@the-open-engine/zeroshot 6.24.0 → 6.25.1

package/task-lib/commands/clean.js

@@ -1,7 +1,88 @@
 import { unlinkSync, existsSync } from 'fs';
 import chalk from 'chalk';
-import { loadTasks, saveTasks } from '../store.js';
+import { clearTaskCommandCleanup, loadTasks, removeTaskIfUnchanged } from '../store.js';
 import { createCommandSpecCleanup } from '../command-spec-cleanup.js';
+import { cleanupOmpSessionPartitionForTask } from '../omp-session-cleanup.js';
+
+/**
+ * Delete a task's OMP session partition directory as part of removing its row. Every ownership
+ * state is cleaned here, including `provisional`: the row is going away, so leaving its partition
+ * behind would orphan a directory nothing can ever reclaim. The shared OMP CAS blob root is never
+ * touched. An unsafe/unresolvable path — or an ownership record that exists but cannot be read —
+ * preserves the record, and therefore the whole task row, with an actionable warning.
+ */
+export function cleanUpOmpSessionPartition(task, warn) {
+  return cleanupOmpSessionPartitionForTask(task, warn);
+}
+
+/**
+ * The live-task retention boundary, evaluated before *any* cleanup side effect.
+ *
+ * A running task owns everything the row points at: its OMP session partition is the working
+ * directory of a live provider process, and its command-cleanup receipt names paths that process
+ * is still using. This used to be checked only inside the `commandCleanup` branch — i.e. after the
+ * OMP partition had already been staged and recursively deleted — so `clean --all` could destroy a
+ * live session's transcript for any task that happened not to carry a cleanup receipt.
+ */
+function isLiveTask(task) {
+  return task.status === 'running';
+}
+
+/**
+ * Remove one task row that `clean` selected, in the only order that is safe:
+ * live-task check, then OMP partition, then command cleanup, then log file, then an owner-fenced
+ * row delete.
+ *
+ * `task` is a snapshot from the caller's single `loadTasks()`, so the delete is conditional on the
+ * row still matching it (see removeTaskIfUnchanged). A watcher update, a kill, or a resume's
+ * ownership transfer landing mid-cleanup leaves the row in place rather than being reverted by a
+ * whole-table rewrite.
+ *
+ * @returns {{removed: boolean, reason: string|null}} `reason` is a short retention label
+ */
+export function removeCleanedTask(task, { warn }) {
+  if (isLiveTask(task)) {
+    return { removed: false, reason: 'running' };
+  }
+  if (!cleanUpOmpSessionPartition(task, warn)) {
+    return { removed: false, reason: 'OMP partition cleanup pending' };
+  }
+
+  let cleanupCleared = false;
+  if (task.commandCleanup) {
+    let recovered = false;
+    try {
+      const cleanup = createCommandSpecCleanup(task.commandCleanup, (cleanupPath, error) => {
+        warn(`failed to clean up ${cleanupPath}: ${error.message}`);
+      });
+      recovered = cleanup.runSync();
+    } catch (error) {
+      warn(`failed to validate cleanup for task ${task.id}: ${error.message}`);
+    }
+    if (!recovered) {
+      return { removed: false, reason: 'command cleanup pending' };
+    }
+    cleanupCleared = true;
+  }
+
+  if (task.logFile && existsSync(task.logFile)) {
+    unlinkSync(task.logFile);
+  }
+
+  if (
+    !removeTaskIfUnchanged(task.id, {
+      status: task.status,
+      ompSessionOwnership: task.ompSessionOwnership ?? null,
+    })
+  ) {
+    // The row moved on under us. Its side effects are already done, so record the one piece of
+    // durable state that would otherwise be retried forever, using a single-column write that
+    // cannot clobber whatever the concurrent writer just persisted.
+    if (cleanupCleared) clearTaskCommandCleanup(task.id, task.commandCleanup);
+    return { removed: false, reason: 'the row changed while it was being cleaned' };
+  }
+  return { removed: true, reason: null };
+}
 
 export function cleanTasks(options = {}) {
   const tasks = loadTasks();
@@ -36,45 +117,21 @@ export function cleanTasks(options = {}) {
   console.log(chalk.dim(`Removing ${toRemove.length} task(s)...\n`));
 
