@moretea-labs/forge 1.8.0 → 1.8.1

package/src/runtime/recovery/maintenance-executor.ts

@@ -8,12 +8,12 @@ import { ensureRepositoryRuntimeStorage, type RepositoryRuntimeStorageReport } f
 import { getRepository, selectRepositoryCheckout, setRepositoryCheckoutLifecycle } from '../../cli/repositories/registry';
 import type { RepositoryRecord } from '../../cli/repositories/types';
 import { rebuildRepositoryProjection } from '../projections/materialized-view';
-import { cancelWorkContract, getWorkContract, readWorkContractStore, updateWorkContract } from '../../../packages/kernel/work/api/index';
-import { getControllerSession, listControllerSessions, withControllerSessionTerminalizationFence } from '../../../packages/kernel/controller/api/index';
+import { getWorkContract, readWorkContractStore, semanticWorkState, updateWorkContract } from '../../../packages/kernel/work/api/index';
+import { assertOwnedResourceCleanupTarget, listOwnedResources, markOwnedResourceCleaned, type OwnedResource } from '../../../packages/kernel/identity/api/index';
 import { listPlanContracts } from '../control-plane/facade/plan-contract-store';
 import { readRequirement } from '../control-plane/persistence/requirement-store';
 import { listControlPlaneRecords, type ControlPlaneRecord } from '../control-plane/persistence/sqlite-store';
-import { isTerminalWorkContractStatus, type WorkContract } from '../control-plane/facade/types';
+import type { WorkContract } from '../control-plane/facade/types';
 import { listSchedules } from '../../../packages/kernel/scheduler/api/index';
 import {
   collectRuntimeProcesses,
@@ -29,6 +29,8 @@ import {
 } from './local-jobs-repair';
 import { gcTerminalProcesses, type ProcessGcResult } from '../execution/process-runtime/gc';
 import { cleanupStaleWorkVerificationSnapshots, type WorkVerificationSnapshotRetentionReport } from '../control-plane/execution/work-verification-snapshot';
+import { cleanupGeneratedRepositoryCheckoutCaches, type RepositoryGeneratedCacheRetentionReport } from '../control-plane/generated-cache-retention';
+import { cleanupWorkPreservationArtifacts, type CleanupArtifactRetentionReport } from '../control-plane/cleanup-artifact-retention';
 import {
   cleanupRuntimeQuarantine,
   quarantineRuntimePath,
@@ -38,6 +40,7 @@ import {
 import { readWorkHandle, resolveWorkDeliveryTargetBranch } from '../control-plane/execution/work-handle-store';
 import { listRecoverableProcessRecords } from '../execution/process-runtime/store';
 import { isManagedProcessActive } from '../execution/process-runtime/types';
+import { managedBranchOwnedResourceId, managedBranchOwnedResourceLocator, managedWorkspaceOwnedResourceId } from '../execution/managed-workspace';
 
 export type RuntimeMaintenanceActionId =
   | 'local_jobs_reconcile'
@@ -151,6 +154,8 @@ export interface RuntimeMaintenanceApplyResult extends Omit<RuntimeMaintenanceSt
   processGc?: ProcessGcResult;
   verificationSnapshotGc?: WorkVerificationSnapshotRetentionReport;
   quarantineGc?: RuntimeQuarantineRetentionReport;
+  generatedCacheGc?: RepositoryGeneratedCacheRetentionReport;
+  cleanupArtifactGc?: CleanupArtifactRetentionReport;
   projection?: unknown;
 }
 
@@ -405,7 +410,11 @@ function scanRuntimeTempCandidates(
     minAgeMinutes: RUNTIME_TEMP_RETENTION_MINUTES,
     maxEntries: Math.max(maxCandidates * 3, 500),
   });
-  const ownershipStatus = explicitRoots ? 'explicit' as const : 'unknown' as const;
+  // scanRuntimeTempEntries is the mechanical temp-ownership fence: it only
+  // returns direct Forge-prefixed children of the approved temp roots, and
+  // removeRuntimeTempEntry revalidates root/name/symlink/age/process occupancy
+  // immediately before mutation. Explicit roots narrow scope; they do not create
+  // a second ownership authority.
   return scan.entries
     .filter((entry) => entry.cleanupCandidate)
     .slice(0, maxCandidates)
@@ -413,17 +422,15 @@ function scanRuntimeTempCandidates(
       kind: 'stale_runtime_temp_entry',
       id: `runtime-temp-${safeId(entry.path)}`,
       path: entry.path,
-      safe: entry.cleanupCandidate && ownershipStatus === 'explicit',
-      reason: ownershipStatus === 'unknown'
-        ? 'Temp entry has unknown durable ownership; it is protected until an owning lifecycle record or safe reconciliation proves eligibility.'
-        : entry.symbolicLink
-          ? 'Symbolic links are never eligible for automatic cleanup.'
-          : entry.occupiedByPid
-            ? `Temp entry is referenced by live process ${entry.occupiedByPid}.`
-            : `Forge temp entry is unoccupied, not a symbolic link, and ${entry.ageMinutes} minute(s) old.`,
+      safe: entry.cleanupCandidate,
+      reason: entry.symbolicLink
+        ? 'Symbolic links are never eligible for automatic cleanup.'
+        : entry.occupiedByPid
+          ? `Temp entry is referenced by live process ${entry.occupiedByPid}.`
+          : `Forge temp entry is unoccupied, not a symbolic link, and ${entry.ageMinutes} minute(s) old.`,
       ageMinutes: entry.ageMinutes,
       suggestedAction: 'full_maintenance_pass',
-      ownershipStatus,
+      ownershipStatus: 'explicit' as const,
     }));
 }
 
