@timurproko/a1 0.1.8-dev.224 → 0.1.8-dev.226

package/dist/foundation/release/cohort-state.d.ts

@@ -43,9 +43,30 @@ export interface ReleaseCleanupDiagnostic {
     readonly attemptedAt: string;
     readonly error: string;
 }
+export type ReleaseCleanupWorkerStatus = "scheduled" | "running" | "completed" | "blocked" | "continued" | "failed" | "skipped";
+export interface ReleaseCleanupWorkerRun {
+    readonly runId: string;
+    readonly status: ReleaseCleanupWorkerStatus;
+    readonly scheduledAt: string;
+    readonly startedAt: string | null;
+    readonly completedAt: string | null;
+    readonly pid: number | null;
+    readonly batches: number;
+    readonly attempted: number;
+    readonly completed: number;
+    readonly remaining: number;
+    readonly error: string | null;
+}
+export interface ReleaseCleanupWorkerSummary {
+    readonly batches: number;
+    readonly attempted: number;
+    readonly completed: number;
+    readonly remaining: number;
+}
 export interface ReleaseCleanupState {
     readonly pending: Readonly<Record<string, ReleaseCleanupDisposition>>;
     readonly diagnostics: readonly ReleaseCleanupDiagnostic[];
+    readonly workerRuns: readonly ReleaseCleanupWorkerRun[];
 }
 export interface CohortState {
     readonly schema: typeof RELEASE_COHORT_SCHEMA;
@@ -126,6 +147,10 @@ export declare class CohortStateStore {
     markCleanupTrash(releaseId: string, trashPath: string): Promise<CohortState>;
     recordCleanupFailure(releaseId: string, stage: string, error: unknown): Promise<CohortState>;
     completeCleanup(releaseId: string): Promise<CohortState>;
+    recordCleanupWorkerScheduled(runId: string): Promise<CohortState>;
+    recordCleanupWorkerStarted(runId: string, pid: number): Promise<CohortState>;
+    recordCleanupWorkerProgress(runId: string, summary: ReleaseCleanupWorkerSummary): Promise<CohortState>;
+    recordCleanupWorkerFinished(runId: string, status: Exclude<ReleaseCleanupWorkerStatus, "scheduled" | "running">, summary: ReleaseCleanupWorkerSummary, error?: unknown): Promise<CohortState>;
     removeUnreferencedRelease(releaseId: string, externalReferences: readonly string[]): Promise<CohortState>;
 }
 export declare function emptyState(): CohortState;

package/dist/foundation/release/cohort-state.js

@@ -219,6 +219,7 @@ export class CohortStateStore {
             return {
                 ...current,
                 cleanup: {
+                    ...current.cleanup,
                     pending,
                     diagnostics: [...current.cleanup.diagnostics, { releaseId, stage, attemptedAt, error: message }].slice(-64),
                 },
@@ -232,6 +233,55 @@ export class CohortStateStore {
             return { ...current, cleanup: { ...current.cleanup, pending } };
         });
     }
+    async recordCleanupWorkerScheduled(runId) {
+        return await this.update(current => {
+            const scheduledAt = new Date().toISOString();
+            const run = {
+                runId,
+                status: "scheduled",
+                scheduledAt,
+                startedAt: null,
+                completedAt: null,
+                pid: null,
+                batches: 0,
+                attempted: 0,
+                completed: 0,
+                remaining: Object.keys(current.cleanup.pending).length,
+                error: null,
+            };
+            return { ...current, cleanup: { ...current.cleanup, workerRuns: [...current.cleanup.workerRuns, run].slice(-16) } };
+        });
+    }
+    async recordCleanupWorkerStarted(runId, pid) {
+        return await this.update(current => replaceCleanupWorkerRun(current, runId, existing => ({
+            ...(existing ?? cleanupWorkerRun(runId, Object.keys(current.cleanup.pending).length)),
+            status: "running",
+            startedAt: new Date().toISOString(),
+            completedAt: null,
+            pid,
+            error: null,
+        })));
+    }
