@moretea-labs/forge 1.7.2 → 1.8.1

package/src/runtime/control-plane/execution/work-terminal-cleanup.ts

@@ -1,26 +1,26 @@
 import { createHash } from 'crypto';
 import { spawnSync } from 'child_process';
 import {
-  cpSync,
   existsSync,
   mkdirSync,
   readFileSync,
-  writeFileSync,
 } from 'fs';
 import { dirname, join, resolve } from 'path';
 import { repoLocalNoIndexControllerHome, repositoryControllerRoot } from '../../../cli/repositories/controller-home';
 import {
   getRepository,
   listRepositories,
+  RepositoryCheckoutSelectionError,
   selectRepositoryCheckout,
   setRepositoryCheckoutLifecycle,
 } from '../../../cli/repositories/registry';
 import { managedPathInside, managedWorktreeStorageRoot } from '../../../cli/repositories/worktree-storage';
 import { markRepositoryProjectionDirty } from '../../projections/invalidation';
 import { listControlPlaneRecords } from '../persistence/sqlite-store';
-import { getWorkContract } from '../facade/work-contract-store';
-import { getControllerSession, releaseObservedControllerSession } from '../facade/controller-session-store';
-import { isRepositoryCompletionReceipt, isTerminalWorkContractStatus, type WorkContract } from '../facade/types';
+import { getWorkContract, recordCancelledWorkCleanupCompleted, semanticWorkState } from '../../../../packages/kernel/work/api/index';
+import { assertOwnedResourceCleanupTarget, markOwnedResourceCleaned, markOwnedResourceRetained } from '../../../../packages/kernel/identity/api/index';
+import { managedBranchOwnedResourceId, managedBranchOwnedResourceLocator, managedWorkspaceOwnedResourceId } from '../../execution/managed-workspace';
+import { isRepositoryCompletionReceipt, type WorkContract } from '../facade/types';
 import {
   cancelProcess,
   getProcessHandle,
@@ -33,14 +33,14 @@ import { getProcessRecord, listProcessRecords } from '../../execution/process-ru
 import {
   listWorkHandles,
   readWorkHandle,
+  resolveWorkDeliveryTargetBranch,
   transitionWorkHandle,
   writeWorkHandle,
   type WorkCleanupReceipt,
   type WorkHandleState,
   type WorkTerminalOutcome,
 } from './work-handle-store';
-
-const CHECKPOINT_MESSAGE = 'chore(checkpoint): preserve terminal work before cleanup';
+import { proveWorkPreservationContained } from '../cleanup-artifact-retention';
 
 export interface TerminalWorkCleanupInput {
   controllerHome: string;
@@ -109,7 +109,7 @@ function newReceipt(handle: WorkHandleState, targetBranch: string, terminalOutco
     updatedAt: timestamp,
     verification: { mode: 'cleanup_only', checksRun: [] },
     processes: { examined: [], terminated: [], blocking: [], allTerminal: false },
-    ownership: { controllerLease: 'pending', processLeases: 'pending' },
+    ownership: { controllerLease: 'already_released', processLeases: 'pending' },
     preservation: { status: 'not_needed' },
     worktree: { path: handle.worktreePath, status: 'pending' },
     branchCleanup: { branch: handle.branch, status: 'pending' },
@@ -159,62 +159,6 @@ function branchUsedByAnotherWorktree(root: string, branch: string, currentPath:
   return false;
 }
 
-function copyUntrackedFiles(worktreePath: string, archiveRoot: string): Array<{ path: string; sha256: string }> {
-  const listed = git(worktreePath, ['ls-files', '--others', '--exclude-standard', '-z']);
-  if (!listed.ok || !listed.stdout) return [];
-  const manifest: Array<{ path: string; sha256: string }> = [];
-  for (const relativePath of listed.stdout.split('\0').filter(Boolean)) {
-    const source = join(worktreePath, relativePath);
-    const destination = join(archiveRoot, 'untracked', relativePath);
-    mkdirSync(dirname(destination), { recursive: true });
-    if (!existsSync(destination)) {
-      cpSync(source, destination, { recursive: true, force: false, errorOnExist: true });
-    }
-    if (existsSync(source)) {
-      try {
-        manifest.push({ path: relativePath, sha256: hashText(readFileSync(source)) });
-      } catch {
-        manifest.push({ path: relativePath, sha256: 'directory-or-unreadable' });
-      }
-    }
-  }
-  return manifest;
-}
-
-function createPatchArchive(controllerHome: string, handle: WorkHandleState): {
-  path: string;
-  sha256: string;
-  recoveryInstructions: string;
-} {
-  const root = artifactRoot(controllerHome, handle);
-  const path = join(root, 'worktree.patch.json');
-  if (!existsSync(path)) {
-    const unstaged = git(handle.worktreePath, ['diff', '--binary', 'HEAD']);
-    const staged = git(handle.worktreePath, ['diff', '--binary', '--cached', 'HEAD']);
-    const untracked = copyUntrackedFiles(handle.worktreePath, root);
-    const archive = {
-      schemaVersion: 1,
-      repoId: handle.repositoryId,
-      checkoutId: handle.checkoutId,
-      workId: handle.workId,
-      branch: handle.branch,
-      baseCommit: handle.baseCommit,
-      expectedHead: handle.expectedHead,
-      createdAt: nowIso(),
-      unstagedPatch: unstaged.stdout,
-      stagedPatch: staged.stdout,
-      untracked,
-    };
-    writeFileSync(path, `${JSON.stringify(archive, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-  }
-  const sha256 = hashText(readFileSync(path));
-  return {
-    path,
-    sha256,
-    recoveryInstructions: `Apply tracked changes from ${path}; restore copied untracked files from ${join(root, 'untracked')}. Verify SHA-256 ${sha256}.`,
-  };
-}
-
 function createVerifiedBundle(controllerHome: string, handle: WorkHandleState, targetRoot: string): {
   path: string;
   sha256: string;
@@ -296,7 +240,7 @@ function workHandleOwnsCheckout(controllerHome: string, handle: WorkHandleState)
   // WorkContract completion is the authoritative ownership boundary. Older
   // runtimes could persist a completed contract while leaving the handle in a
   // non-terminal state; that historical handle must not remain a live owner.
-  return contract === undefined || !isTerminalWorkContractStatus(contract.status);
+  return contract === undefined || semanticWorkState(contract) === 'open';
 }
 
 function assertNoOtherLiveWork(input: TerminalWorkCleanupInput, receipt: WorkCleanupReceipt): void {
@@ -321,59 +265,22 @@ function preserveDirtyWorktree(
     return persist(input.controllerHome, current, receipt);
   }
   if (!status.stdout) {
-    receipt.preservation.status = receipt.preservation.checkpointCommit || receipt.preservation.patchArchivePath
-      ? receipt.preservation.status
-      : 'not_needed';
+    receipt.preservation.status = 'not_needed';
     return persist(input.controllerHome, current, receipt);
   }
 
