@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/execution/process-runtime/runtime.ts

@@ -31,6 +31,8 @@ import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
 import { capProcessOutput } from '../../../effects/process-runner';
 import { getRepository, selectRepositoryCheckout } from '../../../cli/repositories/registry';
+import { recordProcessHandleIndexEntry } from './handle-index';
+import { processScopeExecutionTarget, processScopeFromKey } from './process-scope';
 import { redactSensitiveText, sanitizeSensitiveTextFileInPlace } from '../../evidence/sensitive-output';
 import { isProcessAlive, terminateProcessTree } from '../../shared/process-tree';
 import { repositoryChildProcessEnvironment, resolveBunExecutable } from '../../shared/process-environment';
@@ -1224,6 +1226,7 @@ export async function spawnManagedProcess(input: SpawnManagedProcessInput): Prom
     processId,
     repoId: input.repoId,
     checkoutId: input.checkoutId,
+    ...(input.principalId ? { principalId: input.principalId } : {}),
     workId: input.workId,
     executionIdentity: input.executionIdentity,
     commandId: input.commandId?.trim() || processId,
@@ -1253,6 +1256,16 @@ export async function spawnManagedProcess(input: SpawnManagedProcessInput): Prom
     logPath: stdoutPath,
   };
   createProcessRecord(record);
+  // Instance-level locator so attachment resolves the target from the handle
+  // instead of replaying placement inputs or scanning repository partitions.
+  recordProcessHandleIndexEntry(input.controllerHome, {
+    processId,
+    lane: 'managed',
+    target: processScopeExecutionTarget(input.controllerHome, processScopeFromKey(input.repoId)),
+    principalId: input.principalId,
+    workId: input.workId,
+    commandId: record.commandId,
+  });
 
   if (input.signal?.aborted) {
     completeProcessFromEvidence(input.controllerHome, input.repoId, processId, fenceToken, {
@@ -1489,6 +1502,7 @@ export async function spawnManagedProcess(input: SpawnManagedProcessInput): Prom
     repoId: input.repoId,
     controllerHome: input.controllerHome,
     command,
+    ...(input.trustedRuntimeChild ? { trustedRuntimeChild: input.trustedRuntimeChild } : {}),
     timeoutMs,
     maxStdoutBytes: maxOutputBytes,
     maxStderrBytes: maxOutputBytes,
@@ -1570,17 +1584,19 @@ export async function spawnManagedProcess(input: SpawnManagedProcessInput): Prom
   }
 
   const completed = await new Promise<ManagedProcessRecord | 'timeout'>((resolve) => {
-    const timer = setTimeout(() => resolve('timeout'), interactiveWaitMs);
-    timer.unref?.();
-    monitor.waiters.push((done) => {
+    const finish = (done: ManagedProcessRecord | 'timeout') => {
       clearTimeout(timer);
+      const index = monitor.waiters.indexOf(finish);
+      if (index >= 0) monitor.waiters.splice(index, 1);
       resolve(done);
-    });
+    };
+    const timer = setTimeout(() => finish('timeout'), interactiveWaitMs);
+    timer.unref?.();
+    monitor.waiters.push(finish);
     if (monitor.settled) {
       const current = getProcessRecord(input.controllerHome, input.repoId, processId);
       if (current?.terminalWritten) {
-        clearTimeout(timer);
-        resolve(current);
+        finish(current);
       }
     }
   });
@@ -1627,6 +1643,18 @@ function applyReceiptIfPresent(
   }, { authority: 'durable_exit_receipt' });
 }
 
