@henryqw/pi-subagent 27.2.1 → 27.3.1

package/dist/herdr-runtime.js

@@ -548,7 +548,8 @@ export class HerdrHostRuntime {
                 throw new Error("Worker termination identity does not match the exact saved agent.");
             this.assertLeasePath(allocation.leasePath, allocation.token);
             await assertPrivateLease(allocation.leasePath, false);
-            const agents = (await this.listAgents(allocation.worktreeCwd, context)).map((agent) => ({
+            const cwd = await this.queryCwd(allocation.worktreeCwd);
+            const agents = (await this.listAgents(cwd, context)).map((agent) => ({
                 name: typeof agent.name === "string" ? agent.name : undefined,
                 paneId: exactString(agent.pane_id, "Herdr listed agent pane ID"),
                 tabId: exactString(agent.tab_id, "Herdr listed agent tab ID"),
@@ -559,7 +560,7 @@ export class HerdrHostRuntime {
                 || related[0].paneId !== allocation.paneId || related[0].tabId !== allocation.tabId) {
                 throw new Error("Worker termination requires one exact current agent, tab, and pane match.");
             }
-            const processInfo = await this.herdr.json(["pane", "process-info", "--pane", allocation.paneId], this.processOptions(allocation.worktreeCwd, context, HERDR_OPERATION_CAP_MS));
+            const processInfo = await this.herdr.json(["pane", "process-info", "--pane", allocation.paneId], this.processOptions(cwd, context, HERDR_OPERATION_CAP_MS));
             const processResult = resultRecord(processInfo, "Herdr pane process-info response");
             if (processResult.type !== "pane_process_info")
                 throw new Error("Herdr pane process-info response has the wrong type.");
@@ -567,27 +568,27 @@ export class HerdrHostRuntime {
             if (captured.pane_id !== allocation.paneId) {
                 throw new Error("Herdr pane process-info did not match the exact saved pane.");
             }
-            const closed = await this.herdr.exec(["pane", "close", allocation.paneId], this.processOptions(allocation.worktreeCwd, context, HERDR_OPERATION_CAP_MS));
+            const closed = await this.herdr.exec(["pane", "close", allocation.paneId], this.processOptions(cwd, context, HERDR_OPERATION_CAP_MS));
             if (closed.code !== 0 || closed.killed)
                 throw new Error(herdrCommandFailure(["pane", "close"], closed));
             requireOkResponse(closed.stdout, "Herdr pane close response");
-            if (!await this.paneAbsent(allocation.paneId, allocation.worktreeCwd, context))
+            if (!await this.paneAbsent(allocation.paneId, cwd, context))
                 throw new Error("The exact saved pane still exists after pane close.");
-            let holders = await this.scanLease(allocation.leasePath, allocation.worktreeCwd, context);
+            let holders = await this.scanLease(allocation.leasePath, cwd, context);
             if (holders.length) {
-                await this.signalExactHolders(holders, allocation, "SIGTERM", context);
+                await this.signalExactHolders(holders, { ...allocation, worktreeCwd: cwd }, "SIGTERM", context);
                 await this.delay(250, context.signal);
-                holders = await this.scanLease(allocation.leasePath, allocation.worktreeCwd, context);
+                holders = await this.scanLease(allocation.leasePath, cwd, context);
             }
             if (holders.length) {
-                await this.signalExactHolders(holders, allocation, "SIGKILL", context);
+                await this.signalExactHolders(holders, { ...allocation, worktreeCwd: cwd }, "SIGKILL", context);
                 await this.delay(100, context.signal);
-                holders = await this.scanLease(allocation.leasePath, allocation.worktreeCwd, context);
+                holders = await this.scanLease(allocation.leasePath, cwd, context);
             }
             if (holders.length)
                 throw new Error(`Exact process lease still has ${holders.length} surviving holder(s).`);
             await this.delay(50, context.signal);
-            if ((await this.scanLease(allocation.leasePath, allocation.worktreeCwd, context)).length) {
+            if ((await this.scanLease(allocation.leasePath, cwd, context)).length) {
                 throw new Error("Exact process lease did not remain empty for two consecutive scans.");
             }
             return { outcome: "terminated" };
@@ -605,7 +606,8 @@ export class HerdrHostRuntime {
                 throw new Error("Saved termination worker does not match the exact owned agent.");
             this.assertLeasePath(allocation.leasePath, allocation.token);
             await assertPrivateLease(allocation.leasePath, false);