   for (const task of toRemove) {
-    if (task.commandCleanup) {
-      if (task.status === 'running') {
-        cleanupFailed = true;
-        console.log(
-          chalk.yellow(`  Retained: ${task.id} [running] (live command cleanup ownership)`)
-        );
-        continue;
-      }
-      let recovered = false;
-      try {
-        const cleanup = createCommandSpecCleanup(task.commandCleanup, (cleanupPath, error) => {
-          console.log(chalk.yellow(`Warning: failed to clean up ${cleanupPath}: ${error.message}`));
-        });
-        recovered = cleanup.runSync();
-      } catch (error) {
-        console.log(
-          chalk.yellow(`Warning: failed to validate cleanup for task ${task.id}: ${error.message}`)
-        );
-      }
-      if (!recovered) {
-        cleanupFailed = true;
-        console.log(
-          chalk.yellow(`  Retained: ${task.id} [${task.status}] (command cleanup pending)`)
-        );
-        continue;
-      }
-      task.commandCleanup = null;
-    }
-    if (task.logFile && existsSync(task.logFile)) {
-      unlinkSync(task.logFile);
+    const { removed, reason } = removeCleanedTask(task, {
+      warn: (message) => console.log(chalk.yellow(`Warning: ${message}`)),
+    });
+    if (!removed) {
+      cleanupFailed = true;
+      console.log(chalk.yellow(`  Retained: ${task.id} [${task.status}] (${reason})`));
+      continue;
     }
-
     console.log(chalk.dim(`  Removed: ${task.id} [${task.status}]`));
-    delete tasks[task.id];
     removedCount++;
   }
 
-  saveTasks(tasks);
-
+  // No whole-table rewrite here by design. Rows are deleted individually above, each fenced on the
+  // snapshot it was validated against, so a concurrent watcher/kill/ownership-transfer write is
+  // never reverted by cleanup finishing after it.
   console.log(chalk.green(`\n✓ Cleaned ${removedCount} task(s)`));
   if (cleanupFailed) process.exitCode = 1;
 }

package/task-lib/commands/kill.js

@@ -2,6 +2,25 @@ import chalk from 'chalk';
 import { getTask, requestTaskCancellation, updateTask } from '../store.js';
 import { createCommandSpecCleanup } from '../command-spec-cleanup.js';
 import { terminateProcess } from '../process-termination.js';
+import { retireOmpOwnershipAtTerminalBoundary } from '../omp-session-ownership.js';
+
+/**
+ * Retire the task's OMP session ownership at a confirmed terminal boundary (killed / stale).
+ *
+ * A killed task's provisional partition claim would otherwise outlive the process that made it: no
+ * watcher is left to reach `finalizeOmpOwnership`, and cleanup refuses to reclaim a partition any
+ * row still claims provisionally, so the directory would be unreclaimable forever. Runs *before*
+ * the terminal status write so no window exists where the row is terminal but still claiming.
+ */
+function retireOmpOwnershipForKilledTask(taskId) {
+  retireOmpOwnershipAtTerminalBoundary(taskId, (error) => {
+    console.log(
+      chalk.yellow(
+        `Warning: failed to retire the OMP session ownership of task ${taskId}: ${error.message}`
+      )
+    );
+  });
+}
 
 async function cleanupTerminatedTask(task) {
   if (!task.commandCleanup) return {};
@@ -125,6 +144,7 @@ export async function killTaskCommand(taskId, options = {}) {
     }
     console.log(chalk.yellow('Process already dead, updating status...'));
     const cleanupUpdate = await cleanupTerminatedTask(task);
+    retireOmpOwnershipForKilledTask(taskId);
     updateTask(taskId, {
       status: 'stale',
       pid: null,
@@ -147,6 +167,7 @@ export async function killTaskCommand(taskId, options = {}) {
     if (result.degraded) {
       console.log(chalk.yellow(`Warning: ${result.degradedReason}`));
     }
+    retireOmpOwnershipForKilledTask(taskId);
     updateTask(taskId, {
       status: 'killed',
       pid: null,

package/task-lib/commands/resume.js

@@ -2,14 +2,76 @@ import chalk from 'chalk';
 import { createRequire } from 'module';
 import { getTask } from '../store.js';
 import { spawnTask } from '../runner.js';
+import { validateOwnedByTask } from '../omp-session-ownership-schema.js';
 
 const require = createRequire(import.meta.url);
 const { providerSupportsCapability } = require('../../lib/provider-names.js');
 