+
+function reconcileObservedTerminalProcess(
+  controllerHome: string,
+  repoId: string,
+  record: ManagedProcessRecord,
+): ManagedProcessRecord {
+  if (record.terminalWritten !== true) return record;
+  const reconciled = releaseProcessLeasesOnce(controllerHome, repoId, record.processId) ?? record;
+  cleanupTerminalRunnerReceipts(reconciled);
+  return reconciled;
+}
+
 export function getProcessHandle(
   controllerHome: string,
   repoId: string,
@@ -1634,6 +1662,9 @@ export function getProcessHandle(
 ): ProcessHandle | undefined {
   const record = getProcessRecord(controllerHome, repoId, processId);
   if (!record) return undefined;
+  if (record.terminalWritten === true) {
+    return recordToHandle(reconcileObservedTerminalProcess(controllerHome, repoId, record), { completed: true });
+  }
   if (isManagedProcessActive(record) && !liveMonitors.has(processId)) {
     const fromReceipt = applyReceiptIfPresent(controllerHome, repoId, processId, record);
     if (fromReceipt) return recordToHandle(fromReceipt, { completed: true });
@@ -1656,33 +1687,37 @@ export async function waitForProcess(
 ): Promise<ProcessHandle> {
   const existing = getProcessRecord(controllerHome, repoId, processId);
   if (!existing) throw new Error(`PROCESS_NOT_FOUND: ${processId}`);
-  if (existing.terminalWritten) return recordToHandle(existing, { completed: true });
+  if (existing.terminalWritten) {
+    return recordToHandle(reconcileObservedTerminalProcess(controllerHome, repoId, existing), { completed: true });
+  }
 
   const monitor = liveMonitors.get(processId);
   if (monitor) {
     const waitMs = options.timeoutMs ?? existing.timeoutMs;
     const done = await new Promise<ManagedProcessRecord | 'timeout'>((resolve) => {
-      const timer = setTimeout(() => resolve('timeout'), Math.max(1, waitMs));
+      const finish = (record: ManagedProcessRecord | 'timeout') => {
+        clearTimeout(timer);
+        options.signal?.removeEventListener('abort', onAbort);
+        const index = monitor.waiters.indexOf(finish);
+        if (index >= 0) monitor.waiters.splice(index, 1);
+        resolve(record);
+      };
+      const timer = setTimeout(() => finish('timeout'), Math.max(1, waitMs));
       timer.unref?.();
       const onAbort = () => {
         clearTimeout(timer);
         void cancelProcess(controllerHome, repoId, processId).then(() => {
           const current = getProcessRecord(controllerHome, repoId, processId);
-          if (current) resolve(current);
-          else resolve('timeout');
+          if (current) finish(current);
+          else finish('timeout');
         });
       };
       options.signal?.addEventListener('abort', onAbort, { once: true });
-      monitor.waiters.push((record) => {
-        clearTimeout(timer);
-        options.signal?.removeEventListener('abort', onAbort);
-        resolve(record);
-      });
+      monitor.waiters.push(finish);
       if (monitor.settled) {
         const current = getProcessRecord(controllerHome, repoId, processId);
         if (current?.terminalWritten) {
-          clearTimeout(timer);
-          resolve(current);
+          finish(current);
         }
       }
     });
@@ -1744,7 +1779,9 @@ export async function cancelProcess(
 ): Promise<ProcessHandle> {
   const record = getProcessRecord(controllerHome, repoId, processId);
   if (!record) throw new Error(`PROCESS_NOT_FOUND: ${processId}`);
-  if (record.terminalWritten) return recordToHandle(record, { completed: true });
+  if (record.terminalWritten) {
+    return recordToHandle(reconcileObservedTerminalProcess(controllerHome, repoId, record), { completed: true });
+  }
 
   // Process control is itself a writer mutation. Fence BEFORE sending any
   // signal so a passive/stale runtime cannot kill the active runtime's work.

package/src/runtime/execution/process-runtime/store.ts

@@ -19,6 +19,8 @@ import { basename, dirname, join } from 'path';
 import { ensureRepositoryControllerLayout, repositoryControllerRoot } from '../../../cli/repositories/controller-home';
 import { mutateControlPlaneRecord, readOrImportControlPlaneRecord } from '../../control-plane/persistence/sqlite-store';
 import { isSensitiveOutputKey, redactSensitiveText } from '../../evidence/sensitive-output';
+import { touchSchedulerWakeSignal } from '../../control-plane/global-scheduler/wake-signal';
+import { isRepositoryProcessScopeKey, legacyWorkspaceScopeRoot, processScopeRoot } from './process-scope';
 import {
   isManagedProcessActive,
   isManagedProcessTerminal,
@@ -30,7 +32,12 @@ import {
 } from './types';
 