@@ -464,7 +471,7 @@ function listRetainedMigratedWork(destinationHomeInput: string, repoId: string):
     }
     for (const source of sourceWork) {
       const work = source.value;
-      if (work.repoId !== repoId || !isTerminalWorkContractStatus(work.status)) continue;
+      if (work.repoId !== repoId || semanticWorkState(work) === 'open') continue;
       if (!work.worktreeRef?.trim() || !existsSync(work.worktreeRef)) continue;
       if (destinationWorkIds.has(work.workId)) continue;
       retained.push({ migrationId: migration.migrationId, sourceHome, work });
@@ -497,6 +504,121 @@ function looksLikeForgeManagedWorktree(path: string): boolean {
 
 type StaleWorkSourceState = NonNullable<RuntimeMaintenanceCandidate['sourceState']>;
 
+interface OwnedManagedWorktreeInspection {
+  safe: boolean;
+  path: string;
+  sourceState: StaleWorkSourceState;
+  detail: string;
+  workspaceResourceId?: string;
+  checkoutId?: string;
+  branch?: string;
+  canonicalBranch?: string;
+}
+
+function activeOwnedWorktreeResource(
+  controllerHome: string,
+  repoId: string,
+  path: string,
+): OwnedResource | undefined {
+  const target = resolve(path);
+  return listOwnedResources(controllerHome, { kind: 'worktree', status: 'active', repoId })
+    .find((resource) => resource.cleanupCapable === true && resolve(resource.targetRef) === target);
+}
+
+function inspectOwnedManagedWorktree(
+  repository: RuntimeMaintenanceRepository,
+  controllerHome: string,
+  pathInput: string,
+): OwnedManagedWorktreeInspection {
+  const path = resolve(pathInput);
+  if (!looksLikeForgeManagedWorktree(path)) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Managed worktree is outside Forge-managed storage; automatic cleanup is forbidden.' };
+  }
+  if (!existsSync(path)) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Owned managed worktree path is absent; registry/resource reconciliation is required before cleanup.' };
+  }
+  const workspaceResource = activeOwnedWorktreeResource(controllerHome, repository.repoId, path);
+  if (!workspaceResource) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'No active cleanup-capable OwnedResource matches this managed worktree path.' };
+  }
+  try {
+    assertOwnedResourceCleanupTarget(controllerHome, {
+      resourceId: workspaceResource.resourceId,
+      kind: 'worktree',
+      targetRef: path,
+    });
+  } catch (error) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: `Managed worktree OwnedResource failed exact identity validation: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  const contractOwner = readWorkContractStore({ controllerHome, repoId: repository.repoId }).contracts.find((contract) =>
+    contract.worktreeRef && resolve(contract.worktreeRef) === path);
+  if (contractOwner) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: `Managed worktree still has WorkContract owner ${contractOwner.workId}; cleanup must remain with that Work lifecycle.` };
+  }
+  let registered;
+  try { registered = getRepository(repository.repoId, controllerHome, { includeRemoved: true }); } catch (error) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: `Repository registry could not be read for owned managed worktree: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  const checkout = registered.checkouts.find((candidate) =>
+    candidate.worktree === true
+    && (candidate.lifecycle ?? 'active') === 'active'
+    && (resolve(candidate.canonicalRoot) === path || resolve(candidate.localRoot) === path));
+  if (!checkout) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Owned managed worktree has no active matching Repository Registry checkout.' };
+  }
+  if (registered.activeCheckoutId === checkout.checkoutId) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Owned managed worktree is unexpectedly the canonical active checkout; automatic cleanup is forbidden.' };
+  }
+  const status = runProcess('git', ['status', '--porcelain', '--untracked-files=all'], { cwd: path, timeoutMs: 10_000, maxOutputBytes: 500_000 });
+  if (!status.ok) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Owned managed worktree status could not be read.' };
+  }
+  if (status.stdout.trim()) {
+    return { safe: false, path, sourceState: 'dirty_worktree', detail: 'Owned managed worktree is dirty; unique source must be preserved.' };
+  }
+  const head = runProcess('git', ['rev-parse', 'HEAD'], { cwd: path, timeoutMs: 10_000, maxOutputBytes: 100_000 });
+  const branch = runProcess('git', ['branch', '--show-current'], { cwd: path, timeoutMs: 10_000, maxOutputBytes: 100_000 });
+  if (!head.ok || !head.stdout.trim() || !branch.ok || !branch.stdout.trim()) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Owned managed worktree HEAD/branch identity could not be resolved.' };
+  }
+  const branchName = branch.stdout.trim();
+  if (checkout.branch?.trim() && checkout.branch.trim() !== branchName) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Owned managed worktree branch no longer matches its Repository Registry checkout identity.' };
+  }
+  let canonical;
+  try { canonical = selectRepositoryCheckout(registered, registered.activeCheckoutId); } catch (error) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: `Canonical repository checkout could not be resolved: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  const canonicalBranch = runProcess('git', ['branch', '--show-current'], { cwd: canonical.canonicalRoot, timeoutMs: 10_000, maxOutputBytes: 100_000 });
+  if (!canonicalBranch.ok || !canonicalBranch.stdout.trim()) {
+    return { safe: false, path, sourceState: 'source_state_unknown', detail: 'Canonical integration branch could not be resolved for owned managed-worktree cleanup.' };
+  }
+  const canonicalBranchName = canonicalBranch.stdout.trim();
+  const contained = runProcess('git', ['merge-base', '--is-ancestor', head.stdout.trim(), `refs/heads/${canonicalBranchName}`], {
+    cwd: canonical.canonicalRoot,
+    timeoutMs: 10_000,
+    maxOutputBytes: 100_000,
+  });
+  if (!contained.ok) {
+    return {
+      safe: false,
+      path,
+      sourceState: 'unintegrated_commits',
+      detail: `Owned managed worktree HEAD ${head.stdout.trim()} is not contained in canonical branch ${canonicalBranchName}; source preservation remains required.`,
+    };
+  }
+  return {
+    safe: true,
+    path,
+    sourceState: 'clean_integrated',
+    workspaceResourceId: workspaceResource.resourceId,
+    checkoutId: checkout.checkoutId,
+    branch: branchName,
+    canonicalBranch: canonicalBranchName,
+    detail: `Canonical OwnedResource proves cleanup authority for a clean managed worktree whose HEAD ${head.stdout.trim()} is already contained in canonical branch ${canonicalBranchName}.`,
+  };
+}
+
 interface StaleWorkSourceInspection {
   safeToCancel: boolean;
   state: StaleWorkSourceState;
@@ -535,9 +657,8 @@ function resolveStaleWorkDeliveryTarget(
 