-  if (!receipt.preservation.checkpointCommit && !receipt.preservation.patchArchivePath) {
-    const staged = git(current.worktreePath, ['add', '-A']);
-    const committed = staged.ok
-      ? git(current.worktreePath, [
-          '-c', 'user.name=forge',
-          '-c', 'user.email=forge@local.invalid',
-          'commit', '-m', CHECKPOINT_MESSAGE,
-        ], 60_000)
-      : { ok: false, stdout: '', stderr: staged.stderr };
-    if (committed.ok) {
-      const head = git(current.worktreePath, ['rev-parse', 'HEAD']);
-      if (!head.ok || !head.stdout) {
-        receipt.preservation.status = 'failed';
-        addBlocker(receipt, 'CHECKPOINT_HEAD_UNAVAILABLE');
-      } else {
-        receipt.preservation.status = 'checkpointed';
-        receipt.preservation.checkpointCommit = head.stdout;
-        current = writeWorkHandle(input.controllerHome, {
-          ...current,
-          expectedHead: head.stdout,
-          cleanupReceipt: receipt,
-        });
-      }
-    } else {
-      try {
-        const archive = createPatchArchive(input.controllerHome, current);
-        receipt.preservation.status = 'patch_archived';
-        receipt.preservation.patchArchivePath = archive.path;
-        receipt.preservation.patchArchiveSha256 = archive.sha256;
-        receipt.preservation.recoveryInstructions = archive.recoveryInstructions;
-      } catch (error) {
-        receipt.preservation.status = 'failed';
-        addBlocker(receipt, `PRESERVATION_FAILED: ${error instanceof Error ? error.message : String(error)}`);
-      }
-    }
-  } else if (receipt.preservation.checkpointCommit && status.stdout) {
-    try {
-      const archive = createPatchArchive(input.controllerHome, current);
-      receipt.preservation.status = 'patch_archived';
-      receipt.preservation.patchArchivePath = archive.path;
-      receipt.preservation.patchArchiveSha256 = archive.sha256;
-      receipt.preservation.recoveryInstructions = archive.recoveryInstructions;
-    } catch (error) {
-      receipt.preservation.status = 'failed';
-      addBlocker(receipt, `POST_CHECKPOINT_PRESERVATION_FAILED: ${error instanceof Error ? error.message : String(error)}`);
-    }
-  }
+  // Semantic Work terminal state is not authority to mutate, commit, archive,
+  // or delete uncommitted workspace content. Dirty bytes stay exactly where the
+  // model/user left them until an explicit delivery/discard action resolves them.
+  receipt.preservation.status = 'not_needed';
+  receipt.preservation.recoveryInstructions = `Dirty managed worktree retained in place at ${current.worktreePath}; commit, deliver, or explicitly discard the pending changes before cleanup.`;
+  receipt.worktree.status = 'retained';
+  receipt.worktree.reason = 'Dirty managed worktree retained; terminal semantic state does not authorize destructive cleanup.';
+  receipt.branchCleanup.status = 'retained';
+  receipt.branchCleanup.reason = 'Branch retained with dirty managed worktree.';
+  addBlocker(receipt, 'DIRTY_WORKTREE_RETAINED');
+  markOwnedResourceRetained(input.controllerHome, managedWorkspaceOwnedResourceId(current.repositoryId, current.checkoutId));
+  markOwnedResourceRetained(input.controllerHome, managedBranchOwnedResourceId(current.repositoryId, current.checkoutId));
   return persist(input.controllerHome, current, receipt);
 }
 
@@ -383,8 +290,9 @@ function selectTerminalCleanupTarget(repository: ReturnType<typeof getRepository
     try {
       return selectRepositoryCheckout(repository, sourceCheckoutId, { allowArchived: true });
     } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      if (!message.startsWith('CHECKOUT_NOT_ACTIVE:') && !message.startsWith('checkout not found for ')) throw error;
+      const unavailable = error instanceof RepositoryCheckoutSelectionError
+        && (error.code === 'CHECKOUT_NOT_FOUND' || (error.code === 'CHECKOUT_NOT_ACTIVE' && error.lifecycle === 'removed'));
+      if (!unavailable) throw error;
     }
   }
   // Terminal cleanup only performs repository-common Git administration after
@@ -450,9 +358,15 @@ export interface TerminalWorkCleanupReconcileReport {
   truncated: boolean;
 }
 
+function contractCompletedNoChange(contract: WorkContract): boolean {
+  if (contract.workKind === 'completed_no_change' || contract.completionOutcome === 'completed_no_change') return true;
+  const receipt = contract.completionReceipt;
+  return Boolean(receipt && isRepositoryCompletionReceipt(receipt) && receipt.delivery.kind === 'no_change');
+}
+
 function terminalOutcomeForContract(contract: WorkContract): WorkTerminalOutcome {
-  if (contract.status === 'cancelled') return 'cancelled';
-  if (contract.status === 'completed') return 'completed_cleanup';
+  if (semanticWorkState(contract) === 'cancelled') return 'cancelled';
+  if (semanticWorkState(contract) === 'completed') return 'completed_cleanup';
   return 'failed';
 }
 
@@ -464,7 +378,7 @@ export function recoverTerminalWorkHandle(
   const existing = readWorkHandle(controllerHome, repositoryId, workId);
   if (existing) return existing;
   const contract = getWorkContract({ controllerHome, repoId: repositoryId }, workId);
-  if (!contract || !isTerminalWorkContractStatus(contract.status)) return undefined;
+  if (!contract || semanticWorkState(contract) === 'open') return undefined;
   const worktreePath = contract.worktreeRef?.trim();
   const checkoutId = contract.checkoutId?.trim();
   if (!worktreePath || !checkoutId || !existsSync(worktreePath)) return undefined;
@@ -482,23 +396,27 @@ export function recoverTerminalWorkHandle(
 
