@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/control-plane/execution/work-terminal-cleanup.ts

@@ -1,11 +1,9 @@
 import { createHash } from 'crypto';
 import { spawnSync } from 'child_process';
 import {
-  cpSync,
   existsSync,
   mkdirSync,
   readFileSync,
-  writeFileSync,
 } from 'fs';
 import { dirname, join, resolve } from 'path';
 import { repoLocalNoIndexControllerHome, repositoryControllerRoot } from '../../../cli/repositories/controller-home';
@@ -19,15 +17,10 @@ import {
 import { managedPathInside, managedWorktreeStorageRoot } from '../../../cli/repositories/worktree-storage';
 import { markRepositoryProjectionDirty } from '../../projections/invalidation';
 import { listControlPlaneRecords } from '../persistence/sqlite-store';
-import { getWorkContract } from '../../../../packages/kernel/work/api/index';
-import {
-  controllerTerminalizationAuthorityFromSession,
-  getControllerSession,
-  releaseControllerSessionWithAuthority,
-  releaseObservedControllerSession,
-  type ControllerTerminalizationAuthority,
-} from '../../../../packages/kernel/controller/api/index';
-import { isRepositoryCompletionReceipt, isTerminalWorkContractStatus, type WorkContract } from '../facade/types';
+import { getWorkContract, recordCancelledWorkCleanupCompleted, semanticWorkState } from '../../../../packages/kernel/work/api/index';
+import { assertOwnedResourceCleanupTarget, markOwnedResourceCleaned, markOwnedResourceRetained } from '../../../../packages/kernel/identity/api/index';
+import { managedBranchOwnedResourceId, managedBranchOwnedResourceLocator, managedWorkspaceOwnedResourceId } from '../../execution/managed-workspace';
+import { isRepositoryCompletionReceipt, type WorkContract } from '../facade/types';
 import {
   cancelProcess,
   getProcessHandle,
@@ -49,8 +42,6 @@ import {
 } from './work-handle-store';
 import { proveWorkPreservationContained } from '../cleanup-artifact-retention';
 
-const CHECKPOINT_MESSAGE = 'chore(checkpoint): preserve terminal work before cleanup';
-
 export interface TerminalWorkCleanupInput {
   controllerHome: string;
   handle: WorkHandleState;
@@ -118,7 +109,7 @@ function newReceipt(handle: WorkHandleState, targetBranch: string, terminalOutco
     updatedAt: timestamp,
     verification: { mode: 'cleanup_only', checksRun: [] },
     processes: { examined: [], terminated: [], blocking: [], allTerminal: false },
-    ownership: { controllerLease: 'pending', processLeases: 'pending' },
+    ownership: { controllerLease: 'already_released', processLeases: 'pending' },
     preservation: { status: 'not_needed' },
     worktree: { path: handle.worktreePath, status: 'pending' },
     branchCleanup: { branch: handle.branch, status: 'pending' },
@@ -168,62 +159,6 @@ function branchUsedByAnotherWorktree(root: string, branch: string, currentPath:
   return false;
 }
 
-function copyUntrackedFiles(worktreePath: string, archiveRoot: string): Array<{ path: string; sha256: string }> {
-  const listed = git(worktreePath, ['ls-files', '--others', '--exclude-standard', '-z']);
-  if (!listed.ok || !listed.stdout) return [];
-  const manifest: Array<{ path: string; sha256: string }> = [];
-  for (const relativePath of listed.stdout.split('\0').filter(Boolean)) {
-    const source = join(worktreePath, relativePath);
-    const destination = join(archiveRoot, 'untracked', relativePath);
-    mkdirSync(dirname(destination), { recursive: true });
-    if (!existsSync(destination)) {
-      cpSync(source, destination, { recursive: true, force: false, errorOnExist: true });
-    }
-    if (existsSync(source)) {
-      try {
-        manifest.push({ path: relativePath, sha256: hashText(readFileSync(source)) });
-      } catch {
-        manifest.push({ path: relativePath, sha256: 'directory-or-unreadable' });
-      }
-    }
-  }
-  return manifest;
-}
-
-function createPatchArchive(controllerHome: string, handle: WorkHandleState): {
-  path: string;
-  sha256: string;
-  recoveryInstructions: string;
-} {
-  const root = artifactRoot(controllerHome, handle);
-  const path = join(root, 'worktree.patch.json');
-  if (!existsSync(path)) {
-    const unstaged = git(handle.worktreePath, ['diff', '--binary', 'HEAD']);
-    const staged = git(handle.worktreePath, ['diff', '--binary', '--cached', 'HEAD']);
-    const untracked = copyUntrackedFiles(handle.worktreePath, root);
-    const archive = {
-      schemaVersion: 1,
-      repoId: handle.repositoryId,
-      checkoutId: handle.checkoutId,
-      workId: handle.workId,
-      branch: handle.branch,
-      baseCommit: handle.baseCommit,
-      expectedHead: handle.expectedHead,
-      createdAt: nowIso(),
-      unstagedPatch: unstaged.stdout,
-      stagedPatch: staged.stdout,
-      untracked,
-    };
-    writeFileSync(path, `${JSON.stringify(archive, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-  }
-  const sha256 = hashText(readFileSync(path));
-  return {
-    path,
-    sha256,
-    recoveryInstructions: `Apply tracked changes from ${path}; restore copied untracked files from ${join(root, 'untracked')}. Verify SHA-256 ${sha256}.`,
-  };
-}
-
 function createVerifiedBundle(controllerHome: string, handle: WorkHandleState, targetRoot: string): {
   path: string;
   sha256: string;
@@ -235,6 +170,11 @@ function createVerifiedBundle(controllerHome: string, handle: WorkHandleState, t
   }
   const verified = git(targetRoot, ['bundle', 'verify', path], 60_000);
   if (!verified.ok) throw new Error(verified.stderr || 'git bundle verify failed');
+  const branchHead = git(targetRoot, ['rev-parse', '--verify', `refs/heads/${handle.branch}^{commit}`]);
+  const bundleHead = git(targetRoot, ['bundle', 'list-heads', path, `refs/heads/${handle.branch}`]);
+  if (!branchHead.ok || !bundleHead.ok || bundleHead.stdout !== `${branchHead.stdout} refs/heads/${handle.branch}`) {
+    throw new Error('BRANCH_BUNDLE_HEAD_MISMATCH: verified bundle does not preserve the current branch tip');
+  }
   return { path, sha256: hashText(readFileSync(path)) };
 }
 
