@moretea-labs/forge 1.7.2 → 1.8.1

package/src/runtime/recovery/maintenance-executor.ts

@@ -1,18 +1,20 @@
 import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'fs';
 import { basename, dirname, join, relative, resolve } from 'path';
 import { tmpdir } from 'os';
+import { assertStorageHeadroom } from '../shared/storage-capacity';
 import { runProcess } from '../../effects/process-runner';
-import { cleanupEditSession, getEditSession, listEditSessions, reconcileEditSession } from '../../cli/editing/edit-session';
+import { cleanupEditSession, getEditSession, listEditSessions } from '../../cli/editing/edit-session';
 import { ensureRepositoryRuntimeStorage, type RepositoryRuntimeStorageReport } from '../../cli/repositories/runtime-storage';
+import { getRepository, selectRepositoryCheckout, setRepositoryCheckoutLifecycle } from '../../cli/repositories/registry';
 import type { RepositoryRecord } from '../../cli/repositories/types';
 import { rebuildRepositoryProjection } from '../projections/materialized-view';
-import { getWorkContract, readWorkContractStore, transitionWorkContractPhase } from '../control-plane/facade/work-contract-store';
-import { getControllerSession, withControllerSessionTerminalizationFence } from '../control-plane/facade/controller-session-store';
+import { getWorkContract, readWorkContractStore, semanticWorkState, updateWorkContract } from '../../../packages/kernel/work/api/index';
+import { assertOwnedResourceCleanupTarget, listOwnedResources, markOwnedResourceCleaned, type OwnedResource } from '../../../packages/kernel/identity/api/index';
 import { listPlanContracts } from '../control-plane/facade/plan-contract-store';
 import { readRequirement } from '../control-plane/persistence/requirement-store';
 import { listControlPlaneRecords, type ControlPlaneRecord } from '../control-plane/persistence/sqlite-store';
-import { isTerminalWorkContractStatus, type WorkContract } from '../control-plane/facade/types';
-import { listSchedules } from '../workflow/schedules/store';
+import type { WorkContract } from '../control-plane/facade/types';
+import { listSchedules } from '../../../packages/kernel/scheduler/api/index';
 import {
   collectRuntimeProcesses,
   removeRuntimeTempEntry,
@@ -26,6 +28,19 @@ import {
   type RuntimeStorageRepairPreview,
 } from './local-jobs-repair';
 import { gcTerminalProcesses, type ProcessGcResult } from '../execution/process-runtime/gc';
+import { cleanupStaleWorkVerificationSnapshots, type WorkVerificationSnapshotRetentionReport } from '../control-plane/execution/work-verification-snapshot';
+import { cleanupGeneratedRepositoryCheckoutCaches, type RepositoryGeneratedCacheRetentionReport } from '../control-plane/generated-cache-retention';
+import { cleanupWorkPreservationArtifacts, type CleanupArtifactRetentionReport } from '../control-plane/cleanup-artifact-retention';
+import {
+  cleanupRuntimeQuarantine,
+  quarantineRuntimePath,
+  runtimeLegacyCheckQuarantineRoot,
+  type RuntimeQuarantineRetentionReport,
+} from './quarantine-retention';
+import { readWorkHandle, resolveWorkDeliveryTargetBranch } from '../control-plane/execution/work-handle-store';
+import { listRecoverableProcessRecords } from '../execution/process-runtime/store';
+import { isManagedProcessActive } from '../execution/process-runtime/types';
+import { managedBranchOwnedResourceId, managedBranchOwnedResourceLocator, managedWorkspaceOwnedResourceId } from '../execution/managed-workspace';
 
 export type RuntimeMaintenanceActionId =
   | 'local_jobs_reconcile'
@@ -137,6 +152,10 @@ export interface RuntimeMaintenanceApplyResult extends Omit<RuntimeMaintenanceSt
   runtimeStorageRepairApply?: RuntimeStorageRepairApplyResult;
   /** Existing bounded terminal-process retention, run only during explicit full maintenance. */
   processGc?: ProcessGcResult;
+  verificationSnapshotGc?: WorkVerificationSnapshotRetentionReport;
+  quarantineGc?: RuntimeQuarantineRetentionReport;
+  generatedCacheGc?: RepositoryGeneratedCacheRetentionReport;
+  cleanupArtifactGc?: CleanupArtifactRetentionReport;
   projection?: unknown;
 }
 
@@ -189,10 +208,16 @@ function readJson(path: string): unknown {
 }
 
 function writeJsonAtomic(path: string, value: unknown): void {
+  const content = `${JSON.stringify(value, null, 2)}\n`;
+  assertStorageHeadroom(path, {
+    operation: 'runtime_maintenance_state_write',
+    requiredBytes: Buffer.byteLength(content),
+    reserveBytes: 16 * 1024 * 1024,
+  });
   mkdirSync(dirname(path), { recursive: true });
   const temporaryPath = `${path}.${process.pid}.${Date.now()}.tmp`;
   try {
-    writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    writeFileSync(temporaryPath, content, { encoding: 'utf8', mode: 0o600 });
     renameSync(temporaryPath, path);
   } finally {
     rmSync(temporaryPath, { force: true });
@@ -385,7 +410,11 @@ function scanRuntimeTempCandidates(
     minAgeMinutes: RUNTIME_TEMP_RETENTION_MINUTES,
     maxEntries: Math.max(maxCandidates * 3, 500),
   });
-  const ownershipStatus = explicitRoots ? 'explicit' as const : 'unknown' as const;
+  // scanRuntimeTempEntries is the mechanical temp-ownership fence: it only
+  // returns direct Forge-prefixed children of the approved temp roots, and
+  // removeRuntimeTempEntry revalidates root/name/symlink/age/process occupancy
+  // immediately before mutation. Explicit roots narrow scope; they do not create
+  // a second ownership authority.
   return scan.entries
     .filter((entry) => entry.cleanupCandidate)
     .slice(0, maxCandidates)
@@ -393,17 +422,15 @@ function scanRuntimeTempCandidates(
       kind: 'stale_runtime_temp_entry',
       id: `runtime-temp-${safeId(entry.path)}`,
       path: entry.path,
-      safe: entry.cleanupCandidate && ownershipStatus === 'explicit',
-      reason: ownershipStatus === 'unknown'
-        ? 'Temp entry has unknown durable ownership; it is protected until an owning lifecycle record or safe reconciliation proves eligibility.'
-        : entry.symbolicLink
-          ? 'Symbolic links are never eligible for automatic cleanup.'
-          : entry.occupiedByPid
-            ? `Temp entry is referenced by live process ${entry.occupiedByPid}.`
-            : `Forge temp entry is unoccupied, not a symbolic link, and ${entry.ageMinutes} minute(s) old.`,
+      safe: entry.cleanupCandidate,
+      reason: entry.symbolicLink
+        ? 'Symbolic links are never eligible for automatic cleanup.'
+        : entry.occupiedByPid
+          ? `Temp entry is referenced by live process ${entry.occupiedByPid}.`
+          : `Forge temp entry is unoccupied, not a symbolic link, and ${entry.ageMinutes} minute(s) old.`,
       ageMinutes: entry.ageMinutes,
       suggestedAction: 'full_maintenance_pass',
-      ownershipStatus,
+      ownershipStatus: 'explicit' as const,
     }));
 }
 
@@ -444,7 +471,7 @@ function listRetainedMigratedWork(destinationHomeInput: string, repoId: string):
     }
     for (const source of sourceWork) {
       const work = source.value;
-      if (work.repoId !== repoId || !isTerminalWorkContractStatus(work.status)) continue;
+      if (work.repoId !== repoId || semanticWorkState(work) === 'open') continue;
       if (!work.worktreeRef?.trim() || !existsSync(work.worktreeRef)) continue;
       if (destinationWorkIds.has(work.workId)) continue;
       retained.push({ migrationId: migration.migrationId, sourceHome, work });
@@ -477,6 +504,121 @@ function looksLikeForgeManagedWorktree(path: string): boolean {
 
 type StaleWorkSourceState = NonNullable<RuntimeMaintenanceCandidate['sourceState']>;
 