   const head = git(worktreePath, ['rev-parse', 'HEAD']);
   if (!head.ok || !head.stdout) return undefined;
-  const targetBranch = repository.defaultBranch || 'main';
+  const receiptTargetBranch = contract.completionReceipt && isRepositoryCompletionReceipt(contract.completionReceipt)
+    ? contract.completionReceipt.targetBranch?.trim()
+    : undefined;
+  const targetBranch = receiptTargetBranch || repository.defaultBranch || 'main';
   const targetExists = branchExists(repository.canonicalRoot, targetBranch);
   const contained = targetExists
     ? git(repository.canonicalRoot, ['merge-base', '--is-ancestor', head.stdout, `refs/heads/${targetBranch}`]).ok
     : false;
-  const delivered = contract.status === 'completed' && contained;
-  const session = getControllerSession({ controllerHome, repoId: repositoryId }, workId);
+  const completedNoChange = contractCompletedNoChange(contract);
+  const delivered = semanticWorkState(contract) === 'completed' && contained && !completedNoChange;
   const recordedAt = nowIso();
   return writeWorkHandle(controllerHome, {
     schemaVersion: 1,
     workId,
     workContractId: workId,
-    sessionId: session?.sessionId ?? `terminal-recovery:${workId}`,
-    principalId: contract.principalId?.trim() || session?.principalId || 'terminal-recovery',
+    sessionId: `terminal-recovery:${workId}`,
+    principalId: contract.principalId?.trim() || 'terminal-recovery',
     repositoryId,
     checkoutId,
     sourceCheckoutId: repository.activeCheckoutId,
+    ...(receiptTargetBranch ? { deliveryTargetBranch: receiptTargetBranch } : {}),
     worktreePath,
     branch,
     managedWorktree: true,
@@ -506,17 +424,18 @@ export function recoverTerminalWorkHandle(
     expectedHead: head.stdout,
     permissionSnapshotVersion: 1,
     state: delivered ? 'merged' : 'failed_terminal_cleanup',
-    failureReason: delivered ? undefined : 'Recovered terminal Work ownership for cleanup; target-branch containment was not proven.',
+    failureReason: delivered || completedNoChange
+      ? undefined
+      : 'Recovered terminal Work ownership for cleanup; target-branch containment was not proven.',
     createdAt: contract.createdAt || recordedAt,
     updatedAt: recordedAt,
     cleanupResponsibility: { owner: 'work_finalizer', registeredAt: recordedAt },
     finalization: {
-      validation: contract.status === 'failed' ? 'failed' : 'done',
+      validation: 'done',
       commit: 'skipped',
       merge: delivered ? 'done' : 'skipped',
       branchCleanup: 'pending',
       worktreeCleanup: 'pending',
-      ...(contract.status === 'failed' ? { lastError: 'Recovered failed terminal Work for cleanup.' } : {}),
     },
   });
 }
@@ -529,13 +448,264 @@ function cleanupRetainedByRequest(contract: WorkContract, handle: WorkHandleStat
   // completion-receipt warning as the delivery authority.
   if (
     handle.terminalResourceDisposition?.mode === 'retained_by_request'
-    && handle.terminalResourceDisposition.retainWorktree === true
+    && (handle.terminalResourceDisposition.retainWorktree === true
+      || handle.terminalResourceDisposition.retainBranch === true)
   ) return true;
   const receipt = contract.completionReceipt;
   if (!receipt || !isRepositoryCompletionReceipt(receipt)) return false;
   return receipt.cleanup.warnings.some((warning) => warning.code === 'cleanup_retained_by_request');
 }
 