 function processesRoot(controllerHome: string, repoId: string): string {
-  const root = ensureRepositoryControllerLayout(controllerHome, repoId);
+  // Repository scopes keep the established per-repository layout. Instance and
+  // workspace scopes own sibling partitions so a non-repository process never
+  // needs a synthetic repository identity or repository storage.
+  const root = isRepositoryProcessScopeKey(repoId)
+    ? ensureRepositoryControllerLayout(controllerHome, repoId)
+    : processScopeRoot(controllerHome, repoId);
   const dir = join(root, 'processes');
   mkdirSync(dir, { recursive: true });
   mkdirSync(join(dir, 'logs'), { recursive: true });
@@ -522,7 +529,13 @@ export function getProcessRecord(
   repoId: string,
   processId: string,
 ): ManagedProcessRecord | undefined {
-  return readProcessRecord(processPath(controllerHome, repoId, processId));
+  const current = readProcessRecord(processPath(controllerHome, repoId, processId));
+  if (current) return current;
+  // Bounded migration read: workspace processes written before the workspace
+  // partition existed are still attachable instead of being reported missing.
+  const legacyRoot = legacyWorkspaceScopeRoot(controllerHome, repoId);
+  if (!legacyRoot) return undefined;
+  return readProcessRecord(join(legacyRoot, 'processes', `${processId}.json`));
 }
 
 /**
@@ -559,6 +572,21 @@ export function tryCompleteProcessRecord(
   const sanitized = sanitizeProcessRecord(next).record;
   atomicWrite(path, sanitized);
   updateRecoveryIndexMembership(controllerHome, repoId, processId, processRecoveryMembership(sanitized));
+  // Terminal Process persistence remains the lifecycle authority. The scheduler
+  // notification is emitted only after durable terminal state exists, and only
+  // for Check-backed Processes whose receipts can unblock Work/Edit validation.
+  // Notification failure must never reinterpret or roll back the terminal CAS;
+  // the explicit schedule deadline still provides a bounded observation path.
+  if (sanitized.checkExecution || sanitized.origin?.surface === 'check' || sanitized.origin?.checkId) {
+    try {
+      touchSchedulerWakeSignal(controllerHome, `check-process-terminal:${processId}`);
+    } catch (error) {
+      console.error(
+        `[forge scheduler] Check Process terminal wake failed for ${processId}:`,
+        error instanceof Error ? error.message : String(error),
+      );
+    }
+  }
   return { ok: true, record: sanitized };
 }
 

package/src/runtime/execution/process-runtime/types.ts

@@ -17,7 +17,6 @@ export interface ExecutionConcurrencyWaitProjection {
   wakeTrigger:
     | { kind: 'work_terminal'; workId: string }
     | { kind: 'resource_release'; resourceKeys: string[] }
-    | { kind: 'controller_release'; workId: string }
     | { kind: 'scheduler_capacity'; capacityKey: string }
     | { kind: 'work_contract_change'; workId: string };
   observedAt: string;
@@ -186,6 +185,8 @@ export interface ManagedProcessRecord {
   processId: string;
   repoId: string;
   checkoutId?: string;
+  /** Authenticated principal that owns the handle; opaque ids never authorize by themselves. */
+  principalId?: string;
   /** Optional facade WorkContract that owns this command. */
   workId?: string;
   /** Immutable pre-spawn authority required for post-terminal Work reconciliation. */
@@ -288,6 +289,8 @@ export interface SpawnManagedProcessInput {
   controllerHome: string;
   repoId: string;
   checkoutId?: string;
+  /** Authenticated principal recorded for principal-bound attachment. */
+  principalId?: string;
   /** Immutable resolved execution identity — required; validated immediately before spawn. */
   executionIdentity: ResolvedExecutionIdentity;
   workId?: string;
@@ -306,6 +309,8 @@ export interface SpawnManagedProcessInput {
   resourceClaims?: ProcessResourceClaim[];
   checkExecution?: ProcessCheckExecutionIdentity;
   origin?: ManagedProcessRecord['origin'];
+  /** Runtime-owned child allowed to rebind only the exact current Runtime write authority. */
+  trustedRuntimeChild?: 'plugin_action_sidecar';
   runtimeInstanceId?: string;
   releaseAuthorityRevision?: number;
   releaseId?: string;