-            const agents = (await this.listAgents(allocation.worktreeCwd, context)).map((agent) => ({
+            const cwd = await this.queryCwd(allocation.worktreeCwd);
+            const agents = (await this.listAgents(cwd, context)).map((agent) => ({
                 name: typeof agent.name === "string" ? agent.name : undefined,
                 paneId: exactString(agent.pane_id, "Herdr listed agent pane ID"),
                 tabId: exactString(agent.tab_id, "Herdr listed agent tab ID"),
@@ -617,10 +619,10 @@ export class HerdrHostRuntime {
                     || related[0].paneId !== allocation.paneId || related[0].tabId !== allocation.tabId) {
                     throw new Error("Observed worker identity does not exactly match the saved owned agent and pane.");
                 }
-                if (await this.paneAbsent(allocation.paneId, allocation.worktreeCwd, context)) {
+                if (await this.paneAbsent(allocation.paneId, cwd, context)) {
                     throw new Error("Exact saved agent exists but its saved pane is absent.");
                 }
-                const processInfo = await this.herdr.json(["pane", "process-info", "--pane", allocation.paneId], this.processOptions(allocation.worktreeCwd, context, HERDR_OPERATION_CAP_MS));
+                const processInfo = await this.herdr.json(["pane", "process-info", "--pane", allocation.paneId], this.processOptions(cwd, context, HERDR_OPERATION_CAP_MS));
                 const result = resultRecord(processInfo, "Herdr pane process-info response");
                 if (result.type !== "pane_process_info"
                     || record(result.process_info, "Herdr pane process-info").pane_id !== allocation.paneId) {
@@ -628,14 +630,14 @@ export class HerdrHostRuntime {
                 }
                 return { outcome: "active" };
             }
-            if (!await this.paneAbsent(allocation.paneId, allocation.worktreeCwd, context)) {
+            if (!await this.paneAbsent(allocation.paneId, cwd, context)) {
                 throw new Error("Saved agent is absent but the exact saved pane still exists.");
             }
-            if ((await this.scanLease(allocation.leasePath, allocation.worktreeCwd, context)).length) {
+            if ((await this.scanLease(allocation.leasePath, cwd, context)).length) {
                 throw new Error("Saved worker is absent but its private process lease still has holders.");
             }
             await this.delay(50, context.signal);
-            if ((await this.scanLease(allocation.leasePath, allocation.worktreeCwd, context)).length) {
+            if ((await this.scanLease(allocation.leasePath, cwd, context)).length) {
                 throw new Error("Private process lease did not remain empty for two consecutive scans.");
             }
             return { outcome: "terminated" };
@@ -682,11 +684,13 @@ export class HerdrHostRuntime {
         }
         try {
             if (input.kind === "worker_tab") {
-                const allocation = ownedIntent(input.attempt, "worker_tab");
+                const owned = ownedIntent(input.attempt, "worker_tab");
                 const workspace = ownedIntent(input.attempt, "workspace");
-                requireIntentIdentity(allocation, input.attempt);
+                requireIntentIdentity(owned, input.attempt);
                 requireIntentIdentity(workspace, input.attempt);
-                assertWorkerTabIntent(allocation, input.task, input.attempt);
+                assertWorkerTabIntent(owned, input.task, input.attempt);
+                // Validation uses the saved identity; queries run from an existing directory.
+                const allocation = { ...owned, worktreeCwd: await this.queryCwd(owned.worktreeCwd) };
                 const leasePath = exactString(allocation.leasePath, "saved worker lease path");
                 this.assertLeasePath(leasePath, input.attempt.correlationToken);
                 assertWorkspaceIntent(workspace, input.attempt);
@@ -1327,6 +1331,18 @@ export class HerdrHostRuntime {
             throw new Error("Persisted workspace repository identity no longer matches Git.");
         }
     }
+    /** Herdr and lsof queries are global, so a checkout removed outside Pi Subagent must not be their process cwd. */
+    async queryCwd(cwd) {
+        try {
+            await lstat(cwd);
+            return cwd;
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return this.leaseDirectory;
+            throw error;
+        }
+    }
     processOptions(cwd, context, cap = HERDR_OPERATION_CAP_MS) {
         context.signal.throwIfAborted();
         return { cwd, signal: context.signal, timeoutMs: this.callTimeout(context, cap) };