@@ -305,7 +245,7 @@ function workHandleOwnsCheckout(controllerHome: string, handle: WorkHandleState)
   // WorkContract completion is the authoritative ownership boundary. Older
   // runtimes could persist a completed contract while leaving the handle in a
   // non-terminal state; that historical handle must not remain a live owner.
-  return contract === undefined || !isTerminalWorkContractStatus(contract.status);
+  return contract === undefined || semanticWorkState(contract) === 'open';
 }
 
 function assertNoOtherLiveWork(input: TerminalWorkCleanupInput, receipt: WorkCleanupReceipt): void {
@@ -330,59 +270,22 @@ function preserveDirtyWorktree(
     return persist(input.controllerHome, current, receipt);
   }
   if (!status.stdout) {
-    receipt.preservation.status = receipt.preservation.checkpointCommit || receipt.preservation.patchArchivePath
-      ? receipt.preservation.status
-      : 'not_needed';
+    receipt.preservation.status = 'not_needed';
     return persist(input.controllerHome, current, receipt);
   }
 
-  if (!receipt.preservation.checkpointCommit && !receipt.preservation.patchArchivePath) {
-    const staged = git(current.worktreePath, ['add', '-A']);
-    const committed = staged.ok
-      ? git(current.worktreePath, [
-          '-c', 'user.name=forge',
-          '-c', 'user.email=forge@local.invalid',
-          'commit', '-m', CHECKPOINT_MESSAGE,
-        ], 60_000)
-      : { ok: false, stdout: '', stderr: staged.stderr };
-    if (committed.ok) {
-      const head = git(current.worktreePath, ['rev-parse', 'HEAD']);
-      if (!head.ok || !head.stdout) {
-        receipt.preservation.status = 'failed';
-        addBlocker(receipt, 'CHECKPOINT_HEAD_UNAVAILABLE');
-      } else {
-        receipt.preservation.status = 'checkpointed';
-        receipt.preservation.checkpointCommit = head.stdout;
-        current = writeWorkHandle(input.controllerHome, {
-          ...current,
-          expectedHead: head.stdout,
-          cleanupReceipt: receipt,
-        });
-      }
-    } else {
-      try {
-        const archive = createPatchArchive(input.controllerHome, current);
-        receipt.preservation.status = 'patch_archived';
-        receipt.preservation.patchArchivePath = archive.path;
-        receipt.preservation.patchArchiveSha256 = archive.sha256;
-        receipt.preservation.recoveryInstructions = archive.recoveryInstructions;
-      } catch (error) {
-        receipt.preservation.status = 'failed';
-        addBlocker(receipt, `PRESERVATION_FAILED: ${error instanceof Error ? error.message : String(error)}`);
-      }
-    }
-  } else if (receipt.preservation.checkpointCommit && status.stdout) {
-    try {
-      const archive = createPatchArchive(input.controllerHome, current);
-      receipt.preservation.status = 'patch_archived';
-      receipt.preservation.patchArchivePath = archive.path;
-      receipt.preservation.patchArchiveSha256 = archive.sha256;
-      receipt.preservation.recoveryInstructions = archive.recoveryInstructions;
-    } catch (error) {
-      receipt.preservation.status = 'failed';
-      addBlocker(receipt, `POST_CHECKPOINT_PRESERVATION_FAILED: ${error instanceof Error ? error.message : String(error)}`);
-    }
-  }
+  // Semantic Work terminal state is not authority to mutate, commit, archive,
+  // or delete uncommitted workspace content. Dirty bytes stay exactly where the
+  // model/user left them until an explicit delivery/discard action resolves them.
+  receipt.preservation.status = 'not_needed';
+  receipt.preservation.recoveryInstructions = `Dirty managed worktree retained in place at ${current.worktreePath}; commit, deliver, or explicitly discard the pending changes before cleanup.`;
+  receipt.worktree.status = 'retained';
+  receipt.worktree.reason = 'Dirty managed worktree retained; terminal semantic state does not authorize destructive cleanup.';
+  receipt.branchCleanup.status = 'retained';
+  receipt.branchCleanup.reason = 'Branch retained with dirty managed worktree.';
+  addBlocker(receipt, 'DIRTY_WORKTREE_RETAINED');
+  markOwnedResourceRetained(input.controllerHome, managedWorkspaceOwnedResourceId(current.repositoryId, current.checkoutId));
+  markOwnedResourceRetained(input.controllerHome, managedBranchOwnedResourceId(current.repositoryId, current.checkoutId));
   return persist(input.controllerHome, current, receipt);
 }
 