+    async recordCleanupWorkerProgress(runId, summary) {
+        return await this.update(current => replaceCleanupWorkerRun(current, runId, existing => ({
+            ...(existing ?? cleanupWorkerRun(runId, summary.remaining)),
+            status: "running",
+            startedAt: existing?.startedAt ?? new Date().toISOString(),
+            pid: existing?.pid ?? process.pid,
+            ...summary,
+        })));
+    }
+    async recordCleanupWorkerFinished(runId, status, summary, error = null) {
+        return await this.update(current => replaceCleanupWorkerRun(current, runId, existing => ({
+            ...(existing ?? cleanupWorkerRun(runId, summary.remaining)),
+            status,
+            startedAt: existing?.startedAt ?? new Date().toISOString(),
+            completedAt: new Date().toISOString(),
+            pid: existing?.pid ?? process.pid,
+            ...summary,
+            error: error === null ? null : boundedError(error),
+        })));
+    }
     async removeUnreferencedRelease(releaseId, externalReferences) {
         return await this.update(current => {
             const release = requiredRelease(current, releaseId);
@@ -264,7 +314,7 @@ export function emptyState() {
         revision: 0,
         releases: {},
         references: { active: null, pending: null, approved: null, rollback: null, retention: [] },
-        cleanup: { pending: {}, diagnostics: [] },
+        cleanup: { pending: {}, diagnostics: [], workerRuns: [] },
         activation: activation("idle", null),
     };
 }
@@ -274,6 +324,28 @@ function cleanupDisposition(release, stage, trashPath) {
 function replaceCleanup(current, releaseId, disposition) {
     return { ...current, cleanup: { ...current.cleanup, pending: { ...current.cleanup.pending, [releaseId]: disposition } } };
 }
+function cleanupWorkerRun(runId, remaining) {
+    return {
+        runId,
+        status: "scheduled",
+        scheduledAt: new Date().toISOString(),
+        startedAt: null,
+        completedAt: null,
+        pid: null,
+        batches: 0,
+        attempted: 0,
+        completed: 0,
+        remaining,
+        error: null,
+    };
+}
+function replaceCleanupWorkerRun(current, runId, operation) {
+    const existing = current.cleanup.workerRuns.find(run => run.runId === runId);
+    const workerRuns = existing
+        ? current.cleanup.workerRuns.map(run => run.runId === runId ? operation(run) : run)
+        : [...current.cleanup.workerRuns, operation(undefined)];
+    return { ...current, cleanup: { ...current.cleanup, workerRuns: workerRuns.slice(-16) } };
+}
 function activation(state, reason) {
     return { state, reason, blockerGenerationIds: [], updatedAt: new Date().toISOString() };
 }
@@ -342,17 +414,32 @@ function normalizeState(value) {
     if (!value || typeof value !== "object")
         return value;
     const state = value;
+    const cleanup = state.cleanup;
     return {
         ...state,
-        cleanup: state.cleanup ?? { pending: {}, diagnostics: [] },
+        cleanup: cleanup
+            ? { ...cleanup, workerRuns: cleanup.workerRuns ?? [] }
+            : { pending: {}, diagnostics: [], workerRuns: [] },
     };
 }
 function validateState(state) {
     if (!state || state.schema !== RELEASE_COHORT_SCHEMA || !Number.isSafeInteger(state.revision) || state.revision < 0
         || !state.releases || typeof state.releases !== "object" || !state.references || !Array.isArray(state.references.retention)
-        || !state.cleanup || typeof state.cleanup.pending !== "object" || !Array.isArray(state.cleanup.diagnostics)) {
+        || !state.cleanup || typeof state.cleanup.pending !== "object" || !Array.isArray(state.cleanup.diagnostics)
+        || !Array.isArray(state.cleanup.workerRuns)) {
         throw new Error("invalid release cohort state");
     }
+    for (const run of state.cleanup.workerRuns) {
+        if (!run || typeof run.runId !== "string" || run.runId.length === 0
