filter(
+        (entry) =>
+          entry.preExecutionPhysicalPath !== undefined &&
+          path.resolve(entry.preExecutionPhysicalPath) !==
+            path.resolve(entry.lexicalPath),
+      )
+      .map((entry) => path.resolve(entry.preExecutionPhysicalPath!)),
+  );
+
+  // Trusted physical snapshots are immutable evidence: never resolve them
+  // against the final worker tree. The associated lexical path is used only to
+  // decide whether a symlink node itself changed. Legacy string-only evidence
+  // retains the older conservative final-view classification.
+  const candidates = [
+    ...result.touchedFiles.map((candidate) => ({
+      kind: "touched" as const,
+      candidate,
+    })),
+    ...structured.map((attribution) => ({
+      kind: "structured" as const,
+      attribution,
+    })),
+    ...legacyCandidates.map((candidate) => ({
+      kind: "legacy" as const,
+      candidate,
+    })),
+  ];
+  const classified = await mapConcurrent(
+    candidates,
+    PATH_CLASSIFICATION_CONCURRENCY,
+    async (entry) => {
+      if (entry.kind === "touched") {
+        const absolute = path.resolve(worker.cwd, entry.candidate);
+        if (distinctPhysicalSnapshots.has(absolute)) {
+          return {
+            kind: "touched" as const,
+            path: mapReportedPathToSource(group, physicalWorkerRoot, absolute),
+          };
+        }
+        const associated =
+          attributionByLexical.get(absolute) ??
+          (legacySet.has(absolute) ? true : undefined);
+        const finalStat = await fs.promises.lstat(absolute).catch(() => null);
+        if (
+          associated &&
+          finalStat?.isSymbolicLink() &&
+          gitChanged !== undefined &&
+          !gitChanged.has(absolute)
+        ) {
+          return { kind: "touched" as const, path: undefined };
+        }
+        const resolved = await physicalReportedPath(absolute, false);
+        return {
+          kind: "touched" as const,
+          path: mapReportedPathToSource(
+            group,
+            physicalWorkerRoot,
+            resolved.path,
+          ),
+        };
+      }
+
+      if (entry.kind === "structured") {
+        const evidence = entry.attribution;
+        const physical = evidence.preExecutionPhysicalPath;
+        const resolved = {
+          path: physical
+            ? path.resolve(physical)
+            : path.resolve(evidence.lexicalPath),
+          uncertain: evidence.uncertain || physical === undefined,
+        };
+        return {
+          kind: "attributed" as const,
+          value: {
+            ...resolved,
+            evidence,
+            reportedPath: mapReportedPathToSource(
+              group,
+              physicalWorkerRoot,
+              resolved.path,
+            ),
+          },
+        };
+      }
+
+      const resolved = await physicalReportedPath(entry.candidate, true);
+      return {
+        kind: "attributed" as const,
+        value: {
+          ...resolved,
+          evidence: undefined,
+          reportedPath: mapReportedPathToSource(
+            group,
+            physicalWorkerRoot,
+            resolved.path,
+          ),
+        },
+      };
+    },
+  );
+  const touched = classified
+    .filter(
+      (
+        entry,
+      ): entry is Extract<(typeof classified)[number], { kind: "touched" }> =>
+        entry.kind === "touched",
+    )
+    .map((entry) => entry.path)
+    .filter((candidate): candidate is string => candidate !== undefined);
+  const attributed = classified
+    .filter(
+      (
+        entry,
+      ): entry is Extract<
+        (typeof classified)[number],
+        { kind: "attributed" }
+      > => entry.kind === "attributed",
+    )
+    .map((entry) => entry.value);
+  const escapedOrUncertain = attributed.filter(
+    (candidate) =>
+      candidate.uncertain || !isWithin(physicalWorkerRoot, candidate.path),
+  );
+
+  result.fileAttributions = escapedOrUncertain
+    .filter(
+      (
+        candidate,
+      ): candidate is typeof candidate & { evidence: FileAttribution } =>
+        candidate.evidence !== undefined,
+    )
+    .map((candidate) => ({
+      ...candidate.evidence,
+      lexicalPath: mapReportedPathToSource(
+        group,
+        physicalWorkerRoot,
+        path.resolve(candidate.evidence.lexicalPath),
+      ),
+      preExecutionPhysicalPath:
+        candidate.evidence.preExecutionPhysicalPath === undefined
+          ? undefined
+          : candidate.reportedPath,
+      uncertain: candidate.uncertain,
+    }));
+  result.attributedFiles = [
+    ...new Set(escapedOrUncertain.map((candidate) => candidate.reportedPath)),
+  ];
+  result.touchedFiles = [
+    ...new Set([
+      ...touched,
+      ...escapedOrUncertain.map((candidate) => candidate.reportedPath),
+    ]),
+  ];
+}
+
 async function repositoryRoot(cwd: string): Promise<string> {
   const physicalCwd = await fs.promises.realpath(cwd);
   let root: string;
@@ -180,27 +546,21 @@ async function removeWorktree(
   root: string,
   destination: string,
 ): Promise<boolean> {
+  const override = await removeWorktreeHookForTesting?.(destination);
+  if (override !== undefined) return override;
   try {
     await git(["worktree", "remove", "--force", destination], { cwd: root });
-    return true;
+    if (!pathEntryExists(destination)) return true;
+    console.error(
+      `[delegate] Git reported isolated worktree removal success but the recovery path remains at ${JSON.stringify(destination)}`,
+    );
+    return false;
   } catch (error) {
-    let stillRegistered = true;
-    try {
-      const listed = await git(["worktree", "list", "--porcelain", "-z"], {
-        cwd: root,
-      });
-      stillRegistered = listed.stdout
-        .split("\0")
-        .some(
-          (entry) =>
-            entry.startsWith("worktree ") &&
-            path.resolve(entry.slice("worktree ".length)) ===
-              path.resolve(destination),
-        );
-    } catch {
-      // Fail closed: if registration cannot be checked, preserve the files.
-    }
-    if (!stillRegistered) return true;
+    // The command can report failure after completing removal. Only treat that
+    // as success when the recovery path itself is definitely gone.
+    if (!pathEntryExists(destination)) return true;
+    // An unregistered directory is still recovery evidence. Do not silently
+    // call it removed or recursively delete it after Git declined the cleanup.
     console.error(
       `[delegate] failed to remove isolated worktree '${destination}'`,
       error,
@@ -209,6 +569,16 @@ async function removeWorktree(
   }
 }
 
