@henryqw/pi-subagent 27.2.1 → 27.3.0

package/CONTEXT.md

@@ -1,95 +1,63 @@
-# Pi Subagent Context
-
-## Purpose
-
-Own Role-configured Pi delegation through one `delegate_task` surface:
-
-- **direct mode** runs authorized compact shared-checkout work in Herdr tabs in Main's workspace and returns a handle before completion;
-- **isolated mode** runs durable checked graphs with Herdr worktrees, exact Git identities, guarded integration, and recovery; and
-- the package root exposes the Role, executor, worktree, evidence, schema, state, and runtime mechanisms used by the extension.
-
-## Domain glossary
-
-- **Main**: the Pi session and checkout coordinating delegated work.
-- **Role**: package or user Markdown defining responsibility, tools, trusted extension sources, Skills, optional MCP names, instructions, and an optional model-class default. Roles do not select isolation.
-- **Model Class**: `fast`, `balanced`, `frontier`, or `fav`, resolved through `pi-task-models`.
-- **Direct task**: one bounded task using its Role's declared resources in Main's shared checkout, with a declared `access` of `read` or `write`; authorized writes take effect immediately without checked integration.
-- **Direct reference**: `D<workflow>.<worker>` display reference for one recorded direct worker on the session branch, such as `D7.1`. It identifies a worker for display and `continueFrom`; it never grants ownership.
-- **Continued worker**: a new direct worker, with a new reference and tab, that resumes a finished worker's saved Pi session and private lease through `continueFrom`.
-- **Isolated request**: one durable ID, goal, and checked task graph.
-- **Candidate**: exact clean committed task-worktree identity produced by an isolated changeset worker.
-- **Readiness**: durable proof that one exact live-worker candidate passed its preliminary checks and is sealed for Main's explicit selection; it is not a separate user approval.
-- **Integration generation**: Main's owned, ordered assembly of selected candidates in a separate checkout; each replaced assembly remains an inspectable superseded generation.
-- **Release**: Main's explicit, exact-identity cleanup of a rejected worker or superseded generation after proving it is no longer selected; it never discards dirty or conflicted work.
-- **Productive lease**: repository-scoped process lease that excludes concurrent execute/resume while permitting status and abort.
-- **Safety budget**: finite timeout for child work, process I/O, status, termination, or cleanup. It is not a whole-run deadline.
-
-## Invariants
-
-### Unified surface and modes
-
-- Every `delegate_task` request declares `mode: "direct"` or `mode: "isolated"`. No path silently falls back between modes.
-- Direct mode selects exactly one single, parallel, or chain shape. Unknown properties and mixed shapes fail before launch.
-- Isolated mode accepts 1–8 typed tasks. `dependsOn` controls waves. `contextFrom` may name completed text tasks only and preserves declared order.
-- Roles describe capability, not checkout placement. Role-level worktree isolation is rejected.
-
-### Global limits
-
-- `config/pi-subagent/config.json` is the only user execution-policy source. It owns `maxSubagents`, `maxTurns`, optional `maxTokens`, `maxCorrections`, and child idle/hard timeout.
-- The config loads through `@henryqw/pi-config-store` fields. An unknown key or an invalid bounded limit, timeout, or `roleDefaults` key warns at launch and uses its finite default. An invalid `maxTokens`, or a file that cannot be read or parsed, disables delegation with an error, because the token default is unlimited. Role Markdown files keep per-file exclusion; durable state stays strict.
-- Request fields cannot override or replenish policy. Durable requests store the policy snapshot and cumulative correction count; current config may tighten the correction allowance.
-- Productive execution has no whole-run wall-clock deadline. Long productive work and later resume remain valid. Direct Herdr observation also has no whole-task elapsed deadline; worker idleness is bounded.
-- Child idle/hard runtime, turn/token handling, outer abort, process I/O, status inspection, termination, and cleanup remain independently bounded. Direct Herdr workers use idle limits, not ephemeral child hard runtime.
-- Ephemeral children share one FIFO executor pool. Queued time consumes no child timeout. Isolated Herdr Role launches receive the same non-refilling turn/token/runtime budget metadata.
-
-### Direct evidence
-
-- Direct mode uses each Role's declared resources for explicitly authorized scope. Each task declares `access`; a request with any `write` task is a write request. `read` is Main's unenforced classification: read requests skip admission and return plain text; their parallel tasks run concurrently, chains stay ordered. Write requests serialize tasks and retain Pi checkout admission until exact owned worker termination is proved by pane absence and two empty private process-lease scans; uncertain termination retains admission and live recovery ownership. Write-request answers require an explicit structured `succeeded` outcome; failed, blocked, or malformed completion stops dispatch but does not prevent release after proved termination. `/subagent` Close/cancel-and-release retries termination under session, branch, epoch and exact ownership guards without replaying work or removing checkout/session evidence. This is a worker report, not proof of validation, cleanliness, rollback, or checked integration. Direct changesets require isolated mode.
-- Only direct write requests reserve checkout admission. They cannot start while another direct writer holds it or a Main potentially-writing call is in flight. Main calls, including Bash and nested `codemode` writes, do not block each other. A direct writer blocks Main's writes until verified worker termination; use isolated mode when Main must continue writing. Reads never wait.
-- Each direct worker has a recorded Herdr tab and Pi session identity. The first handle returns before completion; subsequent tab identities remain recoverable on the session branch.
-- `continueFrom` resolves to exactly one recorded tab with the same Role and a saved turn identity. It refuses before launch while a local task owns the session, when the session is missing, above 16 MiB, or its exact recorded turn is not terminal, or when a still-listed old agent is not the exact idle or done agent. Old-pane closure needs pane absence and two empty lease scans. The relaunch reuses the session file and private lease in a new tab and record.
-- `/subagent` **Stop this worker** exists only for running workers of locally owned all-read workflows. It aborts one entry, proves its termination, and records `Stopped by user from /subagent`; siblings continue and Main receives one result.
-- An exact settled worker with a bounded final Pi answer produces a follow-up to Main. Worker text reaching Main carries a no-authority header with imitated harness framing escaped; a failed task keeps a bounded partial excerpt, never shown as success. Blocked, unknown, idle-stalled, truncated, or ambiguous outcomes retain actionable recovery identity. Session replacement never delivers to the wrong Main session.
-
-### Isolated lifecycle
-
-- Changeset tasks durably record allocation intent before each external side effect. Unknown outcomes are retained and never guessed.
-- One worker remains live across prompts, preliminary checks, follow-up/correction, readiness, Main's staging decisions, combined validation, and guarded promotion. Selected workers terminate after promotion; rejected workers terminate on explicit rejection.
-- Optional same-worker follow-ups are admitted only while a changeset is actively working. After the final checked-evidence save, one synchronous queue-or-seal transition prevents admitted revisions from being lost; the runner never waits for routine input.
-- Worker waves pin Main's committed branch/HEAD/tree, excluding staged, unstaged, and untracked changes; dirty Main permits checked candidate readiness, but branch/HEAD drift blocks dispatch and clean Main is required before staging, combined validation, or promotion.
-- Preliminary checks gate readiness. Any changed candidate invalidates previous readiness and validation.
-- Optional task judgment binds to the exact preliminary candidate. Main selects and orders candidates in a separate owned integration checkout, where final full-suite checks and optional final judgment bind to the clean combined tip before promotion.
-- Promotion requires exact unchanged clean Main and a passing combined generation. Durable promotion evidence precedes selected-worker termination and cleanup; recovery never rolls back a proven promotion.
-- Rejected workers and superseded generations stay retained until Main explicitly releases their exact clean, proved-owned resources. At most two unreleased integration checkouts coexist.
-- Failures, ambiguity, interruption, review findings, conflicts, drift, unproved termination, or cleanup failure enter `needs_attention` and preserve evidence.
-- `subagent_status` is read-only, callable from `codemode` scripts, and returns the bounded public projection as structured content, never raw run state. `delegate_task`, `subagent_resume`, `subagent_stage`, `subagent_integrate`, and `subagent_abort` are model-only. `subagent_resume` accepts only strict `retry`, `verify`, or `finalize` continuations; only a correcting `retry` takes Main's optional instruction. `subagent_abort` terminates only exact owned workers.
-- The extension never pushes, opens a pull request, publishes, deploys, stashes, resets, force-cleans, or deletes unproved recoverable work.
-
-### Resource and launch policy
-
-- Ambient child extensions and Skills stay disabled. Only Role/caller resources plus required internal adapters load.
-- Every Role requires `tools`, `extensions`, and `skills` arrays; unknown frontmatter keys are rejected per file, and an invalid file blocks only the name it claims. `roleDefaults` in config merge into every Role first, deduplicated. `extensions` may name Pi built-in extensions as `builtin:<name>`. A Role activates `codemode` only by naming it in `tools` with `builtin:codemode` loaded; MCP configuration never activates it, and Pi's codemode settings apply unchanged. `mcps` names servers from the global `~/.pi/agent/mcp.json`; their tools keep their configured exposure in a codemode Role and are forced to direct exposure otherwise. Omitted or empty `mcps` denies MCP access. Direct `pi-mcp-adapter` loading is rejected because it bypasses the allowlist.
-- The Role tool policy declares the Role's `tools` and the extension tools Pi would declare on registration; extension tools with `codemode` or `deferred` exposure stay callable from scripts without being declared.
-- Selected extensions are trusted executable bundles, not a sandbox. All tools and lifecycle behavior they register load together.
-- Role Skill names resolve through Main's effective Pi registry. Missing Roles, Skills, tools, MCP servers, routes, models, or thinking levels fail before the first productive turn.
-- Route precedence is call model class, then Role default, then registered Model Task assignment/default. A direct model replaces only the route model and must support its thinking level.
-- Main-only delegation/recovery tools and `ask_question` are excluded from children. Recursive delegation is unavailable.
-- Package built-ins are `implementer`, `reviewer`, and `scout`; a same-named user Role overrides a built-in.
-- `git_read` is an internal read-only child tool loaded only for Roles declaring it; the built-in reviewer opts in. Fixed structured Git operations provide bounded local evidence without Bash, network, external filters, or mutations. Named-ref context supplements but never replaces the authoritative exact isolated review patch.
-
-### Executor boundaries
-
-- A terminal response at the turn boundary succeeds; attempted continuation fails with typed `turn_limit` and bounded retained output.
-- Token accounting sums completed assistant responses once. A terminal crossing succeeds. A continuing crossing completes tools and receives one response-only handoff; further continuation fails.
-- Recognized Pi JSON events renew idle timeout; raw bytes do not. Child maximum runtime always terminates ephemeral children.
-- Output, stderr, protocol events, callback draining, and inherited descendant streams are bounded.
-- Low-level worktree finalization returns explicit `pruned`, `retained`, or `recovery` evidence and never force-deletes uncertain work.
-- Exact review helpers produce bounded private evidence; callers must preserve identity guards and verdict validation.
-
-## Owned storage
-
-- User config and Role Markdown: `<agent-dir>/config/pi-subagent/`
-- Durable state: `<agent-dir>/config/pi-subagent/state/<repository-hash>/`
-- Shared model routes: `<agent-dir>/config/pi-task-models/config.json`
-
-State version 5 is strict. Older or malformed files are rejected rather than rewritten or migrated silently.
+# Pi Subagent
+
+Pi Subagent delegates bounded work to Role-configured Pi workers. Direct tasks share Main's checkout; isolated requests produce checked candidates for explicit integration.
+
+## Language
+
+### Delegation
+
+**Main**:
+The Pi session and checkout that coordinate delegated work.
+
+**Role**:
+A named capability definition with instructions, tools, trusted extension sources, Skills, optional MCP servers, and an optional Model Class default. A Role does not select isolation.
+
+**Model Class**:
+A `fast`, `balanced`, `frontier`, or `fav` choice resolved through Pi Task Models.
+
+**Direct task**:
+A bounded task in Main's shared checkout with declared `read` or `write` access. Authorized writes take effect immediately, without rollback or checked integration.
+
+**Direct reference**:
+A display and continuation reference for one recorded direct worker, such as `D7.1`. It does not grant ownership of that worker.
+
+**Continued worker**:
+A new direct worker that resumes a finished worker's saved Pi conversation in a new tab with a new Direct reference.
+
+**Checkout admission**:
+The exclusive permission held by a direct write request that prevents Main and other direct writers from writing to the shared checkout. It remains held until worker termination is proven; read classification is not a sandbox.
+
+**Isolated request**:
+A durable goal and dependency graph of text and changeset tasks, with checked results and recovery state.
+
+**Text task**:
+An isolated-graph task whose result is bounded text rather than a changeset. Completed text can supply context to later tasks.
+
+**Changeset task**:
+An isolated-graph task that produces a committed change in its own worker worktree.
+
+### Checked integration
+
+**Candidate**:
+The exact clean committed identity of a changeset worker's proposed change.
+
+**Readiness**:
+Saved proof that an exact candidate passed preliminary checks and is sealed for Main's explicit selection. It is not a separate user approval.
+
+**Integration generation**:
+Main's ordered assembly of selected candidates in a separate checkout. A replaced assembly remains available as a superseded generation.
+
+**Judgment**:
+A review decision bound to an exact candidate or combined integration generation, separate from automated validation.
+
+**Promotion**:
+The guarded transfer of a validated integration generation into unchanged, clean Main. Readiness alone does not permit promotion.
+
+**Release**:
+Main's explicit cleanup of an exact rejected worker or superseded generation after proving that it is no longer selected. Release does not discard dirty, conflicted, or uncertain work.
+
+**Productive lease**:
+Repository-scoped ownership that excludes concurrent execution or resumption while permitting status inspection and abort.
+
+**Safety budget**:
+A finite limit for child execution or a safety operation, not a deadline for the whole isolated request.