+            || !["scheduled", "running", "completed", "blocked", "continued", "failed", "skipped"].includes(run.status)
+            || typeof run.scheduledAt !== "string" || (run.startedAt !== null && typeof run.startedAt !== "string")
+            || (run.completedAt !== null && typeof run.completedAt !== "string") || (run.pid !== null && (!Number.isSafeInteger(run.pid) || run.pid < 1))
+            || !Number.isSafeInteger(run.batches) || run.batches < 0 || !Number.isSafeInteger(run.attempted) || run.attempted < 0
+            || !Number.isSafeInteger(run.completed) || run.completed < 0 || run.completed > run.attempted
+            || !Number.isSafeInteger(run.remaining) || run.remaining < 0 || (run.error !== null && typeof run.error !== "string")) {
+            throw new Error("invalid release cleanup worker run");
+        }
+    }
     for (const [releaseId, release] of Object.entries(state.releases))
         validateReleaseRecord(releaseId, release);
     for (const reference of [state.references.active, state.references.pending, state.references.approved, state.references.rollback]) {

package/dist/foundation/release/release-gc.d.ts

@@ -19,6 +19,17 @@ export interface ReleaseCleanupOptions {
     readonly now?: () => number;
     /** Fault-injection seam for bounded filesystem recovery tests. */
     readonly operations?: ReleaseCleanupOperations;
+    /** Process-start seam for scheduler and continuation tests. */
+    readonly workerSpawner?: (entry: string, environment: NodeJS.ProcessEnv) => Promise<void>;
+}
+export interface ReleaseCleanupWorkerOptions {
+    readonly cleanup?: ReleaseCleanupOptions;
+    readonly maxDurationMs?: number;
+    readonly maxNoProgressBatches?: number;
+    readonly retryDelayMs?: number;
+    readonly now?: () => number;
+    readonly sleep?: (durationMs: number) => Promise<void>;
+    readonly continueWorker?: (dataDir: string, paths: ProductPaths, options: ReleaseCleanupOptions) => Promise<void>;
 }
 export interface ReleaseCleanupResult {
     readonly planned: number;
@@ -54,7 +65,7 @@ export declare function runBoundedReleaseCleanup(dataDir: string, paths?: Produc
  */
 export declare function scheduleReleaseCleanup(dataDir: string, paths: ProductPaths, options?: ReleaseCleanupOptions): Promise<void>;
 /** Entry used by the private cleanup executable shipped in every immutable release. */
-export declare function runReleaseCleanupWorker(environment?: NodeJS.ProcessEnv): Promise<ReleaseCleanupResult>;
+export declare function runReleaseCleanupWorker(environment?: NodeJS.ProcessEnv, workerOptions?: ReleaseCleanupWorkerOptions): Promise<ReleaseCleanupResult>;
 /** Compatibility helper: detach one requested release and execute a one-item pass. */
 export declare function collectRelease(store: CohortStateStore, dataDir: string, releaseId: string, externalReferences: readonly string[], paths?: ProductPaths): Promise<void>;
 export {};

package/dist/foundation/release/release-gc.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
-import { lstat, mkdir, readFile, readdir, realpath, rename, rm } from "node:fs/promises";
+import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm, stat } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CohortStateStore, planProtectedReleases, } from "./cohort-state.js";
@@ -13,7 +13,12 @@ import { PRODUCT_IDENTITY } from "../../product-identity.js";
 import { collectCompileCaches, startupCompileCachePath } from "../startup/index.js";
 const DEFAULT_CANDIDATE_AGE_MS = 60 * 60 * 1_000;
 const DEFAULT_LIMITS = { maxItems: 8, maxDurationMs: 2_000, concurrency: 1 };
+const DEFAULT_WORKER_DURATION_MS = 10 * 60 * 1_000;
+const DEFAULT_NO_PROGRESS_BATCHES = 5;
+const DEFAULT_RETRY_DELAY_MS = 500;
 const WORKER_HOLDS_ENV = "A1_RELEASE_CLEANUP_HOLDS";
+const WORKER_RUN_ID_ENV = "A1_RELEASE_CLEANUP_RUN_ID";
+const WORKER_LEASE_FILENAME = "release-cleanup-worker.lock";
 /**
  * Reconcile current ownership under the cohort-state lock and durably detach obsolete releases.