@@ -460,9 +363,15 @@ export interface TerminalWorkCleanupReconcileReport {
   truncated: boolean;
 }
 
+function contractCompletedNoChange(contract: WorkContract): boolean {
+  if (contract.workKind === 'completed_no_change' || contract.completionOutcome === 'completed_no_change') return true;
+  const receipt = contract.completionReceipt;
+  return Boolean(receipt && isRepositoryCompletionReceipt(receipt) && receipt.delivery.kind === 'no_change');
+}
+
 function terminalOutcomeForContract(contract: WorkContract): WorkTerminalOutcome {
-  if (contract.status === 'cancelled') return 'cancelled';
-  if (contract.status === 'completed') return 'completed_cleanup';
+  if (semanticWorkState(contract) === 'cancelled') return 'cancelled';
+  if (semanticWorkState(contract) === 'completed') return 'completed_cleanup';
   return 'failed';
 }
 
@@ -474,7 +383,7 @@ export function recoverTerminalWorkHandle(
   const existing = readWorkHandle(controllerHome, repositoryId, workId);
   if (existing) return existing;
   const contract = getWorkContract({ controllerHome, repoId: repositoryId }, workId);
-  if (!contract || !isTerminalWorkContractStatus(contract.status)) return undefined;
+  if (!contract || semanticWorkState(contract) === 'open') return undefined;
   const worktreePath = contract.worktreeRef?.trim();
   const checkoutId = contract.checkoutId?.trim();
   if (!worktreePath || !checkoutId || !existsSync(worktreePath)) return undefined;
@@ -500,15 +409,15 @@ export function recoverTerminalWorkHandle(
   const contained = targetExists
     ? git(repository.canonicalRoot, ['merge-base', '--is-ancestor', head.stdout, `refs/heads/${targetBranch}`]).ok
     : false;
-  const delivered = contract.status === 'completed' && contained;
-  const session = getControllerSession({ controllerHome, repoId: repositoryId }, workId);
+  const completedNoChange = contractCompletedNoChange(contract);
+  const delivered = semanticWorkState(contract) === 'completed' && contained && !completedNoChange;
   const recordedAt = nowIso();
   return writeWorkHandle(controllerHome, {
     schemaVersion: 1,
     workId,
     workContractId: workId,
-    sessionId: session?.sessionId ?? `terminal-recovery:${workId}`,
-    principalId: contract.principalId?.trim() || session?.principalId || 'terminal-recovery',
+    sessionId: `terminal-recovery:${workId}`,
+    principalId: contract.principalId?.trim() || 'terminal-recovery',
     repositoryId,
     checkoutId,
     sourceCheckoutId: repository.activeCheckoutId,
@@ -520,17 +429,18 @@ export function recoverTerminalWorkHandle(
     expectedHead: head.stdout,
     permissionSnapshotVersion: 1,
     state: delivered ? 'merged' : 'failed_terminal_cleanup',
-    failureReason: delivered ? undefined : 'Recovered terminal Work ownership for cleanup; target-branch containment was not proven.',
+    failureReason: delivered || completedNoChange
+      ? undefined
+      : 'Recovered terminal Work ownership for cleanup; target-branch containment was not proven.',
     createdAt: contract.createdAt || recordedAt,
     updatedAt: recordedAt,
     cleanupResponsibility: { owner: 'work_finalizer', registeredAt: recordedAt },
     finalization: {
-      validation: contract.status === 'failed' ? 'failed' : 'done',
+      validation: 'done',
       commit: 'skipped',
       merge: delivered ? 'done' : 'skipped',
       branchCleanup: 'pending',
       worktreeCleanup: 'pending',
-      ...(contract.status === 'failed' ? { lastError: 'Recovered failed terminal Work for cleanup.' } : {}),
     },
   });
 }
@@ -584,9 +494,13 @@ function prepareManagedBranchPreservation(
   current: WorkHandleState,
   target: ReturnType<typeof getRepository>,
   targetBranch: string,
-): { uniqueCommits: number; branchPreserved: boolean } {
+): { uniqueCommits: number; branchPreserved: boolean; branchHead?: string } {
   let uniqueCommits = 0;
+  let branchHead: string | undefined;
   if (branchExists(target.canonicalRoot, current.branch)) {
+    const observed = git(target.canonicalRoot, ['rev-parse', '--verify', `refs/heads/${current.branch}^{commit}`]);
+    if (!observed.ok || !observed.stdout) addBlocker(receipt, 'BRANCH_REVISION_UNKNOWN');
+    else branchHead = observed.stdout;
     if (!branchExists(target.canonicalRoot, targetBranch)) {
       addBlocker(receipt, `TARGET_BRANCH_MISSING: ${targetBranch}`);
     } else {
@@ -597,11 +511,12 @@ function prepareManagedBranchPreservation(
   }
   receipt.branchCleanup.uniqueCommits = uniqueCommits;
 