package/README.md

@@ -42,7 +42,7 @@ Commands are for you. Delegation and state tools and the packaged skill are for
 | `subagent_resume` | tool | Perform the reported `retry`, `verify`, or `finalize` continuation; does not replace staging or integration. A `retry` that sends a same-worker correction accepts an optional `instruction` (at most 32000 characters), added to that prompt as Main's instruction after the saved failure. Other actions reject it. |
 | `subagent_stage` | tool | Stage or resolve an exact candidate, or reject/revise it; rejection of a staged candidate freezes that generation. |
 | `subagent_integrate` | tool | Advance staged dependents, refresh after clean Main drift or evidence-less validation failure, validate in the background, record one correction, promote, reconcile interrupted promotion, clean up proven promotion, or explicitly release rejected/superseded resources. |
-| `subagent_abort` | tool | Abort an isolated request only when no retained candidates or integration worktrees remain; cannot discard them. |
+| `subagent_abort` | tool | Abort an isolated request when no retained candidates or integration worktrees with work remain, or when their checkouts and branches are proved absent. Cannot discard them. |
 | `git_read` | tool | For Role-declared children (not Main): inspect bounded local Git evidence without Bash, tests, network access, or writes. |
 | `pi-subagent` | skill | Guide Main through delegation, authorization, checks, integration, and recovery. |
 | Direct status widget (`D`) | ui | For you in the TUI: show direct worker references (such as `D7.1`), status, Role badges, names, route, task elapsed time, measured task tokens, pending tools, and the latest tool's recorded time. |
@@ -204,9 +204,11 @@ One confirmation removes every listed removable item. When the command removes a
 
 If an isolated worker produced no candidate, `subagent_abort` terminates it. It removes only proven unchanged, clean owned resources. Cleanup includes ignored-file checks and never discards unique commits. The request stays aborted with retained-resource evidence in these cases: productive work did not settle yet, termination is uncertain, or cleanup fails. Inspect `subagent_status`. Resolve the reported blocker. Then run `subagent_abort` again to reconcile cleanup. This does not replay worker prompts. Dirty work, unique commits, and uncertain allocations stay for deliberate manual recovery.
 