+function cleanedManagedBranchRetirementCandidate(
+  repository: ReturnType<typeof getRepository>,
+  contract: WorkContract,
+  handle: WorkHandleState,
+  targetBranch: string,
+  deleteBranch: boolean,
+): boolean {
+  const receipt = handle.cleanupReceipt;
+  if (
+    handle.state !== 'cleaned'
+    || !handle.managedWorktree
+    || !deleteBranch
+    || !receipt
+    || receipt.targetBranch !== targetBranch
+    || cleanupRetainedByRequest(contract, handle)
+  ) return false;
+  if (!['removed', 'already_removed'].includes(receipt.worktree.status)
+    || !['removed', 'already_removed'].includes(receipt.checkoutRegistry.status)
+    || receipt.prune.status !== 'done'
+    || !['retained', 'failed', 'pending'].includes(receipt.branchCleanup.status)) return false;
+  // A crash may occur after branch deletion but before the final cleanup receipt
+  // is persisted. The unsettled branchCleanup status is sufficient residue to
+  // re-enter cleanup; applyManagedBranchCleanup will converge an absent branch
+  // to already_deleted without reopening semantic Work state.
+  return handle.branch !== targetBranch;
+}
+
+function prepareManagedBranchPreservation(
+  input: TerminalWorkCleanupInput,
+  receipt: WorkCleanupReceipt,
+  current: WorkHandleState,
+  target: ReturnType<typeof getRepository>,
+  targetBranch: string,
+): { uniqueCommits: number; branchPreserved: boolean } {
+  let uniqueCommits = 0;
+  if (branchExists(target.canonicalRoot, current.branch)) {
+    if (!branchExists(target.canonicalRoot, targetBranch)) {
+      addBlocker(receipt, `TARGET_BRANCH_MISSING: ${targetBranch}`);
+    } else {
+      const unique = git(target.canonicalRoot, ['rev-list', '--count', `refs/heads/${targetBranch}..refs/heads/${current.branch}`]);
+      if (!unique.ok || !/^\d+$/.test(unique.stdout)) addBlocker(receipt, `BRANCH_UNIQUENESS_UNKNOWN: ${unique.stderr || unique.stdout}`);
+      else uniqueCommits = Number(unique.stdout);
+    }
+  }
+  receipt.branchCleanup.uniqueCommits = uniqueCommits;
+
+  let branchPreserved = Boolean(
+    receipt.preservation.bundleRetirement?.status === 'not_needed'
+    || receipt.preservation.bundleRetirement?.status === 'removed',
+  );
+  if (receipt.preservation.bundlePath && !branchPreserved) {
+    try {
+      const bundle = createVerifiedBundle(input.controllerHome, current, target.canonicalRoot);
+      if (receipt.preservation.bundleSha256 && receipt.preservation.bundleSha256 !== bundle.sha256) {
+        throw new Error(`stored bundle digest ${receipt.preservation.bundleSha256} does not match ${bundle.sha256}`);
+      }
+      receipt.preservation.bundleSha256 = bundle.sha256;
+      branchPreserved = true;
+    } catch (error) {
+      addBlocker(receipt, `BRANCH_BUNDLE_FAILED: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  if (uniqueCommits > 0 && !branchPreserved && receipt.blockers.length === 0) {
+    const proof = proveWorkPreservationContained(target.canonicalRoot, { ...current, cleanupReceipt: receipt }, targetBranch);
+    if (proof.contained) {
+      receipt.preservation.bundleRetirement = {
+        status: 'not_needed',
+        reason: proof.reason === 'no_source_delta' ? 'no_source_delta' : 'target_and_remote_content_contained',
+        protectedRevision: proof.protectedRevision!,
+        targetRevision: proof.targetRevision,
+        remoteRevision: proof.remoteRevision,
+        comparedPaths: proof.comparedPaths,
+        provedAt: nowIso(),
+      };
+      receipt.preservation.recoveryInstructions = `Branch bundle not created after ${proof.reason}; exact proof is stored in cleanupReceipt.preservation.bundleRetirement.`;
+      branchPreserved = true;
+    } else {
+      try {
+        const bundle = createVerifiedBundle(input.controllerHome, current, target.canonicalRoot);
+        receipt.preservation.bundlePath = bundle.path;
+        receipt.preservation.bundleSha256 = bundle.sha256;
+        receipt.preservation.recoveryInstructions = [
+          receipt.preservation.recoveryInstructions,
+          `Recover branch commits with: git fetch ${bundle.path} refs/heads/${current.branch}:refs/heads/${current.branch}`,
+        ].filter(Boolean).join(' ');
+        branchPreserved = true;
+      } catch (error) {
+        addBlocker(receipt, `BRANCH_BUNDLE_FAILED: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+  }
+  return { uniqueCommits, branchPreserved };
+}
+
+function applyManagedBranchCleanup(
+  controllerHome: string,
+  target: ReturnType<typeof getRepository>,
+  current: WorkHandleState,
+  targetBranch: string,
+  deleteBranch: boolean,
+  receipt: WorkCleanupReceipt,
+  uniqueCommits: number,
+  branchPreserved: boolean,
+): void {
+  if (!deleteBranch) {
+    receipt.branchCleanup.status = 'retained';
+    receipt.branchCleanup.reason = 'Branch retention was explicitly requested.';
+  } else if (!branchExists(target.canonicalRoot, current.branch)) {
+    receipt.branchCleanup.status = 'already_deleted';
+    receipt.branchCleanup.reason = undefined;
+  } else if (current.branch === targetBranch) {
+    receipt.branchCleanup.status = 'retained';
+    receipt.branchCleanup.reason = 'Refusing to delete the target branch.';
+    addBlocker(receipt, `BRANCH_IS_TARGET: ${targetBranch}`);
+  } else if (branchUsedByAnotherWorktree(target.canonicalRoot, current.branch, current.worktreePath)) {
+    receipt.branchCleanup.status = 'retained';
+    receipt.branchCleanup.reason = 'Branch is checked out by another worktree.';
+    addBlocker(receipt, `BRANCH_IN_USE: ${current.branch}`);
+  } else if (uniqueCommits > 0 && !branchPreserved) {
+    receipt.branchCleanup.status = 'retained';
+    receipt.branchCleanup.reason = 'Unique commits are not archived.';
+    addBlocker(receipt, `BRANCH_UNPRESERVED: ${current.branch}`);
+  } else {
+    // Branch deletion requires the canonical OwnedResource witness in addition
+    // to Git relation checks. Repository/ref shape alone is not cleanup authority.
+    try {
+      assertOwnedResourceCleanupTarget(controllerHome, {
+        resourceId: managedBranchOwnedResourceId(current.repositoryId, current.checkoutId),
+        kind: 'git_branch',
+        targetRef: current.branch,
+        locator: managedBranchOwnedResourceLocator(target.canonicalRoot, current.checkoutId, current.branch),
+      });
+    } catch (error) {
+      receipt.branchCleanup.status = 'retained';
+      receipt.branchCleanup.reason = error instanceof Error ? error.message : String(error);
+      addBlocker(receipt, `OWNED_BRANCH_CLEANUP_FENCED: ${receipt.branchCleanup.reason}`);
+      return;
+    }
+    // We already proved the exact branch relation against targetBranch above.
+    // `git branch -d` instead consults the checkout's current HEAD, which may be
+    // an older/stale source checkout and can falsely reject a branch that is
+    // fully contained in the explicit target branch. After that target-branch
+    // proof (or a verified archive for unique commits), delete the ref directly.
+    const deleted = git(target.canonicalRoot, ['branch', '-D', current.branch]);
+    if (!deleted.ok && branchExists(target.canonicalRoot, current.branch)) {
+      receipt.branchCleanup.status = 'failed';
+      receipt.branchCleanup.reason = deleted.stderr || 'branch delete failed';
+      addBlocker(receipt, `BRANCH_DELETE_FAILED: ${receipt.branchCleanup.reason}`);
+    } else {
+      receipt.branchCleanup.status = uniqueCommits > 0 && receipt.preservation.bundlePath ? 'archived' : 'deleted';
+      receipt.branchCleanup.reason = undefined;
+    }
+  }
+}
+
+function cleanupReceiptComplete(receipt: WorkCleanupReceipt, deleteBranch: boolean): boolean {
+  return receipt.blockers.length === 0
+    && ['removed', 'already_removed'].includes(receipt.worktree.status)
+    && ['removed', 'already_removed'].includes(receipt.checkoutRegistry.status)
+    && (deleteBranch
+      ? ['deleted', 'already_deleted', 'archived'].includes(receipt.branchCleanup.status)
+      : receipt.branchCleanup.status === 'retained');
+}
+
+function projectOwnedResourceCleanup(
+  controllerHome: string,
+  handle: WorkHandleState,
+  receipt: WorkCleanupReceipt,
+): void {
+  const worktreeResourceId = managedWorkspaceOwnedResourceId(handle.repositoryId, handle.checkoutId);
+  if (['removed', 'already_removed'].includes(receipt.worktree.status)) {
+    markOwnedResourceCleaned(controllerHome, worktreeResourceId, 'forge:work-terminal-cleanup', receipt.receiptId);
+  }
+
+  const branchResourceId = managedBranchOwnedResourceId(handle.repositoryId, handle.checkoutId);
+  if (['deleted', 'already_deleted', 'archived'].includes(receipt.branchCleanup.status)) {
+    markOwnedResourceCleaned(controllerHome, branchResourceId, 'forge:work-terminal-cleanup', receipt.receiptId);
+  } else if (receipt.branchCleanup.status === 'retained') {
+    markOwnedResourceRetained(controllerHome, branchResourceId);
+  }
+}
+
+function reconcileCleanedManagedBranchRetirement(
+  input: TerminalWorkCleanupInput,
+  repository: ReturnType<typeof getRepository>,
+  targetBranch: string,
+  deleteBranch: boolean,
+  current: WorkHandleState,
+  receipt: WorkCleanupReceipt,
+): TerminalWorkCleanupResult | undefined {
+  const workId = current.workContractId ?? current.workId;
+  const contract = getWorkContract({ controllerHome: input.controllerHome, repoId: current.repositoryId }, workId);
+  if (!contract || semanticWorkState(contract) === 'open'
+    || !cleanedManagedBranchRetirementCandidate(repository, contract, current, targetBranch, deleteBranch)) return undefined;
+
+  const target = selectTerminalCleanupTarget(repository, current);
+  receipt.blockers = [];
+  receipt.partial = false;
+  receipt.complete = false;
+  receipt.completedAt = undefined;
+  receipt.branchCleanup.status = 'pending';
+  receipt.branchCleanup.reason = undefined;
+
+  const preservation = prepareManagedBranchPreservation(input, receipt, current, target, targetBranch);
+  current = persist(input.controllerHome, current, receipt);
+  if (receipt.blockers.length === 0) {
+    applyManagedBranchCleanup(
+      input.controllerHome,
+      target,
+      current,
+      targetBranch,
+      deleteBranch,
+      receipt,
+      preservation.uniqueCommits,
+      preservation.branchPreserved,
+    );
+  } else if (receipt.branchCleanup.status === 'pending') {
+    receipt.branchCleanup.status = 'retained';
+    receipt.branchCleanup.reason = 'Branch retirement proof could not be re-established.';
+  }
+
+  const pruned = git(target.canonicalRoot, ['worktree', 'prune']);
+  receipt.prune.status = pruned.ok ? 'done' : 'failed';
+  if (!pruned.ok) {
+    receipt.prune.reason = pruned.stderr || 'git worktree prune failed';
+    addBlocker(receipt, `WORKTREE_PRUNE_FAILED: ${receipt.prune.reason}`);
+  } else {
+    receipt.prune.reason = undefined;
+  }
+
+  receipt.complete = cleanupReceiptComplete(receipt, deleteBranch);
+  receipt.partial = !receipt.complete;
+  if (receipt.complete) receipt.completedAt = nowIso();
+  const finalization = {
+    ...current.finalization,
+    branchCleanup: receipt.complete ? 'done' as const : 'failed' as const,
+    worktreeCleanup: 'done' as const,
+  };
+  current = writeWorkHandle(input.controllerHome, {
+    ...current,
+    state: 'cleaned',
+    cleanupReceipt: receipt,
+    finalization,
+  });
+  if (receipt.complete) {
+    markRepositoryProjectionDirty(input.controllerHome, current.repositoryId, `cleanup:${current.workId}:terminal-branch-retirement`);
+  }
+  return { handle: current, receipt };
+}
+
 function reconcileLegacyTerminalBranchDrift(
   controllerHome: string,
   repository: ReturnType<typeof getRepository>,
@@ -585,11 +755,22 @@ function reconcileLegacyTerminalBranchDrift(
 