+  const retirement = receipt.preservation.bundleRetirement;
   let branchPreserved = Boolean(
-    receipt.preservation.bundleRetirement?.status === 'not_needed'
-    || receipt.preservation.bundleRetirement?.status === 'removed',
+    branchHead && retirement?.protectedRevision === branchHead
+    && (retirement.status === 'not_needed' || retirement.status === 'removed'),
   );
-  if (receipt.preservation.bundlePath && !branchPreserved) {
+  if (branchHead && receipt.preservation.bundlePath && !branchPreserved) {
     try {
       const bundle = createVerifiedBundle(input.controllerHome, current, target.canonicalRoot);
       if (receipt.preservation.bundleSha256 && receipt.preservation.bundleSha256 !== bundle.sha256) {
@@ -614,7 +529,7 @@ function prepareManagedBranchPreservation(
     }
   }
   if (uniqueCommits > 0 && !branchPreserved && receipt.blockers.length === 0) {
-    const proof = proveWorkPreservationContained(target.canonicalRoot, { ...current, cleanupReceipt: receipt }, targetBranch);
+    const proof = proveWorkPreservationContained(target.canonicalRoot, current, targetBranch, branchHead);
     if (proof.contained) {
       receipt.preservation.bundleRetirement = {
         status: 'not_needed',
@@ -642,10 +557,11 @@ function prepareManagedBranchPreservation(
       }
     }
   }
-  return { uniqueCommits, branchPreserved };
+  return { uniqueCommits, branchPreserved, branchHead };
 }
 
 function applyManagedBranchCleanup(
+  controllerHome: string,
   target: ReturnType<typeof getRepository>,
   current: WorkHandleState,
   targetBranch: string,
@@ -653,6 +569,7 @@ function applyManagedBranchCleanup(
   receipt: WorkCleanupReceipt,
   uniqueCommits: number,
   branchPreserved: boolean,
+  expectedBranchHead: string | undefined,
 ): void {
   if (!deleteBranch) {
     receipt.branchCleanup.status = 'retained';
@@ -672,13 +589,30 @@ function applyManagedBranchCleanup(
     receipt.branchCleanup.status = 'retained';
     receipt.branchCleanup.reason = 'Unique commits are not archived.';
     addBlocker(receipt, `BRANCH_UNPRESERVED: ${current.branch}`);
+  } else if (!expectedBranchHead) {
+    receipt.branchCleanup.status = 'retained';
+    receipt.branchCleanup.reason = 'Exact branch revision is unavailable.';
+    addBlocker(receipt, 'BRANCH_REVISION_UNKNOWN');
   } else {
-    // We already proved the exact branch relation against targetBranch above.
-    // `git branch -d` instead consults the checkout's current HEAD, which may be
-    // an older/stale source checkout and can falsely reject a branch that is
-    // fully contained in the explicit target branch. After that target-branch
-    // proof (or a verified archive for unique commits), delete the ref directly.
-    const deleted = git(target.canonicalRoot, ['branch', '-D', current.branch]);
+    // Branch deletion requires the canonical OwnedResource witness in addition
+    // to Git relation checks. Repository/ref shape alone is not cleanup authority.
+    try {
+      assertOwnedResourceCleanupTarget(controllerHome, {
+        resourceId: managedBranchOwnedResourceId(current.repositoryId, current.checkoutId),
+        kind: 'git_branch',
+        targetRef: current.branch,
+        locator: managedBranchOwnedResourceLocator(target.canonicalRoot, current.checkoutId, current.branch),
+      });
+    } catch (error) {
+      receipt.branchCleanup.status = 'retained';
+      receipt.branchCleanup.reason = error instanceof Error ? error.message : String(error);
+      addBlocker(receipt, `OWNED_BRANCH_CLEANUP_FENCED: ${receipt.branchCleanup.reason}`);
+      return;
+    }
+    // Delete only the exact tip whose containment or bundle was proved above.
+    // A concurrent successor must retain its ref rather than inherit an older
+    // WorkHandle or preservation receipt's deletion authority.
+    const deleted = git(target.canonicalRoot, ['update-ref', '-d', `refs/heads/${current.branch}`, expectedBranchHead]);
     if (!deleted.ok && branchExists(target.canonicalRoot, current.branch)) {
       receipt.branchCleanup.status = 'failed';
       receipt.branchCleanup.reason = deleted.stderr || 'branch delete failed';
@@ -699,6 +633,24 @@ function cleanupReceiptComplete(receipt: WorkCleanupReceipt, deleteBranch: boole
       : receipt.branchCleanup.status === 'retained');
 }
 