+If you removed the checkouts, branches, and Herdr workspaces of a request outside Pi Subagent, `subagent_abort` can close the request. For each retained candidate and each integration generation with stages, abort proves that the checkout is not registered, that its path does not exist, and that its branch does not exist. It proves worker absence with the same pane and lease checks. Then it records the candidates as rejected and released, and it completes the cleanup records. If one of these resources still exists, abort fails and does not change the request. In that case, release the resources first.
+
 The following details describe exact identity and retained-work requirements.
 
-A checked candidate stays retained if Main is dirty. Staging, combined validation, and promotion require Main to be clean at the pinned committed identity. Clean your local edits deliberately before you use those actions. The extension does not replay or merge dirty work automatically. To stage, pass the exact `generation`, candidate (`taskId`, `attempt`, `candidate`), and `expectedTip` identities that status reports. To integrate, pass the generation and the combined `expectedTip`. If Main advances cleanly before promotion, call `subagent_integrate refresh` with the recorded `expectedMain`, the old `expectedTip`, and the new clean `newMain`. Main must restage selected immutable candidates into the new generation and run combined checks again. Dirty or divergent Main blocks refresh. Stale identities fail. If integration allocation was uncertain, `subagent_stage resolve` first proves that the owned checkout is still at its base. Then it starts the selected merge. Otherwise, it retains the intent. Each request can keep at most two unreleased integration worktrees. A superseded generation is read-only. To release a superseded *clean* integration checkout, call `subagent_integrate` with `{ id, action: "release", generation, expectedTip }`. As `expectedTip`, use the last staged tip of that generation, or the integration base when no stage completed. A rejected candidate can be released after its worker terminates and all generations that use it are released. To release it, pass `{ id, action: "release", generation: <latest generation number, or 1>, taskId, attempt, expectedTip: <candidate tip> }`. Release persists each host, checkout, and branch step. It verifies ownership and cleanliness, including ignored files. It deletes the branch only if its ref still names the exact tip. Dirty, conflicted, changed, or uncertain resources stay for manual inspection. After you resolve the obstacle, do the same release again. Each released checkout frees a retained slot. Abort is available after every retained resource is released. Rejection can invalidate dependent work. If fresh dependent execution is not possible, start a new request. Do not force promotion. Productive requests have no whole-run wall-clock deadline. Resume does not reset the recorded policy or correction count. Text tasks have two dispatch attempts. Inspection failures before dispatch do not use an attempt. Verification requires passing preliminary checks and any required judgment. It cannot override a failed review. Child limits, abort signals, process I/O, status inspection, exact termination, and cleanup keep finite safety bounds.
+A checked candidate stays retained if Main is dirty. Staging, combined validation, and promotion require Main to be clean at the pinned committed identity. Clean your local edits deliberately before you use those actions. The extension does not replay or merge dirty work automatically. To stage, pass the exact `generation`, candidate (`taskId`, `attempt`, `candidate`), and `expectedTip` identities that status reports. To integrate, pass the generation and the combined `expectedTip`. If Main advances cleanly before promotion, call `subagent_integrate refresh` with the recorded `expectedMain`, the old `expectedTip`, and the new clean `newMain`. Main must restage selected immutable candidates into the new generation and run combined checks again. Dirty or divergent Main blocks refresh. Stale identities fail. If integration allocation was uncertain, `subagent_stage resolve` first proves that the owned checkout is still at its base. Then it starts the selected merge. Otherwise, it retains the intent. Each request can keep at most two unreleased integration worktrees. A superseded generation is read-only. To release a superseded *clean* integration checkout, call `subagent_integrate` with `{ id, action: "release", generation, expectedTip }`. As `expectedTip`, use the recorded tip of that generation: the correction tip after `correct`, else the last staged tip, else the integration base. A superseded generation keeps its correction record for this purpose. You can release a rejected candidate after you release all generations that use it. This includes a dependent candidate that a refresh or a rejection made invalid. Release first proves that the exact worker stopped. If the worker is already gone, release records the proof of absence. If the idle worker still runs, release closes its exact pane and proves pane absence and two empty lease scans. Release never tries again to close a worker after an uncertain termination. To release the candidate, pass `{ id, action: "release", generation: <latest generation number, or 1>, taskId, attempt, expectedTip: <candidate tip> }`. Release persists each host, checkout, and branch step. It verifies ownership and cleanliness, including ignored files. It deletes the branch only if its ref still names the exact tip. Dirty, conflicted, changed, or uncertain resources stay for manual inspection. After you resolve the obstacle, do the same release again. Each released checkout frees a retained slot. Abort is available after every retained resource is released. Abort also removes an empty integration generation that a refresh created, if its checkout is clean at its base. Rejection can invalidate dependent work. A rejection does not fail because of dependent attempts that a refresh or an earlier rejection already made invalid. If fresh dependent execution is not possible, start a new request. Do not force promotion. Productive requests have no whole-run wall-clock deadline. Resume does not reset the recorded policy or correction count. Text tasks have two dispatch attempts. Inspection failures before dispatch do not use an attempt. Verification requires passing preliminary checks and any required judgment. It cannot override a failed review. Child limits, abort signals, process I/O, status inspection, exact termination, and cleanup keep finite safety bounds.
 
 The extension never pushes, opens a pull request, publishes, deploys, force-cleans recoverable work, or silently falls back to Main.
 

package/dist/herdr-runtime.d.ts

@@ -138,6 +138,8 @@ export declare class HerdrHostRuntime implements HostRuntime {
     private assertWorkspaceEvidence;
     private repositoryIdentity;
     private assertRepositoryIdentity;
+    /** Herdr and lsof queries are global, so a checkout removed outside Pi Subagent must not be their process cwd. */
+    private queryCwd;
     private processOptions;
     private childContext;
     private callTimeout;