package/src/runtime/execution/thin-harness/execution-router.ts

@@ -317,7 +317,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
   }
 
   if (commandLooksDestructive(input.command) || operation.includes('destructive')) {
-    if (input.approvalContinuation === true && operation === 'repository_command_execute') {
+    if (input.approvalContinuation === true && operation === 'execute_command') {
       return decisionBase({
         mode: 'durable',
         reasons: ['destructive_approval_continuation'],
@@ -325,7 +325,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
         estimatedClass: 'unknown',
         requiresIsolation: true,
         requiresRecovery: false,
-        suggestedOperation: 'repository_command_execute through Durable Work / Local Job',
+        suggestedOperation: 'execute_command through Durable Work / Local Job',
         effects: {
           readsWorkspace: true,
           mutatesWorkspace: true,
@@ -342,7 +342,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
       requiresIsolation: true,
       requiresRecovery: false,
       rejectCode: 'DESTRUCTIVE_REJECTED',
-      suggestedOperation: 'repository_command_preview + explicit strong confirmation via Durable Work',
+      suggestedOperation: 'execute_command(dry_run=true) + explicit strong confirmation via Durable Work',
       effects: {
         readsWorkspace: true,
         mutatesWorkspace: true,
@@ -381,7 +381,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
 
   let commandEffectsValue: ExecutionEffects | undefined;
 
-  if (operation === 'repository_command_execute' || operation === 'run_short_command' || operation === 'run_focused_check') {
+  if (operation === 'execute_command' || operation === 'run_short_command' || operation === 'run_focused_check') {
     if (input.command !== undefined) {
       const classification = classifyRepositoryCommand(input.command, input.defaultBranch);
       const canonical = normalizeRepositoryCommand(input.command);
@@ -401,7 +401,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
           requiresIsolation: true,
           requiresRecovery: false,
           rejectCode: 'UNSAFE_SHELL',
-          suggestedOperation: 'repository_command_preview',
+          suggestedOperation: 'execute_command(dry_run=true)',
           effects: commandEffectsValue,
         }, operation);
       }
@@ -411,7 +411,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
       }
       if (classification.risk === 'remote_write') reasons.push('command_classified_remote_write');
       if (classification.risk === 'destructive') {
-        if (input.approvalContinuation === true && operation === 'repository_command_execute') {
+        if (input.approvalContinuation === true && operation === 'execute_command') {
           return decisionBase({
             mode: 'durable',
             reasons: ['destructive_approval_continuation', ...classification.reasons],
@@ -419,7 +419,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
             estimatedClass: 'unknown',
             requiresIsolation: true,
             requiresRecovery: false,
-            suggestedOperation: 'repository_command_execute through Durable Work / Local Job',
+            suggestedOperation: 'execute_command through Durable Work / Local Job',
             effects: commandEffectsValue,
           }, operation);
         }
@@ -431,7 +431,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
           requiresIsolation: true,
           requiresRecovery: false,
           rejectCode: 'DESTRUCTIVE_COMMAND',
-          suggestedOperation: 'repository_command_preview',
+          suggestedOperation: 'execute_command(dry_run=true)',
           effects: commandEffectsValue,
         }, operation);
       }
@@ -440,14 +440,14 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
         reasons.push('not_a_strict_focused_check');
       }
       if (classification.risk === 'workspace_write' && !focused && !safeShellCombo) {
-        if (operation === 'repository_command_execute' || operation === 'run_short_command' || operation === 'run_focused_check') {
+        if (operation === 'execute_command' || operation === 'run_short_command' || operation === 'run_focused_check') {
           reasons.push('mutating_or_unfocused_command');
         }
       }
       if (classification.risk !== 'readonly' && !focused && !safeShellCombo && !FAST_OPERATIONS.has(operation)) {
         reasons.push('untrusted_or_unclassified_command');
       }
-    } else if (operation === 'repository_command_execute' || operation === 'run_focused_check') {
+    } else if (operation === 'execute_command' || operation === 'run_focused_check') {
       reasons.push('missing_command');
     }
   }
@@ -564,7 +564,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
     }, operation);
   }
 