+/**
+ * Manual standalone resume (`zeroshot task resume <id>`) reuses the *exact* persisted partition
+ * under the storage root recorded on the owner row, and asserts the complete committed tuple —
+ * including the partition identity, which the cluster path can only learn from the row itself.
+ * `state === 'committed'` is required: a provisional or cleanup-required record never durably
+ * proved a resumable session, so anything less fails closed to a fresh context.
+ *
+ * This surface is standalone-only, and refuses a `cluster-agent` owner outright.
+ *
+ * A cluster-agent lineage belongs to a live agent generation: the committed record is the tail of
+ * an `agentId`/`clusterId`/iteration chain whose next turn is spawned by that agent process, and
+ * only that process can reach the post-hook boundary where a cluster-agent owner may be committed
+ * (agent-lifecycle.js#finalizeProviderSessionAfterCommit). Handing those ids to a detached
+ * `zeroshot task resume` would transfer the whole lineage onto a row no parent agent knows about
+ * or can ever commit: the prior owner's record is cleared by the transfer, the resumed row stays
+ * provisional to the end of time, and the partition becomes unreclaimable while the agent that
+ * *should* own the continuation silently falls back to a fresh context. Refusing before spawn is
+ * what keeps that lineage intact and resumable by its real owner.
+ */
+function buildOmpResumeTaskOptions(task) {
+  const ownership = validateOwnedByTask(task.ompSessionOwnership, task.id);
+  if (!ownership) {
+    throw new Error(`Task ${task.id} has no valid OMP session ownership record; refusing resume.`);
+  }
+  if (ownership.owner.kind !== 'standalone') {
+    throw new Error(
+      `Task ${task.id} OMP session is owned by cluster agent ${ownership.owner.clusterId}/${ownership.owner.agentId}; manual resume is standalone-only. Let the owning agent continue it.`
+    );
+  }
+  if (ownership.state !== 'committed' || !ownership.session || !ownership.partitionIdentity) {
+    throw new Error(
+      `Task ${task.id} OMP session ownership is '${ownership.state}', not a committed resumable session; refusing resume.`
+    );
+  }
+  return {
+    cwd: ownership.canonicalWorkspace,
+    provider: task.provider,
+    storageRoot: ownership.storageRoot,
+    // A standalone owner carries null cluster/agent ids by schema, so the resumed row is
+    // standalone too. They are passed explicitly rather than omitted so this stays an exact
+    // lineage copy of the record above, not an inference.
+    clusterId: ownership.owner.clusterId,
+    agentId: ownership.owner.agentId,
+    ompResume: {
+      priorOwnerTaskId: task.id,
+      partitionId: ownership.partitionId,
+      sessionFileName: ownership.session.fileName,
+      expectedSessionId: ownership.session.sessionId,
+      expectedPartitionIdentity: ownership.partitionIdentity,
+      expectedSessionFileIdentity: ownership.session.fileIdentity,
+      expectedArtifactManifestDigest: ownership.session.artifactManifestDigest,
+      expectedExecutionFingerprint: ownership.session.executionFingerprint,
+      expectedSelectedProvider: ownership.session.selectedProvider,
+      expectedSelectedModel: ownership.session.selectedModel,
+    },
+  };
+}
+
 export function buildResumeTaskOptions(task) {
   if (!providerSupportsCapability(task.provider, 'sessionResume')) {
     throw new Error(`Provider ${task.provider} does not support safe session resume.`);
   }
+  if (task.provider === 'omp') {
+    return buildOmpResumeTaskOptions(task);
+  }
   if (
     task.requestedResumeSessionId &&
     (task.status !== 'completed' || task.resumeIdentityVerified !== true)

package/task-lib/commands/run.js

@@ -1,6 +1,85 @@
 import chalk from 'chalk';
 import { shouldUseAttachableWatcher, spawnTask } from '../runner.js';
 