 function isLegacyImplicitRemoteEffectPlacement(contract: WorkContract): boolean {
   if (contract.workKind !== 'remote_effect' || contract.worktreePolicy.required !== true || !contract.worktreeRef || !contract.checkoutId) return false;
-  if (contract.routeDecision?.requiresIsolation === true) return false;
   const reason = contract.worktreePolicy.reason?.trim() ?? '';
-  if (/Typed placement|Route Policy requires isolated execution/i.test(reason)) return false;
+  if (/Typed placement/i.test(reason)) return false;
   return true;
 }
 
@@ -573,7 +694,7 @@ function inspectLegacyRemoteEffectPlacement(
   if (registeredPath !== path && resolve(checkout.localRoot) !== path) return { safe: false, path, detail: 'Legacy remote_effect WorkContract path does not match its registered checkout identity.' };
   const otherOwner = readWorkContractStore({ controllerHome, repoId: repository.repoId }).contracts.find((candidate) =>
     candidate.workId !== contract.workId
-    && !isTerminalWorkContractStatus(candidate.status)
+    && semanticWorkState(candidate) === 'open'
     && candidate.worktreeRef
     && resolve(candidate.worktreeRef) === path);
   if (otherOwner) return { safe: false, path, detail: `Managed worktree is also owned by active Work ${otherOwner.workId}; resource detachment is fenced.` };
@@ -771,20 +892,11 @@ function inspectStaleWorkRepositorySource(
   };
 }
 
-function staleWorkSemanticTerminalizationReady(contract: WorkContract): boolean {
-  if (contract.phase !== 'cleanup') return false;
-  return (['implementation', 'verification', 'delivery'] as const).every((phase) =>
-    ['satisfied', 'skipped'].includes(contract.phaseEvidence[phase].state));
-}
-
-function staleWorkCandidateReason(source: StaleWorkSourceInspection, semanticReady: boolean): string {
+function staleWorkCandidateReason(source: StaleWorkSourceInspection): string {
   if (!source.safeToCancel) {
-    return `Protected stale Work: no active lifecycle authority remains, but repository source preservation is required. ${source.detail} The Work must remain nonterminal until source is explicitly adopted, delivered, or cleanup is semantically authorized.`;
+    return `Protected stale Work: repository source preservation is required. ${source.detail} Maintenance may reconcile only concrete owned resources; semantic Work remains model/user-owned.`;
   }
-  if (!semanticReady) {
-    return `Protected stale Work: repository source has no unique live changes, but the Work semantic lifecycle has not reached cleanup with implementation, verification, and delivery explicitly satisfied or skipped. ${source.detail} Maintenance may clean source debt, but it cannot infer that the objective or acceptance criteria are complete.`;
-  }
-  return `Cleanup-ready WorkContract exceeded the explicit maintenance age threshold and has no active Plan, Requirement, Schedule, or Controller authority. ${source.detail} Explicit full maintenance may finish cleanup while retaining durable evidence.`;
+  return `Observed stale Work: repository source has no unique live changes, but liveness/legacy phase facts do not authorize semantic cancellation or completion. ${source.detail} Use explicit Work semantic CAS to close the Work.`;
 }
 