package/dist/integration-git.d.ts

@@ -49,6 +49,8 @@ export declare class IntegrationGit {
             to: WorkspaceIdentity;
         };
     }, signal: AbortSignal): Promise<GitOutcome<WorkspaceIdentity>>;
+    /** Read-only proof that an owned checkout, its registration, and its branch are all gone. */
+    absent(root: string, info: WorktreeInfo, signal: AbortSignal): Promise<boolean>;
     /** Explicit release of an unselected clean checkout. The branch deletion is an exact ref compare-and-swap. */
     release(root: string, info: WorktreeInfo, expected: WorkspaceIdentity, kind: "worktree" | "branch", signal: AbortSignal): Promise<GitOutcome<"removed" | "absent">>;
     /** Cleanup is deliberately separate per resource; callers persist each proven substep. */

package/dist/integration-git.js

@@ -358,15 +358,23 @@ export class IntegrationGit {
         catch { /* Retain all resources when verification fails. */ }
         return { outcome: "unknown", failure: "Promotion returned success but exact clean Main tip could not be proved.", possibleResources: [integration.path, integration.branch] };
     }
+    /** Read-only proof that an owned checkout, its registration, and its branch are all gone. */
+    async absent(root, info, signal) {
+        await ownershipMetadata(root, info, signal);
+        const registered = await requireGit(["worktree", "list", "--porcelain", "-z"], root, signal);
+        if (registered.split("\0").includes(`worktree ${info.path}`) || await exists(info.path))
+            return false;
+        const args = ["show-ref", "--verify", "--quiet", `refs/heads/${info.branch}`];
+        const ref = await git(args, root, signal);
+        if (ref.code !== 0 && ref.code !== 1)
+            throw new Error(failure(args, ref));
+        return ref.code === 1;
+    }
     /** Explicit release of an unselected clean checkout. The branch deletion is an exact ref compare-and-swap. */
     async release(root, info, expected, kind, signal) {
         const possibleResources = [info.path, info.branch];
         try {
             await ownershipMetadata(root, info, signal);
-            if (expected.branch !== `refs/heads/${info.branch}` || expected.index !== expected.tree
-                || !await ancestor(info.baseCommit, expected.head, root, signal)) {
-                return { outcome: "blocked", failure: "Release lacks an exact clean owned branch and base lineage." };
-            }
             const registered = await requireGit(["worktree", "list", "--porcelain", "-z"], root, signal);
             const present = registered.split("\0").includes(`worktree ${info.path}`);
             const pathPresent = await exists(info.path);
@@ -377,9 +385,14 @@ export class IntegrationGit {
             const branch = await git(["rev-parse", "--verify", ref], root, signal);
             if (branch.code !== 0 && branch.code !== 128)
                 throw new Error("Owned branch tip could not be inspected.");
+            // Absence needs no lineage proof: nothing remains to remove, even after Git pruned the commits.
+            if (!present && !pathPresent && (kind === "worktree" || branch.code === 128))
+                return { outcome: "ready", value: "absent" };
+            if (expected.branch !== ref || expected.index !== expected.tree
+                || !await ancestor(info.baseCommit, expected.head, root, signal)) {
+                return { outcome: "blocked", failure: "Release lacks an exact clean owned branch and base lineage." };
+            }
             if (kind === "worktree") {
-                if (!present && !pathPresent)
-                    return { outcome: "ready", value: "absent" };
                 if (!present || !pathPresent || branch.stdout.trim() !== expected.head
                     || !sameIdentity(await current(root, info, signal), expected)) {
                     return { outcome: "blocked", failure: "Owned checkout, registration, branch or clean candidate changed." };
@@ -398,8 +411,6 @@ export class IntegrationGit {
             }
             if (present || pathPresent)
                 return { outcome: "blocked", failure: "Release the exact checkout before branch deletion." };
-            if (branch.code === 128)
-                return { outcome: "ready", value: "absent" };
             if (branch.stdout.trim() !== expected.head)
                 return { outcome: "blocked", failure: "Owned branch differs from the approved tip." };
             const args = ["update-ref", "-d", ref, expected.head];

package/dist/runner.d.ts

@@ -347,6 +347,8 @@ export declare class IsolatedRunner {
     private cleanupPromoted;
     private requireExactIntegration;
     abort(id: string, root: string, outerSignal?: AbortSignal): Promise<RunResponse>;
+    /** Read-only proof that every retained candidate checkout and staged integration checkout is already gone. */
+    private retainedWorkAbsent;
     private cleanupAborted;
     status(id: string, root: string, outerSignal?: AbortSignal): Promise<RunResponse>;
     private run;
@@ -356,6 +358,11 @@ export declare class IsolatedRunner {
     private driveWorkerSafely;
     private driveWorker;
     private terminationCandidate;
+    /**
+     * Proves exact worker termination without replay. Reconciliation records a worker that is already gone;
+     * only an observed live worker without saved termination intent is closed.
+     */
+    private proveTermination;
     private terminateWithSafety;
     private runCheckBatch;
     private runReview;