+// Every field the agent's `providerSession.ompSession` snapshot carries, plus the outer tuple's
+// session ID and the prior owner's task id. All are required: the descriptor is only ever built
+// from a complete committed record, and task-lib/runner.js re-checks every one of them against
+// that record before a task row exists. Missing/extra/mistyped fields fail closed here.
+const OMP_RESUME_STRING_FIELDS = [
+  'priorOwnerTaskId',
+  'partitionId',
+  'sessionFileName',
+  'expectedSessionId',
+  'expectedArtifactManifestDigest',
+  'expectedExecutionFingerprint',
+  'expectedSelectedProvider',
+  'expectedSelectedModel',
+];
+const OMP_RESUME_IDENTITY_FIELDS = ['expectedSessionFileIdentity'];
+const OMP_RESUME_OPTIONAL_IDENTITY_FIELDS = ['expectedPartitionIdentity'];
+const OMP_RESUME_ALLOWED_FIELDS = new Set([
+  ...OMP_RESUME_STRING_FIELDS,
+  ...OMP_RESUME_IDENTITY_FIELDS,
+  ...OMP_RESUME_OPTIONAL_IDENTITY_FIELDS,
+]);
+
+// Issue #866 fixes device/inode as *canonical unsigned decimal strings*. This descriptor arrives
+// over argv from another process, so the type is checked, never coerced: `String(value.device)`
+// would have accepted the JSON number 42, `new String('42')`, `['42']`, and anything else with a
+// matching toString, then silently canonicalized it into a string the persisted record never
+// contained. A descriptor that does not already carry the canonical form is a descriptor built by
+// something other than this codebase's writer, and it fails closed rather than being repaired.
+const CANONICAL_DECIMAL = /^(0|[1-9][0-9]*)$/;
+const IDENTITY_KEYS = new Set(['device', 'inode']);
+
+function isCanonicalDecimalString(value) {
+  return typeof value === 'string' && CANONICAL_DECIMAL.test(value);
+}
+
+function isIdentityShape(value) {
+  return (
+    value !== null &&
+    typeof value === 'object' &&
+    !Array.isArray(value) &&
+    Object.keys(value).length === IDENTITY_KEYS.size &&
+    Object.keys(value).every((key) => IDENTITY_KEYS.has(key)) &&
+    isCanonicalDecimalString(value.device) &&
+    isCanonicalDecimalString(value.inode)
+  );
+}
+
+export function parseOmpResumeDescriptor(raw) {
+  if (!raw) return undefined;
+  let descriptor;
+  try {
+    descriptor = JSON.parse(raw);
+  } catch (error) {
+    throw new Error(`--omp-resume must be a JSON descriptor: ${error.message}`);
+  }
+  if (!descriptor || typeof descriptor !== 'object' || Array.isArray(descriptor)) {
+    throw new Error('--omp-resume descriptor must be a JSON object.');
+  }
+  const unknown = Object.keys(descriptor).filter((key) => !OMP_RESUME_ALLOWED_FIELDS.has(key));
+  if (unknown.length > 0) {
+    throw new Error(`--omp-resume descriptor has unknown field(s): ${unknown.join(', ')}.`);
+  }
+  const missing = [
+    ...OMP_RESUME_STRING_FIELDS.filter(
+      (field) => typeof descriptor[field] !== 'string' || descriptor[field].length === 0
+    ),
+    ...OMP_RESUME_IDENTITY_FIELDS.filter((field) => !isIdentityShape(descriptor[field])),
+  ];
+  if (missing.length > 0) {
+    throw new Error(`--omp-resume descriptor is missing/invalid field(s): ${missing.join(', ')}.`);
+  }
+  for (const field of OMP_RESUME_OPTIONAL_IDENTITY_FIELDS) {
+    if (descriptor[field] !== undefined && !isIdentityShape(descriptor[field])) {
+      throw new Error(`--omp-resume descriptor field ${field} is not a device/inode identity.`);
+    }
+  }
+  return descriptor;
+}
+
 export async function runTask(prompt, options = {}) {
   if (!prompt || prompt.trim().length === 0) {
     console.log(chalk.red('Error: Prompt is required'));
@@ -36,6 +115,7 @@ export async function runTask(prompt, options = {}) {
     provider: options.provider,
     resume: options.resume,
     continue: options.continue,
+    ompResume: parseOmpResumeDescriptor(options.ompResume),
     outputFormat,
     jsonSchema,
     mcpConfig: options.mcpConfig,