+interface OwnedManagedWorktreeInspection {
+  safe: boolean;
+  path: string;
+  sourceState: StaleWorkSourceState;
+  detail: string;
+  workspaceResourceId?: string;
+  checkoutId?: string;
+  branch?: string;
+  canonicalBranch?: string;
+}
+
+function activeOwnedWorktreeResource(
+  controllerHome: string,
+  repoId: string,
+  path: string,
+): OwnedResource | undefined {
+  const target = resolve(path);
+  return listOwnedResources(controllerHome, { kind: 'worktree', status: 'active', repoId })
+    .find((resource) => resource.cleanupCapable === true && resolve(resource.targetRef) === target);
+}
+
+function inspectOwnedManagedWorktree(
+  repository: RuntimeMaintenanceRepository,
+  controllerHome: string,
+  pathInput: string,
+): OwnedManagedWorktreeInspection {
+  const path = resolve(pathInput);
+  if (!looksLikeForgeManagedWorktree(path)) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Managed worktree is outside Forge-managed storage; automatic cleanup is forbidden.' };
+  }
+  if (!existsSync(path)) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Owned managed worktree path is absent; registry/resource reconciliation is required before cleanup.' };
+  }
+  const workspaceResource = activeOwnedWorktreeResource(controllerHome, repository.repoId, path);
+  if (!workspaceResource) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'No active cleanup-capable OwnedResource matches this managed worktree path.' };
+  }
+  try {
+    assertOwnedResourceCleanupTarget(controllerHome, {
+      resourceId: workspaceResource.resourceId,
+      kind: 'worktree',
+      targetRef: path,
+    });
+  } catch (error) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: `Managed worktree OwnedResource failed exact identity validation: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  const contractOwner = readWorkContractStore({ controllerHome, repoId: repository.repoId }).contracts.find((contract) =>
+    contract.worktreeRef && resolve(contract.worktreeRef) === path);
+  if (contractOwner) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: `Managed worktree still has WorkContract owner ${contractOwner.workId}; cleanup must remain with that Work lifecycle.` };
+  }
+  let registered;
+  try { registered = getRepository(repository.repoId, controllerHome, { includeRemoved: true }); } catch (error) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: `Repository registry could not be read for owned managed worktree: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  const checkout = registered.checkouts.find((candidate) =>
+    candidate.worktree === true
+    && (candidate.lifecycle ?? 'active') === 'active'
+    && (resolve(candidate.canonicalRoot) === path || resolve(candidate.localRoot) === path));
+  if (!checkout) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Owned managed worktree has no active matching Repository Registry checkout.' };
+  }
+  if (registered.activeCheckoutId === checkout.checkoutId) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Owned managed worktree is unexpectedly the canonical active checkout; automatic cleanup is forbidden.' };
+  }
+  const status = runProcess('git', ['status', '--porcelain', '--untracked-files=all'], { cwd: path, timeoutMs: 10_000, maxOutputBytes: 500_000 });
+  if (!status.ok) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Owned managed worktree status could not be read.' };
+  }
+  if (status.stdout.trim()) {
+    return { safe: false, path, sourceState: 'dirty_worktree', detail: 'Owned managed worktree is dirty; unique source must be preserved.' };
+  }
+  const head = runProcess('git', ['rev-parse', 'HEAD'], { cwd: path, timeoutMs: 10_000, maxOutputBytes: 100_000 });
+  const branch = runProcess('git', ['branch', '--show-current'], { cwd: path, timeoutMs: 10_000, maxOutputBytes: 100_000 });
+  if (!head.ok || !head.stdout.trim() || !branch.ok || !branch.stdout.trim()) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Owned managed worktree HEAD/branch identity could not be resolved.' };
+  }
+  const branchName = branch.stdout.trim();
+  if (checkout.branch?.trim() && checkout.branch.trim() !== branchName) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Owned managed worktree branch no longer matches its Repository Registry checkout identity.' };
+  }
+  let canonical;
+  try { canonical = selectRepositoryCheckout(registered, registered.activeCheckoutId); } catch (error) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: `Canonical repository checkout could not be resolved: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  const canonicalBranch = runProcess('git', ['branch', '--show-current'], { cwd: canonical.canonicalRoot, timeoutMs: 10_000, maxOutputBytes: 100_000 });
+  if (!canonicalBranch.ok || !canonicalBranch.stdout.trim()) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Canonical integration branch could not be resolved for owned managed-worktree cleanup.' };
+  }
+  const canonicalBranchName = canonicalBranch.stdout.trim();
+  const contained = runProcess('git', ['merge-base', '--is-ancestor', head.stdout.trim(), `refs/heads/${canonicalBranchName}`], {
+    cwd: canonical.canonicalRoot,
+    timeoutMs: 10_000,
+    maxOutputBytes: 100_000,
+  });
+  if (!contained.ok) {
+    return {
+      safe: false,
+      path,
+      sourceState: 'unintegrated_commits',
+      detail: `Owned managed worktree HEAD ${head.stdout.trim()} is not contained in canonical branch ${canonicalBranchName}; source preservation remains required.`,
+    };
+  }
+  return {
+    safe: true,
+    path,
+    sourceState: 'clean_integrated',
+    workspaceResourceId: workspaceResource.resourceId,
+    checkoutId: checkout.checkoutId,
+    branch: branchName,
+    canonicalBranch: canonicalBranchName,
+    detail: `Canonical OwnedResource proves cleanup authority for a clean managed worktree whose HEAD ${head.stdout.trim()} is already contained in canonical branch ${canonicalBranchName}.`,
+  };
+}
+
 interface StaleWorkSourceInspection {
   safeToCancel: boolean;
   state: StaleWorkSourceState;
@@ -484,10 +626,116 @@ interface StaleWorkSourceInspection {
   detail: string;
 }
 