 function scanRetainedWorktreeCandidates(
@@ -811,12 +923,12 @@ function scanRetainedWorktreeCandidates(
     if (normalized === resolve(repository.canonicalRoot) || currentOwnedPaths.has(normalized)) continue;
     const migrated = retainedByPath.get(normalized);
     if (migrated) {
-      const completed = migrated.work.status === 'completed';
+      const completed = semanticWorkState(migrated.work) === 'completed';
       candidates.push({
         kind: 'retained_migrated_work',
         id: migrated.work.workId,
         path: normalized,
-        status: migrated.work.status,
+        status: migrated.work.semanticState,
         safe: false,
         reason: completed
           ? 'A terminal Work from a retired Controller Home still owns a Git worktree and requires completion/cleanup reconciliation under the current Controller before lifecycle health can be reported.'
@@ -831,12 +943,28 @@ function scanRetainedWorktreeCandidates(
       continue;
     }
     if (!looksLikeForgeManagedWorktree(normalized)) continue;
+    const ownedResource = activeOwnedWorktreeResource(controllerHome, repository.repoId, normalized);
+    if (ownedResource) {
+      const inspection = inspectOwnedManagedWorktree(repository, controllerHome, normalized);
+      candidates.push({
+        kind: 'unowned_managed_worktree',
+        id: `managed-worktree:${basename(normalized)}`,
+        path: normalized,
+        safe: inspection.safe,
+        reason: inspection.detail,
+        suggestedAction: 'full_maintenance_pass',
+        ownershipStatus: 'explicit',
+        sourceState: inspection.sourceState,
+        disposition: inspection.safe ? undefined : 'source_preservation_required',
+      });
+      continue;
+    }
     candidates.push({
       kind: 'unowned_managed_worktree',
       id: `managed-worktree:${basename(normalized)}`,
       path: normalized,
       safe: false,
-      reason: 'Git reports a Forge-managed worktree for this repository, but the current Controller has no WorkContract ownership and no retained migration identity for it. Ownership must be reconciled before lifecycle health can be reported.',
+      reason: 'Git reports a Forge-managed worktree for this repository, but neither the current Work store, retained migration state, nor canonical OwnedResource authority owns it. Ownership must be reconciled before lifecycle health can be reported.',
       suggestedAction: 'full_maintenance_pass',
       ownershipStatus: 'unknown',
       disposition: 'ownership_reconciliation',
@@ -860,12 +988,12 @@ function scanRetainedWorktreeCandidates(
     // path outside current Git inventory only remains lifecycle debt when its
     // worktree .git marker still exists for manual reconciliation.
     if (!existsSync(join(normalized, '.git'))) continue;
-    const completed = migrated.work.status === 'completed';
+    const completed = semanticWorkState(migrated.work) === 'completed';
     candidates.push({
       kind: 'retained_migrated_work',
       id: migrated.work.workId,
       path: normalized,
-      status: migrated.work.status,
+      status: migrated.work.semanticState,
       safe: false,
       reason: 'A terminal Work retained by a migrated Controller Home still has preserved filesystem state, but Git no longer reports it as a registered worktree. Manual lifecycle reconciliation is required; automatic cleanup is forbidden.',
       suggestedAction: 'full_maintenance_pass',
@@ -891,7 +1019,6 @@ function normalizedOptions(options: RuntimeMaintenanceOptions = {}): Required<Ru
 interface RuntimeMaintenanceAuthoritySnapshot {
   contracts: WorkContract[];
   workById: Map<string, WorkContract>;
-  controllerWorkIds: Set<string>;
   planByWorkId: Map<string, string>;
   activeRequirementStateById: Map<string, string>;
   scheduleByWorkId: Map<string, string>;
@@ -911,7 +1038,6 @@ function buildRuntimeMaintenanceAuthoritySnapshot(
 ): RuntimeMaintenanceAuthoritySnapshot {
   const contracts = readWorkContractStore({ controllerHome, repoId: repository.repoId }).contracts;
   const workById = new Map(contracts.map((contract) => [contract.workId, contract]));
-  const controllerWorkIds = new Set(listControllerSessions({ controllerHome, repoId: repository.repoId }).map((session) => session.workId));
   const planByWorkId = new Map<string, string>();
   for (const plan of listPlanContracts({ controllerHome, repoId: repository.repoId, status: 'active', limit: 100 })) {
     for (const step of plan.steps) if (step.workId) planByWorkId.set(step.workId, plan.planId);
@@ -934,12 +1060,11 @@ function buildRuntimeMaintenanceAuthoritySnapshot(
   for (const process of listRecoverableProcessRecords(controllerHome, repository.repoId)) {
     if (process.workId && isManagedProcessActive(process) && !processByWorkId.has(process.workId)) processByWorkId.set(process.workId, process.processId);
   }
-  return { contracts, workById, controllerWorkIds, planByWorkId, activeRequirementStateById, scheduleByWorkId, processByWorkId };
+  return { contracts, workById, planByWorkId, activeRequirementStateById, scheduleByWorkId, processByWorkId };
 }
 