package/dist/runner.js

@@ -286,7 +286,27 @@ function affectedDependents(state, taskId) {
             }
         }
     }
-    return state.tasks.filter((task) => task.taskId !== taskId && affected.has(task.taskId) && task.attempts.length > 0);
+    return state.tasks.filter((task) => task.taskId !== taskId && affected.has(task.taskId) && task.attempts.length > 0
+        // Refresh or an earlier rejection already invalidated this attempt; it needs no second invalidation.
+        && !(task.status === "pending" && (task.kind === "changeset" ? task.attempts.at(-1).superseded
+            : task.attempts.at(-1).status === "superseded")));
+}
+/** Freezes a generation as read-only. The correction stays recorded because it names the checkout's exact tip. */
+function supersedeGeneration(generation, failure) {
+    if (generation.status === "promotion_failed") {
+        generation.supersededPromotion = generation.promotion;
+        delete generation.promotion;
+    }
+    generation.supersededFrom = generation.status;
+    generation.status = "superseded";
+    generation.failure = failure;
+    delete generation.combinedTip;
+    delete generation.checks;
+    delete generation.review;
+}
+/** The exact tip a retained integration checkout holds: its correction, last staged merge, or base. */
+function retainedGenerationTip(generation) {
+    return generation.correction?.to ?? generation.stages.at(-1)?.tip ?? generation.integrationBase;
 }
 /** Every changeset predecessor must be present in this exact committed snapshot. */
 function stagedDependencySnapshot(state, taskId, tip) {
@@ -950,13 +970,7 @@ export class IsolatedRunner {
                     }
                     if (!["staging", "conflict", "validation_failed", "ready"].includes(generation.status))
                         throw new Error("Cannot supersede an unresolved promotion or validation.");
-                    generation.supersededFrom = generation.status;
-                    generation.status = "superseded";
-                    generation.failure = `Main ${action.action === "reject" ? "rejected" : "revised"} ${action.taskId}; retained generation is read-only.`;
-                    delete generation.combinedTip;
-                    delete generation.checks;
-                    delete generation.review;
-                    delete generation.correction;
+                    supersedeGeneration(generation, `Main ${action.action === "reject" ? "rejected" : "revised"} ${action.taskId}; retained generation is read-only.`);
                 }
                 candidate.decision = "rejected";
                 for (const dependent of affected) {
@@ -1164,20 +1178,22 @@ export class IsolatedRunner {
                     const candidates = state.integration.candidates.filter((item) => item.taskId === action.taskId && item.attempt === action.attempt);
                     const candidate = candidates.find((item) => sameIdentity(item.tip, action.expectedTip));
                     const worker = attempt?.allocations.find((item) => item.kind === "worktree" && item.status === "owned")?.worktree;
-                    if (!candidate || candidate.decision !== "rejected" || task.status !== "rejected"
-                        || attempt?.termination?.status !== "terminated"
-                        || !sameIdentity(attempt.termination.candidate, action.expectedTip) || !worker
+                    const tip = attempt?.termination?.candidate ?? attempt?.candidate;
+                    // A rejected task or an invalidated dependent attempt never runs again; its worker can stop.
+                    if (!candidate || candidate.decision !== "rejected" || !attempt || (task.status !== "rejected" && !attempt.superseded)
+                        || !tip || !sameIdentity(tip, action.expectedTip) || !worker
                         || candidates.some((item) => !item.decision)
                         || state.integration.generations.some((item) => item.stages.some((stage) => stage.taskId === action.taskId
                             && stage.attempt === action.attempt && item.cleanup?.every((step) => step.status === "completed") !== true))) {
-                        throw new Error("Release requires a rejected terminated worker and no retained staged generation using its checkout.");
+                        throw new Error("Release requires a rejected candidate of a stopped or invalidated worker and no retained staged generation using its checkout.");
                     }
+                    await this.proveTermination(handle, task, attempt, action.expectedTip, async () => await this.saveProductive(handle), scope.signal);
                     await this.releaseRejected(handle, task, attempt, worker, scope);
                     return this.response(state);
                 }
                 const superseded = state.integration.generations[action.generation - 1];
                 if (!superseded?.worktree || superseded.status !== "superseded"
-                    || !sameIdentity(action.expectedTip, superseded.stages.at(-1)?.tip ?? superseded.integrationBase)
+                    || !sameIdentity(action.expectedTip, retainedGenerationTip(superseded))
                     || superseded.stages.some((stage) => stage.status === "pending" || stage.status === "staging")) {
                     throw new Error("Release requires an exact superseded integration checkout without an uncertain stage.");
                 }
@@ -1234,18 +1250,7 @@ export class IsolatedRunner {
                     throw new Error("A dependent has unproved resources or exhausted fresh attempts; refresh is blocked.");
                 }
                 if (generation && generation.status !== "superseded") {
-                    if (generation.status === "promotion_failed") {
-                        generation.supersededPromotion = generation.promotion;
-                        delete generation.promotion;
-                    }
-                    generation.supersededFrom = generation.status;
-                    generation.status = "superseded";
-                    generation.failure = `${unchangedMain ? "Validation evidence missing" : "Main advanced"}; retained generation is read-only. Restage immutable candidates in a new generation.`;
-                    delete generation.combinedTip;
-                    delete generation.checks;
-                    delete generation.review;
-                    if (!generation.supersededPromotion)
-                        delete generation.correction;
+                    supersedeGeneration(generation, `${unchangedMain ? "Validation evidence missing" : "Main advanced"}; retained generation is read-only. Restage immutable candidates in a new generation.`);
                 }
                 for (const task of stale) {
                     if (task.kind === "text") {
@@ -1659,10 +1664,23 @@ export class IsolatedRunner {
             const state = handle.state;
             if (terminal(state) && state.status !== "aborted")
                 return this.response(state);
-            if (state.integration.candidates.some((candidate) => candidate.worker !== "released")
-                || state.integration.generations.some((generation) => generation.worktree
-                    && !generation.cleanup?.every((step) => step.status === "completed"))) {