 export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Promise<TerminalWorkCleanupResult> {
   const repository = getRepository(input.handle.repositoryId, input.controllerHome, { includeRemoved: true });
-  const targetBranch = input.targetBranch?.trim() || repository.defaultBranch || 'main';
+  const targetBranch = resolveWorkDeliveryTargetBranch(input.handle, repository.defaultBranch, input.targetBranch);
   const deleteBranch = input.deleteBranch !== false;
   let current = input.handle;
-  const landed = current.state === 'merged' || current.finalization.merge === 'done';
-  const preservedFailure = (input.failureReason ?? current.failureReason ?? current.finalization.lastError ?? 'terminal work cleanup').slice(0, 1_000);
+  const contract = getWorkContract(
+    { controllerHome: input.controllerHome, repoId: current.repositoryId },
+    current.workContractId ?? current.workId,
+  );
+  const completedNoChange = Boolean(contract && contractCompletedNoChange(contract));
+  // `merged` is delivery truth, not a generic terminal-cleanup waypoint. Historical
+  // no-change handles may carry merge=done/state=merged from the retired finalizer;
+  // normalize that stale projection before any destructive cleanup attempt.
+  const landed = !completedNoChange && (current.state === 'merged' || current.finalization.merge === 'done');
+  const successfulCompletion = completedNoChange || input.terminalOutcome === 'completed_cleanup';
+  const preservedFailure = successfulCompletion
+    ? undefined
+    : (input.failureReason ?? current.failureReason ?? current.finalization.lastError ?? 'terminal work cleanup').slice(0, 1_000);
   const receipt = current.cleanupReceipt ?? newReceipt(current, targetBranch, input.terminalOutcome);
 
   if (
@@ -597,8 +778,50 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
     || receipt.checkoutId !== current.checkoutId
     || receipt.workId !== current.workId
   ) throw new Error('WORK_CLEANUP_RECEIPT_IDENTITY_MISMATCH');
+  // Legacy receipts may retain the former Controller lease stage. ControllerSession
+  // is no longer a cleanup resource; normalize this projection without touching
+  // any explicit continuation state.
+  if (receipt.ownership.controllerLease === 'pending') {
+    receipt.ownership.controllerLease = 'already_released';
+  }
 
-  if (current.state === 'cleaned' && receipt.complete) return { handle: current, receipt };
+  if (current.state === 'cleaned') {
+    const branchRetirement = reconcileCleanedManagedBranchRetirement(
+      input,
+      repository,
+      targetBranch,
+      deleteBranch,
+      current,
+      receipt,
+    );
+    if (branchRetirement) return branchRetirement;
+    if (!receipt.complete) {
+      receipt.complete = true;
+      receipt.partial = false;
+      receipt.completedAt = receipt.completedAt ?? current.updatedAt ?? nowIso();
+      receipt.blockers = [];
+      receipt.processes.allTerminal = true;
+      if (receipt.ownership.processLeases === 'pending') receipt.ownership.processLeases = 'released';
+      if (receipt.worktree.status === 'pending' || receipt.worktree.status === 'failed') {
+        receipt.worktree.status = 'already_removed';
+        receipt.worktree.reason = 'Reconciled from durable cleaned WorkHandle state.';
+      }
+      if (receipt.checkoutRegistry.status === 'pending' || receipt.checkoutRegistry.status === 'failed') {
+        receipt.checkoutRegistry.status = 'already_removed';
+        receipt.checkoutRegistry.reason = 'Reconciled from durable cleaned WorkHandle state.';
+      }
+      if (receipt.prune.status === 'pending' || receipt.prune.status === 'failed') {
+        receipt.prune.status = 'done';
+        receipt.prune.reason = 'Reconciled from durable cleaned WorkHandle state.';
+      }
+      if (receipt.branchCleanup.status === 'pending' || receipt.branchCleanup.status === 'failed') {
+        receipt.branchCleanup.status = 'retained';
+        receipt.branchCleanup.reason = 'Historical cleaned state does not prove branch deletion; branch is conservatively retained.';
+      }
+      current = writeWorkHandle(input.controllerHome, { ...current, cleanupReceipt: receipt });
+    }
+    return { handle: current, receipt };
+  }
 