 function activeWorkAuthorityRefs(contract: WorkContract, snapshot: RuntimeMaintenanceAuthoritySnapshot): string[] {
   const refs: string[] = [];
-  if (snapshot.controllerWorkIds.has(contract.workId)) refs.push('controller_session');
   const planId = snapshot.planByWorkId.get(contract.workId);
   if (planId) refs.push(`plan:${planId}`);
   if (contract.requirementId) {
@@ -961,7 +1086,7 @@ function scanStaleWorkContractCandidates(
 ): RuntimeMaintenanceCandidate[] {
   const nowMs = Date.now();
   return snapshot.contracts
-    .filter((contract) => !isTerminalWorkContractStatus(contract.status))
+    .filter((contract) => semanticWorkState(contract) === 'open')
     .map((contract) => {
       const updatedMs = Date.parse(contract.updatedAt);
       const ageMinutes = Number.isFinite(updatedMs) ? Math.max(0, Math.floor((nowMs - updatedMs) / 60_000)) : 0;
@@ -969,7 +1094,7 @@ function scanStaleWorkContractCandidates(
     })
     .filter(({ ageMinutes }) => ageMinutes >= options.minAgeMinutes)
     .filter(({ contract }) => {
-      // A live Plan/Requirement/Schedule/Controller/Process reference is lifecycle authority,
+      // A live Plan/Requirement/Schedule/Process reference is retained migration authority,
       // not maintenance debt. The authority inventory was read once for this status pass.
       return activeWorkAuthorityRefs(contract, snapshot).length === 0;
     })
@@ -981,21 +1106,20 @@ function scanStaleWorkContractCandidates(
     }))
     .map(({ contract, ageMinutes, source }) => {
       const legacyRemotePlacement = isLegacyImplicitRemoteEffectPlacement(contract);
-      const semanticReady = staleWorkSemanticTerminalizationReady(contract);
       return {
         kind: 'stale_work_contract' as const,
         id: contract.workId,
         path: source.path,
-        status: contract.status,
-        safe: legacyRemotePlacement ? source.safeToCancel : source.safeToCancel && semanticReady,
-        reason: legacyRemotePlacement ? source.detail : staleWorkCandidateReason(source, semanticReady),
+        status: contract.semanticState,
+        safe: legacyRemotePlacement ? source.safeToCancel : false,
+        reason: legacyRemotePlacement ? source.detail : staleWorkCandidateReason(source),
         ageMinutes,
         suggestedAction: 'full_maintenance_pass' as const,
         ownershipStatus: 'explicit' as const,
         sourceState: source.state,
         disposition: !source.safeToCancel
           ? ('source_preservation_required' as const)
-          : !legacyRemotePlacement && !semanticReady
+          : !legacyRemotePlacement
             ? ('semantic_completion_required' as const)
             : undefined,
       };
@@ -1013,24 +1137,52 @@ function detachLegacyRemoteEffectPlacement(
     return { ...candidate, safe: false, reason: inspection?.detail ?? 'Legacy remote_effect placement is no longer eligible for resource detachment.', sourceState: 'source_state_unknown', disposition: 'source_preservation_required', applied: false, result: 'legacy_remote_effect_placement_preserved' };
   }
   const store = { controllerHome, repoId: repository.repoId };
-  const previous = { checkoutId: current.checkoutId, worktreeRef: current.worktreeRef, constraints: current.constraints, driver: current.driver, worktreePolicy: current.worktreePolicy };
+  try {
+    assertOwnedResourceCleanupTarget(controllerHome, {
+      resourceId: managedWorkspaceOwnedResourceId(repository.repoId, inspection.checkoutId),
+      kind: 'worktree',
+      targetRef: inspection.path,
+    });
+  } catch (error) {
+    return {
+      ...candidate,
+      safe: false,
+      reason: `Canonical OwnedResource authority is required before legacy worktree detachment: ${error instanceof Error ? error.message : String(error)}`,
+      sourceState: 'source_state_unknown',
+      disposition: 'source_preservation_required',
+      applied: false,
+      result: 'legacy_remote_effect_owned_resource_required',
+    };
+  }
+  const previous = { checkoutId: current.checkoutId, worktreeRef: current.worktreeRef, constraints: current.constraints, worktreePolicy: current.worktreePolicy };
   updateWorkContract(store, current.workId, {
     checkoutId: inspection.canonicalCheckoutId,
     worktreeRef: undefined,
-    constraints: { ...current.constraints, workspaceMode: 'auto', requireWorktree: false },
-    driver: { ...current.driver, preferred: 'direct_edit', allowDirectEdit: true },
+    constraints: { ...current.constraints, workspaceMode: 'current' },
     worktreePolicy: { required: false, reason: 'Legacy pure remote_effect repository placement detached by explicit runtime maintenance; external-effect execution has no repository source authority.' },
   });
   try {
     setRepositoryCheckoutLifecycle({ controllerHome, repoId: repository.repoId, checkoutId: inspection.checkoutId, lifecycle: 'removed', reason: `Legacy remote_effect placement detached for ${current.workId}.` });
     const removed = runProcess('git', ['worktree', 'remove', '--force', inspection.path], { cwd: repository.canonicalRoot, timeoutMs: 60_000, maxOutputBytes: 500_000 });
     if (!removed.ok && existsSync(inspection.path)) throw new Error(`LEGACY_REMOTE_EFFECT_WORKTREE_REMOVE_FAILED: ${removed.stderr || removed.stdout}`);
+    markOwnedResourceCleaned(controllerHome, managedWorkspaceOwnedResourceId(repository.repoId, inspection.checkoutId), 'forge:legacy-remote-effect-detach');
     if (inspection.branch !== inspection.canonicalBranch) {
+      try {
+        assertOwnedResourceCleanupTarget(controllerHome, {
+          resourceId: managedBranchOwnedResourceId(repository.repoId, inspection.checkoutId),
+          kind: 'git_branch',
+          targetRef: inspection.branch,
+          locator: managedBranchOwnedResourceLocator(repository.canonicalRoot, inspection.checkoutId, inspection.branch),
+        });
+      } catch {
+        return { ...candidate, safe: true, reason: inspection.detail, sourceState: 'clean_integrated', disposition: undefined, applied: true, result: `legacy_remote_effect_placement_detached_branch_retained:${inspection.branch}` };
+      }
       const deleted = runProcess('git', ['branch', '--delete', inspection.branch], { cwd: repository.canonicalRoot, timeoutMs: 10_000, maxOutputBytes: 100_000 });
       if (!deleted.ok) {
         const forced = runProcess('git', ['branch', '--delete', '--force', inspection.branch], { cwd: repository.canonicalRoot, timeoutMs: 10_000, maxOutputBytes: 100_000 });
         if (!forced.ok) return { ...candidate, safe: true, reason: inspection.detail, sourceState: 'clean_integrated', disposition: undefined, applied: true, result: `legacy_remote_effect_placement_detached_branch_retained:${inspection.branch}` };
       }
+      markOwnedResourceCleaned(controllerHome, managedBranchOwnedResourceId(repository.repoId, inspection.checkoutId), 'forge:legacy-remote-effect-detach');
     }
     return { ...candidate, safe: true, reason: inspection.detail, sourceState: 'clean_integrated', disposition: undefined, applied: true, result: 'legacy_remote_effect_placement_detached' };
   } catch (error) {
@@ -1042,99 +1194,169 @@ function detachLegacyRemoteEffectPlacement(
   }
 }
 