package/dist/herdr-runtime.js

@@ -548,7 +548,8 @@ export class HerdrHostRuntime {
                 throw new Error("Worker termination identity does not match the exact saved agent.");
             this.assertLeasePath(allocation.leasePath, allocation.token);
             await assertPrivateLease(allocation.leasePath, false);
-            const agents = (await this.listAgents(allocation.worktreeCwd, context)).map((agent) => ({
+            const cwd = await this.queryCwd(allocation.worktreeCwd);
+            const agents = (await this.listAgents(cwd, context)).map((agent) => ({
                 name: typeof agent.name === "string" ? agent.name : undefined,
                 paneId: exactString(agent.pane_id, "Herdr listed agent pane ID"),
                 tabId: exactString(agent.tab_id, "Herdr listed agent tab ID"),
@@ -559,7 +560,7 @@ export class HerdrHostRuntime {
                 || related[0].paneId !== allocation.paneId || related[0].tabId !== allocation.tabId) {
                 throw new Error("Worker termination requires one exact current agent, tab, and pane match.");
             }
-            const processInfo = await this.herdr.json(["pane", "process-info", "--pane", allocation.paneId], this.processOptions(allocation.worktreeCwd, context, HERDR_OPERATION_CAP_MS));
+            const processInfo = await this.herdr.json(["pane", "process-info", "--pane", allocation.paneId], this.processOptions(cwd, context, HERDR_OPERATION_CAP_MS));
             const processResult = resultRecord(processInfo, "Herdr pane process-info response");
             if (processResult.type !== "pane_process_info")
                 throw new Error("Herdr pane process-info response has the wrong type.");
@@ -567,27 +568,27 @@ export class HerdrHostRuntime {
             if (captured.pane_id !== allocation.paneId) {
                 throw new Error("Herdr pane process-info did not match the exact saved pane.");
             }
-            const closed = await this.herdr.exec(["pane", "close", allocation.paneId], this.processOptions(allocation.worktreeCwd, context, HERDR_OPERATION_CAP_MS));
+            const closed = await this.herdr.exec(["pane", "close", allocation.paneId], this.processOptions(cwd, context, HERDR_OPERATION_CAP_MS));
             if (closed.code !== 0 || closed.killed)
                 throw new Error(herdrCommandFailure(["pane", "close"], closed));
             requireOkResponse(closed.stdout, "Herdr pane close response");
-            if (!await this.paneAbsent(allocation.paneId, allocation.worktreeCwd, context))
+            if (!await this.paneAbsent(allocation.paneId, cwd, context))
                 throw new Error("The exact saved pane still exists after pane close.");
-            let holders = await this.scanLease(allocation.leasePath, allocation.worktreeCwd, context);
+            let holders = await this.scanLease(allocation.leasePath, cwd, context);
             if (holders.length) {
-                await this.signalExactHolders(holders, allocation, "SIGTERM", context);
+                await this.signalExactHolders(holders, { ...allocation, worktreeCwd: cwd }, "SIGTERM", context);
                 await this.delay(250, context.signal);
-                holders = await this.scanLease(allocation.leasePath, allocation.worktreeCwd, context);
+                holders = await this.scanLease(allocation.leasePath, cwd, context);
             }
             if (holders.length) {
-                await this.signalExactHolders(holders, allocation, "SIGKILL", context);
+                await this.signalExactHolders(holders, { ...allocation, worktreeCwd: cwd }, "SIGKILL", context);
                 await this.delay(100, context.signal);
-                holders = await this.scanLease(allocation.leasePath, allocation.worktreeCwd, context);
+                holders = await this.scanLease(allocation.leasePath, cwd, context);
             }
             if (holders.length)
                 throw new Error(`Exact process lease still has ${holders.length} surviving holder(s).`);
             await this.delay(50, context.signal);
-            if ((await this.scanLease(allocation.leasePath, allocation.worktreeCwd, context)).length) {
+            if ((await this.scanLease(allocation.leasePath, cwd, context)).length) {
                 throw new Error("Exact process lease did not remain empty for two consecutive scans.");
             }
             return { outcome: "terminated" };
@@ -605,7 +606,8 @@ export class HerdrHostRuntime {
                 throw new Error("Saved termination worker does not match the exact owned agent.");
             this.assertLeasePath(allocation.leasePath, allocation.token);
             await assertPrivateLease(allocation.leasePath, false);
-            const agents = (await this.listAgents(allocation.worktreeCwd, context)).map((agent) => ({
+            const cwd = await this.queryCwd(allocation.worktreeCwd);
+            const agents = (await this.listAgents(cwd, context)).map((agent) => ({
                 name: typeof agent.name === "string" ? agent.name : undefined,
                 paneId: exactString(agent.pane_id, "Herdr listed agent pane ID"),
                 tabId: exactString(agent.tab_id, "Herdr listed agent tab ID"),
@@ -617,10 +619,10 @@ export class HerdrHostRuntime {
                     || related[0].paneId !== allocation.paneId || related[0].tabId !== allocation.tabId) {
                     throw new Error("Observed worker identity does not exactly match the saved owned agent and pane.");
                 }
-                if (await this.paneAbsent(allocation.paneId, allocation.worktreeCwd, context)) {
+                if (await this.paneAbsent(allocation.paneId, cwd, context)) {
                     throw new Error("Exact saved agent exists but its saved pane is absent.");
                 }
-                const processInfo = await this.herdr.json(["pane", "process-info", "--pane", allocation.paneId], this.processOptions(allocation.worktreeCwd, context, HERDR_OPERATION_CAP_MS));
+                const processInfo = await this.herdr.json(["pane", "process-info", "--pane", allocation.paneId], this.processOptions(cwd, context, HERDR_OPERATION_CAP_MS));
                 const result = resultRecord(processInfo, "Herdr pane process-info response");
                 if (result.type !== "pane_process_info"
                     || record(result.process_info, "Herdr pane process-info").pane_id !== allocation.paneId) {
@@ -628,14 +630,14 @@ export class HerdrHostRuntime {
                 }
                 return { outcome: "active" };
             }
-            if (!await this.paneAbsent(allocation.paneId, allocation.worktreeCwd, context)) {
+            if (!await this.paneAbsent(allocation.paneId, cwd, context)) {
                 throw new Error("Saved agent is absent but the exact saved pane still exists.");
             }
-            if ((await this.scanLease(allocation.leasePath, allocation.worktreeCwd, context)).length) {
+            if ((await this.scanLease(allocation.leasePath, cwd, context)).length) {
                 throw new Error("Saved worker is absent but its private process lease still has holders.");
             }
             await this.delay(50, context.signal);
-            if ((await this.scanLease(allocation.leasePath, allocation.worktreeCwd, context)).length) {
+            if ((await this.scanLease(allocation.leasePath, cwd, context)).length) {
                 throw new Error("Private process lease did not remain empty for two consecutive scans.");
             }
             return { outcome: "terminated" };
@@ -682,11 +684,13 @@ export class HerdrHostRuntime {
         }
         try {
             if (input.kind === "worker_tab") {
-                const allocation = ownedIntent(input.attempt, "worker_tab");
+                const owned = ownedIntent(input.attempt, "worker_tab");
                 const workspace = ownedIntent(input.attempt, "workspace");
-                requireIntentIdentity(allocation, input.attempt);
+                requireIntentIdentity(owned, input.attempt);
                 requireIntentIdentity(workspace, input.attempt);
-                assertWorkerTabIntent(allocation, input.task, input.attempt);
+                assertWorkerTabIntent(owned, input.task, input.attempt);
+                // Validation uses the saved identity; queries run from an existing directory.
+                const allocation = { ...owned, worktreeCwd: await this.queryCwd(owned.worktreeCwd) };
                 const leasePath = exactString(allocation.leasePath, "saved worker lease path");
                 this.assertLeasePath(leasePath, input.attempt.correlationToken);
                 assertWorkspaceIntent(workspace, input.attempt);
@@ -1327,6 +1331,18 @@ export class HerdrHostRuntime {
             throw new Error("Persisted workspace repository identity no longer matches Git.");
         }
     }
+    /** Herdr and lsof queries are global, so a checkout removed outside Pi Subagent must not be their process cwd. */
+    async queryCwd(cwd) {
+        try {
+            await lstat(cwd);
+            return cwd;
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return this.leaseDirectory;
+            throw error;
+        }
+    }
     processOptions(cwd, context, cap = HERDR_OPERATION_CAP_MS) {
         context.signal.throwIfAborted();
         return { cwd, signal: context.signal, timeoutMs: this.callTimeout(context, cap) };

package/dist/integration-git.d.ts

@@ -49,6 +49,8 @@ export declare class IntegrationGit {
             to: WorkspaceIdentity;
         };
     }, signal: AbortSignal): Promise<GitOutcome<WorkspaceIdentity>>;
+    /** Read-only proof that an owned checkout, its registration, and its branch are all gone. */
+    absent(root: string, info: WorktreeInfo, signal: AbortSignal): Promise<boolean>;
     /** Explicit release of an unselected clean checkout. The branch deletion is an exact ref compare-and-swap. */
     release(root: string, info: WorktreeInfo, expected: WorkspaceIdentity, kind: "worktree" | "branch", signal: AbortSignal): Promise<GitOutcome<"removed" | "absent">>;
     /** Cleanup is deliberately separate per resource; callers persist each proven substep. */