+interface StaleWorkDeliveryTargetResolution {
+  targetBranch: string;
+  handle?: NonNullable<ReturnType<typeof readWorkHandle>>;
+  identityMismatch: boolean;
+}
+
+function resolveStaleWorkDeliveryTarget(
+  repository: RuntimeMaintenanceRepository,
+  controllerHome: string,
+  contract: WorkContract,
+): StaleWorkDeliveryTargetResolution {
+  const handle = readWorkHandle(controllerHome, repository.repoId, contract.workId);
+  if (!handle) {
+    return { targetBranch: repository.defaultBranch?.trim() || 'main', identityMismatch: false };
+  }
+  if (!contract.checkoutId || handle.checkoutId !== contract.checkoutId) {
+    return {
+      targetBranch: repository.defaultBranch?.trim() || 'main',
+      handle,
+      identityMismatch: true,
+    };
+  }
+  return {
+    targetBranch: resolveWorkDeliveryTargetBranch(handle, repository.defaultBranch),
+    handle,
+    identityMismatch: false,
+  };
+}
+
+function isLegacyImplicitRemoteEffectPlacement(contract: WorkContract): boolean {
+  if (contract.workKind !== 'remote_effect' || contract.worktreePolicy.required !== true || !contract.worktreeRef || !contract.checkoutId) return false;
+  const reason = contract.worktreePolicy.reason?.trim() ?? '';
+  if (/Typed placement/i.test(reason)) return false;
+  return true;
+}
+
+interface LegacyRemoteEffectPlacementInspection {
+  safe: boolean;
+  path?: string;
+  detail: string;
+  checkoutId?: string;
+  canonicalCheckoutId?: string;
+  branch?: string;
+  canonicalBranch?: string;
+}
+
+function inspectLegacyRemoteEffectPlacement(
+  repository: RuntimeMaintenanceRepository,
+  controllerHome: string,
+  contract: WorkContract,
+): LegacyRemoteEffectPlacementInspection | undefined {
+  if (!isLegacyImplicitRemoteEffectPlacement(contract)) return undefined;
+  const recordedPath = contract.worktreeRef?.trim();
+  if (!recordedPath) return undefined;
+  const path = resolve(recordedPath);
+  if (!looksLikeForgeManagedWorktree(path)) return { safe: false, path, detail: 'Legacy remote_effect placement is outside Forge-managed worktree storage; automatic resource detachment is forbidden.' };
+  if (readWorkHandle(controllerHome, repository.repoId, contract.workId)) return { safe: false, path, detail: 'Legacy remote_effect placement unexpectedly has a WorkHandle; repository source authority must be reconciled explicitly.' };
+  let registered;
+  try { registered = getRepository(repository.repoId, controllerHome, { includeRemoved: true }); } catch (error) {
+    return { safe: false, path, detail: `Repository registry could not be read for legacy remote_effect placement: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  const checkout = registered.checkouts.find((candidate) => candidate.checkoutId === contract.checkoutId);
+  if (!checkout) return { safe: false, path, detail: 'Legacy remote_effect checkout identity is missing from the Repository Registry.' };
+  if ((checkout.lifecycle ?? 'active') !== 'active' || checkout.worktree !== true) return { safe: false, path, detail: `Legacy remote_effect checkout ${checkout.checkoutId} is not an active registered worktree.` };
+  const registeredPath = resolve(checkout.canonicalRoot);
+  if (registeredPath !== path && resolve(checkout.localRoot) !== path) return { safe: false, path, detail: 'Legacy remote_effect WorkContract path does not match its registered checkout identity.' };
+  const otherOwner = readWorkContractStore({ controllerHome, repoId: repository.repoId }).contracts.find((candidate) =>
+    candidate.workId !== contract.workId
+    && semanticWorkState(candidate) === 'open'
+    && candidate.worktreeRef
+    && resolve(candidate.worktreeRef) === path);
+  if (otherOwner) return { safe: false, path, detail: `Managed worktree is also owned by active Work ${otherOwner.workId}; resource detachment is fenced.` };
+  if (!existsSync(path)) return { safe: false, path, detail: 'Legacy remote_effect managed worktree path is absent; registry/source reconciliation is required before detachment.' };
+  const status = runProcess('git', ['status', '--porcelain', '--untracked-files=all'], { cwd: path, timeoutMs: 10_000, maxOutputBytes: 500_000 });
+  if (!status.ok || status.stdout.trim()) return { safe: false, path, detail: status.ok ? 'Legacy remote_effect managed worktree is dirty; live source must be preserved.' : 'Legacy remote_effect managed worktree status could not be read.' };
+  const head = runProcess('git', ['rev-parse', 'HEAD'], { cwd: path, timeoutMs: 10_000, maxOutputBytes: 100_000 });
+  const baseRevision = contract.baseRevision?.trim();
+  if (!head.ok || !head.stdout.trim() || !baseRevision || head.stdout.trim() !== baseRevision) return { safe: false, path, detail: 'Legacy remote_effect worktree HEAD does not exactly equal the Work base revision; repository delta ownership is ambiguous.' };
+  const branch = runProcess('git', ['branch', '--show-current'], { cwd: path, timeoutMs: 10_000, maxOutputBytes: 100_000 });
+  if (!branch.ok || !branch.stdout.trim()) return { safe: false, path, detail: 'Legacy remote_effect managed worktree branch could not be resolved.' };
+  let canonical;
+  try { canonical = selectRepositoryCheckout(registered, registered.activeCheckoutId); } catch (error) {
+    return { safe: false, path, detail: `Canonical repository checkout could not be resolved: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  if (canonical.activeCheckoutId === checkout.checkoutId) return { safe: false, path, detail: 'Legacy remote_effect placement unexpectedly points at the canonical active checkout; automatic detachment is forbidden.' };
+  const canonicalBranch = runProcess('git', ['branch', '--show-current'], { cwd: canonical.canonicalRoot, timeoutMs: 10_000, maxOutputBytes: 100_000 });
+  if (!canonicalBranch.ok || !canonicalBranch.stdout.trim()) return { safe: false, path, detail: 'Canonical integration branch could not be resolved for legacy remote_effect detachment.' };
+  const contained = runProcess('git', ['merge-base', '--is-ancestor', baseRevision, `refs/heads/${canonicalBranch.stdout.trim()}`], { cwd: canonical.canonicalRoot, timeoutMs: 10_000, maxOutputBytes: 100_000 });
+  if (!contained.ok) return { safe: false, path, detail: `Legacy remote_effect base revision ${baseRevision} is not contained in canonical branch ${canonicalBranch.stdout.trim()}; source preservation remains required.` };
+  return {
+    safe: true, path, checkoutId: checkout.checkoutId, canonicalCheckoutId: canonical.activeCheckoutId,
+    branch: branch.stdout.trim(), canonicalBranch: canonicalBranch.stdout.trim(),
+    detail: `Legacy remote_effect owns a clean no-delta managed worktree at base revision ${baseRevision}, which is already contained in canonical branch ${canonicalBranch.stdout.trim()}; repository placement may be detached without changing Work semantics.`,
+  };
+}
+
 function inspectStaleWorkRepositorySource(
   repository: RuntimeMaintenanceRepository,
+  controllerHome: string,
   contract: WorkContract,
 ): StaleWorkSourceInspection {
+  const legacyRemoteEffect = inspectLegacyRemoteEffectPlacement(repository, controllerHome, contract);
+  if (legacyRemoteEffect) {
+    return {
+      safeToCancel: legacyRemoteEffect.safe,
+      state: legacyRemoteEffect.safe ? 'clean_integrated' : 'source_state_unknown',
+      path: legacyRemoteEffect.path,
+      detail: legacyRemoteEffect.detail,
+    };
+  }
   const recordedPath = contract.worktreeRef?.trim();
   if (!recordedPath) {
     return {
@@ -506,11 +754,62 @@ function inspectStaleWorkRepositorySource(
     };
   }
   if (!existsSync(path)) {
+    const deliveryTarget = resolveStaleWorkDeliveryTarget(repository, controllerHome, contract);
+    const handle = deliveryTarget.handle;
+    const expectedHead = handle?.expectedHead?.trim();
+    if (deliveryTarget.identityMismatch || !handle || !expectedHead) {
+      return {
+        safeToCancel: false,
+        state: 'source_state_unknown',
+        path,
+        detail: 'Recorded managed worktree path is absent and no identity-matched durable WorkHandle head can prove source preservation; destructive stale-Work cancellation is fenced.',
+      };
+    }
+    const targetBranch = deliveryTarget.targetBranch;
+    const head = runProcess('git', ['rev-parse', '--verify', `${expectedHead}^{commit}`], {
+      cwd: repository.canonicalRoot,
+      timeoutMs: 10_000,
+      maxOutputBytes: 100_000,
+    });
+    const target = runProcess('git', ['rev-parse', '--verify', `refs/heads/${targetBranch}`], {
+      cwd: repository.canonicalRoot,
+      timeoutMs: 10_000,
+      maxOutputBytes: 100_000,
+    });
+    if (!head.ok || !head.stdout.trim() || !target.ok || !target.stdout.trim()) {
+      return {
+        safeToCancel: false,
+        state: 'source_state_unknown',
+        path,
+        detail: `Recorded managed worktree path is absent and durable source head/target ${targetBranch} could not be resolved; destructive stale-Work cancellation is fenced.`,
+      };
+    }
+    const unique = runProcess('git', ['rev-list', '--count', `${target.stdout.trim()}..${head.stdout.trim()}`], {
+      cwd: repository.canonicalRoot,
+      timeoutMs: 10_000,
+      maxOutputBytes: 100_000,
+    });
+    if (!unique.ok || !/^\d+$/.test(unique.stdout.trim())) {
+      return {
+        safeToCancel: false,
+        state: 'source_state_unknown',
+        path,
+        detail: 'Durable WorkHandle source head could not be compared with its delivery target; destructive stale-Work cancellation is fenced.',
+      };
+    }
+    if (Number(unique.stdout.trim()) > 0) {
+      return {
+        safeToCancel: false,
+        state: 'unintegrated_commits',
+        path,
+        detail: `Managed worktree is absent, but durable WorkHandle head ${expectedHead} has ${unique.stdout.trim()} commit(s) not reachable from ${targetBranch}; exact source remains preserved in Git and requires explicit adoption or cleanup authority.`,
+      };
+    }
     return {
-      safeToCancel: false,
-      state: 'source_state_unknown',
+      safeToCancel: true,
+      state: 'clean_integrated',
       path,
-      detail: 'Recorded managed worktree path is absent, so maintenance cannot prove that no unique branch/source remains recoverable through Git or checkout metadata; destructive stale-Work cancellation is fenced.',
+      detail: `Managed worktree is absent, but its identity-matched durable WorkHandle head ${expectedHead} is already reachable from ${targetBranch}; no unique source is being discarded.`,
     };
   }
 