-export function applyStaleWorkContractMaintenanceCandidate(
+function detachOwnedManagedWorktree(
   repository: RuntimeMaintenanceRepository,
   controllerHome: string,
   candidate: RuntimeMaintenanceCandidate,
 ): RuntimeMaintenanceCandidate & { applied: boolean; result: string } {
-  const work = getWorkContract({ controllerHome, repoId: repository.repoId }, candidate.id);
-  if (!work || isTerminalWorkContractStatus(work.status)) {
-    return { ...candidate, applied: false, result: 'already_terminal' };
+  if (!candidate.path) return { ...candidate, applied: false, result: 'owned_managed_worktree_path_missing' };
+  const inspection = inspectOwnedManagedWorktree(repository, controllerHome, candidate.path);
+  if (!inspection.safe || !inspection.workspaceResourceId || !inspection.checkoutId || !inspection.branch || !inspection.canonicalBranch) {
+    return {
+      ...candidate,
+      safe: false,
+      reason: inspection.detail,
+      sourceState: inspection.sourceState,
+      disposition: 'source_preservation_required',
+      applied: false,
+      result: 'owned_managed_worktree_preserved',
+    };
   }
-
-  // The stale scan is discovery only. Re-evaluate every non-Controller authority
-  // while holding the canonical ControllerSession lock, then perform the Work
-  // transition before releasing it. A newer controller_claim therefore either
-  // wins the lock first and fences this mutation, or starts only after an already
-  // completed maintenance terminalization; there is no check-then-cancel gap.
-  const fenced = withControllerSessionTerminalizationFence(
-    { controllerHome, repoId: repository.repoId },
-    { workId: work.workId, actor: `runtime-maintenance-terminalize:${work.workId}` },
-    () => {
-      const current = getWorkContract({ controllerHome, repoId: repository.repoId }, work.workId);
-      if (!current || isTerminalWorkContractStatus(current.status)) {
-        return { ...candidate, applied: false, result: 'already_terminal' };
-      }
-      const authorityRefs = activeWorkAuthorityRefs(current, buildRuntimeMaintenanceAuthoritySnapshot(repository, controllerHome));
-      if (authorityRefs.length > 0) {
+  try {
+    setRepositoryCheckoutLifecycle({
+      controllerHome,
+      repoId: repository.repoId,
+      checkoutId: inspection.checkoutId,
+      lifecycle: 'removed',
+      reason: 'Canonical OwnedResource cleanup reconciled a WorkContract-less managed worktree whose source is already integrated.',
+    });
+    const removed = runProcess('git', ['worktree', 'remove', '--force', inspection.path], {
+      cwd: repository.canonicalRoot,
+      timeoutMs: 60_000,
+      maxOutputBytes: 500_000,
+    });
+    if (!removed.ok && existsSync(inspection.path)) {
+      throw new Error(`OWNED_MANAGED_WORKTREE_REMOVE_FAILED: ${removed.stderr || removed.stdout}`);
+    }
+    markOwnedResourceCleaned(controllerHome, inspection.workspaceResourceId, 'forge:runtime-maintenance-owned-worktree');
+    if (inspection.branch !== inspection.canonicalBranch) {
+      try {
+        assertOwnedResourceCleanupTarget(controllerHome, {
+          resourceId: managedBranchOwnedResourceId(repository.repoId, inspection.checkoutId),
+          kind: 'git_branch',
+          targetRef: inspection.branch,
+          locator: managedBranchOwnedResourceLocator(repository.canonicalRoot, inspection.checkoutId, inspection.branch),
+        });
+      } catch {
         return {
           ...candidate,
-          applied: false,
-          result: `work_authority_became_active:${authorityRefs.join(',')}`,
+          safe: true,
+          reason: inspection.detail,
+          sourceState: 'clean_integrated',
+          disposition: undefined,
+          applied: true,
+          result: `owned_managed_worktree_detached_branch_retained:${inspection.branch}`,
         };
       }
-      // Discovery and mutation are separated by an arbitrary Controller/MCP delay.
-      // Re-probe the live worktree while the canonical ControllerSession fence is
-      // held so neither a newer Controller claim nor a late source write can be
-      // raced by stale maintenance terminalization.
-      const source = inspectStaleWorkRepositorySource(repository, controllerHome, current);
-      if (!source.safeToCancel) {
+      const deleted = runProcess('git', ['branch', '--delete', inspection.branch], {
+        cwd: repository.canonicalRoot,
+        timeoutMs: 10_000,
+        maxOutputBytes: 100_000,
+      });
+      if (!deleted.ok) {
+        const forced = runProcess('git', ['branch', '--delete', '--force', inspection.branch], {
+          cwd: repository.canonicalRoot,
+          timeoutMs: 10_000,
+          maxOutputBytes: 100_000,
+        });
+        if (!forced.ok) {
+          return {
+            ...candidate,
+            safe: true,
+            reason: inspection.detail,
+            sourceState: 'clean_integrated',
+            disposition: undefined,
+            applied: true,
+            result: `owned_managed_worktree_detached_branch_retained:${inspection.branch}`,
+          };
+        }
+      }
+      markOwnedResourceCleaned(
+        controllerHome,