package/dist/integration-git.js

@@ -358,15 +358,23 @@ export class IntegrationGit {
         catch { /* Retain all resources when verification fails. */ }
         return { outcome: "unknown", failure: "Promotion returned success but exact clean Main tip could not be proved.", possibleResources: [integration.path, integration.branch] };
     }
+    /** Read-only proof that an owned checkout, its registration, and its branch are all gone. */
+    async absent(root, info, signal) {
+        await ownershipMetadata(root, info, signal);
+        const registered = await requireGit(["worktree", "list", "--porcelain", "-z"], root, signal);
+        if (registered.split("\0").includes(`worktree ${info.path}`) || await exists(info.path))
+            return false;
+        const args = ["show-ref", "--verify", "--quiet", `refs/heads/${info.branch}`];
+        const ref = await git(args, root, signal);
+        if (ref.code !== 0 && ref.code !== 1)
+            throw new Error(failure(args, ref));
+        return ref.code === 1;
+    }
     /** Explicit release of an unselected clean checkout. The branch deletion is an exact ref compare-and-swap. */
     async release(root, info, expected, kind, signal) {
         const possibleResources = [info.path, info.branch];
         try {
             await ownershipMetadata(root, info, signal);
-            if (expected.branch !== `refs/heads/${info.branch}` || expected.index !== expected.tree
-                || !await ancestor(info.baseCommit, expected.head, root, signal)) {
-                return { outcome: "blocked", failure: "Release lacks an exact clean owned branch and base lineage." };
-            }
             const registered = await requireGit(["worktree", "list", "--porcelain", "-z"], root, signal);
             const present = registered.split("\0").includes(`worktree ${info.path}`);
             const pathPresent = await exists(info.path);
@@ -377,9 +385,14 @@ export class IntegrationGit {
             const branch = await git(["rev-parse", "--verify", ref], root, signal);
             if (branch.code !== 0 && branch.code !== 128)
                 throw new Error("Owned branch tip could not be inspected.");
+            // Absence needs no lineage proof: nothing remains to remove, even after Git pruned the commits.
+            if (!present && !pathPresent && (kind === "worktree" || branch.code === 128))
+                return { outcome: "ready", value: "absent" };
+            if (expected.branch !== ref || expected.index !== expected.tree
+                || !await ancestor(info.baseCommit, expected.head, root, signal)) {
+                return { outcome: "blocked", failure: "Release lacks an exact clean owned branch and base lineage." };
+            }
             if (kind === "worktree") {
-                if (!present && !pathPresent)
-                    return { outcome: "ready", value: "absent" };
                 if (!present || !pathPresent || branch.stdout.trim() !== expected.head
                     || !sameIdentity(await current(root, info, signal), expected)) {
                     return { outcome: "blocked", failure: "Owned checkout, registration, branch or clean candidate changed." };
@@ -398,8 +411,6 @@ export class IntegrationGit {
             }
             if (present || pathPresent)
                 return { outcome: "blocked", failure: "Release the exact checkout before branch deletion." };
-            if (branch.code === 128)
-                return { outcome: "ready", value: "absent" };
             if (branch.stdout.trim() !== expected.head)
                 return { outcome: "blocked", failure: "Owned branch differs from the approved tip." };
             const args = ["update-ref", "-d", ref, expected.head];

package/dist/runner.d.ts

@@ -347,6 +347,8 @@ export declare class IsolatedRunner {
     private cleanupPromoted;
     private requireExactIntegration;
     abort(id: string, root: string, outerSignal?: AbortSignal): Promise<RunResponse>;
+    /** Read-only proof that every retained candidate checkout and staged integration checkout is already gone. */
+    private retainedWorkAbsent;
     private cleanupAborted;
     status(id: string, root: string, outerSignal?: AbortSignal): Promise<RunResponse>;
     private run;
@@ -356,6 +358,11 @@ export declare class IsolatedRunner {
     private driveWorkerSafely;
     private driveWorker;
     private terminationCandidate;
+    /**
+     * Proves exact worker termination without replay. Reconciliation records a worker that is already gone;
+     * only an observed live worker without saved termination intent is closed.
+     */
+    private proveTermination;
     private terminateWithSafety;
     private runCheckBatch;
     private runReview;