+function projectOwnedResourceCleanup(
+  controllerHome: string,
+  handle: WorkHandleState,
+  receipt: WorkCleanupReceipt,
+): void {
+  const worktreeResourceId = managedWorkspaceOwnedResourceId(handle.repositoryId, handle.checkoutId);
+  if (['removed', 'already_removed'].includes(receipt.worktree.status)) {
+    markOwnedResourceCleaned(controllerHome, worktreeResourceId, 'forge:work-terminal-cleanup', receipt.receiptId);
+  }
+
+  const branchResourceId = managedBranchOwnedResourceId(handle.repositoryId, handle.checkoutId);
+  if (['deleted', 'already_deleted', 'archived'].includes(receipt.branchCleanup.status)) {
+    markOwnedResourceCleaned(controllerHome, branchResourceId, 'forge:work-terminal-cleanup', receipt.receiptId);
+  } else if (receipt.branchCleanup.status === 'retained') {
+    markOwnedResourceRetained(controllerHome, branchResourceId);
+  }
+}
+
 function reconcileCleanedManagedBranchRetirement(
   input: TerminalWorkCleanupInput,
   repository: ReturnType<typeof getRepository>,
@@ -709,7 +661,7 @@ function reconcileCleanedManagedBranchRetirement(
 ): TerminalWorkCleanupResult | undefined {
   const workId = current.workContractId ?? current.workId;
   const contract = getWorkContract({ controllerHome: input.controllerHome, repoId: current.repositoryId }, workId);
-  if (!contract || !isTerminalWorkContractStatus(contract.status)
+  if (!contract || semanticWorkState(contract) === 'open'
     || !cleanedManagedBranchRetirementCandidate(repository, contract, current, targetBranch, deleteBranch)) return undefined;
 
   const target = selectTerminalCleanupTarget(repository, current);
@@ -724,6 +676,7 @@ function reconcileCleanedManagedBranchRetirement(
   current = persist(input.controllerHome, current, receipt);
   if (receipt.blockers.length === 0) {
     applyManagedBranchCleanup(
+      input.controllerHome,
       target,
       current,
       targetBranch,
@@ -731,6 +684,7 @@ function reconcileCleanedManagedBranchRetirement(
       receipt,
       preservation.uniqueCommits,
       preservation.branchPreserved,
+      preservation.branchHead,
     );
   } else if (receipt.branchCleanup.status === 'pending') {
     receipt.branchCleanup.status = 'retained';
@@ -818,8 +772,19 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
   const targetBranch = resolveWorkDeliveryTargetBranch(input.handle, repository.defaultBranch, input.targetBranch);
   const deleteBranch = input.deleteBranch !== false;
   let current = input.handle;
-  const landed = current.state === 'merged' || current.finalization.merge === 'done';
-  const preservedFailure = (input.failureReason ?? current.failureReason ?? current.finalization.lastError ?? 'terminal work cleanup').slice(0, 1_000);
+  const contract = getWorkContract(
+    { controllerHome: input.controllerHome, repoId: current.repositoryId },
+    current.workContractId ?? current.workId,
+  );
+  const completedNoChange = Boolean(contract && contractCompletedNoChange(contract));
+  // `merged` is delivery truth, not a generic terminal-cleanup waypoint. Historical
+  // no-change handles may carry merge=done/state=merged from the retired finalizer;
+  // normalize that stale projection before any destructive cleanup attempt.
+  const landed = !completedNoChange && (current.state === 'merged' || current.finalization.merge === 'done');
+  const successfulCompletion = completedNoChange || input.terminalOutcome === 'completed_cleanup';
+  const preservedFailure = successfulCompletion
+    ? undefined
+    : (input.failureReason ?? current.failureReason ?? current.finalization.lastError ?? 'terminal work cleanup').slice(0, 1_000);
   const receipt = current.cleanupReceipt ?? newReceipt(current, targetBranch, input.terminalOutcome);
 