  * This operation intentionally reads only manifests and directory metadata, never payload bytes.
@@ -30,52 +35,85 @@ export async function prepareReleaseCleanup(dataDir, paths, options = {}) {
 }
 /** Run a bounded, restart-safe physical cleanup pass over detached releases and abandoned artifacts. */
 export async function runBoundedReleaseCleanup(dataDir, paths, options = {}) {
-    const startedAt = (options.now ?? Date.now)();
     const now = options.now ?? Date.now;
     const limits = normalizeLimits(options.limits);
     const { store, discovered } = await prepareReleaseCleanup(dataDir, paths, options);
+    // Performance: The physical-work allowance begins after discovery, ownership probes, and the
+    // durable reconciliation write. A slow preparation phase must not starve every worker invocation.
+    const startedAt = now();
     const initial = await store.read();
-    const pending = Object.values(initial.cleanup.pending).sort((left, right) => left.release.releaseId.localeCompare(right.release.releaseId));
-    let attempted = 0;
-    let completed = 0;
-    for (let offset = 0; offset < pending.length && attempted < limits.maxItems; offset += limits.concurrency) {
-        if (now() - startedAt >= limits.maxDurationMs)
-            break;
-        const batch = pending.slice(offset, Math.min(offset + limits.concurrency, offset + (limits.maxItems - attempted)));
-        attempted += batch.length;
-        const results = await Promise.all(batch.map(async (disposition) => await collectDisposition(store, dataDir, paths, disposition, options)));
-        completed += results.filter(Boolean).length;
-    }
-    const transaction = await (options.transactionStore ?? new UpdateTransactionStore(dataDir)).read();
+    const pending = sortCleanupDispositions(Object.values(initial.cleanup.pending));
+    const transactionStore = options.transactionStore ?? new UpdateTransactionStore(dataDir);
+    const transaction = await transactionStore.read();
     const activeTransaction = transaction?.status === "active";
-    const artifactBudget = Math.max(0, limits.maxItems - attempted);
-    const artifacts = [
+    const artifacts = sortArtifacts([
         ...(!activeTransaction ? discovered.candidates : []),
         ...discovered.unmanagedTrash,
         ...discovered.certifications,
-    ].slice(0, artifactBudget);
-    for (const artifact of artifacts) {
-        if (now() - startedAt >= limits.maxDurationMs)
-            break;
-        const certificationId = certificationReleaseId(artifact);
-        if (certificationId !== null) {
-            const inputs = await protectionInputs(paths, options.transactionStore ?? new UpdateTransactionStore(dataDir), options.externalHolds ?? []);
-            if (isProtectedDetachedRelease(await store.read(), inputs, certificationId))
-                continue;
-        }
-        attempted += 1;
-        try {
-            await removeAbandonedArtifact(dataDir, artifact, options.operations);
-            completed += 1;
+    ], initial);
+    let attempted = 0;
+    let completed = 0;
+    let pendingOffset = 0;
+    let artifactOffset = 0;
+    const hasTime = (guaranteed = false) => guaranteed || attempted === 0 || now() - startedAt < limits.maxDurationMs;
+    const attemptPending = async (maximum, guaranteed = false) => {
+        while (pendingOffset < pending.length && attempted < limits.maxItems && maximum > 0 && hasTime(guaranteed)) {
+            const size = Math.min(limits.concurrency, maximum, limits.maxItems - attempted, pending.length - pendingOffset);
+            const batch = pending.slice(pendingOffset, pendingOffset + size);
+            pendingOffset += size;
+            maximum -= size;
+            attempted += batch.length;
+            const results = await Promise.all(batch.map(async (disposition) => await collectDisposition(store, dataDir, paths, disposition, options)));
+            completed += results.filter(Boolean).length;
+            guaranteed = false;
         }
-        catch (error) {
-            await store.recordCleanupFailure(artifactName(artifact), "artifact-delete", error);
+    };
+    const attemptArtifacts = async (maximum, guaranteed = false) => {
+        while (artifactOffset < artifacts.length && attempted < limits.maxItems && maximum > 0 && hasTime(guaranteed)) {