package/dist/runner.js

@@ -286,7 +286,27 @@ function affectedDependents(state, taskId) {
             }
         }
     }
-    return state.tasks.filter((task) => task.taskId !== taskId && affected.has(task.taskId) && task.attempts.length > 0);
+    return state.tasks.filter((task) => task.taskId !== taskId && affected.has(task.taskId) && task.attempts.length > 0
+        // Refresh or an earlier rejection already invalidated this attempt; it needs no second invalidation.
+        && !(task.status === "pending" && (task.kind === "changeset" ? task.attempts.at(-1).superseded
+            : task.attempts.at(-1).status === "superseded")));
+}
+/** Freezes a generation as read-only. The correction stays recorded because it names the checkout's exact tip. */
+function supersedeGeneration(generation, failure) {
+    if (generation.status === "promotion_failed") {
+        generation.supersededPromotion = generation.promotion;
+        delete generation.promotion;
+    }
+    generation.supersededFrom = generation.status;
+    generation.status = "superseded";
+    generation.failure = failure;
+    delete generation.combinedTip;
+    delete generation.checks;
+    delete generation.review;
+}
+/** The exact tip a retained integration checkout holds: its correction, last staged merge, or base. */
+function retainedGenerationTip(generation) {
+    return generation.correction?.to ?? generation.stages.at(-1)?.tip ?? generation.integrationBase;
 }
 /** Every changeset predecessor must be present in this exact committed snapshot. */
 function stagedDependencySnapshot(state, taskId, tip) {
@@ -950,13 +970,7 @@ export class IsolatedRunner {
                     }
                     if (!["staging", "conflict", "validation_failed", "ready"].includes(generation.status))
                         throw new Error("Cannot supersede an unresolved promotion or validation.");
-                    generation.supersededFrom = generation.status;
-                    generation.status = "superseded";
-                    generation.failure = `Main ${action.action === "reject" ? "rejected" : "revised"} ${action.taskId}; retained generation is read-only.`;
-                    delete generation.combinedTip;
-                    delete generation.checks;
-                    delete generation.review;
-                    delete generation.correction;
+                    supersedeGeneration(generation, `Main ${action.action === "reject" ? "rejected" : "revised"} ${action.taskId}; retained generation is read-only.`);
                 }
                 candidate.decision = "rejected";
                 for (const dependent of affected) {
@@ -1164,20 +1178,22 @@ export class IsolatedRunner {
                     const candidates = state.integration.candidates.filter((item) => item.taskId === action.taskId && item.attempt === action.attempt);
                     const candidate = candidates.find((item) => sameIdentity(item.tip, action.expectedTip));
                     const worker = attempt?.allocations.find((item) => item.kind === "worktree" && item.status === "owned")?.worktree;
-                    if (!candidate || candidate.decision !== "rejected" || task.status !== "rejected"
-                        || attempt?.termination?.status !== "terminated"
-                        || !sameIdentity(attempt.termination.candidate, action.expectedTip) || !worker
+                    const tip = attempt?.termination?.candidate ?? attempt?.candidate;
+                    // A rejected task or an invalidated dependent attempt never runs again; its worker can stop.
+                    if (!candidate || candidate.decision !== "rejected" || !attempt || (task.status !== "rejected" && !attempt.superseded)
+                        || !tip || !sameIdentity(tip, action.expectedTip) || !worker
                         || candidates.some((item) => !item.decision)
                         || state.integration.generations.some((item) => item.stages.some((stage) => stage.taskId === action.taskId
                             && stage.attempt === action.attempt && item.cleanup?.every((step) => step.status === "completed") !== true))) {
-                        throw new Error("Release requires a rejected terminated worker and no retained staged generation using its checkout.");
+                        throw new Error("Release requires a rejected candidate of a stopped or invalidated worker and no retained staged generation using its checkout.");
                     }
+                    await this.proveTermination(handle, task, attempt, action.expectedTip, async () => await this.saveProductive(handle), scope.signal);
                     await this.releaseRejected(handle, task, attempt, worker, scope);
                     return this.response(state);
                 }
                 const superseded = state.integration.generations[action.generation - 1];
                 if (!superseded?.worktree || superseded.status !== "superseded"
-                    || !sameIdentity(action.expectedTip, superseded.stages.at(-1)?.tip ?? superseded.integrationBase)
+                    || !sameIdentity(action.expectedTip, retainedGenerationTip(superseded))
                     || superseded.stages.some((stage) => stage.status === "pending" || stage.status === "staging")) {
                     throw new Error("Release requires an exact superseded integration checkout without an uncertain stage.");
                 }
@@ -1234,18 +1250,7 @@ export class IsolatedRunner {
                     throw new Error("A dependent has unproved resources or exhausted fresh attempts; refresh is blocked.");
                 }
                 if (generation && generation.status !== "superseded") {
-                    if (generation.status === "promotion_failed") {
-                        generation.supersededPromotion = generation.promotion;
-                        delete generation.promotion;
-                    }
-                    generation.supersededFrom = generation.status;
-                    generation.status = "superseded";
-                    generation.failure = `${unchangedMain ? "Validation evidence missing" : "Main advanced"}; retained generation is read-only. Restage immutable candidates in a new generation.`;
-                    delete generation.combinedTip;
-                    delete generation.checks;
-                    delete generation.review;
-                    if (!generation.supersededPromotion)
-                        delete generation.correction;
+                    supersedeGeneration(generation, `${unchangedMain ? "Validation evidence missing" : "Main advanced"}; retained generation is read-only. Restage immutable candidates in a new generation.`);
                 }
                 for (const task of stale) {
                     if (task.kind === "text") {
@@ -1659,10 +1664,23 @@ export class IsolatedRunner {
             const state = handle.state;
             if (terminal(state) && state.status !== "aborted")
                 return this.response(state);
-            if (state.integration.candidates.some((candidate) => candidate.worker !== "released")
-                || state.integration.generations.some((generation) => generation.worktree
-                    && !generation.cleanup?.every((step) => step.status === "completed"))) {
-                throw new Error("Retained candidates and integration worktrees must be explicitly rejected and released before abort.");
+            const candidates = state.integration.candidates.filter((candidate) => candidate.worker !== "released");
+            const generations = state.integration.generations.filter((generation) => generation.worktree
+                && !generation.cleanup?.every((step) => step.status === "completed"));
+            // Abort removes only unchanged resources: an empty refreshed generation, or candidate work proved already gone.
+            if ((candidates.length || generations.length) && (lifecycle.productiveRunLeaseActive
+                || generations.some((generation) => generation.status === "promotion_failed" ? generation.promotion?.outcome !== "drift"
+                    : !["staging", "conflict", "validation_failed", "ready", "superseded"].includes(generation.status))
+                || ((candidates.length || generations.some((generation) => generation.stages.length))
+                    && !await this.retainedWorkAbsent(state, candidates, generations, outerSignal)))) {
+                throw new Error("Retained candidates and integration worktrees must be explicitly rejected and released before abort, unless their checkouts and branches are proved absent.");
+            }
+            for (const candidate of candidates.filter((item) => !item.decision)) {
+                candidate.decision = "rejected";
+                this.attention(changesetTaskState(state, candidate.taskId), "Abort rejected this candidate after proving its checkout and branch absent.");
+            }
+            for (const generation of generations.filter((item) => item.status !== "superseded")) {
+                supersedeGeneration(generation, "Request aborted; the integration checkout is released.");
             }
             const activeControls = this.activeControls(root, id);
             for (const { control } of activeControls)
@@ -1679,30 +1697,11 @@ export class IsolatedRunner {
                 for (const attempt of task.attempts) {
                     if (!allocationByKind(attempt, "agent")?.agentName || attempt.termination?.status === "terminated")
                         continue;
-                    if (attempt.termination) {
-                        const safety = new DeadlineScope(safetyDeadline, () => this.coordinatorRuntime.now(), outerSignal);
-                        try {
-                            const result = await safety.call((context) => this.hostRuntime.reconcileWorkerTermination({
-                                task: changesetTaskRequest(state, task.taskId), attempt,
-                                workerId: attempt.termination.workerId, candidate: attempt.termination.candidate,
-                            }, context));
-                            if (result.outcome !== "terminated")
-                                throw new Error(result.outcome === "unknown"
-                                    ? result.failure : "Exact worker remains active; termination was not replayed.");
-                            attempt.termination = { ...attempt.termination, status: "terminated", at: this.coordinatorRuntime.now() };
-                            delete attempt.termination.failure;
-                        }
-                        catch (error) {
-                            attempt.termination.status = "unknown";
-                            attempt.termination.failure = errorText(error);
-                            this.attention(task, attempt.termination.failure);
-                        }
-                        finally {
-                            safety.close();
-                        }
+                    try {
+                        await this.proveTermination(handle, task, attempt, this.terminationCandidate(attempt), async () => await handle.save(), outerSignal, safetyDeadline);
                     }
-                    else {
-                        await this.terminateWithSafety(handle, task, attempt, this.terminationCandidate(attempt), outerSignal, safetyDeadline, true);
+                    catch (error) {
+                        this.attention(task, errorText(error));
                     }
                 }
             }
@@ -1717,6 +1716,24 @@ export class IsolatedRunner {
             return this.response(state);
         }, { purpose: "abort" });
     }
+    /** Read-only proof that every retained candidate checkout and staged integration checkout is already gone. */
+    async retainedWorkAbsent(state, candidates, generations, signal) {
+        const checkouts = [
+            ...candidates.map((candidate) => allocationByKind(changesetTaskState(state, candidate.taskId).attempts[candidate.attempt - 1], "worktree")?.worktree),
+            ...generations.filter((generation) => generation.stages.length).map((generation) => generation.worktree),
+        ];
+        const scope = new DeadlineScope(this.coordinatorRuntime.now() + CLEANUP_SAFETY_BUDGET_MS, () => this.coordinatorRuntime.now(), signal);
+        try {
+            for (const checkout of checkouts) {
+                if (!checkout || !await scope.call((context) => this.integrationGit.absent(state.root, checkout, context.signal)))
+                    return false;
+            }
+            return true;
+        }
+        finally {
+            scope.close();
+        }
+    }
     async cleanupAborted(handle, signal) {
         const state = handle.state;
         const scope = new DeadlineScope(this.coordinatorRuntime.now() + CLEANUP_SAFETY_BUDGET_MS, () => this.coordinatorRuntime.now(), signal);
@@ -1737,7 +1754,8 @@ export class IsolatedRunner {
                         if (allocationByKind(attempt, "agent") && attempt.termination?.status !== "terminated") {
                             throw new Error("Exact worker termination remains unproved.");
                         }
-                        if (expected && attempt.termination && attempt.termination.candidate.head !== expected.head) {
+                        if (expected && attempt.termination && attempt.termination.candidate.head !== expected.head
+                            && !await scope.call((context) => this.integrationGit.absent(state.root, worker, context.signal))) {
                             throw new Error("Aborted worker may contain committed work; automatic cleanup preserves it.");
                         }
                         for (const step of attempt.cleanup) {
@@ -1773,6 +1791,45 @@ export class IsolatedRunner {
                     }
                 }
             }
+            // Abort admitted retained candidates only after proving their checkouts absent.
+            for (const candidate of state.integration.candidates) {
+                const task = changesetTaskState(state, candidate.taskId);
+                const attempt = task.attempts[candidate.attempt - 1];
+                if (candidate.worker === "released" || candidate.decision !== "rejected" || attempt.termination?.status !== "terminated"
+                    || attempt.cleanup.some((step) => step.status !== "completed"))
+                    continue;
+                candidate.worker = "released";
+                if (task.status === "needs_attention" && attempt === task.attempts.at(-1) && !attempt.superseded) {
+                    task.status = "rejected";
+                    delete task.failure;
+                }
+                await handle.save();
+            }
+            for (const generation of state.integration.generations) {
+                if (!generation.worktree || generation.status !== "superseded")
+                    continue;
+                const steps = generation.cleanup ??= [{ kind: "worktree", status: "pending" }, { kind: "branch", status: "pending" }];
+                try {
+                    for (const step of steps) {
+                        if (step.status === "completed")
+                            continue;
+                        step.status = "running";
+                        delete step.failure;
+                        await handle.save();
+                        const result = await scope.call((context) => this.integrationGit.release(state.root, generation.worktree, retainedGenerationTip(generation), step.kind, context.signal));
+                        if (result.outcome !== "ready")
+                            throw new Error(result.failure);
+                        step.status = "completed";
+                        await handle.save();
+                    }
+                }
+                catch (error) {
+                    const pending = steps.find((step) => step.status === "running");
+                    if (pending)
+                        pending.failure = bounded(`Abort cleanup retained resources: ${errorText(error)}`);
+                    await handle.save();
+                }
+            }
         }
         finally {
             scope.close();
@@ -2434,6 +2491,43 @@ export class IsolatedRunner {
             ?? attempt.prompts.at(-1)?.preCandidate
             ?? attempt.waveBase;
     }
+    /**
+     * Proves exact worker termination without replay. Reconciliation records a worker that is already gone;
+     * only an observed live worker without saved termination intent is closed.
+     */
+    async proveTermination(handle, task, attempt, candidate, save, signal, deadline = this.coordinatorRuntime.now() + TERMINATION_SAFETY_BUDGET_MS) {
+        if (attempt.termination?.status === "terminated")
+            return;
+        const workerId = attempt.termination?.workerId ?? allocationByKind(attempt, "agent")?.agentName;
+        if (!workerId)
+            throw new Error("Worker termination requires an exact durably owned agent ID.");
+        const input = { task: changesetTaskRequest(handle.state, task.taskId), attempt, workerId,
+            candidate: attempt.termination?.candidate ?? candidate };
+        const safety = new DeadlineScope(deadline, () => this.coordinatorRuntime.now(), signal);
+        try {
+            let result = await safety.call((context) => this.hostRuntime.reconcileWorkerTermination(input, context));
+            if (result.outcome === "active" && !attempt.termination) {
+                attempt.termination = { status: "terminating", workerId, candidate: input.candidate };
+                await save(); // Intent before the exact pane close.
+                result = await safety.call((context) => this.hostRuntime.terminateWorker(input, context));
+            }
+            if (result.outcome !== "terminated") {
+                throw new Error(result.outcome === "unknown" ? result.failure : "Exact worker remains active; termination was not replayed.");
+            }
+            attempt.termination = { status: "terminated", workerId, candidate: input.candidate, at: this.coordinatorRuntime.now() };
+        }
+        catch (error) {
+            const failure = bounded(`Worker termination is unproved: ${errorText(error)}`);
+            // Without saved intent, nothing was closed; a later proof may still close the exact live worker.
+            if (attempt.termination)
+                attempt.termination = { status: "unknown", workerId, candidate: input.candidate, failure };
+            throw new Error(failure, { cause: error });
+        }
+        finally {
+            safety.close();
+            await save();
+        }
+    }
     async terminateWithSafety(handle, task, attempt, candidate, outerSignal, safetyDeadline = this.coordinatorRuntime.now() + TERMINATION_SAFETY_BUDGET_MS, lifecycleLocked = false) {
         if (!lifecycleLocked && this.productiveLifecycles.has(handle.state.root)) {
             return await this.withLifecycleLock(handle, async () => await this.terminateWithSafety(handle, task, attempt, candidate, outerSignal, safetyDeadline, true));
@@ -2985,8 +3079,9 @@ export class IsolatedRunner {
             text: bounded([
                 `Pi Subagent ${state.request.id}: ${state.status}.`,
                 `Tasks: ${completed}/${state.tasks.length} completed, ${rejected} rejected. Accepted: ${state.accepted}.`,
-                ...(state.status === "aborted" && state.tasks.some((task) => task.kind === "changeset"
+                ...(state.status === "aborted" && (state.tasks.some((task) => task.kind === "changeset"
                     && task.attempts.some((attempt) => attempt.cleanup.some((step) => step.status !== "completed")))
+                    || state.integration.generations.some((generation) => generation.cleanup?.some((step) => step.status !== "completed")))
                     ? ["Aborted resources remain retained. Inspect cleanup evidence; retry subagent_abort after active work settles or cleanup blockers are resolved. Unique commits and uncertain work are never discarded."] : []),
                 ...(main?.status === "current" ? ["Main: current at the recorded exact identity."] : []),
                 ...(main?.status === "drifted" ? [
@@ -3009,10 +3104,10 @@ export class IsolatedRunner {
                 ] : []),
                 ...(state.integration.generations.some((item) => item.status === "superseded" && item.worktree
                     && !item.cleanup?.every((step) => step.status === "completed")) ? [
-                    "Superseded integration worktrees remain owned. Use subagent_integrate release with their exact generation and last staged tip; dirty or conflicted work stays retained.",
+                    "Superseded integration worktrees remain owned. Use subagent_integrate release with their exact generation and recorded tip (correction tip, else last staged tip, else integration base); dirty or conflicted work stays retained.",
                 ] : []),
                 ...(state.integration.candidates.some((item) => item.decision === "rejected" && item.worker !== "released") ? [
-                    "Rejected candidate resources remain retained. After proving worker termination and releasing any superseded stage, use subagent_integrate release with the exact task, attempt and candidate tip.",
+                    "Rejected candidate resources remain retained. Release every generation that staged it, then use subagent_integrate release with the exact task, attempt and candidate tip; release first proves or performs exact worker termination.",
                 ] : []),
                 ...(state.final.failure ? [`Final: ${state.final.failure}`] : []),
                 ...(continuation ? [`Continuation: ${JSON.stringify(continuation)}`] : []),