   // Retryable blockers are observations, not permanent vetoes. Recompute them
   // from durable Work/Process/Git state after a controller restart or retry.
@@ -623,7 +846,11 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
       ? 'failed' as const
       : current.finalization.validation,
     commit: current.finalization.commit === 'pending' ? 'skipped' as const : current.finalization.commit,
-    merge: landed ? 'done' as const : current.finalization.merge === 'pending' ? 'skipped' as const : current.finalization.merge,
+    merge: completedNoChange
+      ? 'skipped' as const
+      : landed
+        ? 'done' as const
+        : current.finalization.merge === 'pending' ? 'skipped' as const : current.finalization.merge,
     lastError: preservedFailure,
   };
   if (landed) {
@@ -649,7 +876,11 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
   }
 
   await settleProcesses(input, receipt);
-  assertNoOtherLiveWork(input, receipt);
+  // The selected/current repository checkout is shared infrastructure, not a
+  // disposable Work-owned resource. Other live Works may legitimately share it;
+  // only a managed Work checkout requires exclusive lifecycle ownership before
+  // physical removal.
+  if (current.managedWorktree) assertNoOtherLiveWork(input, receipt);
   current = persist(input.controllerHome, current, receipt);
   if (receipt.blockers.length > 0) return { handle: current, receipt };
 
@@ -716,7 +947,19 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
       current = persist(input.controllerHome, current, receipt);
       return { handle: current, receipt };
     }
-    if (!root.ok || resolve(root.stdout) !== resolve(current.worktreePath) || !branch.ok || branch.stdout !== current.branch) {
+    const rootIdentityValid = root.ok && resolve(root.stdout) === resolve(current.worktreePath);
+    const branchIdentityValid = branch.ok && branch.stdout === current.branch;
+    let detachedContainedIdentity = false;
+    if (rootIdentityValid && branch.ok && !branch.stdout) {
+      const status = git(current.worktreePath, ['status', '--porcelain=v1', '--untracked-files=all']);
+      const head = git(current.worktreePath, ['rev-parse', 'HEAD']);
+      detachedContainedIdentity = status.ok
+        && !status.stdout
+        && head.ok
+        && Boolean(head.stdout)
+        && git(target.canonicalRoot, ['merge-base', '--is-ancestor', head.stdout, `refs/heads/${targetBranch}`]).ok;
+    }
+    if (!rootIdentityValid || (!branchIdentityValid && !detachedContainedIdentity)) {
       addBlocker(receipt, 'WORKTREE_IDENTITY_INVALID');
       current = persist(input.controllerHome, current, receipt);
       return { handle: current, receipt };
@@ -732,31 +975,13 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
     receipt.worktree.status = 'already_removed';
   }
 
-  let uniqueCommits = 0;
-  if (branchExists(target.canonicalRoot, current.branch)) {
-    if (!branchExists(target.canonicalRoot, targetBranch)) {
-      addBlocker(receipt, `TARGET_BRANCH_MISSING: ${targetBranch}`);
-    } else {
-      const unique = git(target.canonicalRoot, ['rev-list', '--count', `refs/heads/${targetBranch}..refs/heads/${current.branch}`]);
-      if (!unique.ok || !/^\d+$/.test(unique.stdout)) addBlocker(receipt, `BRANCH_UNIQUENESS_UNKNOWN: ${unique.stderr || unique.stdout}`);
-      else uniqueCommits = Number(unique.stdout);
-    }
-  }
-  receipt.branchCleanup.uniqueCommits = uniqueCommits;
-
-  if (uniqueCommits > 0 && !receipt.preservation.bundlePath) {
-    try {
-      const bundle = createVerifiedBundle(input.controllerHome, current, target.canonicalRoot);
-      receipt.preservation.bundlePath = bundle.path;
-      receipt.preservation.bundleSha256 = bundle.sha256;
-      receipt.preservation.recoveryInstructions = [
-        receipt.preservation.recoveryInstructions,
-        `Recover branch commits with: git fetch ${bundle.path} refs/heads/${current.branch}:refs/heads/${current.branch}`,
-      ].filter(Boolean).join(' ');
-    } catch (error) {
-      addBlocker(receipt, `BRANCH_BUNDLE_FAILED: ${error instanceof Error ? error.message : String(error)}`);
-    }
-  }
+  const { uniqueCommits, branchPreserved } = prepareManagedBranchPreservation(
+    input,
+    receipt,
+    current,
+    target,
+    targetBranch,
+  );
   current = persist(input.controllerHome, current, receipt);
   if (receipt.blockers.length > 0) {
     receipt.worktree.status = existsSync(current.worktreePath) ? 'retained' : receipt.worktree.status;
@@ -767,6 +992,19 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
   }
 
   if (existsSync(current.worktreePath)) {
+    try {
+      assertOwnedResourceCleanupTarget(input.controllerHome, {
+        resourceId: managedWorkspaceOwnedResourceId(current.repositoryId, current.checkoutId),
+        kind: 'worktree',
+        targetRef: current.worktreePath,
+      });
+    } catch (error) {
+      receipt.worktree.status = 'retained';
+      receipt.worktree.reason = error instanceof Error ? error.message : String(error);
+      addBlocker(receipt, `OWNED_WORKTREE_CLEANUP_FENCED: ${receipt.worktree.reason}`);
+      current = persist(input.controllerHome, current, receipt);
+      return { handle: current, receipt };
+    }
     const removed = git(target.canonicalRoot, ['worktree', 'remove', '--force', current.worktreePath], 60_000);
     if (!removed.ok && existsSync(current.worktreePath)) {
       receipt.worktree.status = 'failed';
@@ -802,38 +1040,16 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
     receipt.checkoutRegistry.reason = 'Checkout metadata was absent after Controller Home migration; canonical managed-worktree and Git identity checks passed before cleanup.';
   }
 