-                throw new Error("Retained candidates and integration worktrees must be explicitly rejected and released before abort.");
+            const candidates = state.integration.candidates.filter((candidate) => candidate.worker !== "released");
+            const generations = state.integration.generations.filter((generation) => generation.worktree
+                && !generation.cleanup?.every((step) => step.status === "completed"));
+            // Abort removes only unchanged resources: an empty refreshed generation, or candidate work proved already gone.
+            if ((candidates.length || generations.length) && (lifecycle.productiveRunLeaseActive
+                || generations.some((generation) => generation.status === "promotion_failed" ? generation.promotion?.outcome !== "drift"
+                    : !["staging", "conflict", "validation_failed", "ready", "superseded"].includes(generation.status))
+                || ((candidates.length || generations.some((generation) => generation.stages.length))
+                    && !await this.retainedWorkAbsent(state, candidates, generations, outerSignal)))) {
+                throw new Error("Retained candidates and integration worktrees must be explicitly rejected and released before abort, unless their checkouts and branches are proved absent.");
+            }
+            for (const candidate of candidates.filter((item) => !item.decision)) {
+                candidate.decision = "rejected";
+                this.attention(changesetTaskState(state, candidate.taskId), "Abort rejected this candidate after proving its checkout and branch absent.");
+            }
+            for (const generation of generations.filter((item) => item.status !== "superseded")) {
+                supersedeGeneration(generation, "Request aborted; the integration checkout is released.");
             }
             const activeControls = this.activeControls(root, id);
             for (const { control } of activeControls)
@@ -1679,30 +1697,11 @@ export class IsolatedRunner {
                 for (const attempt of task.attempts) {
                     if (!allocationByKind(attempt, "agent")?.agentName || attempt.termination?.status === "terminated")
                         continue;
-                    if (attempt.termination) {
-                        const safety = new DeadlineScope(safetyDeadline, () => this.coordinatorRuntime.now(), outerSignal);
-                        try {
-                            const result = await safety.call((context) => this.hostRuntime.reconcileWorkerTermination({
-                                task: changesetTaskRequest(state, task.taskId), attempt,
-                                workerId: attempt.termination.workerId, candidate: attempt.termination.candidate,
-                            }, context));
-                            if (result.outcome !== "terminated")
-                                throw new Error(result.outcome === "unknown"
-                                    ? result.failure : "Exact worker remains active; termination was not replayed.");
-                            attempt.termination = { ...attempt.termination, status: "terminated", at: this.coordinatorRuntime.now() };
-                            delete attempt.termination.failure;
-                        }
-                        catch (error) {
-                            attempt.termination.status = "unknown";
-                            attempt.termination.failure = errorText(error);
-                            this.attention(task, attempt.termination.failure);
-                        }
-                        finally {
-                            safety.close();
-                        }
+                    try {
+                        await this.proveTermination(handle, task, attempt, this.terminationCandidate(attempt), async () => await handle.save(), outerSignal, safetyDeadline);
                     }
-                    else {
-                        await this.terminateWithSafety(handle, task, attempt, this.terminationCandidate(attempt), outerSignal, safetyDeadline, true);
+                    catch (error) {
+                        this.attention(task, errorText(error));
                     }
                 }
             }
@@ -1717,6 +1716,24 @@ export class IsolatedRunner {
             return this.response(state);
         }, { purpose: "abort" });
     }
+    /** Read-only proof that every retained candidate checkout and staged integration checkout is already gone. */
+    async retainedWorkAbsent(state, candidates, generations, signal) {
+        const checkouts = [
+            ...candidates.map((candidate) => allocationByKind(changesetTaskState(state, candidate.taskId).attempts[candidate.attempt - 1], "worktree")?.worktree),
+            ...generations.filter((generation) => generation.stages.length).map((generation) => generation.worktree),
+        ];
+        const scope = new DeadlineScope(this.coordinatorRuntime.now() + CLEANUP_SAFETY_BUDGET_MS, () => this.coordinatorRuntime.now(), signal);
+        try {
+            for (const checkout of checkouts) {
+                if (!checkout || !await scope.call((context) => this.integrationGit.absent(state.root, checkout, context.signal)))
+                    return false;
+            }
+            return true;
+        }
+        finally {
+            scope.close();
+        }
+    }
     async cleanupAborted(handle, signal) {
         const state = handle.state;
         const scope = new DeadlineScope(this.coordinatorRuntime.now() + CLEANUP_SAFETY_BUDGET_MS, () => this.coordinatorRuntime.now(), signal);
@@ -1737,7 +1754,8 @@ export class IsolatedRunner {
                         if (allocationByKind(attempt, "agent") && attempt.termination?.status !== "terminated") {
                             throw new Error("Exact worker termination remains unproved.");
                         }
-                        if (expected && attempt.termination && attempt.termination.candidate.head !== expected.head) {
+                        if (expected && attempt.termination && attempt.termination.candidate.head !== expected.head
+                            && !await scope.call((context) => this.integrationGit.absent(state.root, worker, context.signal))) {
                             throw new Error("Aborted worker may contain committed work; automatic cleanup preserves it.");
                         }
                         for (const step of attempt.cleanup) {
@@ -1773,6 +1791,45 @@ export class IsolatedRunner {
                     }
                 }
             }
+            // Abort admitted retained candidates only after proving their checkouts absent.
+            for (const candidate of state.integration.candidates) {
+                const task = changesetTaskState(state, candidate.taskId);
+                const attempt = task.attempts[candidate.attempt - 1];
+                if (candidate.worker === "released" || candidate.decision !== "rejected" || attempt.termination?.status !== "terminated"
+                    || attempt.cleanup.some((step) => step.status !== "completed"))
+                    continue;
+                candidate.worker = "released";