+            const artifact = artifacts[artifactOffset++];
+            maximum -= 1;
+            const certificationId = certificationReleaseId(artifact);
+            if (certificationId !== null) {
+                const inputs = await protectionInputs(paths, transactionStore, options.externalHolds ?? []);
+                if (isProtectedDetachedRelease(await store.read(), inputs, certificationId))
+                    continue;
+            }
+            attempted += 1;
+            try {
+                await removeAbandonedArtifact(dataDir, artifact, options.operations);
+                completed += 1;
+            }
+            catch (error) {
+                await store.recordCleanupFailure(artifactName(artifact), "artifact-delete", error);
+            }
+            guaranteed = false;
         }
+    };
+    // Concurrency: Give each available class one opportunity before filling the batch. This keeps
+    // a locked release or a large release backlog from indefinitely starving candidates and evidence.
+    if (pending.length > 0)
+        await attemptPending(1, true);
+    if (artifacts.length > 0 && attempted < limits.maxItems)
+        await attemptArtifacts(1, true);
+    if (!activeTransaction && attempted < limits.maxItems) {
+        const layerResult = await collectUnreferencedDependencyLayers(store, dataDir, 1, options);
+        attempted += layerResult.attempted;
+        completed += layerResult.completed;
+    }
+    while (attempted < limits.maxItems && hasTime()) {
+        const before = attempted;
+        await attemptPending(1);
+        if (attempted < limits.maxItems)
+            await attemptArtifacts(1);
+        if (attempted === before)
+            break;
     }
-    if (!activeTransaction && attempted < limits.maxItems && now() - startedAt < limits.maxDurationMs) {
+    if (!activeTransaction && attempted < limits.maxItems && hasTime()) {
         const layerResult = await collectUnreferencedDependencyLayers(store, dataDir, limits.maxItems - attempted, options);
         attempted += layerResult.attempted;
         completed += layerResult.completed;
+    }
+    if (!activeTransaction && hasTime()) {
         await collectCompileCaches(dataDir, await protectedCompileCachePaths(dataDir, await store.read())).catch(() => { });
     }
     const remaining = Object.keys((await store.read()).cleanup.pending).length;
@@ -87,33 +125,102 @@ export async function runBoundedReleaseCleanup(dataDir, paths, options = {}) {
  */
 export async function scheduleReleaseCleanup(dataDir, paths, options = {}) {
     const { store } = await prepareReleaseCleanup(dataDir, paths, options);
+    const runId = randomUUID();
+    await store.recordCleanupWorkerScheduled(runId);
     const entry = fileURLToPath(new URL("../../../bin/release-cleanup.js", import.meta.url));
+    const environment = {
+        ...process.env,
+        [PRODUCT_IDENTITY.environment.dataDir]: dataDir,
+        [PRODUCT_IDENTITY.environment.runtimeDir]: paths.runtimeDir,
+        [WORKER_HOLDS_ENV]: JSON.stringify(options.externalHolds ?? []),
+        [WORKER_RUN_ID_ENV]: runId,
+    };
     try {
-        const child = spawn(process.execPath, [entry], {
-            detached: true,
-            windowsHide: true,
-            stdio: "ignore",
-            env: {
-                ...process.env,
-                [PRODUCT_IDENTITY.environment.dataDir]: dataDir,
-                [PRODUCT_IDENTITY.environment.runtimeDir]: paths.runtimeDir,
-                [WORKER_HOLDS_ENV]: JSON.stringify(options.externalHolds ?? []),
-            },
-        });
-        await new Promise((resolvePromise, rejectPromise) => {
-            child.once("spawn", resolvePromise);
-            child.once("error", rejectPromise);
-        });
-        child.unref();
+        await (options.workerSpawner ?? spawnCleanupWorker)(entry, environment);
     }
     catch (error) {
+        const summary = { batches: 0, attempted: 0, completed: 0, remaining: Object.keys((await store.read()).cleanup.pending).length };
+        await store.recordCleanupWorkerFinished(runId, "failed", summary, error);
         await store.recordCleanupFailure("worker", "spawn", error);
     }
 }
 /** Entry used by the private cleanup executable shipped in every immutable release. */