@@ -541,7 +840,16 @@ function inspectStaleWorkRepositorySource(
     timeoutMs: 10_000,
     maxOutputBytes: 100_000,
   });
-  const targetBranch = repository.defaultBranch?.trim() || 'main';
+  const deliveryTarget = resolveStaleWorkDeliveryTarget(repository, controllerHome, contract);
+  if (deliveryTarget.identityMismatch) {
+    return {
+      safeToCancel: false,
+      state: 'source_state_unknown',
+      path,
+      detail: 'Managed worktree has a durable WorkHandle whose checkout identity does not match the WorkContract; source containment cannot be proven against that handle and destructive stale-Work cancellation is fenced.',
+    };
+  }
+  const targetBranch = deliveryTarget.targetBranch;
   const target = runProcess('git', ['rev-parse', '--verify', `refs/heads/${targetBranch}`], {
     cwd: repository.canonicalRoot,
     timeoutMs: 10_000,
@@ -584,20 +892,11 @@ function inspectStaleWorkRepositorySource(
   };
 }
 
-function staleWorkSemanticTerminalizationReady(contract: WorkContract): boolean {
-  if (contract.phase !== 'cleanup') return false;
-  return (['implementation', 'verification', 'delivery'] as const).every((phase) =>
-    ['satisfied', 'skipped'].includes(contract.phaseEvidence[phase].state));
-}
-
-function staleWorkCandidateReason(source: StaleWorkSourceInspection, semanticReady: boolean): string {
+function staleWorkCandidateReason(source: StaleWorkSourceInspection): string {
   if (!source.safeToCancel) {
-    return `Protected stale Work: no active lifecycle authority remains, but repository source preservation is required. ${source.detail} The Work must remain nonterminal until source is explicitly adopted, delivered, or cleanup is semantically authorized.`;
-  }
-  if (!semanticReady) {
-    return `Protected stale Work: repository source has no unique live changes, but the Work semantic lifecycle has not reached cleanup with implementation, verification, and delivery explicitly satisfied or skipped. ${source.detail} Maintenance may clean source debt, but it cannot infer that the objective or acceptance criteria are complete.`;
+    return `Protected stale Work: repository source preservation is required. ${source.detail} Maintenance may reconcile only concrete owned resources; semantic Work remains model/user-owned.`;
   }
-  return `Cleanup-ready WorkContract exceeded the explicit maintenance age threshold and has no active Plan, Requirement, Schedule, or Controller authority. ${source.detail} Explicit full maintenance may finish cleanup while retaining durable evidence.`;
+  return `Observed stale Work: repository source has no unique live changes, but liveness/legacy phase facts do not authorize semantic cancellation or completion. ${source.detail} Use explicit Work semantic CAS to close the Work.`;
 }
 
 function scanRetainedWorktreeCandidates(
@@ -624,12 +923,12 @@ function scanRetainedWorktreeCandidates(
     if (normalized === resolve(repository.canonicalRoot) || currentOwnedPaths.has(normalized)) continue;
     const migrated = retainedByPath.get(normalized);
     if (migrated) {
-      const completed = migrated.work.status === 'completed';
+      const completed = semanticWorkState(migrated.work) === 'completed';
       candidates.push({
         kind: 'retained_migrated_work',
         id: migrated.work.workId,
         path: normalized,
-        status: migrated.work.status,
+        status: migrated.work.semanticState,
         safe: false,
         reason: completed
           ? 'A terminal Work from a retired Controller Home still owns a Git worktree and requires completion/cleanup reconciliation under the current Controller before lifecycle health can be reported.'
@@ -644,12 +943,28 @@ function scanRetainedWorktreeCandidates(
       continue;
     }
     if (!looksLikeForgeManagedWorktree(normalized)) continue;
+    const ownedResource = activeOwnedWorktreeResource(controllerHome, repository.repoId, normalized);
+    if (ownedResource) {
+      const inspection = inspectOwnedManagedWorktree(repository, controllerHome, normalized);
+      candidates.push({
+        kind: 'unowned_managed_worktree',
+        id: `managed-worktree:${basename(normalized)}`,
+        path: normalized,
+        safe: inspection.safe,
+        reason: inspection.detail,
+        suggestedAction: 'full_maintenance_pass',
+        ownershipStatus: 'explicit',
+        sourceState: inspection.sourceState,
+        disposition: inspection.safe ? undefined : 'source_preservation_required',
+      });
+      continue;
+    }
     candidates.push({
       kind: 'unowned_managed_worktree',
       id: `managed-worktree:${basename(normalized)}`,
       path: normalized,
       safe: false,
-      reason: 'Git reports a Forge-managed worktree for this repository, but the current Controller has no WorkContract ownership and no retained migration identity for it. Ownership must be reconciled before lifecycle health can be reported.',
+      reason: 'Git reports a Forge-managed worktree for this repository, but neither the current Work store, retained migration state, nor canonical OwnedResource authority owns it. Ownership must be reconciled before lifecycle health can be reported.',
       suggestedAction: 'full_maintenance_pass',
       ownershipStatus: 'unknown',
       disposition: 'ownership_reconciliation',
@@ -673,12 +988,12 @@ function scanRetainedWorktreeCandidates(
     // path outside current Git inventory only remains lifecycle debt when its
     // worktree .git marker still exists for manual reconciliation.
     if (!existsSync(join(normalized, '.git'))) continue;
-    const completed = migrated.work.status === 'completed';
+    const completed = semanticWorkState(migrated.work) === 'completed';
     candidates.push({
       kind: 'retained_migrated_work',
       id: migrated.work.workId,
       path: normalized,
-      status: migrated.work.status,
+      status: migrated.work.semanticState,
       safe: false,
       reason: 'A terminal Work retained by a migrated Controller Home still has preserved filesystem state, but Git no longer reports it as a registered worktree. Manual lifecycle reconciliation is required; automatic cleanup is forbidden.',
       suggestedAction: 'full_maintenance_pass',
@@ -701,26 +1016,65 @@ function normalizedOptions(options: RuntimeMaintenanceOptions = {}): Required<Ru
   };
 }
 