+                if (task.status === "needs_attention" && attempt === task.attempts.at(-1) && !attempt.superseded) {
+                    task.status = "rejected";
+                    delete task.failure;
+                }
+                await handle.save();
+            }
+            for (const generation of state.integration.generations) {
+                if (!generation.worktree || generation.status !== "superseded")
+                    continue;
+                const steps = generation.cleanup ??= [{ kind: "worktree", status: "pending" }, { kind: "branch", status: "pending" }];
+                try {
+                    for (const step of steps) {
+                        if (step.status === "completed")
+                            continue;
+                        step.status = "running";
+                        delete step.failure;
+                        await handle.save();
+                        const result = await scope.call((context) => this.integrationGit.release(state.root, generation.worktree, retainedGenerationTip(generation), step.kind, context.signal));
+                        if (result.outcome !== "ready")
+                            throw new Error(result.failure);
+                        step.status = "completed";
+                        await handle.save();
+                    }
+                }
+                catch (error) {
+                    const pending = steps.find((step) => step.status === "running");
+                    if (pending)
+                        pending.failure = bounded(`Abort cleanup retained resources: ${errorText(error)}`);
+                    await handle.save();
+                }
+            }
         }
         finally {
             scope.close();
@@ -2434,6 +2491,43 @@ export class IsolatedRunner {
             ?? attempt.prompts.at(-1)?.preCandidate
             ?? attempt.waveBase;
     }
+    /**
+     * Proves exact worker termination without replay. Reconciliation records a worker that is already gone;
+     * only an observed live worker without saved termination intent is closed.
+     */
+    async proveTermination(handle, task, attempt, candidate, save, signal, deadline = this.coordinatorRuntime.now() + TERMINATION_SAFETY_BUDGET_MS) {
+        if (attempt.termination?.status === "terminated")
+            return;
+        const workerId = attempt.termination?.workerId ?? allocationByKind(attempt, "agent")?.agentName;
+        if (!workerId)
+            throw new Error("Worker termination requires an exact durably owned agent ID.");
+        const input = { task: changesetTaskRequest(handle.state, task.taskId), attempt, workerId,
+            candidate: attempt.termination?.candidate ?? candidate };
+        const safety = new DeadlineScope(deadline, () => this.coordinatorRuntime.now(), signal);
+        try {
+            let result = await safety.call((context) => this.hostRuntime.reconcileWorkerTermination(input, context));
+            if (result.outcome === "active" && !attempt.termination) {
+                attempt.termination = { status: "terminating", workerId, candidate: input.candidate };
+                await save(); // Intent before the exact pane close.
+                result = await safety.call((context) => this.hostRuntime.terminateWorker(input, context));
+            }
+            if (result.outcome !== "terminated") {
+                throw new Error(result.outcome === "unknown" ? result.failure : "Exact worker remains active; termination was not replayed.");
+            }
+            attempt.termination = { status: "terminated", workerId, candidate: input.candidate, at: this.coordinatorRuntime.now() };
+        }
+        catch (error) {
+            const failure = bounded(`Worker termination is unproved: ${errorText(error)}`);
+            // Without saved intent, nothing was closed; a later proof may still close the exact live worker.
+            if (attempt.termination)
+                attempt.termination = { status: "unknown", workerId, candidate: input.candidate, failure };
+            throw new Error(failure, { cause: error });
+        }
+        finally {
+            safety.close();
+            await save();
+        }
+    }
     async terminateWithSafety(handle, task, attempt, candidate, outerSignal, safetyDeadline = this.coordinatorRuntime.now() + TERMINATION_SAFETY_BUDGET_MS, lifecycleLocked = false) {
         if (!lifecycleLocked && this.productiveLifecycles.has(handle.state.root)) {
             return await this.withLifecycleLock(handle, async () => await this.terminateWithSafety(handle, task, attempt, candidate, outerSignal, safetyDeadline, true));
@@ -2985,8 +3079,9 @@ export class IsolatedRunner {
             text: bounded([
                 `Pi Subagent ${state.request.id}: ${state.status}.`,
                 `Tasks: ${completed}/${state.tasks.length} completed, ${rejected} rejected. Accepted: ${state.accepted}.`,
-                ...(state.status === "aborted" && state.tasks.some((task) => task.kind === "changeset"
+                ...(state.status === "aborted" && (state.tasks.some((task) => task.kind === "changeset"
                     && task.attempts.some((attempt) => attempt.cleanup.some((step) => step.status !== "completed")))
+                    || state.integration.generations.some((generation) => generation.cleanup?.some((step) => step.status !== "completed")))
                     ? ["Aborted resources remain retained. Inspect cleanup evidence; retry subagent_abort after active work settles or cleanup blockers are resolved. Unique commits and uncertain work are never discarded."] : []),
                 ...(main?.status === "current" ? ["Main: current at the recorded exact identity."] : []),
                 ...(main?.status === "drifted" ? [
@@ -3009,10 +3104,10 @@ export class IsolatedRunner {
                 ] : []),
                 ...(state.integration.generations.some((item) => item.status === "superseded" && item.worktree
                     && !item.cleanup?.every((step) => step.status === "completed")) ? [
-                    "Superseded integration worktrees remain owned. Use subagent_integrate release with their exact generation and last staged tip; dirty or conflicted work stays retained.",
+                    "Superseded integration worktrees remain owned. Use subagent_integrate release with their exact generation and recorded tip (correction tip, else last staged tip, else integration base); dirty or conflicted work stays retained.",
                 ] : []),
                 ...(state.integration.candidates.some((item) => item.decision === "rejected" && item.worker !== "released") ? [
-                    "Rejected candidate resources remain retained. After proving worker termination and releasing any superseded stage, use subagent_integrate release with the exact task, attempt and candidate tip.",
+                    "Rejected candidate resources remain retained. Release every generation that staged it, then use subagent_integrate release with the exact task, attempt and candidate tip; release first proves or performs exact worker termination.",
                 ] : []),
                 ...(state.final.failure ? [`Final: ${state.final.failure}`] : []),
                 ...(continuation ? [`Continuation: ${JSON.stringify(continuation)}`] : []),