+async function requireWorktreeRemoved(
+  root: string,
+  destination: string,
+): Promise<void> {
+  if (await removeWorktree(root, destination)) return;
+  throw new Error(
+    `Could not remove isolated worktree; recovery workspace retained at ${JSON.stringify(destination)}.`,
+  );
+}
+
 async function changedFiles(
   root: string,
   from: string,
@@ -299,6 +669,25 @@ interface IsolatedGroup {
   baselineCommit: string;
   baselineRef: string;
   taskIndexes: number[];
+  /** Deferred quarantine cleanup must not run Git worktree operations while the
+   * group is still reconciling candidates/source state. */
+  reconciliationDone: Promise<void>;
+  finishReconciliation: () => void;
+  deferredCleanupTail: Promise<void>;
+}
+
+function enqueueDeferredGroupCleanup(
+  group: IsolatedGroup,
+  cleanup: () => Promise<void>,
+): Promise<void> {
+  const run = async () => {
+    await group.reconciliationDone;
+    await cleanup();
+  };
+  const queued = group.deferredCleanupTail.then(run, run);
+  // Keep the serialization chain usable after a surfaced callback failure.
+  group.deferredCleanupTail = queued.catch(() => {});
+  return queued;
 }
 
 interface IsolatedWorker {
@@ -357,33 +746,100 @@ async function reconcileGroup(
     const worker = workers.get(taskIndex)!;
     const result = results[taskIndex]!;
     result.workspace = "isolated";
-    result.touchedFiles = result.touchedFiles.map((candidate) => {
-      const absolute = path.resolve(worker.cwd, candidate);
-      return isWithin(worker.workerRoot, absolute)
-        ? path.join(
-            group.sourceRoot,
-            path.relative(worker.workerRoot, absolute),
-          )
-        : absolute;
-    });
-    // Writes inside the worktree did not touch the source concurrently.
-    // Preserve only explicitly attributed paths that escaped the worktree.
-    result.attributedFiles = (result.attributedFiles ?? [])
-      .map((candidate) => path.resolve(worker.cwd, candidate))
-      .filter((candidate) => !isWithin(worker.workerRoot, candidate));
-    if (result.error) {
+
+    const quarantine = sessionQuarantineOf(result);
+    if (quarantine) {
+      result.error ??=
+        "AgentSession quiescence was abandoned; the isolated proposal was not applied.";
       result.integration = {
         status: "discarded",
         proposedFiles: [],
         appliedFiles: [],
+        cleanupIssue: {
+          status: "deferred",
+          reason:
+            "Worker cleanup is deferred until background AgentSession safety is confirmed; the recovery path may be removed after safe cleanup.",
+          recoveryPath: worker.workerRoot,
+        },
       };
-      await removeWorktree(group.sourceRoot, worker.workerRoot);
+      console.error(
+        `[delegate] retaining abandoned isolated worker '${worker.workerRoot}' until its AgentSession is confirmed quiescent; proposal will not be snapshotted or applied`,
+      );
+      observeQuarantineSafety(
+        quarantine,
+        "deferred isolated worker cleanup",
+        async () =>
+          enqueueDeferredGroupCleanup(group, async () => {
+            try {
+              await stopWorkspaceProcesses(worker.workerRoot);
+              const removed = await removeWorktree(
+                group.sourceRoot,
+                worker.workerRoot,
+              );
+              if (removed) {
+                console.error(
+                  `[delegate] safely cleaned deferred isolated worker '${worker.workerRoot}'`,
+                );
+              } else {
+                console.error(
+                  `[delegate] deferred isolated worker cleanup could not remove '${worker.workerRoot}'; retaining it as recovery evidence`,