-function activeWorkAuthorityRefs(
+interface RuntimeMaintenanceAuthoritySnapshot {
+  contracts: WorkContract[];
+  workById: Map<string, WorkContract>;
+  planByWorkId: Map<string, string>;
+  activeRequirementStateById: Map<string, string>;
+  scheduleByWorkId: Map<string, string>;
+  processByWorkId: Map<string, string>;
+}
+
+/**
+ * Build one bounded read snapshot for a maintenance status pass. Discovery must
+ * never turn N candidate Works/EditSessions into N full Plan/Schedule/Process
+ * scans. Process liveness comes from Process Runtime's recovery index instead of
+ * enumerating terminal process history. This snapshot is advisory only; mutation
+ * paths still re-read current authority before terminalization.
+ */
+function buildRuntimeMaintenanceAuthoritySnapshot(
   repository: RuntimeMaintenanceRepository,
   controllerHome: string,
-  contract: WorkContract,
-): string[] {
+): RuntimeMaintenanceAuthoritySnapshot {
+  const contracts = readWorkContractStore({ controllerHome, repoId: repository.repoId }).contracts;
+  const workById = new Map(contracts.map((contract) => [contract.workId, contract]));
+  const planByWorkId = new Map<string, string>();
+  for (const plan of listPlanContracts({ controllerHome, repoId: repository.repoId, status: 'active', limit: 100 })) {
+    for (const step of plan.steps) if (step.workId) planByWorkId.set(step.workId, plan.planId);
+    if (plan.planId) {
+      for (const contract of contracts) if (contract.planId === plan.planId) planByWorkId.set(contract.workId, plan.planId);
+    }
+  }
+  const activeRequirementStateById = new Map<string, string>();
+  for (const requirementId of new Set(contracts.flatMap((contract) => contract.requirementId ? [contract.requirementId] : []))) {
+    const requirement = readRequirement({ controllerHome }, requirementId)?.value;
+    if (requirement && !['done', 'cancelled'].includes(requirement.state)) activeRequirementStateById.set(requirementId, requirement.state);
+  }
+  const scheduleByWorkId = new Map<string, string>();
+  for (const schedule of listSchedules(controllerHome, repository.repoId)) {
+    if (!schedule.enabled) continue;
+    const workId = String((schedule.action.arguments as Record<string, unknown> | undefined)?.work_id ?? '').trim();
+    if (workId && !scheduleByWorkId.has(workId)) scheduleByWorkId.set(workId, schedule.scheduleId);
+  }
+  const processByWorkId = new Map<string, string>();
+  for (const process of listRecoverableProcessRecords(controllerHome, repository.repoId)) {
+    if (process.workId && isManagedProcessActive(process) && !processByWorkId.has(process.workId)) processByWorkId.set(process.workId, process.processId);
+  }
+  return { contracts, workById, planByWorkId, activeRequirementStateById, scheduleByWorkId, processByWorkId };
+}
+
+function activeWorkAuthorityRefs(contract: WorkContract, snapshot: RuntimeMaintenanceAuthoritySnapshot): string[] {
   const refs: string[] = [];
-  if (getControllerSession({ controllerHome, repoId: repository.repoId }, contract.workId)) refs.push('controller_session');
-  const activePlans = listPlanContracts({ controllerHome, repoId: repository.repoId, status: 'active', limit: 100 });
-  const plan = activePlans.find((candidate) => candidate.planId === contract.planId || candidate.steps.some((step) => step.workId === contract.workId));
-  if (plan) refs.push(`plan:${plan.planId}`);
+  const planId = snapshot.planByWorkId.get(contract.workId);
+  if (planId) refs.push(`plan:${planId}`);
   if (contract.requirementId) {
-    const requirement = readRequirement({ controllerHome }, contract.requirementId)?.value;
-    if (requirement && !['done', 'cancelled'].includes(requirement.state)) refs.push(`requirement:${requirement.requirementId}:${requirement.state}`);
+    const state = snapshot.activeRequirementStateById.get(contract.requirementId);
+    if (state) refs.push(`requirement:${contract.requirementId}:${state}`);
   }
-  const boundSchedule = listSchedules(controllerHome, repository.repoId).find((schedule) => {
-    if (!schedule.enabled) return false;
-    const args = schedule.action.arguments as Record<string, unknown> | undefined;
-    return args?.work_id === contract.workId;
-  });
-  if (boundSchedule) refs.push(`schedule:${boundSchedule.scheduleId}`);
+  const scheduleId = snapshot.scheduleByWorkId.get(contract.workId);
+  if (scheduleId) refs.push(`schedule:${scheduleId}`);
+  const processId = snapshot.processByWorkId.get(contract.workId);
+  if (processId) refs.push(`process:${processId}`);
   return refs;
 }
 
@@ -728,170 +1082,305 @@ function scanStaleWorkContractCandidates(
   repository: RuntimeMaintenanceRepository,
   controllerHome: string,
   options: Required<RuntimeMaintenanceOptions>,
+  snapshot: RuntimeMaintenanceAuthoritySnapshot,
 ): RuntimeMaintenanceCandidate[] {
   const nowMs = Date.now();
-  return readWorkContractStore({ controllerHome, repoId: repository.repoId }).contracts
-    .filter((contract) => !isTerminalWorkContractStatus(contract.status))
+  return snapshot.contracts
+    .filter((contract) => semanticWorkState(contract) === 'open')
     .map((contract) => {
       const updatedMs = Date.parse(contract.updatedAt);
       const ageMinutes = Number.isFinite(updatedMs) ? Math.max(0, Math.floor((nowMs - updatedMs) / 60_000)) : 0;
       return { contract, ageMinutes };
     })
     .filter(({ ageMinutes }) => ageMinutes >= options.minAgeMinutes)
-    .flatMap(({ contract, ageMinutes }) => {
-      const authorityRefs = activeWorkAuthorityRefs(repository, controllerHome, contract);
-      // A live Plan/Requirement/Schedule/Controller reference is lifecycle authority,
-      // not maintenance debt. Keep the Work fenced until that authority disappears;
-      // if it later becomes unowned, the next scan will surface it as stale.
-      if (authorityRefs.length > 0) return [];
-      return [{ contract, ageMinutes, source: inspectStaleWorkRepositorySource(repository, contract) }];
+    .filter(({ contract }) => {
+      // A live Plan/Requirement/Schedule/Process reference is retained migration authority,
+      // not maintenance debt. The authority inventory was read once for this status pass.
+      return activeWorkAuthorityRefs(contract, snapshot).length === 0;
     })
     .sort((left, right) => right.ageMinutes - left.ageMinutes)
+    // Expensive Git source inspection belongs after the visible candidate budget.
     .slice(0, options.maxCandidates)
+    .map(({ contract, ageMinutes }) => ({
+      contract, ageMinutes, source: inspectStaleWorkRepositorySource(repository, controllerHome, contract),
+    }))
     .map(({ contract, ageMinutes, source }) => {
-      const semanticReady = staleWorkSemanticTerminalizationReady(contract);
+      const legacyRemotePlacement = isLegacyImplicitRemoteEffectPlacement(contract);
       return {
         kind: 'stale_work_contract' as const,
         id: contract.workId,
         path: source.path,
-        status: contract.status,
-        safe: source.safeToCancel && semanticReady,
-        reason: staleWorkCandidateReason(source, semanticReady),
+        status: contract.semanticState,
+        safe: legacyRemotePlacement ? source.safeToCancel : false,
+        reason: legacyRemotePlacement ? source.detail : staleWorkCandidateReason(source),
         ageMinutes,
         suggestedAction: 'full_maintenance_pass' as const,
         ownershipStatus: 'explicit' as const,
         sourceState: source.state,
         disposition: !source.safeToCancel
           ? ('source_preservation_required' as const)
-          : !semanticReady
+          : !legacyRemotePlacement
             ? ('semantic_completion_required' as const)
             : undefined,
       };
     });
 }
 