+        managedBranchOwnedResourceId(repository.repoId, inspection.checkoutId),
+        'forge:runtime-maintenance-owned-worktree',
+      );
+    }
+    return {
+      ...candidate,
+      safe: true,
+      reason: inspection.detail,
+      sourceState: 'clean_integrated',
+      disposition: undefined,
+      applied: true,
+      result: 'owned_managed_worktree_detached',
+    };
+  } catch (error) {
+    if (existsSync(inspection.path)) {
+      try {
+        setRepositoryCheckoutLifecycle({
+          controllerHome,
+          repoId: repository.repoId,
+          checkoutId: inspection.checkoutId,
+          lifecycle: 'active',
+          reason: 'Rollback failed OwnedResource managed-worktree cleanup.',
+        });
+      } catch { /* preserve primary failure */ }
+    }
+    throw error;
+  }
+}
+
+export function applyStaleWorkContractMaintenanceCandidate(
+  repository: RuntimeMaintenanceRepository,
+  controllerHome: string,
+  candidate: RuntimeMaintenanceCandidate,
+): RuntimeMaintenanceCandidate & { applied: boolean; result: string } {
+  const work = getWorkContract({ controllerHome, repoId: repository.repoId }, candidate.id);
+  if (!work || semanticWorkState(work) !== 'open') {
+    return { ...candidate, applied: false, result: 'already_terminal' };
+  }
+
+  // The stale scan is discovery only. Re-read the exact Work and every
+  // non-Controller authority immediately before mutation. WorkContract writes are
+  // serialized by the canonical Work store writer; ControllerSession ownership is
+  // continuation state and cannot fence maintenance of semantic Work.
+  const current = getWorkContract({ controllerHome, repoId: repository.repoId }, work.workId);
+  if (!current || semanticWorkState(current) !== 'open') {
+    return { ...candidate, applied: false, result: 'already_terminal' };
+  }
+  const authorityRefs = activeWorkAuthorityRefs(current, buildRuntimeMaintenanceAuthoritySnapshot(repository, controllerHome));
+  if (authorityRefs.length > 0) {
+    return {
+      ...candidate,
+      applied: false,
+      result: `work_authority_became_active:${authorityRefs.join(',')}`,
+    };
+  }
+  // Discovery and mutation are separated by an arbitrary Runtime delay.
+  // Re-probe the live worktree immediately before mutation; concrete Git/worktree
+  // state is the relevant safety authority, not a Controller claim.
+  const source = inspectStaleWorkRepositorySource(repository, controllerHome, current);
+  if (!source.safeToCancel) {
         return {
           ...candidate,
           path: source.path ?? candidate.path,
           safe: false,
-          reason: isLegacyImplicitRemoteEffectPlacement(current) ? source.detail : staleWorkCandidateReason(source, staleWorkSemanticTerminalizationReady(current)),
+          reason: isLegacyImplicitRemoteEffectPlacement(current) ? source.detail : staleWorkCandidateReason(source),
           sourceState: source.state,
           disposition: 'source_preservation_required' as const,
           applied: false,
           result: `work_source_preserved:${source.state}`,
         };
       }
-      if (isLegacyImplicitRemoteEffectPlacement(current)) {
+  if (isLegacyImplicitRemoteEffectPlacement(current)) {
         return detachLegacyRemoteEffectPlacement(repository, controllerHome, current, candidate);
       }
-      const semanticReady = staleWorkSemanticTerminalizationReady(current);
-      if (!semanticReady) {
-        return {
-          ...candidate,
-          path: source.path ?? candidate.path,
-          safe: false,
-          reason: staleWorkCandidateReason(source, false),
-          sourceState: source.state,
-          disposition: 'semantic_completion_required' as const,
-          applied: false,
-          result: 'work_semantic_completion_required',
-        };
-      }
-      cancelWorkContract(
-        { controllerHome, repoId: repository.repoId },
-        current.workId,
-        {
-          summary: 'Cancelled by explicit full maintenance after the Work had already reached cleanup with prior semantic phases satisfied and no unique live repository source remained; durable evidence retained.',
-          evidenceRefs: current.evidenceRefs,
-        },
-      );
-      return {
-        ...candidate,
-        path: source.path ?? candidate.path,
-        safe: true,
-        reason: staleWorkCandidateReason(source, true),
-        sourceState: source.state,
-        disposition: undefined,
-        applied: true,
-        result: 'work_contract_cancelled_evidence_retained',
-      };
-    },
-  );
-  if (!fenced.allowed) {
-    const generation = fenced.owner?.claimGeneration;
-    return {
-      ...candidate,
-      applied: false,
-      result: `work_terminalization_fenced:${fenced.reason}${typeof generation === 'number' ? `:claim_generation=${generation}` : ''}`,
-    };
-  }
-  return fenced.value;
+  return {
+    ...candidate,
+    path: source.path ?? candidate.path,
+    safe: false,
+    reason: staleWorkCandidateReason(source),
+    sourceState: source.state,
+    disposition: 'semantic_completion_required' as const,
+    applied: false,
+    result: 'work_semantic_completion_required',
+  };
 }
 