-  if (!deleteBranch) {
-    receipt.branchCleanup.status = 'retained';
-    receipt.branchCleanup.reason = 'Branch retention was explicitly requested.';
-  } else if (!branchExists(target.canonicalRoot, current.branch)) {
-    receipt.branchCleanup.status = 'already_deleted';
-  } else if (current.branch === targetBranch) {
-    receipt.branchCleanup.status = 'retained';
-    receipt.branchCleanup.reason = 'Refusing to delete the target branch.';
-    addBlocker(receipt, `BRANCH_IS_TARGET: ${targetBranch}`);
-  } else if (branchUsedByAnotherWorktree(target.canonicalRoot, current.branch, current.worktreePath)) {
-    receipt.branchCleanup.status = 'retained';
-    receipt.branchCleanup.reason = 'Branch is checked out by another worktree.';
-    addBlocker(receipt, `BRANCH_IN_USE: ${current.branch}`);
-  } else if (uniqueCommits > 0 && !receipt.preservation.bundlePath) {
-    receipt.branchCleanup.status = 'retained';
-    receipt.branchCleanup.reason = 'Unique commits are not archived.';
-    addBlocker(receipt, `BRANCH_UNPRESERVED: ${current.branch}`);
-  } else {
-    // We already proved the exact branch relation against targetBranch above.
-    // `git branch -d` instead consults the checkout's current HEAD, which may be
-    // an older/stale source checkout and can falsely reject a branch that is
-    // fully contained in the explicit target branch. After that target-branch
-    // proof (or a verified archive for unique commits), delete the ref directly.
-    const deleted = git(target.canonicalRoot, ['branch', '-D', current.branch]);
-    if (!deleted.ok && branchExists(target.canonicalRoot, current.branch)) {
-      receipt.branchCleanup.status = 'failed';
-      receipt.branchCleanup.reason = deleted.stderr || 'branch delete failed';
-      addBlocker(receipt, `BRANCH_DELETE_FAILED: ${receipt.branchCleanup.reason}`);
-    } else {
-      receipt.branchCleanup.status = uniqueCommits > 0 ? 'archived' : 'deleted';
-    }
-  }
+  applyManagedBranchCleanup(
+    input.controllerHome,
+    target,
+    current,
+    targetBranch,
+    deleteBranch,
+    receipt,
+    uniqueCommits,
+    branchPreserved,
+  );
 
   const pruned = git(target.canonicalRoot, ['worktree', 'prune']);
   receipt.prune.status = pruned.ok ? 'done' : 'failed';
@@ -842,14 +1058,10 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
     addBlocker(receipt, `WORKTREE_PRUNE_FAILED: ${receipt.prune.reason}`);
   }
 
-  receipt.complete = receipt.blockers.length === 0
-    && ['removed', 'already_removed'].includes(receipt.worktree.status)
-    && ['removed', 'already_removed'].includes(receipt.checkoutRegistry.status)
-    && (deleteBranch
-      ? ['deleted', 'already_deleted', 'archived'].includes(receipt.branchCleanup.status)
-      : receipt.branchCleanup.status === 'retained');
+  receipt.complete = cleanupReceiptComplete(receipt, deleteBranch);
   receipt.partial = !receipt.complete;
   if (receipt.complete) receipt.completedAt = receipt.completedAt ?? nowIso();
+  projectOwnedResourceCleanup(input.controllerHome, current, receipt);
 
   const finalization = {
     ...current.finalization,
@@ -880,6 +1092,92 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
   return { handle: current, receipt };
 }
 
+export interface SingleTerminalWorkCleanupResult {
+  status: 'cleaned' | 'retained' | 'blocked' | 'no_handle' | 'not_terminal';
+  workId: string;
+  handle?: WorkHandleState;
+  receipt?: WorkCleanupReceipt;
+  reason?: string;
+}
+
+/**
+ * Reconcile physical resources for one already-terminal Work without reviving its
+ * historical execution principal. WorkContract remains the terminal outcome
+ * authority; this path owns only resource cleanup and refuses unproven active
+ * Controller ownership or unsafe branch drift. A caller proving the exact
+ * leftover owner epoch may release it before physical cleanup.
+ */
+function reconcileCancelledCleanupProjection(
+  controllerHome: string,
+  repoId: string,
+  contract: WorkContract,
+  receipt: WorkCleanupReceipt,
+): void {
+  if (contract.semanticState !== 'cancelled' || receipt.complete !== true) return;
+  if (contract.phase === 'cleanup' && contract.phaseEvidence.cleanup.state === 'satisfied'
+    && contract.phaseEvidence.cleanup.receiptId === receipt.receiptId) return;
+  recordCancelledWorkCleanupCompleted(
+    { controllerHome, repoId },
+    contract.workId,
+    {
+      summary: `Verified terminal resource cleanup completed with receipt ${receipt.receiptId}.`,
+      receiptId: receipt.receiptId,
+      evidenceRefs: [{
+        title: 'cancelled Work terminal cleanup completed',
+        summary: `Physical worktree/branch cleanup completed under receipt ${receipt.receiptId}; unexecuted semantic phases remain skipped rather than satisfied.`,
+        detailLevel: 'summary',
+      }, ...contract.evidenceRefs],
+    },
+  );
+}
+
+export async function reconcileSingleTerminalWorkCleanup(
+  controllerHome: string,
+  repositoryId: string,
+  workId: string,
+  options: {
+    targetBranch?: string;
+    deleteBranch?: boolean;
+  } = {},
+): Promise<SingleTerminalWorkCleanupResult> {
+  const repository = getRepository(repositoryId, controllerHome, { includeRemoved: true });
+  const contract = getWorkContract({ controllerHome, repoId: repositoryId }, workId);
+  if (!contract || semanticWorkState(contract) === 'open') {
+    return { status: 'not_terminal', workId, reason: 'Work is not terminal.' };
+  }
+  const originalHandle = readWorkHandle(controllerHome, repositoryId, workId)
+    ?? recoverTerminalWorkHandle(controllerHome, repositoryId, workId);
+  if (!originalHandle) return { status: 'no_handle', workId };
+  if (cleanupRetainedByRequest(contract, originalHandle)) {
+    return { status: 'retained', workId, handle: originalHandle, receipt: originalHandle.cleanupReceipt };
+  }
+  const targetBranch = resolveWorkDeliveryTargetBranch(originalHandle, repository.defaultBranch, options.targetBranch);
+  const drift = reconcileLegacyTerminalBranchDrift(controllerHome, repository, originalHandle, targetBranch);
+  if (drift.blocker) return { status: 'blocked', workId, handle: drift.handle, reason: drift.blocker };
+  const cleaned = await cleanupTerminalWork({
+    controllerHome,
+    handle: drift.handle,
+    targetBranch,
+    deleteBranch: options.deleteBranch !== false,
+    terminalOutcome: terminalOutcomeForContract(contract),
+    failureReason: drift.handle.failureReason ?? drift.handle.finalization.lastError,
+  });
+  const persisted = writeWorkHandle(controllerHome, { ...cleaned.handle, cleanupReceipt: cleaned.receipt });
+  if (cleaned.receipt.complete) {
+    reconcileCancelledCleanupProjection(controllerHome, repositoryId, contract, cleaned.receipt);
+  }
+  if (!cleaned.receipt.complete) {
+    return {
+      status: 'blocked',
+      workId,
+      handle: persisted,
+      receipt: cleaned.receipt,
+      reason: cleaned.receipt.blockers.join('; ') || cleaned.receipt.worktree.reason || cleaned.receipt.branchCleanup.reason || 'terminal cleanup incomplete',
+    };
+  }
+  return { status: 'cleaned', workId, handle: persisted, receipt: cleaned.receipt };
+}
+
 export async function reconcileTerminalWorkCleanups(
   controllerHome: string,
   options: TerminalWorkCleanupReconcileOptions = {},
@@ -901,7 +1199,14 @@ export async function reconcileTerminalWorkCleanups(
     truncated: false,
   };
 