-export function applyStaleWorkContractMaintenanceCandidate(
+function detachLegacyRemoteEffectPlacement(
   repository: RuntimeMaintenanceRepository,
   controllerHome: string,
+  current: WorkContract,
   candidate: RuntimeMaintenanceCandidate,
 ): RuntimeMaintenanceCandidate & { applied: boolean; result: string } {
-  const work = getWorkContract({ controllerHome, repoId: repository.repoId }, candidate.id);
-  if (!work || isTerminalWorkContractStatus(work.status)) {
-    return { ...candidate, applied: false, result: 'already_terminal' };
+  const inspection = inspectLegacyRemoteEffectPlacement(repository, controllerHome, current);
+  if (!inspection || !inspection.safe || !inspection.path || !inspection.checkoutId || !inspection.canonicalCheckoutId || !inspection.branch || !inspection.canonicalBranch) {
+    return { ...candidate, safe: false, reason: inspection?.detail ?? 'Legacy remote_effect placement is no longer eligible for resource detachment.', sourceState: 'source_state_unknown', disposition: 'source_preservation_required', applied: false, result: 'legacy_remote_effect_placement_preserved' };
   }
-
-  // The stale scan is discovery only. Re-evaluate every non-Controller authority
-  // while holding the canonical ControllerSession lock, then perform the Work
-  // transition before releasing it. A newer controller_claim therefore either
-  // wins the lock first and fences this mutation, or starts only after an already
-  // completed maintenance terminalization; there is no check-then-cancel gap.
-  const fenced = withControllerSessionTerminalizationFence(
-    { controllerHome, repoId: repository.repoId },
-    { workId: work.workId, actor: `runtime-maintenance-terminalize:${work.workId}` },
-    () => {
-      const current = getWorkContract({ controllerHome, repoId: repository.repoId }, work.workId);
-      if (!current || isTerminalWorkContractStatus(current.status)) {
-        return { ...candidate, applied: false, result: 'already_terminal' };
+  const store = { controllerHome, repoId: repository.repoId };
+  try {
+    assertOwnedResourceCleanupTarget(controllerHome, {
+      resourceId: managedWorkspaceOwnedResourceId(repository.repoId, inspection.checkoutId),
+      kind: 'worktree',
+      targetRef: inspection.path,
+    });
+  } catch (error) {
+    return {
+      ...candidate,
+      safe: false,
+      reason: `Canonical OwnedResource authority is required before legacy worktree detachment: ${error instanceof Error ? error.message : String(error)}`,
+      sourceState: 'source_state_unknown',
+      disposition: 'source_preservation_required',
+      applied: false,
+      result: 'legacy_remote_effect_owned_resource_required',
+    };
+  }
+  const previous = { checkoutId: current.checkoutId, worktreeRef: current.worktreeRef, constraints: current.constraints, worktreePolicy: current.worktreePolicy };
+  updateWorkContract(store, current.workId, {
+    checkoutId: inspection.canonicalCheckoutId,
+    worktreeRef: undefined,
+    constraints: { ...current.constraints, workspaceMode: 'current' },
+    worktreePolicy: { required: false, reason: 'Legacy pure remote_effect repository placement detached by explicit runtime maintenance; external-effect execution has no repository source authority.' },
+  });
+  try {
+    setRepositoryCheckoutLifecycle({ controllerHome, repoId: repository.repoId, checkoutId: inspection.checkoutId, lifecycle: 'removed', reason: `Legacy remote_effect placement detached for ${current.workId}.` });
+    const removed = runProcess('git', ['worktree', 'remove', '--force', inspection.path], { cwd: repository.canonicalRoot, timeoutMs: 60_000, maxOutputBytes: 500_000 });
+    if (!removed.ok && existsSync(inspection.path)) throw new Error(`LEGACY_REMOTE_EFFECT_WORKTREE_REMOVE_FAILED: ${removed.stderr || removed.stdout}`);
+    markOwnedResourceCleaned(controllerHome, managedWorkspaceOwnedResourceId(repository.repoId, inspection.checkoutId), 'forge:legacy-remote-effect-detach');
+    if (inspection.branch !== inspection.canonicalBranch) {
+      try {
+        assertOwnedResourceCleanupTarget(controllerHome, {
+          resourceId: managedBranchOwnedResourceId(repository.repoId, inspection.checkoutId),
+          kind: 'git_branch',
+          targetRef: inspection.branch,
+          locator: managedBranchOwnedResourceLocator(repository.canonicalRoot, inspection.checkoutId, inspection.branch),
+        });
+      } catch {
+        return { ...candidate, safe: true, reason: inspection.detail, sourceState: 'clean_integrated', disposition: undefined, applied: true, result: `legacy_remote_effect_placement_detached_branch_retained:${inspection.branch}` };
+      }
+      const deleted = runProcess('git', ['branch', '--delete', inspection.branch], { cwd: repository.canonicalRoot, timeoutMs: 10_000, maxOutputBytes: 100_000 });
+      if (!deleted.ok) {
+        const forced = runProcess('git', ['branch', '--delete', '--force', inspection.branch], { cwd: repository.canonicalRoot, timeoutMs: 10_000, maxOutputBytes: 100_000 });
+        if (!forced.ok) return { ...candidate, safe: true, reason: inspection.detail, sourceState: 'clean_integrated', disposition: undefined, applied: true, result: `legacy_remote_effect_placement_detached_branch_retained:${inspection.branch}` };
       }
-      const authorityRefs = activeWorkAuthorityRefs(repository, controllerHome, current);
-      if (authorityRefs.length > 0) {
+      markOwnedResourceCleaned(controllerHome, managedBranchOwnedResourceId(repository.repoId, inspection.checkoutId), 'forge:legacy-remote-effect-detach');
+    }
+    return { ...candidate, safe: true, reason: inspection.detail, sourceState: 'clean_integrated', disposition: undefined, applied: true, result: 'legacy_remote_effect_placement_detached' };
+  } catch (error) {
+    if (existsSync(inspection.path)) {
+      try { setRepositoryCheckoutLifecycle({ controllerHome, repoId: repository.repoId, checkoutId: inspection.checkoutId, lifecycle: 'active', reason: `Rollback failed legacy remote_effect detach for ${current.workId}.` }); } catch { /* preserve primary failure */ }
+      try { updateWorkContract(store, current.workId, previous); } catch { /* preserve primary failure */ }
+    }
+    throw error;
+  }
+}
+
+function detachOwnedManagedWorktree(
+  repository: RuntimeMaintenanceRepository,
+  controllerHome: string,
+  candidate: RuntimeMaintenanceCandidate,
+): RuntimeMaintenanceCandidate & { applied: boolean; result: string } {
+  if (!candidate.path) return { ...candidate, applied: false, result: 'owned_managed_worktree_path_missing' };
+  const inspection = inspectOwnedManagedWorktree(repository, controllerHome, candidate.path);
+  if (!inspection.safe || !inspection.workspaceResourceId || !inspection.checkoutId || !inspection.branch || !inspection.canonicalBranch) {
+    return {
+      ...candidate,
+      safe: false,
+      reason: inspection.detail,
+      sourceState: inspection.sourceState,
+      disposition: 'source_preservation_required',
+      applied: false,
+      result: 'owned_managed_worktree_preserved',
+    };
+  }
+  try {
+    setRepositoryCheckoutLifecycle({
+      controllerHome,
+      repoId: repository.repoId,
+      checkoutId: inspection.checkoutId,
+      lifecycle: 'removed',
+      reason: 'Canonical OwnedResource cleanup reconciled a WorkContract-less managed worktree whose source is already integrated.',
+    });
+    const removed = runProcess('git', ['worktree', 'remove', '--force', inspection.path], {
+      cwd: repository.canonicalRoot,
+      timeoutMs: 60_000,
+      maxOutputBytes: 500_000,
+    });
+    if (!removed.ok && existsSync(inspection.path)) {
+      throw new Error(`OWNED_MANAGED_WORKTREE_REMOVE_FAILED: ${removed.stderr || removed.stdout}`);
+    }
+    markOwnedResourceCleaned(controllerHome, inspection.workspaceResourceId, 'forge:runtime-maintenance-owned-worktree');
+    if (inspection.branch !== inspection.canonicalBranch) {
+      try {
+        assertOwnedResourceCleanupTarget(controllerHome, {
+          resourceId: managedBranchOwnedResourceId(repository.repoId, inspection.checkoutId),
+          kind: 'git_branch',
+          targetRef: inspection.branch,
+          locator: managedBranchOwnedResourceLocator(repository.canonicalRoot, inspection.checkoutId, inspection.branch),
+        });
+      } catch {
         return {
           ...candidate,
-          applied: false,
-          result: `work_authority_became_active:${authorityRefs.join(',')}`,
+          safe: true,
+          reason: inspection.detail,
+          sourceState: 'clean_integrated',
+          disposition: undefined,
+          applied: true,
+          result: `owned_managed_worktree_detached_branch_retained:${inspection.branch}`,
         };
       }
-      // Discovery and mutation are separated by an arbitrary Controller/MCP delay.
-      // Re-probe the live worktree while the canonical ControllerSession fence is
-      // held so neither a newer Controller claim nor a late source write can be
-      // raced by stale maintenance terminalization.
-      const source = inspectStaleWorkRepositorySource(repository, current);
-      if (!source.safeToCancel) {
+      const deleted = runProcess('git', ['branch', '--delete', inspection.branch], {
+        cwd: repository.canonicalRoot,
+        timeoutMs: 10_000,
+        maxOutputBytes: 100_000,
+      });
+      if (!deleted.ok) {
+        const forced = runProcess('git', ['branch', '--delete', '--force', inspection.branch], {
+          cwd: repository.canonicalRoot,
+          timeoutMs: 10_000,
+          maxOutputBytes: 100_000,
+        });
+        if (!forced.ok) {
+          return {
+            ...candidate,
+            safe: true,
+            reason: inspection.detail,
+            sourceState: 'clean_integrated',
+            disposition: undefined,
+            applied: true,
+            result: `owned_managed_worktree_detached_branch_retained:${inspection.branch}`,
+          };
+        }
+      }
+      markOwnedResourceCleaned(
+        controllerHome,
+        managedBranchOwnedResourceId(repository.repoId, inspection.checkoutId),
+        'forge:runtime-maintenance-owned-worktree',
+      );
+    }
+    return {
+      ...candidate,
+      safe: true,
+      reason: inspection.detail,
+      sourceState: 'clean_integrated',
+      disposition: undefined,
+      applied: true,
+      result: 'owned_managed_worktree_detached',
+    };
+  } catch (error) {
+    if (existsSync(inspection.path)) {
+      try {
+        setRepositoryCheckoutLifecycle({
+          controllerHome,
+          repoId: repository.repoId,
+          checkoutId: inspection.checkoutId,
+          lifecycle: 'active',
+          reason: 'Rollback failed OwnedResource managed-worktree cleanup.',
+        });
+      } catch { /* preserve primary failure */ }
+    }
+    throw error;
+  }
+}
+
+export function applyStaleWorkContractMaintenanceCandidate(
+  repository: RuntimeMaintenanceRepository,
+  controllerHome: string,
+  candidate: RuntimeMaintenanceCandidate,
+): RuntimeMaintenanceCandidate & { applied: boolean; result: string } {
+  const work = getWorkContract({ controllerHome, repoId: repository.repoId }, candidate.id);
+  if (!work || semanticWorkState(work) !== 'open') {
+    return { ...candidate, applied: false, result: 'already_terminal' };
+  }
+
+  // The stale scan is discovery only. Re-read the exact Work and every
+  // non-Controller authority immediately before mutation. WorkContract writes are
+  // serialized by the canonical Work store writer; ControllerSession ownership is
+  // continuation state and cannot fence maintenance of semantic Work.
+  const current = getWorkContract({ controllerHome, repoId: repository.repoId }, work.workId);
+  if (!current || semanticWorkState(current) !== 'open') {
+    return { ...candidate, applied: false, result: 'already_terminal' };
+  }
+  const authorityRefs = activeWorkAuthorityRefs(current, buildRuntimeMaintenanceAuthoritySnapshot(repository, controllerHome));
+  if (authorityRefs.length > 0) {
+    return {
+      ...candidate,
+      applied: false,
+      result: `work_authority_became_active:${authorityRefs.join(',')}`,
+    };
+  }
+  // Discovery and mutation are separated by an arbitrary Runtime delay.
+  // Re-probe the live worktree immediately before mutation; concrete Git/worktree
+  // state is the relevant safety authority, not a Controller claim.
+  const source = inspectStaleWorkRepositorySource(repository, controllerHome, current);
+  if (!source.safeToCancel) {
         return {
           ...candidate,
           path: source.path ?? candidate.path,
           safe: false,
-          reason: staleWorkCandidateReason(source, staleWorkSemanticTerminalizationReady(current)),
+          reason: isLegacyImplicitRemoteEffectPlacement(current) ? source.detail : staleWorkCandidateReason(source),
           sourceState: source.state,
           disposition: 'source_preservation_required' as const,
           applied: false,
           result: `work_source_preserved:${source.state}`,
         };
       }
-      const semanticReady = staleWorkSemanticTerminalizationReady(current);
-      if (!semanticReady) {
-        return {
-          ...candidate,
-          path: source.path ?? candidate.path,
-          safe: false,
-          reason: staleWorkCandidateReason(source, false),
-          sourceState: source.state,
-          disposition: 'semantic_completion_required' as const,
-          applied: false,
-          result: 'work_semantic_completion_required',
-        };
+  if (isLegacyImplicitRemoteEffectPlacement(current)) {
+        return detachLegacyRemoteEffectPlacement(repository, controllerHome, current, candidate);
       }
-      transitionWorkContractPhase({ controllerHome, repoId: repository.repoId }, current.workId, {
-        phase: 'cleanup',
-        status: 'cancelled',
-        state: 'skipped',
-        summary: 'Cancelled by explicit full maintenance after the Work had already reached cleanup with prior semantic phases satisfied and no unique live repository source remained; durable evidence retained.',
-        evidenceRefs: current.evidenceRefs,
-      });
-      return {
-        ...candidate,
-        path: source.path ?? candidate.path,
-        safe: true,
-        reason: staleWorkCandidateReason(source, true),
-        sourceState: source.state,
-        disposition: undefined,
-        applied: true,
-        result: 'work_contract_cancelled_evidence_retained',
-      };
-    },
-  );
-  if (!fenced.allowed) {
-    const generation = fenced.owner?.claimGeneration;
-    return {
-      ...candidate,
-      applied: false,
-      result: `work_terminalization_fenced:${fenced.reason}${typeof generation === 'number' ? `:claim_generation=${generation}` : ''}`,
-    };
-  }
-  return fenced.value;
+  return {
+    ...candidate,
+    path: source.path ?? candidate.path,
+    safe: false,
+    reason: staleWorkCandidateReason(source),
+    sourceState: source.state,
+    disposition: 'semantic_completion_required' as const,
+    applied: false,
+    result: 'work_semantic_completion_required',
+  };
 }
 