 function scanStaleEditSessionCandidates(
@@ -1157,7 +1379,7 @@ function scanStaleEditSessionCandidates(
     .slice(0, options.maxCandidates)
     .flatMap(({ session, ageMinutes }) => {
       const work = session.workId ? snapshot.workById.get(session.workId) : undefined;
-      const terminalWork = Boolean(work && isTerminalWorkContractStatus(work.status));
+      const terminalWork = Boolean(work && semanticWorkState(work) !== 'open');
       if (work && !terminalWork && activeWorkAuthorityRefs(work, snapshot).length > 0) {
         // The Edit Session inherits the live Work lifecycle authority. Reporting it
         // as stale maintenance debt while that authority is active would duplicate
@@ -1269,7 +1491,7 @@ export function buildRuntimeMaintenanceStatus(
       'Pending approvals are not cancelled unless cancel_pending_approvals is explicitly enabled.',
       'System temp cleanup only removes direct forge-prefixed children of approved temp roots after a 24-hour retention period and a fresh process-occupancy check.',
       'Runtime lifecycle changes and source repair are outside the runtime maintenance executor.',
-      'Retained or unowned managed worktrees are review-only lifecycle blockers. Runtime maintenance never deletes or modifies their preserved implementation state.',
+      'Retained or unknown-ownership managed worktrees remain review-only lifecycle blockers. A WorkContract-less managed worktree is cleanup-eligible only when canonical OwnedResource identity is exact, the worktree is clean, and its HEAD is already contained in the canonical branch.',
     ],
   };
 }
@@ -1482,6 +1704,9 @@ export function applyRuntimeMaintenance(
       if (candidate.kind === 'stale_work_contract') {
         return applyStaleWorkContractMaintenanceCandidate(repository, controllerHome, candidate);
       }
+      if (candidate.kind === 'unowned_managed_worktree') {
+        return detachOwnedManagedWorktree(repository, controllerHome, candidate);
+      }
       if (candidate.kind === 'stale_edit_session') {
         const cleaned = cleanupEditSession(repository.canonicalRoot, candidate.id, {
           reviewer: 'runtime-maintenance',
@@ -1506,7 +1731,7 @@ export function applyRuntimeMaintenance(
     : undefined;
   const currentWork = readWorkContractStore({ controllerHome, repoId: repository.repoId }).contracts;
   const protectedWorkIds = currentWork
-    .filter((contract) => !isTerminalWorkContractStatus(contract.status))
+    .filter((contract) => semanticWorkState(contract) === 'open')
     .map((contract) => contract.workId);
   const verificationSnapshotGc = options.actionId === 'full_maintenance_pass'
     ? cleanupStaleWorkVerificationSnapshots(controllerHome, repository.repoId, {
@@ -1522,6 +1747,30 @@ export function applyRuntimeMaintenance(
       additionalRoots: [runtimeLegacyCheckQuarantineRoot(controllerHome, repository.repoId)],
     })
     : undefined;
+  let generatedCacheGc: RepositoryGeneratedCacheRetentionReport | undefined;
+  let cleanupArtifactGc: CleanupArtifactRetentionReport | undefined;
+  if (options.actionId === 'full_maintenance_pass') {
+    let cacheRepository: Parameters<typeof cleanupGeneratedRepositoryCheckoutCaches>[0] = {
+      canonicalRoot: repository.canonicalRoot,
+      checkouts: [],
+    };
+    try {
+      cacheRepository = getRepository(repository.repoId, controllerHome, { includeRemoved: true });
+    } catch {
+      // Embedded/test repositories may not be present in the Controller registry.
+      // The explicit maintenance action still safely covers their canonical root.
+    }
+    generatedCacheGc = cleanupGeneratedRepositoryCheckoutCaches(cacheRepository, {
+      graceMs: 60_000,
+      maxEntries: Math.max(1_000, (options.maxCandidates ?? 50) * 20),
+      maxRemovals: Math.max(1, options.maxCandidates ?? 50),
+    });
+    cleanupArtifactGc = cleanupWorkPreservationArtifacts(controllerHome, {
+      maxEntries: Math.max(1_000, (options.maxCandidates ?? 50) * 20),
+      maxRemovals: Math.max(1, options.maxCandidates ?? 50),
+      repositoryIds: [repository.repoId],
+    });
+  }
 
   if (options.actionId === 'runtime_storage_finalize_relocation' || options.actionId === 'full_maintenance_pass' || applied.some((candidate) => candidate.applied) || runtimeStorageRepairApply) {
     rebuildActiveIndex(repository.canonicalRoot);
@@ -1541,6 +1790,8 @@ export function applyRuntimeMaintenance(
     processGc,
     verificationSnapshotGc,
     quarantineGc,
+    generatedCacheGc,
+    cleanupArtifactGc,
     projection,
   };
 }