+                );
+              }
+            } catch (error) {
+              console.error(
+                `[delegate] deferred isolated worker cleanup failed for '${worker.workerRoot}'; retaining it`,
+                error,
+              );
+            }
+          }),
+        (error) => {
+          console.error(
+            `[delegate] isolated AgentSession safety monitor failed; retaining worker '${worker.workerRoot}' indefinitely`,
+            error,
+          );
+        },
+      );
       continue;
     }
 
     let proposedFiles: string[] = [];
     try {
+      // A child that outlived prompt quiescence can still race symlink
+      // inspection. Stop it before reporting paths even when its task failed.
       await stopWorkspaceProcesses(worker.workerRoot);
+
+      if (result.error) {
+        let classificationIssues:
+          Array<{ path: string; reason: string }> | undefined;
+        try {
+          await classifyReportedFiles(group, worker, result);
+        } catch (error) {
+          const reason = error instanceof Error ? error.message : String(error);
+          classificationIssues = [{ path: "(attribution)", reason }];
+          console.error(
+            `[delegate] failed to classify paths for already-failed isolated worker '${worker.workerRoot}'; discarding and removing it without changing the task failure`,
+            error,
+          );
+        }
+        if (classificationIssues) {
+          // The original lists may contain worker-relative paths that become
+          // dangling as soon as the disposable worktree is removed. Never
+          // publish those stale paths after classification failed.
+          result.touchedFiles = [];
+          result.attributedFiles = [];
+          result.fileAttributions = [];
+        }
+        result.integration = {
+          status: "discarded",
+          proposedFiles: [],
+          appliedFiles: [],
+          ...(classificationIssues ? { classificationIssues } : {}),
+        };
+        await requireWorktreeRemoved(group.sourceRoot, worker.workerRoot);
+        continue;
+      }
+
+      await classifyReportedFiles(group, worker, result);
       const proposalTree = await snapshotTree(
         worker.workerRoot,
         group.baselineCommit,
@@ -409,7 +865,7 @@ async function reconcileGroup(
         group.baselineCommit,
         proposalCommit,
       );
-      await removeWorktree(group.sourceRoot, worker.workerRoot);
+      await requireWorktreeRemoved(group.sourceRoot, worker.workerRoot);
 
       if (!proposedFiles.length) {
         result.integration = {
@@ -444,7 +900,7 @@ async function reconcileGroup(
           proposedFiles,
           appliedFiles: proposedFiles,
         };
-        await removeWorktree(group.sourceRoot, candidateRoot);
+        await requireWorktreeRemoved(group.sourceRoot, candidateRoot);
       } catch (error) {
         const reason =
           error instanceof GitCommandError
@@ -469,7 +925,7 @@ async function reconcileGroup(
         worker.proposalRef,
       );
       const patchExists = fs.existsSync(worker.patchPath);
-      const worktreeExists = fs.existsSync(worker.workerRoot);
+      const worktreeExists = pathEntryExists(worker.workerRoot);
       result.integration = {
         status: "apply_failed",
         proposedFiles,
@@ -489,7 +945,7 @@ async function reconcileGroup(
   }
 
   if (integratedCommit === group.baselineCommit) {
-    await removeWorktree(group.sourceRoot, pristineRoot);
+    await requireWorktreeRemoved(group.sourceRoot, pristineRoot);
     return;
   }
 