package/dist/schema.js

@@ -923,7 +923,7 @@ export function parseIntegrationState(value, request) {
         if (generation.status === "superseded") {
             if (!generation.supersededFrom || !generation.failure?.trim() || generation.promotion
                 || generation.checks || generation.review || generation.combinedTip
-                || (generation.supersededFrom === "promotion_failed" ? !generation.supersededPromotion : generation.correction || generation.supersededPromotion)) {
+                || (generation.supersededFrom === "promotion_failed" ? !generation.supersededPromotion : generation.supersededPromotion)) {
                 throw new Error(`Superseded generation ${generation.number} retains usable evidence or lacks its reason.`);
             }
         }
@@ -1256,7 +1256,7 @@ export function parseRunState(value) {
             const selected = state.integration.generations.at(-1);
             const releasedWithRevisedAttempt = selected?.status === "promoted" && selected.stages.some((stage) => stage.taskId === candidate.taskId && stage.attempt === candidate.attempt && !sameIdentity(stage.source, candidate.tip))
                 && attempt?.cleanup.every((step) => step.status === "completed");
-            const releasedAfterRejection = task?.status === "rejected" && attempt?.termination?.status === "terminated"
+            const releasedAfterRejection = (task?.status === "rejected" || attempt?.superseded) && attempt?.termination?.status === "terminated"
                 && (candidate.worker === "release_pending" || candidate.worker === "released"
                     && attempt.cleanup.every((step) => step.status === "completed"));
             if (!attempt || (candidate.worker !== "retained" && !releasedAfterRejection

package/docs/orchestration.md

@@ -117,9 +117,9 @@ The user's request can authorize the declared local graph, checks, review, and M
 - `subagent_stage`: `{ id, action: "stage" | "resolve" | "reject" | "revise", generation, taskId, attempt, candidate, expectedTip, instruction? }`. `candidate` is the ready candidate's `tip`; `expectedTip` is Main's recorded identity for the first stage or the previous stage's exact tip. `resolve` reconciles a pending/conflicted merge; `reject` and `revise` arbitrate a candidate without changing Main.
 - `subagent_integrate`: `{ id, action: "advance" | "validate" | "correct" | "promote" | "reconcile" | "cleanup", generation, expectedTip }`. Use the generation's exact `combinedTip`. `advance` dispatches ready dependents on that snapshot, `correct` records the single clean committed correction after a definitive failed check/review, `reconcile` inspects an interrupted validation or promotion without replaying an uncertain promotion, and `cleanup` completes proved post-promotion cleanup.
 - `subagent_integrate refresh`: `{ id, action: "refresh", generation, expectedTip, expectedMain, newMain }`. If Main advanced to a clean same-branch descendant, this freezes the old generation and allocates a new integration checkout from `newMain`. Restage selected immutable candidates in explicit order, resolve fresh conflicts, then rerun combined validation. Dirty, divergent, or uncertain Main cannot refresh. For a reconciled `validation_failed` generation without checks, review, or a prior combined correction, identical `expectedMain` and `newMain` instead rebuild on the unchanged base. This requires the exact clean retained integration tip, leaves the old checkout retained, and never resumes its uncertain checks. Prove old coordinator/check processes stopped before recovery; a live productive lease blocks it. Restage explicitly and rerun all final gates; no correction allowance is replenished.
-- `subagent_integrate release`: `{ id, action: "release", generation, expectedTip, taskId?, attempt? }`. With no task, release an explicitly superseded checkout using that generation's last staged tip (or integration base if empty). With both `taskId` and `attempt`, release a rejected, terminated worker using its exact candidate tip and the latest generation number (or 1 when none exists); release every generation that staged it first. Cleanup steps are persisted separately, and a retry reconciles already-removed resources by proving absence. Release refuses dirty/conflicted work, changed refs, unproved termination, and still-needed checkouts.
+- `subagent_integrate release`: `{ id, action: "release", generation, expectedTip, taskId?, attempt? }`. With no task, release an explicitly superseded checkout using that generation's recorded tip: its correction tip, else its last staged tip, else its integration base. Supersession keeps the correction record for this proof. With both `taskId` and `attempt`, release the rejected candidate of a rejected task or of a dependent attempt that refresh or rejection invalidated, using its exact candidate tip and the latest generation number (or 1 when none exists); release every generation that staged it first. Release proves exact worker termination before cleanup: reconciliation records an absent worker after pane absence and two empty lease scans, and only an observed live worker without saved termination intent is closed with the same proof. An uncertain termination is never replayed. Cleanup steps are persisted separately, and a retry reconciles already-removed resources by proving absence. Release refuses dirty/conflicted work, changed refs, unproved termination, and still-needed checkouts.
 