package/task-lib/omp-session-cleanup.js

@@ -0,0 +1,197 @@
+// The single implementation behind all three OMP session-partition cleanup surfaces required by
+// issue #866: standalone task `clean` (task-lib/commands/clean.js), cluster clear
+// (cli/index.js deleteClusterData, also reached by `zeroshot purge`), and global `purge`
+// (cli/index.js, which runs cluster clear then `clean --all`).
+//
+// Three invariants hold on every surface:
+//   * A committed session stays available for resume until its own task record is being removed —
+//     cleanup is driven by the task row, never by scanning the partition tree for orphans.
+//   * A partition is never deleted while any *other* row holds an authoritative claim on it.
+//     Several rows can name one partition at once: a resumed row is inserted before its owner
+//     transfer runs, so two competing resumes of one committed session put three rows on it. The
+//     fence is therefore over every authoritative row (provisional or committed), never over the
+//     committed rows alone — after a transfer the live owner is `provisional` and no row is
+//     committed at all.
+//   * The shared, machine-wide OMP CAS blob root (src/omp-blob-root.js) is never touched. Blobs
+//     are addressed from *other* sessions' JSONL too, so deleting one is data loss for unrelated
+//     work; stageOmpSessionPartitionForDeletion refuses any path that resolves inside it.
+//
+// An unsafe or unresolvable path preserves the owner record with an actionable warning instead of
+// deleting, so the operator can inspect it and the cleanup stays durably retryable.
+import {
+  loadTasks,
+  updateTask,
+  getTaskStoreDatabase,
+  hasUnreadableOmpSessionOwnership,
+} from './store.js';
+import { findAuthoritativeOwnersForPartition } from './omp-session-ownership.js';
+import {
+  serializeOmpSessionOwnership,
+  validateOwnedByTask,
+} from './omp-session-ownership-schema.js';
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+const {
+  removeStagedOmpSessionPartition,
+  stageOmpSessionPartitionForDeletion,
+} = require('../src/omp-session-partition.js');
+
+/**
+ * Take the partition away from its canonical name under a task-store write fence, then remove the
+ * staged tree outside it.
+ *
+ * The fence spans exactly three steps: "this row still holds the record cleanup validated", "no
+ * other row holds an authoritative claim on this partition", and "the partition no longer answers
+ * to its canonical name". Without it, a resume could insert its provisional row — or win its
+ * ownership transfer — in the gap between the checks and the rename, and cleanup would move a live
+ * session out from under it. `BEGIN IMMEDIATE` takes the write lock up front, so every competing
+ * ownership write is serialized either wholly before the checks (and is therefore seen by them) or
+ * wholly after the rename, where it lands on a partition that is already gone and fails that turn
+ * closed rather than costing a live one its data.
+ *
+ * The row re-read closes the same race from the caller's side: every cleanup surface iterates a
+ * task snapshot taken by an earlier `loadTasks()`, and a resume that transferred this partition
+ * away in the meantime leaves that snapshot describing a record the row no longer holds — acting
+ * on it would delete the partition on behalf of an owner that has already released it. `store.js`
+ * writes this column only through `serializeOmpSessionOwnership`, whose output is canonical per
+ * record, so comparing the stored bytes is an exact "still the same record" test.
+ *
+ * The recursive removal runs *after* the fence is released. By then the tree only answers to its
+ * deterministic owner-bound staging name, and every retry revalidates that name and identity.
+ * Holding a write lock across an arbitrarily large `rm -r` would stall every other store writer.
+ */
+function describeBlockingOwner(owner) {
+  if (owner.unknown) {
+    return `${owner.taskId} (ownership record is unreadable or invalid; inspect or repair that task row)`;
+  }
+  return `${owner.taskId} (${owner.state})`;
+}
+
+function stageUnderOwnerFence(ownership, taskId) {
+  const database = getTaskStoreDatabase();
+  const expectedRecord = serializeOmpSessionOwnership(ownership);
+  const readRecord = database.prepare(
+    'SELECT omp_session_ownership AS record FROM tasks WHERE id = ?'
+  );
+  const fenced = database.transaction(() => {
+    const row = readRecord.get(taskId);
+    if (!row || row.record !== expectedRecord) {
+      return {
+        staged: false,
+        deleted: false,
+        reason: 'its ownership record changed while cleanup was running',
+      };
+    }
+    const owners = findAuthoritativeOwnersForPartition(ownership.partitionId, taskId, database);
+    if (owners.length > 0) {
+      return {
+        staged: false,
+        deleted: false,
+        reason: `it is still claimed by ${owners.map(describeBlockingOwner).join(', ')}`,
+      };
+    }