@@ -523,7 +979,7 @@ async function reconcileGroup(
         patchPath: worker.patchPath,
       };
     }
-    await removeWorktree(group.sourceRoot, pristineRoot);
+    await requireWorktreeRemoved(group.sourceRoot, pristineRoot);
     return;
   }
 
@@ -595,7 +1051,27 @@ async function reconcileGroup(
     return;
   }
 
-  await removeWorktree(group.sourceRoot, pristineRoot);
+  try {
+    await requireWorktreeRemoved(group.sourceRoot, pristineRoot);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    // Source application has already succeeded. Cleanup failure must not
+    // rewrite that durable outcome as apply_failed; publish recovery metadata
+    // separately before the result is delivered.
+    for (const [taskIndex] of accepted) {
+      const integration = results[taskIndex]!.integration;
+      if (integration?.status !== "applied_unverified") continue;
+      integration.cleanupIssue = {
+        status: "failed",
+        reason,
+        recoveryPath: pristineRoot,
+      };
+    }
+    console.error(
+      `[delegate] applied isolated changes, but failed to remove recovery worktree '${pristineRoot}'; applied_unverified remains authoritative`,
+      error,
+    );
+  }
 }
 
 async function deletePrivateRefs(
@@ -637,14 +1113,7 @@ async function markGroupReconciliationFailure(
   for (const taskIndex of group.taskIndexes) {
     const result = results[taskIndex]!;
     const current = result.integration;
-    if (
-      current?.status === "conflict" ||
-      current?.status === "apply_failed" ||
-      current?.status === "no_changes" ||
-      current?.status === "discarded"
-    ) {
-      continue;
-    }
+    if (current?.status === "conflict") continue;
 
     const worker = workers.get(taskIndex)!;
     const proposalExists = await privateRefExists(
@@ -652,11 +1121,12 @@ async function markGroupReconciliationFailure(
       worker.proposalRef,
     );
     const patchExists = fs.existsSync(worker.patchPath);
-    const recoveryWorktree = fs.existsSync(worker.workerRoot)
-      ? worker.workerRoot
-      : fs.existsSync(pristineRoot)
-        ? pristineRoot
-        : undefined;
+    let recoveryWorktree: string | undefined;
+    if (pathEntryExists(worker.workerRoot)) {
+      recoveryWorktree = worker.workerRoot;
+    } else if (pathEntryExists(pristineRoot)) {
+      recoveryWorktree = pristineRoot;
+    }
     result.workspace = "isolated";
     result.integration = {
       status: "apply_failed",
@@ -767,6 +1237,10 @@ export async function prepareIsolatedBatch(
           cwd: sourceRoot,
           signal,
         });
+        let finishReconciliation!: () => void;
+        const reconciliationDone = new Promise<void>((resolve) => {
+          finishReconciliation = resolve;
+        });
         group = {
           sourceRoot,
           sourceHead,
@@ -774,6 +1248,9 @@ export async function prepareIsolatedBatch(
           baselineCommit,
           baselineRef,
           taskIndexes: [],
+          reconciliationDone,
+          finishReconciliation,
+          deferredCleanupTail: Promise.resolve(),
         };
         groupsByRoot.set(sourceRoot, group);
       }
@@ -841,15 +1318,26 @@ export async function prepareIsolatedBatch(
     async reconcile(results: TaskResult[]): Promise<TaskResult[]> {
       for (const group of groupsByRoot.values()) {
         try {
-          await reconcileGroup(group, workers, results);
-        } catch (error) {
-          console.error(
-            "[delegate] isolated group reconciliation failed",
-            error,
-          );
-          await markGroupReconciliationFailure(group, workers, results, error);
+          try {
+            await reconcileGroup(group, workers, results);
+          } catch (error) {
+            console.error(
+              "[delegate] isolated group reconciliation failed",
+              error,
+            );
+            await markGroupReconciliationFailure(
+              group,
+              workers,
+              results,
+              error,
+            );
+          }
+          await cleanupCompletedGroupRefs(group, workers, results);
+        } finally {
+          // Unblocks and serializes any safety-confirmed quarantine cleanups
+          // only after all candidate/source/ref work for this group is done.
+          group.finishReconciliation();
         }
-        await cleanupCompletedGroupRefs(group, workers, results);
       }
       return results;
     },