 function scanStaleEditSessionCandidates(
   repository: RuntimeMaintenanceRepository,
-  controllerHome: string,
   options: Required<RuntimeMaintenanceOptions>,
+  snapshot: RuntimeMaintenanceAuthoritySnapshot,
 ): RuntimeMaintenanceCandidate[] {
   const nowMs = Date.now();
   return listEditSessions(repository.canonicalRoot, Math.min(options.maxCandidates * 3, 500))
     .filter((summary) => ['open', 'dirty', 'checked', 'check_failed'].includes(summary.status))
-    .flatMap((summary) => {
-      try {
-        const session = reconcileEditSession(repository.canonicalRoot, summary.sessionId, {
-          reviewer: 'runtime-maintenance',
-          note: 'Reconciled during maintenance discovery; source files were not modified.',
-        });
-        if (['finalized', 'superseded', 'rolled_back'].includes(session.status)) return [];
-        const updatedMs = Date.parse(session.updatedAt);
-        const ageMinutes = Number.isFinite(updatedMs) ? Math.max(0, Math.floor((nowMs - updatedMs) / 60_000)) : 0;
-        return [{ session, ageMinutes }];
-      } catch {
-        return [];
-      }
+    // Status discovery is read-only. Workspace hashing/Git reconciliation belongs
+    // exclusively to explicit full maintenance for the selected candidate.
+    .map((session) => {
+      const updatedMs = Date.parse(session.updatedAt);
+      const ageMinutes = Number.isFinite(updatedMs) ? Math.max(0, Math.floor((nowMs - updatedMs) / 60_000)) : 0;
+      return { session, ageMinutes };
     })
     .filter(({ ageMinutes }) => ageMinutes >= options.minAgeMinutes)
     .sort((left, right) => right.ageMinutes - left.ageMinutes)
     .slice(0, options.maxCandidates)
     .flatMap(({ session, ageMinutes }) => {
-      const work = session.workId
-        ? getWorkContract({ controllerHome, repoId: repository.repoId }, session.workId)
-        : undefined;
-      const terminalWork = Boolean(work && isTerminalWorkContractStatus(work.status));
-      if (work && !terminalWork && activeWorkAuthorityRefs(repository, controllerHome, work).length > 0) {
+      const work = session.workId ? snapshot.workById.get(session.workId) : undefined;
+      const terminalWork = Boolean(work && semanticWorkState(work) !== 'open');
+      if (work && !terminalWork && activeWorkAuthorityRefs(work, snapshot).length > 0) {
         // The Edit Session inherits the live Work lifecycle authority. Reporting it
         // as stale maintenance debt while that authority is active would duplicate
         // ownership and can permanently block release readiness for valid long work.
@@ -952,7 +1441,10 @@ export function buildRuntimeMaintenanceStatus(
   options: RuntimeMaintenanceOptions = {},
 ): RuntimeMaintenanceStatus {
   const normalized = normalizedOptions(options);
+  // Runtime-storage binding is the compatibility cutover authority for legacy test/
+  // migrated repositories. Read lifecycle owners only after that binding is resolved.
   const storage = safeRuntimeStorage(repository, controllerHome);
+  const authoritySnapshot = buildRuntimeMaintenanceAuthoritySnapshot(repository, controllerHome);
   const runtimeStorageRepair = previewRuntimeStorageRepair(coerceRepository(repository), controllerHome, {
     minAgeMinutes: normalized.minAgeMinutes,
     maxCandidates: normalized.maxCandidates,
@@ -960,8 +1452,8 @@ export function buildRuntimeMaintenanceStatus(
   const localJobCandidates = scanLocalJobCandidates(repository.canonicalRoot, normalized);
   const storageCandidates = runtimeStorageCandidates(storage.report);
   const tempCandidates = scanRuntimeTempCandidates(repository, normalized.maxCandidates);
-  const staleWorkCandidates = scanStaleWorkContractCandidates(repository, controllerHome, normalized);
-  const staleEditCandidates = scanStaleEditSessionCandidates(repository, controllerHome, normalized);
+  const staleWorkCandidates = scanStaleWorkContractCandidates(repository, controllerHome, normalized, authoritySnapshot);
+  const staleEditCandidates = scanStaleEditSessionCandidates(repository, normalized, authoritySnapshot);
   const retainedWorktreeCandidates = scanRetainedWorktreeCandidates(repository, controllerHome, normalized.maxCandidates);
   const candidates = [...localJobCandidates, ...storageCandidates, ...staleWorkCandidates, ...staleEditCandidates, ...retainedWorktreeCandidates, ...tempCandidates].slice(0, normalized.maxCandidates);
   const summary = summarize(candidates);
@@ -999,7 +1491,7 @@ export function buildRuntimeMaintenanceStatus(
       'Pending approvals are not cancelled unless cancel_pending_approvals is explicitly enabled.',
       'System temp cleanup only removes direct forge-prefixed children of approved temp roots after a 24-hour retention period and a fresh process-occupancy check.',
       'Runtime lifecycle changes and source repair are outside the runtime maintenance executor.',
-      'Retained or unowned managed worktrees are review-only lifecycle blockers. Runtime maintenance never deletes or modifies their preserved implementation state.',
+      'Retained or unknown-ownership managed worktrees remain review-only lifecycle blockers. A WorkContract-less managed worktree is cleanup-eligible only when canonical OwnedResource identity is exact, the worktree is clean, and its HEAD is already contained in the canonical branch.',
     ],
   };
 }
@@ -1110,11 +1602,6 @@ export function previewAutomaticRuntimeMaintenance(
   };
 }
 