+    return stageOmpSessionPartitionForDeletion(ownership);
+  });
+  // BEGIN IMMEDIATE: take the write lock up front so the checks cannot run under a shared lock that
+  // another writer is simultaneously upgrading.
+  return fenced.immediate();
+}
+
+/**
+ * Delete one task's OMP session partition. Returns true when the task row is now safe to remove
+ * (nothing to clean, or the partition is gone).
+ *
+ * @param {object} task task record as returned by the store
+ * @param {(message: string) => void} warn receives an actionable message for a retained partition
+ * @param {{clearRecord?: boolean}} options `clearRecord` NULLs the row's ownership after a
+ *   successful delete — required on surfaces (cluster clear) where the row itself survives.
+ */
+export function cleanupOmpSessionPartitionForTask(task, warn, { clearRecord = false } = {}) {
+  // A SQL-NULL ownership column is exact truth that this task never allocated a partition: there
+  // is nothing to clean and the row is free to go. An *unreadable* column is the opposite — some
+  // partition may exist that only this row still points at — so the row and its evidence are
+  // retained for an operator instead of being deleted into an orphan. The malformed bytes are
+  // never parsed, canonicalized, or otherwise acted on.
+  if (hasUnreadableOmpSessionOwnership(task)) {
+    warn(
+      `Task ${task.id}: OMP session ownership record is present but unreadable; retaining the task row and its record for inspection. Nothing was deleted, and any partition it named must be reclaimed manually.`
+    );
+    return false;
+  }
+  if (!task?.ompSessionOwnership) return true;
+  const ownership = validateOwnedByTask(task.ompSessionOwnership, task.id);
+  if (!ownership) {
+    warn(
+      `Task ${task.id}: retained an OMP session ownership record that failed validation; nothing was deleted.`
+    );
+    return false;
+  }
+
+  // More than one row can name a single partition: a resume inserts its provisional row before its
+  // ownership transfer runs, and two competing resumes of one committed session put three rows on
+  // it. The fence is therefore every *authoritative* (provisional or committed) claim other than
+  // this row's — a crashed-before-transfer resume must not delete the prior owner's still-resumable
+  // session, and a losing competing resume must not delete the winner's live one.
+  const staged = stageUnderOwnerFence(ownership, task.id);
+  if (!staged.staged) {
+    if (staged.deleted) return finishCleanup(task, clearRecord);
+    warn(
+      `Task ${task.id}: retained OMP session partition ${ownership.partitionId} (${staged.reason}).`
+    );
+    return false;
+  }
+
+  const { deleted, reason } = removeStagedOmpSessionPartition(staged.stagingPath, ownership);
+  if (!deleted) {
+    warn(`Task ${task.id}: retained OMP session partition ${ownership.partitionId} (${reason}).`);
+    return false;
+  }
+  return finishCleanup(task, clearRecord);
+}
+
+function finishCleanup(task, clearRecord) {
+  if (clearRecord) {
+    updateTask(task.id, { ompSessionOwnership: null });
+  }
+  return true;
+}
+
+/**
+ * Delete every OMP session partition owned by a cluster's agents. Cluster partitions live under
+ * the cluster's own `storageDir`, so this is what makes cluster clear (and therefore purge)
+ * actually reclaim them; the task rows themselves survive and have their ownership cleared.
+ *
+ * A row whose ownership column is present but unreadable cannot be attributed to a cluster at all
+ * — the owner tuple is exactly what is unreadable — so it is reported separately (`unreadable`)
+ * rather than silently skipped. Cluster clear keeps task rows, so the evidence survives either way;
+ * the warning is what tells the operator a partition may need reclaiming by hand.
+ *
+ * @returns {{deleted: string[], retained: string[], unreadable: string[]}} partition ids, plus the
+ *   task ids whose ownership record could not be read
+ */
+export function cleanupOmpSessionPartitionsForCluster(clusterId, warn) {
+  const deleted = [];
+  const retained = [];
+  const unreadable = [];
+  if (!clusterId) return { deleted, retained, unreadable };
+
+  for (const task of Object.values(loadTasks())) {
+    if (hasUnreadableOmpSessionOwnership(task)) {
+      unreadable.push(task.id);
+      warn(
+        `Task ${task.id}: OMP session ownership record is present but unreadable, so it cannot be attributed to a cluster; the row and its record are retained for inspection.`
+      );
+      continue;
+    }
+    const ownership = validateOwnedByTask(task?.ompSessionOwnership ?? null, task?.id);
+    if (!ownership || ownership.owner.kind !== 'cluster-agent') continue;
+    if (ownership.owner.clusterId !== clusterId) continue;
+    if (cleanupOmpSessionPartitionForTask(task, warn, { clearRecord: true })) {
+      deleted.push(ownership.partitionId);
+    } else {
+      retained.push(ownership.partitionId);
+    }
+  }
+  return { deleted, retained, unreadable };
+}