-  if (!FAST_OPERATIONS.has(operation) && operation !== 'repository_command_execute') {
+  if (!FAST_OPERATIONS.has(operation) && operation !== 'execute_command') {
     return decisionBase({
       mode: 'durable',
       reasons: ['operation_not_in_fast_allowlist'],
@@ -576,7 +576,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
     }, operation);
   }
 
-  if (operation === 'repository_command_execute' || operation === 'run_short_command' || operation === 'run_focused_check') {
+  if (operation === 'execute_command' || operation === 'run_short_command' || operation === 'run_focused_check') {
     if (input.command === undefined) {
       return decisionBase({
         mode: 'durable',
@@ -585,7 +585,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
         estimatedClass: 'unknown',
         requiresIsolation: false,
         requiresRecovery: false,
-        suggestedOperation: 'repository_command_execute via Durable Work',
+        suggestedOperation: 'execute_command via Durable Work',
       }, operation);
     }
     const classification = classifyRepositoryCommand(input.command, input.defaultBranch);
@@ -602,7 +602,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
         estimatedClass: 'long',
         requiresIsolation: false,
         requiresRecovery: false,
-        suggestedOperation: 'repository_command_execute via Durable Work / Local Job',
+        suggestedOperation: 'execute_command via Durable Work / Local Job',
         effects,
       }, operation);
     }
@@ -632,7 +632,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
       estimatedClass: 'long',
       requiresIsolation: false,
       requiresRecovery: false,
-      suggestedOperation: 'repository_command_execute via Durable Work / Local Job',
+      suggestedOperation: 'execute_command via Durable Work / Local Job',
       effects,
     }, operation);
   }
@@ -673,7 +673,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
 function durableSuggestion(operation: string): string {
   if (operation === 'run_check' || operation === 'run_focused_check') return 'run_check through Durable Work';
   if (operation.includes('patch')) return 'repository_safe_patch_apply with apply_mode=async or Durable Work';
-  if (operation.includes('command')) return 'repository_command_execute through Durable Work / Local Job';
+  if (operation.includes('command')) return 'execute_command through Durable Work / Local Job';
   if (operation.includes('agent') || operation === 'quick_agent_session') return 'quick_agent_session / dispatch_task';
   return 'Durable Work (ExecutionJob path)';
 }

package/src/runtime/execution/thin-harness/fast-executor.ts

@@ -6,7 +6,7 @@ import {
   previewRepositoryCommandExecutionAsync,
   type RepositoryCommandSnapshot,
 } from '../../../cli/repositories/command-executor';
-import { getMcpPolicy } from '../../../cli/mcp/policy';
+import { getMcpPolicy } from '../../../../adapters/mcp/policy';
 import { readRepositoryRange } from '../../../cli/repository/inspector';
 import type { RepositoryRecord } from '../../../cli/repositories/types';
 import { getLeaseSideEffectMetrics } from '../../resources/leases/store';
@@ -878,7 +878,7 @@ export async function executeFast(
       } else if (
         operation === 'run_short_command'
         || operation === 'run_focused_check'
-        || operation === 'repository_command_execute'
+        || operation === 'execute_command'
       ) {
         const command = request.input.command as string | string[];
         const preview = await trace.measure('policyMs', async () => previewRepositoryCommandExecutionAsync(ctx.repository, {

package/src/runtime/execution/thin-harness/search-worker.ts

@@ -4,8 +4,8 @@
  */
 import { isMainThread, parentPort, workerData, Worker } from 'worker_threads';
 import { fileURLToPath } from 'url';
-import { getMcpPolicy } from '../../../cli/mcp/policy';
-import type { McpPolicy } from '../../../cli/mcp/types';
+import { getMcpPolicy } from '../../../../adapters/mcp/policy';
+import type { McpPolicy } from '../../../../adapters/mcp/types';
 import {
   searchRepository,
   searchRepositoryMany,