-function quarantinePath(repoRoot: string, id: string): string {
-  const stamp = now().replace(/[:.]/g, '-');
-  return join(repoRoot, '.ai', 'harness', 'local-jobs-quarantine', `${stamp}-${safeId(id)}`);
-}
-
 function terminalizeLocalJob(candidate: RuntimeMaintenanceCandidate, status: 'orphaned' | 'cancelled' = 'orphaned'): string {
   if (!candidate.path) throw new Error('LOCAL_JOB_PATH_MISSING');
   const jobPath = join(candidate.path, 'job.json');
@@ -1132,14 +1619,11 @@ function terminalizeLocalJob(candidate: RuntimeMaintenanceCandidate, status: 'or
   return status;
 }
 
-function quarantineLocalJob(repoRoot: string, candidate: RuntimeMaintenanceCandidate): string {
+function quarantineLocalJob(controllerHome: string, repoId: string, repoRoot: string, candidate: RuntimeMaintenanceCandidate): string {
   if (!candidate.path) throw new Error('LOCAL_JOB_PATH_MISSING');
   const root = localJobsRoot(repoRoot);
   if (!isWithin(root, candidate.path)) throw new Error('LOCAL_JOB_PATH_OUTSIDE_ROOT');
-  const destination = quarantinePath(repoRoot, candidate.id);
-  mkdirSync(dirname(destination), { recursive: true });
-  renameSync(candidate.path, destination);
-  return destination;
+  return quarantineRuntimePath(controllerHome, repoId, candidate.path, candidate.id);
 }
 
 function rebuildActiveIndex(repoRoot: string): void {
@@ -1204,7 +1688,7 @@ export function applyRuntimeMaintenance(
         return { ...candidate, applied: true, result: terminalizeLocalJob(candidate, 'cancelled') };
       }
       if (candidate.kind === 'unreadable_local_job' || candidate.kind === 'missing_job_metadata') {
-        return { ...candidate, applied: true, result: quarantineLocalJob(repository.canonicalRoot, candidate) };
+        return { ...candidate, applied: true, result: quarantineLocalJob(controllerHome, repository.repoId, repository.canonicalRoot, candidate) };
       }
       if (candidate.kind === 'stale_runtime_temp_entry') {
         if (!candidate.path) throw new Error('RUNTIME_TEMP_PATH_MISSING');
@@ -1220,6 +1704,9 @@ export function applyRuntimeMaintenance(
       if (candidate.kind === 'stale_work_contract') {
         return applyStaleWorkContractMaintenanceCandidate(repository, controllerHome, candidate);
       }
+      if (candidate.kind === 'unowned_managed_worktree') {
+        return detachOwnedManagedWorktree(repository, controllerHome, candidate);
+      }
       if (candidate.kind === 'stale_edit_session') {
         const cleaned = cleanupEditSession(repository.canonicalRoot, candidate.id, {
           reviewer: 'runtime-maintenance',
@@ -1242,6 +1729,48 @@ export function applyRuntimeMaintenance(
   const processGc = options.actionId === 'full_maintenance_pass'
     ? gcTerminalProcesses({ controllerHome, repoId: repository.repoId })
     : undefined;
+  const currentWork = readWorkContractStore({ controllerHome, repoId: repository.repoId }).contracts;
+  const protectedWorkIds = currentWork
+    .filter((contract) => semanticWorkState(contract) === 'open')
+    .map((contract) => contract.workId);
+  const verificationSnapshotGc = options.actionId === 'full_maintenance_pass'
+    ? cleanupStaleWorkVerificationSnapshots(controllerHome, repository.repoId, {
+      protectedWorkIds,
+      maxEntries: Math.max(100, (options.maxCandidates ?? 50) * 3),
+      maxRemovals: Math.max(1, options.maxCandidates ?? 50),
+    })
+    : undefined;
+  const quarantineGc = options.actionId === 'full_maintenance_pass'
+    ? cleanupRuntimeQuarantine(controllerHome, repository.repoId, repository.canonicalRoot, {
+      maxEntries: Math.max(100, (options.maxCandidates ?? 50) * 3),
+      maxRemovals: Math.max(1, options.maxCandidates ?? 50),
+      additionalRoots: [runtimeLegacyCheckQuarantineRoot(controllerHome, repository.repoId)],
+    })
+    : undefined;
+  let generatedCacheGc: RepositoryGeneratedCacheRetentionReport | undefined;
+  let cleanupArtifactGc: CleanupArtifactRetentionReport | undefined;
+  if (options.actionId === 'full_maintenance_pass') {
+    let cacheRepository: Parameters<typeof cleanupGeneratedRepositoryCheckoutCaches>[0] = {
+      canonicalRoot: repository.canonicalRoot,
+      checkouts: [],
+    };
+    try {
+      cacheRepository = getRepository(repository.repoId, controllerHome, { includeRemoved: true });
+    } catch {
+      // Embedded/test repositories may not be present in the Controller registry.
+      // The explicit maintenance action still safely covers their canonical root.
+    }
+    generatedCacheGc = cleanupGeneratedRepositoryCheckoutCaches(cacheRepository, {
+      graceMs: 60_000,
+      maxEntries: Math.max(1_000, (options.maxCandidates ?? 50) * 20),
+      maxRemovals: Math.max(1, options.maxCandidates ?? 50),
+    });
+    cleanupArtifactGc = cleanupWorkPreservationArtifacts(controllerHome, {
+      maxEntries: Math.max(1_000, (options.maxCandidates ?? 50) * 20),
+      maxRemovals: Math.max(1, options.maxCandidates ?? 50),
+      repositoryIds: [repository.repoId],
+    });
+  }
 
   if (options.actionId === 'runtime_storage_finalize_relocation' || options.actionId === 'full_maintenance_pass' || applied.some((candidate) => candidate.applied) || runtimeStorageRepairApply) {
     rebuildActiveIndex(repository.canonicalRoot);
@@ -1259,6 +1788,10 @@ export function applyRuntimeMaintenance(
     applied,
     runtimeStorageRepairApply,
     processGc,
+    verificationSnapshotGc,
+    quarantineGc,
+    generatedCacheGc,
+    cleanupArtifactGc,
     projection,
   };
 }