   if (
@@ -827,6 +792,12 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
     || receipt.checkoutId !== current.checkoutId
     || receipt.workId !== current.workId
   ) throw new Error('WORK_CLEANUP_RECEIPT_IDENTITY_MISMATCH');
+  // Legacy receipts may retain the former Controller lease stage. ControllerSession
+  // is no longer a cleanup resource; normalize this projection without touching
+  // any explicit continuation state.
+  if (receipt.ownership.controllerLease === 'pending') {
+    receipt.ownership.controllerLease = 'already_released';
+  }
 
   if (current.state === 'cleaned') {
     const branchRetirement = reconcileCleanedManagedBranchRetirement(
@@ -844,7 +815,6 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
       receipt.completedAt = receipt.completedAt ?? current.updatedAt ?? nowIso();
       receipt.blockers = [];
       receipt.processes.allTerminal = true;
-      if (receipt.ownership.controllerLease === 'pending') receipt.ownership.controllerLease = 'already_released';
       if (receipt.ownership.processLeases === 'pending') receipt.ownership.processLeases = 'released';
       if (receipt.worktree.status === 'pending' || receipt.worktree.status === 'failed') {
         receipt.worktree.status = 'already_removed';
@@ -890,7 +860,11 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
       ? 'failed' as const
       : current.finalization.validation,
     commit: current.finalization.commit === 'pending' ? 'skipped' as const : current.finalization.commit,
-    merge: landed ? 'done' as const : current.finalization.merge === 'pending' ? 'skipped' as const : current.finalization.merge,
+    merge: completedNoChange
+      ? 'skipped' as const
+      : landed
+        ? 'done' as const
+        : current.finalization.merge === 'pending' ? 'skipped' as const : current.finalization.merge,
     lastError: preservedFailure,
   };
   if (landed) {
@@ -987,7 +961,19 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
       current = persist(input.controllerHome, current, receipt);
       return { handle: current, receipt };
     }
-    if (!root.ok || resolve(root.stdout) !== resolve(current.worktreePath) || !branch.ok || branch.stdout !== current.branch) {
+    const rootIdentityValid = root.ok && resolve(root.stdout) === resolve(current.worktreePath);
+    const branchIdentityValid = branch.ok && branch.stdout === current.branch;
+    let detachedContainedIdentity = false;
+    if (rootIdentityValid && branch.ok && !branch.stdout) {
+      const status = git(current.worktreePath, ['status', '--porcelain=v1', '--untracked-files=all']);
+      const head = git(current.worktreePath, ['rev-parse', 'HEAD']);
+      detachedContainedIdentity = status.ok
+        && !status.stdout
+        && head.ok
+        && Boolean(head.stdout)
+        && git(target.canonicalRoot, ['merge-base', '--is-ancestor', head.stdout, `refs/heads/${targetBranch}`]).ok;
+    }
+    if (!rootIdentityValid || (!branchIdentityValid && !detachedContainedIdentity)) {
       addBlocker(receipt, 'WORKTREE_IDENTITY_INVALID');
       current = persist(input.controllerHome, current, receipt);
       return { handle: current, receipt };
@@ -1003,7 +989,7 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
     receipt.worktree.status = 'already_removed';
   }
 
-  const { uniqueCommits, branchPreserved } = prepareManagedBranchPreservation(
+  const { uniqueCommits, branchPreserved, branchHead } = prepareManagedBranchPreservation(
     input,
     receipt,
     current,
@@ -1020,6 +1006,19 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
   }
 
   if (existsSync(current.worktreePath)) {
+    try {
+      assertOwnedResourceCleanupTarget(input.controllerHome, {
+        resourceId: managedWorkspaceOwnedResourceId(current.repositoryId, current.checkoutId),
+        kind: 'worktree',
+        targetRef: current.worktreePath,
+      });
+    } catch (error) {
+      receipt.worktree.status = 'retained';
+      receipt.worktree.reason = error instanceof Error ? error.message : String(error);
+      addBlocker(receipt, `OWNED_WORKTREE_CLEANUP_FENCED: ${receipt.worktree.reason}`);
+      current = persist(input.controllerHome, current, receipt);
+      return { handle: current, receipt };
+    }
     const removed = git(target.canonicalRoot, ['worktree', 'remove', '--force', current.worktreePath], 60_000);
     if (!removed.ok && existsSync(current.worktreePath)) {
       receipt.worktree.status = 'failed';
@@ -1056,6 +1055,7 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
   }
 
   applyManagedBranchCleanup(
+    input.controllerHome,
     target,
     current,
     targetBranch,
@@ -1063,6 +1063,7 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
     receipt,
     uniqueCommits,
     branchPreserved,
+    branchHead,
   );
 