package/src/runtime/execution/workers/executor.ts

@@ -29,7 +29,6 @@ import { existsSync } from 'fs';
 import { isAbsolute, relative, resolve, sep } from 'path';
 import { isAssistantPluginError } from '../../plugins/errors';
 import { executeWork, validateWork } from '../../control-plane/execution/work-operation-service';
-import { finalizeWork } from '../../control-plane/execution/work-finalization-service';
 import { describeFailure } from '../../../../packages/protocols/failure';
 
 
@@ -519,14 +518,12 @@ export async function executeExecutionJob(controllerHome: string, job: Execution
       ...context,
       controllerHome,
       explicitRepository: repository,
-      toolset: job.payload.toolset === 'core' || job.payload.toolset === 'full' ? job.payload.toolset : 'advanced',
-      toolsetLocked: true,
+      toolset: 'full',
     };
     // Durable Work mutations execute through control-plane application services.
     // The Worker must never import MCP transport to obtain Work semantics.
     const durableWorkOperation = job.payload.operation === 'work_execute'
-      || job.payload.operation === 'work_validate'
-      || job.payload.operation === 'work_finalize';
+      || job.payload.operation === 'work_validate';
     const toolArguments = { ...(job.payload.arguments ?? {}) };
     const workArguments = {
       ...toolArguments,
@@ -537,9 +534,7 @@ export async function executeExecutionJob(controllerHome: string, job: Execution
       ? await executeWork(runtimeContext, workArguments)
       : job.payload.operation === 'work_validate'
         ? await validateWork(runtimeContext, workArguments)
-        : job.payload.operation === 'work_finalize'
-          ? await finalizeWork(runtimeContext, workArguments)
-          : undefined;
+        : undefined;
     const executionResult: CallToolResult | undefined = durableWorkOperation && executionRecord
       ? { structuredContent: executionRecord, content: [] }
       : undefined;

package/src/runtime/maintenance/cleanup.ts

@@ -88,12 +88,42 @@ function isSafeForgeTemp(path: string): boolean {
   const name = basename(path);
   if (!name.startsWith('forge')) return false;
   const parent = dirname(path);
-  const allowedParents = new Set([resolve(tmpdir()), '/private/tmp', '/tmp']);
-  return allowedParents.has(resolve(parent));
+  const allowedParents = new Set([tmpdir(), '/private/tmp', '/tmp'].filter((root) => existsSync(root)).map((root) => realpathSync(root)));
+  try { return allowedParents.has(realpathSync(parent)); } catch { return false; }
+}
+
+// Temp cleanup cannot dispose of a Git worktree just because its directory
+// begins with "forge". Bounded traversal fails closed on nested repositories,
+// symlinks and uninspectable or high-cardinality source.
+function protectsGitSource(root: string): boolean {
+  const pending: Array<{ path: string; depth: number }> = [{ path: root, depth: 0 }];
+  let visited = 0;
+  while (pending.length > 0) {
+    const current = pending.pop()!;
+    if (++visited > 256) return true;
+    try {
+      const stat = lstatSync(current.path);
+      if (stat.isSymbolicLink()) return true;
+      if (!stat.isDirectory()) continue;
+      if (existsSync(join(current.path, '.git'))
+        || (existsSync(join(current.path, 'HEAD')) && existsSync(join(current.path, 'objects')) && existsSync(join(current.path, 'refs')))) return true;
+      const entries = readdirSync(current.path, { withFileTypes: true });
+      if (entries.length + visited > 256) return true;
+      for (const entry of entries) {
+        if (entry.isSymbolicLink()) return true;
+        if (!entry.isDirectory()) continue;
+        if (current.depth >= 5) return true;
+        pending.push({ path: join(current.path, entry.name), depth: current.depth + 1 });
+      }
+    } catch {
+      return true;
+    }
+  }
+  return false;
 }
 