package/dist/schema.js

@@ -923,7 +923,7 @@ export function parseIntegrationState(value, request) {
         if (generation.status === "superseded") {
             if (!generation.supersededFrom || !generation.failure?.trim() || generation.promotion
                 || generation.checks || generation.review || generation.combinedTip
-                || (generation.supersededFrom === "promotion_failed" ? !generation.supersededPromotion : generation.correction || generation.supersededPromotion)) {
+                || (generation.supersededFrom === "promotion_failed" ? !generation.supersededPromotion : generation.supersededPromotion)) {
                 throw new Error(`Superseded generation ${generation.number} retains usable evidence or lacks its reason.`);
             }
         }
@@ -1256,7 +1256,7 @@ export function parseRunState(value) {
             const selected = state.integration.generations.at(-1);
             const releasedWithRevisedAttempt = selected?.status === "promoted" && selected.stages.some((stage) => stage.taskId === candidate.taskId && stage.attempt === candidate.attempt && !sameIdentity(stage.source, candidate.tip))
                 && attempt?.cleanup.every((step) => step.status === "completed");
-            const releasedAfterRejection = task?.status === "rejected" && attempt?.termination?.status === "terminated"
+            const releasedAfterRejection = (task?.status === "rejected" || attempt?.superseded) && attempt?.termination?.status === "terminated"
                 && (candidate.worker === "release_pending" || candidate.worker === "released"
                     && attempt.cleanup.every((step) => step.status === "completed"));
             if (!attempt || (candidate.worker !== "retained" && !releasedAfterRejection