   const pruned = git(target.canonicalRoot, ['worktree', 'prune']);
@@ -1075,6 +1076,7 @@ export async function cleanupTerminalWork(input: TerminalWorkCleanupInput): Prom
   receipt.complete = cleanupReceiptComplete(receipt, deleteBranch);
   receipt.partial = !receipt.complete;
   if (receipt.complete) receipt.completedAt = receipt.completedAt ?? nowIso();
+  projectOwnedResourceCleanup(input.controllerHome, current, receipt);
 
   const finalization = {
     ...current.finalization,
@@ -1120,6 +1122,30 @@ export interface SingleTerminalWorkCleanupResult {
  * Controller ownership or unsafe branch drift. A caller proving the exact
  * leftover owner epoch may release it before physical cleanup.
  */
+function reconcileCancelledCleanupProjection(
+  controllerHome: string,
+  repoId: string,
+  contract: WorkContract,
+  receipt: WorkCleanupReceipt,
+): void {
+  if (contract.semanticState !== 'cancelled' || receipt.complete !== true) return;
+  if (contract.phase === 'cleanup' && contract.phaseEvidence.cleanup.state === 'satisfied'
+    && contract.phaseEvidence.cleanup.receiptId === receipt.receiptId) return;
+  recordCancelledWorkCleanupCompleted(
+    { controllerHome, repoId },
+    contract.workId,
+    {
+      summary: `Verified terminal resource cleanup completed with receipt ${receipt.receiptId}.`,
+      receiptId: receipt.receiptId,
+      evidenceRefs: [{
+        title: 'cancelled Work terminal cleanup completed',
+        summary: `Physical worktree/branch cleanup completed under receipt ${receipt.receiptId}; unexecuted semantic phases remain skipped rather than satisfied.`,
+        detailLevel: 'summary',
+      }, ...contract.evidenceRefs],
+    },
+  );
+}
+
 export async function reconcileSingleTerminalWorkCleanup(
   controllerHome: string,
   repositoryId: string,
@@ -1127,38 +1153,13 @@ export async function reconcileSingleTerminalWorkCleanup(
   options: {
     targetBranch?: string;
     deleteBranch?: boolean;
-    /** Recovery authority for the narrow crash window after semantic terminalization but before owner release. */
-    controllerAuthority?: ControllerTerminalizationAuthority;
   } = {},
 ): Promise<SingleTerminalWorkCleanupResult> {
   const repository = getRepository(repositoryId, controllerHome, { includeRemoved: true });
   const contract = getWorkContract({ controllerHome, repoId: repositoryId }, workId);
-  if (!contract || !isTerminalWorkContractStatus(contract.status)) {
+  if (!contract || semanticWorkState(contract) === 'open') {
     return { status: 'not_terminal', workId, reason: 'Work is not terminal.' };
   }
-  let controllerLease: WorkCleanupReceipt['ownership']['controllerLease'] = 'already_released';
-  const owner = getControllerSession({ controllerHome, repoId: repositoryId }, workId);
-  if (owner) {
-    const authority = options.controllerAuthority;
-    if (!authority) return { status: 'blocked', workId, reason: 'Active Controller ownership still exists.' };
-    const ownerAuthority = controllerTerminalizationAuthorityFromSession(owner);
-    if (!ownerAuthority
-      || ownerAuthority.controllerId !== authority.controllerId
-      || ownerAuthority.controllerType !== authority.controllerType
-      || ownerAuthority.principalId !== authority.principalId
-      || ownerAuthority.controllerInstanceId !== authority.controllerInstanceId
-      || ownerAuthority.claimGeneration !== authority.claimGeneration) {
-      return { status: 'blocked', workId, reason: 'Active Controller ownership does not match the cleanup authority.' };
-    }
-    const released = releaseControllerSessionWithAuthority(
-      { controllerHome, repoId: repositoryId },
-      { workId, actor: `terminal-cleanup:${workId}`, authority },
-    );
-    if (!released.allowed) {
-      return { status: 'blocked', workId, reason: `Active Controller ownership release fenced: ${released.reason}.` };
-    }
-    controllerLease = 'released';
-  }
   const originalHandle = readWorkHandle(controllerHome, repositoryId, workId)
     ?? recoverTerminalWorkHandle(controllerHome, repositoryId, workId);
   if (!originalHandle) return { status: 'no_handle', workId };
@@ -1176,8 +1177,10 @@ export async function reconcileSingleTerminalWorkCleanup(
     terminalOutcome: terminalOutcomeForContract(contract),
     failureReason: drift.handle.failureReason ?? drift.handle.finalization.lastError,
   });
-  cleaned.receipt.ownership.controllerLease = controllerLease;
   const persisted = writeWorkHandle(controllerHome, { ...cleaned.handle, cleanupReceipt: cleaned.receipt });
+  if (cleaned.receipt.complete) {
+    reconcileCancelledCleanupProjection(controllerHome, repositoryId, contract, cleaned.receipt);
+  }
   if (!cleaned.receipt.complete) {
     return {
       status: 'blocked',
@@ -1211,7 +1214,14 @@ export async function reconcileTerminalWorkCleanups(
     truncated: false,
   };
 