-A rejection or revision of a staged candidate supersedes that generation, leaves its checkout read-only, and requires explicit restaging of chosen candidates into a new generation. At most two unreleased owned integration checkouts can coexist per request. Superseded integration checkouts and rejected candidate resources are **retained until Main explicitly releases them**. Inspect exact status first; dirty or unresolved conflicts require manual recovery without force deletion. Rejection invalidates dependent attempts; if the required fresh dependent work cannot run within the bounded attempt/lineage constraints, start a new request. `subagent_abort` cannot discard retained resources, but can finish after all candidates are rejected and all owned checkouts are released.
+A rejection or revision of a staged candidate supersedes that generation, leaves its checkout read-only, and requires explicit restaging of chosen candidates into a new generation. At most two unreleased owned integration checkouts can coexist per request. Superseded integration checkouts and rejected candidate resources are **retained until Main explicitly releases them**. Inspect exact status first; dirty or unresolved conflicts require manual recovery without force deletion. Rejection invalidates dependent attempts; if the required fresh dependent work cannot run within the bounded attempt/lineage constraints, start a new request. `subagent_abort` cannot discard retained resources, but can finish after all candidates are rejected and all owned checkouts are released. It also releases an empty refreshed generation that is clean at its base. If retained candidate checkouts and staged integration checkouts are proved absent (unregistered, path missing, branch ref missing) and their workers are proved absent, abort records those candidates as rejected and released and completes their cleanup; any present resource fails abort without state changes. Rejection and revision ignore dependents that refresh or an earlier rejection already invalidated.
 
 ### Recovery and state
 

package/extensions/isolated.ts

@@ -439,7 +439,7 @@ function inspectionNotices({ state, main, continuation }: RunResponse): string[]
 			&& !generation.promotion?.failure && !generation.supersededPromotion?.failure
 			&& generation !== state.integration.generations.at(-1)) continue;
 		const stagedTip = [...generation.stages].reverse().find((stage) => stage.tip)?.tip ?? generation.integrationBase;
-		lines.push(`Integration generation ${generation.number}: ${generation.status}; ${retainedPath ? `${checkoutCleaned ? "historical checkout; branch cleanup pending" : "worktree"}: ${JSON.stringify({ path: generation.worktree!.path, cwd: generation.worktree!.cwd, branch: generation.worktree!.branch, repoRoot: generation.worktree!.repoRoot })}; ` : ""}last staged tip: ${JSON.stringify(stagedTip)}${generation.combinedTip ? `; combined tip: ${JSON.stringify(generation.combinedTip)}` : ""}${generation.failure ? `; blockage: ${boundedPublicText(generation.failure)}` : ""}.`);
+		lines.push(`Integration generation ${generation.number}: ${generation.status}; ${retainedPath ? `${checkoutCleaned ? "historical checkout; branch cleanup pending" : "worktree"}: ${JSON.stringify({ path: generation.worktree!.path, cwd: generation.worktree!.cwd, branch: generation.worktree!.branch, repoRoot: generation.worktree!.repoRoot })}; ` : ""}last staged tip: ${JSON.stringify(stagedTip)}${generation.correction ? `; correction tip: ${JSON.stringify(generation.correction.to)}` : ""}${generation.combinedTip ? `; combined tip: ${JSON.stringify(generation.combinedTip)}` : ""}${generation.failure ? `; blockage: ${boundedPublicText(generation.failure)}` : ""}.`);
 		for (const stage of generation.stages.filter((item) => item.status === "conflict" || item.failure)) lines.push(`Integration generation ${generation.number} stage ${stage.taskId} attempt ${stage.attempt}: ${stage.status}${stage.failure ? `; blockage: ${boundedPublicText(stage.failure)}` : ""}.`);
 		for (const promotion of [generation.promotion, generation.supersededPromotion]) if (promotion?.failure) lines.push(`Integration generation ${generation.number} promotion ${promotion.status}: ${boundedPublicText(promotion.failure)}`);
 		if (generation.cleanup?.some((step) => step.status !== "completed")) lines.push(`Integration generation ${generation.number} cleanup pending: ${JSON.stringify(generation.cleanup.filter((step) => step.status !== "completed").map((step) => ({ kind: step.kind, status: step.status, failure: step.failure ? boundedPublicText(step.failure) : undefined })))}`);
@@ -766,7 +766,7 @@ export function registerIsolatedExtension(pi: ExtensionAPI, options: RegisterIso
 	pi.registerTool({
 		name: "subagent_abort",
 		label: "Subagent abort",
-		description: "Abort an isolated request; reject and release retained candidates and integration checkouts first. Terminate only exact owned workers. Repeat abort to reconcile cleanup of unchanged no-candidate allocations; preserve dirty or committed work.",
+		description: "Abort an isolated request; reject and release retained candidates and integration checkouts first unless their checkouts and branches are proved absent. Terminate only exact owned workers. Repeat abort to reconcile cleanup of unchanged allocations; preserve dirty or committed work.",
 		parameters: IdOnlySchema,
 		prepareArguments: parseIdOnly,
 		exposure: "model-only",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@henryqw/pi-subagent",
-  "version": "27.2.1",
+  "version": "27.3.1",
   "description": "Delegate bounded direct work or durable checked isolated task graphs to Pi roles.",
   "keywords": [
     "pi-package",