-export async function runReleaseCleanupWorker(environment = process.env) {
+export async function runReleaseCleanupWorker(environment = process.env, workerOptions = {}) {
     const paths = resolveProductPaths(environment);
-    return await runBoundedReleaseCleanup(paths.dataDir, paths, { externalHolds: parseWorkerHolds(environment[WORKER_HOLDS_ENV]) });
+    const store = new CohortStateStore(paths.dataDir);
+    const runId = environment[WORKER_RUN_ID_ENV] ?? randomUUID();
+    const now = workerOptions.now ?? Date.now;
+    const sleep = workerOptions.sleep ?? (async (durationMs) => await new Promise(resolvePromise => setTimeout(resolvePromise, durationMs)));
+    const cleanupOptions = {
+        ...workerOptions.cleanup,
+        externalHolds: workerOptions.cleanup?.externalHolds ?? parseWorkerHolds(environment[WORKER_HOLDS_ENV]),
+    };
+    const summary = { batches: 0, attempted: 0, completed: 0, remaining: Object.keys((await store.read()).cleanup.pending).length };
+    let lease = null;
+    let continuation = false;
+    let status = "completed";
+    let failure = null;
+    const startedAt = now();
+    try {
+        lease = await acquireWorkerLease(paths.dataDir, runId);
+        if (lease === null) {
+            status = "skipped";
+            failure = "another release cleanup worker owns the data root";
+            return { planned: 0, attempted: 0, completed: 0, remaining: summary.remaining, durationMs: 0 };
+        }
+        await store.recordCleanupWorkerStarted(runId, process.pid);
+        let noProgressBatches = 0;
+        while (true) {
+            const result = await runBoundedReleaseCleanup(paths.dataDir, paths, cleanupOptions);
+            summary.batches += 1;
+            summary.attempted += result.attempted;
+            summary.completed += result.completed;
+            summary.remaining = result.remaining;
+            await store.recordCleanupWorkerProgress(runId, summary);
+            if (result.attempted === 0)
+                break;
+            if (result.completed === 0) {
+                noProgressBatches += 1;
+                if (noProgressBatches >= (workerOptions.maxNoProgressBatches ?? DEFAULT_NO_PROGRESS_BATCHES)) {
+                    status = "blocked";
+                    failure = "cleanup made no progress within its bounded retry allowance";
+                    break;
+                }
+                await sleep((workerOptions.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS) * (2 ** (noProgressBatches - 1)));
+            }
+            else {
+                noProgressBatches = 0;
+            }
+            if (now() - startedAt >= (workerOptions.maxDurationMs ?? DEFAULT_WORKER_DURATION_MS)) {
+                status = "continued";
+                continuation = true;
+                break;
+            }
+        }
+    }
+    catch (error) {
+        status = "failed";
+        failure = error;
+    }
+    finally {
+        if (lease !== null)
+            await releaseWorkerLease(paths.dataDir, runId, lease);
+        await store.recordCleanupWorkerFinished(runId, status, summary, failure);
+    }
+    if (continuation) {
+        await (workerOptions.continueWorker ?? scheduleReleaseCleanup)(paths.dataDir, paths, cleanupOptions).catch(async (error) => {
+            await store.recordCleanupFailure("worker", "continuation", error);
+        });
+    }
+    if (status === "failed")
+        throw failure instanceof Error ? failure : new Error(errorMessage(failure));
+    return {
+        planned: summary.remaining + summary.completed,
+        attempted: summary.attempted,
+        completed: summary.completed,
+        remaining: summary.remaining,
+        durationMs: Math.max(0, now() - startedAt),
+    };
 }
 /** Compatibility helper: detach one requested release and execute a one-item pass. */
 export async function collectRelease(store, dataDir, releaseId, externalReferences, paths) {
@@ -305,11 +412,9 @@ async function assertReleaseDirectory(path, parent, release, expectedName) {
 async function removeCertificationEvidence(dataDir, release, store) {
     if (release.diagnosticsPath === null)
         return;
+    // Security: the persisted path is historical metadata, not deletion authority. Derive the
+    // only permitted target from validated identity so Windows casing changes cannot strand it.