-  const repositories = listRepositories(controllerHome).filter((repository) => repository.enabled && !repository.removedAt);
+  const maintenanceEpoch = Math.floor(nowMs / 60_000);
+  const repositories = listRepositories(controllerHome)
+    .filter((repository) => repository.enabled && !repository.removedAt)
+    .sort((left, right) => {
+      const leftOrder = hashText(`${maintenanceEpoch}\0${left.repoId}`);
+      const rightOrder = hashText(`${maintenanceEpoch}\0${right.repoId}`);
+      return leftOrder.localeCompare(rightOrder) || left.repoId.localeCompare(right.repoId);
+    });
   outer: for (const repository of repositories) {
     const handles = listWorkHandles(controllerHome, repository.repoId, 10_000)
       .filter((handle) => handle.managedWorktree);
@@ -1223,7 +1233,7 @@ export async function reconcileTerminalWorkCleanups(
       limit: 10_000,
     })) {
       const contract = record.value;
-      if (knownWorkIds.has(contract.workId) || !isTerminalWorkContractStatus(contract.status)) continue;
+      if (knownWorkIds.has(contract.workId) || semanticWorkState(contract) === 'open') continue;
       if (!contract.worktreeRef?.trim() || !existsSync(contract.worktreeRef)) continue;
       let recovered: WorkHandleState | undefined;
       try {
@@ -1247,15 +1257,22 @@ export async function reconcileTerminalWorkCleanups(
         report.errors.push({ workId: originalHandle.workId, error: error instanceof Error ? error.message : String(error) });
         continue;
       }
-      if (!contract || !isTerminalWorkContractStatus(contract.status)) {
+      if (!contract || semanticWorkState(contract) === 'open') {
         report.skippedNonTerminal.push(originalHandle.workId);
         continue;
       }
+      // Semantic terminality is the lifecycle authority that starts mechanical
+      // cleanup reconciliation. It is not deletion authority: work_finalizer must
+      // still prove exact Forge ownership, preserve dirty bytes/unique commits,
+      // settle live processes, and honor explicit retention before removing any
+      // physical resource. Completion/cleanup receipts are delivery/progress
+      // evidence, not a second permission gate that can strand terminal Work.
       if (cleanupRetainedByRequest(contract, originalHandle)) {
         report.skippedRetained.push(originalHandle.workId);
         continue;
       }
       if (originalHandle.state === 'cleaned' && originalHandle.cleanupReceipt?.complete === true) {
+        reconcileCancelledCleanupProjection(controllerHome, repository.repoId, contract, originalHandle.cleanupReceipt);
         const targetBranch = resolveWorkDeliveryTargetBranch(originalHandle, repository.defaultBranch);
         if (!cleanedManagedBranchRetirementCandidate(
           repository,
@@ -1296,26 +1313,11 @@ export async function reconcileTerminalWorkCleanups(
           terminalOutcome: terminalOutcomeForContract(contract),
           failureReason: drift.handle.failureReason ?? drift.handle.finalization.lastError,
         });
-        const workId = cleaned.handle.workContractId ?? cleaned.handle.workId;
-        const controllerSession = getControllerSession({ controllerHome, repoId: repository.repoId }, workId);
-        if (controllerSession) {
-          const released = releaseObservedControllerSession(
-            { controllerHome, repoId: repository.repoId },
-            { workId, actor: `terminal-cleanup:${originalHandle.workId}`, owner: controllerSession },
-          );
-          if (released.allowed) {
-            cleaned.receipt.ownership.controllerLease = 'released';
-          } else {
-            cleaned.receipt.complete = false;
-            cleaned.receipt.partial = true;
-            cleaned.receipt.completedAt = undefined;
-            cleaned.receipt.blockers = appendUnique(cleaned.receipt.blockers, `controller lease release fenced: ${released.reason}`);
-          }
-        } else {
-          cleaned.receipt.ownership.controllerLease = 'already_released';
-        }
         writeWorkHandle(controllerHome, { ...cleaned.handle, cleanupReceipt: cleaned.receipt });
-        if (cleaned.receipt.complete) report.cleaned.push(originalHandle.workId);
+        if (cleaned.receipt.complete) {
+          reconcileCancelledCleanupProjection(controllerHome, repository.repoId, contract, cleaned.receipt);
+          report.cleaned.push(originalHandle.workId);
+        }
         else report.blocked.push({
           workId: originalHandle.workId,
           reason: cleaned.receipt.blockers.join('; ') || cleaned.receipt.worktree.reason || cleaned.receipt.branchCleanup.reason || 'terminal cleanup incomplete',