package/docs/orchestration.md

@@ -117,9 +117,9 @@ The user's request can authorize the declared local graph, checks, review, and M
 - `subagent_stage`: `{ id, action: "stage" | "resolve" | "reject" | "revise", generation, taskId, attempt, candidate, expectedTip, instruction? }`. `candidate` is the ready candidate's `tip`; `expectedTip` is Main's recorded identity for the first stage or the previous stage's exact tip. `resolve` reconciles a pending/conflicted merge; `reject` and `revise` arbitrate a candidate without changing Main.
 - `subagent_integrate`: `{ id, action: "advance" | "validate" | "correct" | "promote" | "reconcile" | "cleanup", generation, expectedTip }`. Use the generation's exact `combinedTip`. `advance` dispatches ready dependents on that snapshot, `correct` records the single clean committed correction after a definitive failed check/review, `reconcile` inspects an interrupted validation or promotion without replaying an uncertain promotion, and `cleanup` completes proved post-promotion cleanup.
 - `subagent_integrate refresh`: `{ id, action: "refresh", generation, expectedTip, expectedMain, newMain }`. If Main advanced to a clean same-branch descendant, this freezes the old generation and allocates a new integration checkout from `newMain`. Restage selected immutable candidates in explicit order, resolve fresh conflicts, then rerun combined validation. Dirty, divergent, or uncertain Main cannot refresh. For a reconciled `validation_failed` generation without checks, review, or a prior combined correction, identical `expectedMain` and `newMain` instead rebuild on the unchanged base. This requires the exact clean retained integration tip, leaves the old checkout retained, and never resumes its uncertain checks. Prove old coordinator/check processes stopped before recovery; a live productive lease blocks it. Restage explicitly and rerun all final gates; no correction allowance is replenished.
-- `subagent_integrate release`: `{ id, action: "release", generation, expectedTip, taskId?, attempt? }`. With no task, release an explicitly superseded checkout using that generation's last staged tip (or integration base if empty). With both `taskId` and `attempt`, release a rejected, terminated worker using its exact candidate tip and the latest generation number (or 1 when none exists); release every generation that staged it first. Cleanup steps are persisted separately, and a retry reconciles already-removed resources by proving absence. Release refuses dirty/conflicted work, changed refs, unproved termination, and still-needed checkouts.
+- `subagent_integrate release`: `{ id, action: "release", generation, expectedTip, taskId?, attempt? }`. With no task, release an explicitly superseded checkout using that generation's recorded tip: its correction tip, else its last staged tip, else its integration base. Supersession keeps the correction record for this proof. With both `taskId` and `attempt`, release the rejected candidate of a rejected task or of a dependent attempt that refresh or rejection invalidated, using its exact candidate tip and the latest generation number (or 1 when none exists); release every generation that staged it first. Release proves exact worker termination before cleanup: reconciliation records an absent worker after pane absence and two empty lease scans, and only an observed live worker without saved termination intent is closed with the same proof. An uncertain termination is never replayed. Cleanup steps are persisted separately, and a retry reconciles already-removed resources by proving absence. Release refuses dirty/conflicted work, changed refs, unproved termination, and still-needed checkouts.
 
-A rejection or revision of a staged candidate supersedes that generation, leaves its checkout read-only, and requires explicit restaging of chosen candidates into a new generation. At most two unreleased owned integration checkouts can coexist per request. Superseded integration checkouts and rejected candidate resources are **retained until Main explicitly releases them**. Inspect exact status first; dirty or unresolved conflicts require manual recovery without force deletion. Rejection invalidates dependent attempts; if the required fresh dependent work cannot run within the bounded attempt/lineage constraints, start a new request. `subagent_abort` cannot discard retained resources, but can finish after all candidates are rejected and all owned checkouts are released.
+A rejection or revision of a staged candidate supersedes that generation, leaves its checkout read-only, and requires explicit restaging of chosen candidates into a new generation. At most two unreleased owned integration checkouts can coexist per request. Superseded integration checkouts and rejected candidate resources are **retained until Main explicitly releases them**. Inspect exact status first; dirty or unresolved conflicts require manual recovery without force deletion. Rejection invalidates dependent attempts; if the required fresh dependent work cannot run within the bounded attempt/lineage constraints, start a new request. `subagent_abort` cannot discard retained resources, but can finish after all candidates are rejected and all owned checkouts are released. It also releases an empty refreshed generation that is clean at its base. If retained candidate checkouts and staged integration checkouts are proved absent (unregistered, path missing, branch ref missing) and their workers are proved absent, abort records those candidates as rejected and released and completes their cleanup; any present resource fails abort without state changes. Rejection and revision ignore dependents that refresh or an earlier rejection already invalidated.
 
 ### Recovery and state
 

package/extensions/isolated.ts

@@ -439,7 +439,7 @@ function inspectionNotices({ state, main, continuation }: RunResponse): string[]
 			&& !generation.promotion?.failure && !generation.supersededPromotion?.failure
 			&& generation !== state.integration.generations.at(-1)) continue;
 		const stagedTip = [...generation.stages].reverse().find((stage) => stage.tip)?.tip ?? generation.integrationBase;
-		lines.push(`Integration generation ${generation.number}: ${generation.status}; ${retainedPath ? `${checkoutCleaned ? "historical checkout; branch cleanup pending" : "worktree"}: ${JSON.stringify({ path: generation.worktree!.path, cwd: generation.worktree!.cwd, branch: generation.worktree!.branch, repoRoot: generation.worktree!.repoRoot })}; ` : ""}last staged tip: ${JSON.stringify(stagedTip)}${generation.combinedTip ? `; combined tip: ${JSON.stringify(generation.combinedTip)}` : ""}${generation.failure ? `; blockage: ${boundedPublicText(generation.failure)}` : ""}.`);
+		lines.push(`Integration generation ${generation.number}: ${generation.status}; ${retainedPath ? `${checkoutCleaned ? "historical checkout; branch cleanup pending" : "worktree"}: ${JSON.stringify({ path: generation.worktree!.path, cwd: generation.worktree!.cwd, branch: generation.worktree!.branch, repoRoot: generation.worktree!.repoRoot })}; ` : ""}last staged tip: ${JSON.stringify(stagedTip)}${generation.correction ? `; correction tip: ${JSON.stringify(generation.correction.to)}` : ""}${generation.combinedTip ? `; combined tip: ${JSON.stringify(generation.combinedTip)}` : ""}${generation.failure ? `; blockage: ${boundedPublicText(generation.failure)}` : ""}.`);
 		for (const stage of generation.stages.filter((item) => item.status === "conflict" || item.failure)) lines.push(`Integration generation ${generation.number} stage ${stage.taskId} attempt ${stage.attempt}: ${stage.status}${stage.failure ? `; blockage: ${boundedPublicText(stage.failure)}` : ""}.`);
 		for (const promotion of [generation.promotion, generation.supersededPromotion]) if (promotion?.failure) lines.push(`Integration generation ${generation.number} promotion ${promotion.status}: ${boundedPublicText(promotion.failure)}`);
 		if (generation.cleanup?.some((step) => step.status !== "completed")) lines.push(`Integration generation ${generation.number} cleanup pending: ${JSON.stringify(generation.cleanup.filter((step) => step.status !== "completed").map((step) => ({ kind: step.kind, status: step.status, failure: step.failure ? boundedPublicText(step.failure) : undefined })))}`);
@@ -766,7 +766,7 @@ export function registerIsolatedExtension(pi: ExtensionAPI, options: RegisterIso
 	pi.registerTool({
 		name: "subagent_abort",
 		label: "Subagent abort",
-		description: "Abort an isolated request; reject and release retained candidates and integration checkouts first. Terminate only exact owned workers. Repeat abort to reconcile cleanup of unchanged no-candidate allocations; preserve dirty or committed work.",
+		description: "Abort an isolated request; reject and release retained candidates and integration checkouts first unless their checkouts and branches are proved absent. Terminate only exact owned workers. Repeat abort to reconcile cleanup of unchanged allocations; preserve dirty or committed work.",
 		parameters: IdOnlySchema,
 		prepareArguments: parseIdOnly,
 		exposure: "model-only",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@henryqw/pi-subagent",
-  "version": "27.2.1",
+  "version": "27.3.0",
   "description": "Delegate bounded direct work or durable checked isolated task graphs to Pi roles.",
   "keywords": [
     "pi-package",