-  const repositories = listRepositories(controllerHome).filter((repository) => repository.enabled && !repository.removedAt);
+  const maintenanceEpoch = Math.floor(nowMs / 60_000);
+  const repositories = listRepositories(controllerHome)
+    .filter((repository) => repository.enabled && !repository.removedAt)
+    .sort((left, right) => {
+      const leftOrder = hashText(`${maintenanceEpoch}\0${left.repoId}`);
+      const rightOrder = hashText(`${maintenanceEpoch}\0${right.repoId}`);
+      return leftOrder.localeCompare(rightOrder) || left.repoId.localeCompare(right.repoId);
+    });
   outer: for (const repository of repositories) {
     const handles = listWorkHandles(controllerHome, repository.repoId, 10_000)
       .filter((handle) => handle.managedWorktree);
@@ -913,9 +1218,15 @@ export async function reconcileTerminalWorkCleanups(
       limit: 10_000,
     })) {
       const contract = record.value;
-      if (knownWorkIds.has(contract.workId) || !isTerminalWorkContractStatus(contract.status)) continue;
+      if (knownWorkIds.has(contract.workId) || semanticWorkState(contract) === 'open') continue;
       if (!contract.worktreeRef?.trim() || !existsSync(contract.worktreeRef)) continue;
-      const recovered = recoverTerminalWorkHandle(controllerHome, repository.repoId, contract.workId);
+      let recovered: WorkHandleState | undefined;
+      try {
+        recovered = recoverTerminalWorkHandle(controllerHome, repository.repoId, contract.workId);
+      } catch (error) {
+        report.errors.push({ workId: contract.workId, error: error instanceof Error ? error.message : String(error) });
+        continue;
+      }
       if (!recovered) continue;
       handles.push(recovered);
       knownWorkIds.add(recovered.workId);
@@ -924,16 +1235,38 @@ export async function reconcileTerminalWorkCleanups(
     handles.sort((left, right) => left.updatedAt.localeCompare(right.updatedAt));
     for (const originalHandle of handles) {
       report.scanned += 1;
-      const contract = getWorkContract({ controllerHome, repoId: repository.repoId }, originalHandle.workContractId ?? originalHandle.workId);
-      if (!contract || !isTerminalWorkContractStatus(contract.status)) {
+      let contract: WorkContract | undefined;
+      try {
+        contract = getWorkContract({ controllerHome, repoId: repository.repoId }, originalHandle.workContractId ?? originalHandle.workId);
+      } catch (error) {
+        report.errors.push({ workId: originalHandle.workId, error: error instanceof Error ? error.message : String(error) });
+        continue;
+      }
+      if (!contract || semanticWorkState(contract) === 'open') {
         report.skippedNonTerminal.push(originalHandle.workId);
         continue;
       }
-      if (originalHandle.state === 'cleaned' && originalHandle.cleanupReceipt?.complete === true) continue;
+      // Semantic terminality is the lifecycle authority that starts mechanical
+      // cleanup reconciliation. It is not deletion authority: work_finalizer must
+      // still prove exact Forge ownership, preserve dirty bytes/unique commits,
+      // settle live processes, and honor explicit retention before removing any
+      // physical resource. Completion/cleanup receipts are delivery/progress
+      // evidence, not a second permission gate that can strand terminal Work.
       if (cleanupRetainedByRequest(contract, originalHandle)) {
         report.skippedRetained.push(originalHandle.workId);
         continue;
       }
+      if (originalHandle.state === 'cleaned' && originalHandle.cleanupReceipt?.complete === true) {
+        reconcileCancelledCleanupProjection(controllerHome, repository.repoId, contract, originalHandle.cleanupReceipt);
+        const targetBranch = resolveWorkDeliveryTargetBranch(originalHandle, repository.defaultBranch);
+        if (!cleanedManagedBranchRetirementCandidate(
+          repository,
+          contract,
+          originalHandle,
+          targetBranch,
+          true,
+        )) continue;
+      }
       // Reconstructing a missing handle is metadata recovery, not new Work activity.
       // Do not let that write reset the terminal-age grace period indefinitely.
       const terminalAt = recoveredWorkIds.has(originalHandle.workId)
@@ -950,7 +1283,7 @@ export async function reconcileTerminalWorkCleanups(
       }
       report.attempted += 1;
       try {
-        const targetBranch = repository.defaultBranch || 'main';
+        const targetBranch = resolveWorkDeliveryTargetBranch(originalHandle, repository.defaultBranch);
         const drift = reconcileLegacyTerminalBranchDrift(controllerHome, repository, originalHandle, targetBranch);
         if (drift.blocker) {
           report.blocked.push({ workId: originalHandle.workId, reason: drift.blocker });
@@ -965,26 +1298,11 @@ export async function reconcileTerminalWorkCleanups(
           terminalOutcome: terminalOutcomeForContract(contract),
           failureReason: drift.handle.failureReason ?? drift.handle.finalization.lastError,
         });
-        const workId = cleaned.handle.workContractId ?? cleaned.handle.workId;
-        const controllerSession = getControllerSession({ controllerHome, repoId: repository.repoId }, workId);
-        if (controllerSession) {
-          const released = releaseObservedControllerSession(
-            { controllerHome, repoId: repository.repoId },
-            { workId, actor: `terminal-cleanup:${originalHandle.workId}`, owner: controllerSession },
-          );
-          if (released.allowed) {
-            cleaned.receipt.ownership.controllerLease = 'released';
-          } else {
-            cleaned.receipt.complete = false;
-            cleaned.receipt.partial = true;
-            cleaned.receipt.completedAt = undefined;
-            cleaned.receipt.blockers = appendUnique(cleaned.receipt.blockers, `controller lease release fenced: ${released.reason}`);
-          }
-        } else {
-          cleaned.receipt.ownership.controllerLease = 'already_released';
-        }
         writeWorkHandle(controllerHome, { ...cleaned.handle, cleanupReceipt: cleaned.receipt });
-        if (cleaned.receipt.complete) report.cleaned.push(originalHandle.workId);
+        if (cleaned.receipt.complete) {
+          reconcileCancelledCleanupProjection(controllerHome, repository.repoId, contract, cleaned.receipt);
+          report.cleaned.push(originalHandle.workId);
+        }
         else report.blocked.push({
           workId: originalHandle.workId,
           reason: cleaned.receipt.blockers.join('; ') || cleaned.receipt.worktree.reason || cleaned.receipt.branchCleanup.reason || 'terminal cleanup incomplete',