 function scanTempDirs(minAgeMinutes: number, limit: number): RuntimeCleanupCandidate[] {
-  const roots = Array.from(new Set([tmpdir(), '/private/tmp', '/tmp'].filter((root) => existsSync(root)).map((root) => resolve(root))));
+  const roots = Array.from(new Set([tmpdir(), '/private/tmp', '/tmp'].filter((root) => existsSync(root)).map((root) => realpathSync(root))));
   const processes = processCommands();
   const at = Date.now();
   const candidates: RuntimeCleanupCandidate[] = [];
@@ -108,11 +138,14 @@ function scanTempDirs(minAgeMinutes: number, limit: number): RuntimeCleanupCandi
         if (!stat.isDirectory()) continue;
         const occupied = processes.find((process) => process.command.includes(path));
         const ageMinutes = Math.max(0, Math.round((at - stat.mtimeMs) / 60_000));
-        const safe = !occupied && ageMinutes >= minAgeMinutes;
+        const gitSourceProtected = protectsGitSource(path);
+        const safe = !occupied && ageMinutes >= minAgeMinutes && !gitSourceProtected;
         candidates.push({
           kind: 'temp_dir',
           path,
-          reason: safe
+          reason: gitSourceProtected
+            ? 'Git worktree, repository, symlink or uninspectable source is protected; use its Work/Git owner.'
+            : safe
             ? `Forge temp directory is older than ${minAgeMinutes} minutes and not referenced by a running process.`
             : 'Temp directory is too new or still referenced by a running process.',
           ageMinutes,
@@ -368,6 +401,9 @@ export function applyRuntimeCleanup(repoRoot: string, options: RuntimeCleanupOpt
   const applied: Array<RuntimeCleanupCandidate & { applied: boolean; error?: string }> = eligible.slice(0, normalized.maxRemovals).map((candidate) => {
     try {
       if (candidate.kind === 'temp_dir' && candidate.path && isSafeForgeTemp(candidate.path)) {
+        // A preview is not a mutation lease. Recheck source and liveness.
+        if (protectsGitSource(candidate.path)) throw new Error('RUNTIME_CLEANUP_GIT_SOURCE_PROTECTED');
+        if (processCommands().some((process) => process.command.includes(candidate.path!))) throw new Error('RUNTIME_CLEANUP_TEMP_PROCESS_OCCUPIED');
         rmSync(candidate.path, { recursive: true, force: true });
         return { ...candidate, applied: true };
       }

package/src/runtime/platform/service-inventory.ts

@@ -0,0 +1,130 @@
+import { createHash } from 'crypto';
+import { resolve } from 'path';
+import type { PlatformServiceManagerHost } from './service-manager';
+
+export type ForgePersistentServiceOwner = 'forge-core' | 'provider';
+export type ForgePersistentServiceState = 'current' | 'retired';
+
+export interface ForgePersistentServiceIdentity {
+  id: string;
+  owner: ForgePersistentServiceOwner;
+  state: ForgePersistentServiceState;
+  launchdLabel: string;
+  systemdUnitName: string;
+}
+
+export const FORGE_RECOVERY_DAEMON_LABEL = 'com.moretea.forge-recovery';
+export const FORGE_RECOVERY_GATEWAY_LABEL = 'com.moretea.forge-recovery-gateway';
+export const FORGE_RECOVERY_WATCHDOG_LABEL = 'com.moretea.forge-recovery-watchdog';
+
+const RETIRED_CORE_LABELS = [
+  ['legacy-runtime', 'com.moretea.forge.runtime'],
+  ['legacy-mcp-gateway', 'com.moretea.forge.mcp-gateway'],
+  ['bootstrap-supervisor', 'com.moretea.forge-bootstrap-supervisor'],
+  ['evolution-supervisor', 'com.moretea.forge-evolution-supervisor'],
+  ['legacy-recovery-gateway', FORGE_RECOVERY_GATEWAY_LABEL],
+  ['legacy-recovery-watchdog', FORGE_RECOVERY_WATCHDOG_LABEL],
+] as const;
+
+/**
+ * These identities are intentionally outside Forge core lifecycle authority.
+ * They are listed to make the negative ownership boundary machine-visible,
+ * not to authorize any retirement action.
+ */
+export const FORGE_PROVIDER_OWNED_PERSISTENT_SERVICES = [
+  'com.moretea.forge.desktop-operator',
+  'com.moretea.desktop-operator',
+] as const;
+
+function controllerHomeSuffix(controllerHome: string): string {
+  return createHash('sha256').update(resolve(controllerHome)).digest('hex').slice(0, 12);
+}
+
+export function forgeRuntimePersistentServiceLabel(controllerHome: string): string {
+  return `com.moretea.forge.runtime.${controllerHomeSuffix(controllerHome)}`;
+}
+
+export function forgeConnectorPersistentServiceLabel(controllerHome: string): string {
+  return `com.moretea.forge.mcp-gateway.${controllerHomeSuffix(controllerHome)}`;
+}
+
+function identity(
+  id: string,
+  label: string,
+  state: ForgePersistentServiceState,
+): ForgePersistentServiceIdentity {
+  return {
+    id,
+    owner: 'forge-core',
+    state,
+    launchdLabel: label,
+    systemdUnitName: `${label}.service`,
+  };
+}
+
+export const FORGE_RETIRED_PERSISTENT_SERVICES: readonly ForgePersistentServiceIdentity[] =
+  RETIRED_CORE_LABELS.map(([id, label]) => identity(id, label, 'retired'));
+
+export function forgeOwnedPersistentServiceInventory(controllerHome: string): {
+  current: ForgePersistentServiceIdentity[];
+  retired: readonly ForgePersistentServiceIdentity[];
+  providerOwnedExcludedLabels: readonly string[];
+} {
+  return {
+    current: [
+      identity('runtime', forgeRuntimePersistentServiceLabel(controllerHome), 'current'),
+      identity('mcp-gateway', forgeConnectorPersistentServiceLabel(controllerHome), 'current'),
+      identity('recovery', FORGE_RECOVERY_DAEMON_LABEL, 'current'),
+    ],
+    retired: FORGE_RETIRED_PERSISTENT_SERVICES,
+    providerOwnedExcludedLabels: FORGE_PROVIDER_OWNED_PERSISTENT_SERVICES,
+  };
+}
+
+export interface ForgeRetiredServiceReconciliation {
+  id: string;
+  label: string;
+  platform: 'launchd' | 'systemd-user';
+  serviceWasPresent: boolean;
+  artifactWasPresent: boolean;
+  retired: boolean;
+}
+
+export async function reconcileRetiredForgePersistentServices(input: {
+  host: PlatformServiceManagerHost;
+  env?: NodeJS.ProcessEnv;
+  accountHome?: string;
+}): Promise<ForgeRetiredServiceReconciliation[]> {
+  if (!input.host.selection.persistent || input.host.selection.kind === 'portable') return [];
+  const results: ForgeRetiredServiceReconciliation[] = [];
+  for (const service of FORGE_RETIRED_PERSISTENT_SERVICES) {
+    if (input.host.selection.kind === 'launchd') {
+      const result = await input.host.retireLaunchdExact({
+        label: service.launchdLabel,
+        accountHome: input.accountHome,
+      });
+      results.push({
+        id: service.id,
+        label: service.launchdLabel,
+        platform: 'launchd',
+        serviceWasPresent: result.serviceWasPresent,
+        artifactWasPresent: result.plistWasPresent,
+        retired: result.absentAfter,
+      });
+    } else {
+      const result = input.host.retireSystemdUserExact({
+        unitName: service.systemdUnitName,
+        env: input.env,
+      });
+      results.push({
+        id: service.id,
+        label: service.systemdUnitName,
+        platform: 'systemd-user',
+        serviceWasPresent: result.serviceWasPresent,
+        artifactWasPresent: result.unitFileWasPresent,
+        retired: result.absentAfter,
+      });
+    }
+  }
+  return results;
+}