     const expected = resolve(dataDir, `certification-${release.releaseId}.json`);
-    if (resolve(release.diagnosticsPath) !== expected) {
-        await store.recordCleanupFailure(release.releaseId, "certification", "refused to delete certification evidence outside its managed identity path");
-        return;
-    }
     const metadata = await lstat(expected).catch(error => missingOrThrow(error));
     if (metadata === null)
         return;
@@ -317,7 +422,13 @@ async function removeCertificationEvidence(dataDir, release, store) {
         await store.recordCleanupFailure(release.releaseId, "certification", "refused to delete linked or non-file certification evidence");
         return;
     }
-    await rm(expected, { force: true });
+    const [canonicalDataDir, canonicalEvidence] = await Promise.all([realpath(dataDir), realpath(expected)]);
+    assertDirectChild(canonicalDataDir, canonicalEvidence);
+    if (artifactName(canonicalEvidence) !== `certification-${release.releaseId}.json`) {
+        await store.recordCleanupFailure(release.releaseId, "certification", "refused to delete certification evidence with a different managed identity");
+        return;
+    }
+    await rm(canonicalEvidence, { force: true });
 }
 async function canonicalReleaseStore(dataDir) {
     const root = resolve(dataDir, "releases");
@@ -511,6 +622,91 @@ function normalizeLimits(input) {
     }
     return limits;
 }
+function sortCleanupDispositions(dispositions) {
+    return [...dispositions].sort((left, right) => left.attempts - right.attempts
+        || (left.lastAttemptAt ?? "").localeCompare(right.lastAttemptAt ?? "")
+        || left.release.releaseId.localeCompare(right.release.releaseId));
+}
+function sortArtifacts(artifacts, state) {
+    const attempts = new Map();
+    for (const diagnostic of state.cleanup.diagnostics) {
+        attempts.set(diagnostic.releaseId, (attempts.get(diagnostic.releaseId) ?? 0) + 1);
+    }
+    return [...artifacts].sort((left, right) => (attempts.get(artifactName(left)) ?? 0) - (attempts.get(artifactName(right)) ?? 0)
+        || artifactName(left).localeCompare(artifactName(right)));
+}
+async function spawnCleanupWorker(entry, environment) {
+    const child = spawn(process.execPath, [entry], {
+        detached: true,
+        windowsHide: true,
+        stdio: "ignore",
+        env: environment,
+    });
+    await new Promise((resolvePromise, rejectPromise) => {
+        child.once("spawn", resolvePromise);
+        child.once("error", rejectPromise);
+    });
+    child.unref();
+}
+async function acquireWorkerLease(dataDir, runId) {
+    const path = resolve(dataDir, WORKER_LEASE_FILENAME);
+    await mkdir(dataDir, { recursive: true, mode: 0o700 });
+    try {
+        const lease = await open(path, "wx", 0o600);
+        await lease.writeFile(JSON.stringify({ runId, pid: process.pid, createdAt: new Date().toISOString() }));
+        await lease.sync();
+        return lease;
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "EEXIST"))
+            throw error;
+    }
+    const owner = await readWorkerLease(path);
+    if (owner?.pid && processIsAlive(owner.pid))
+        return null;
+    if (owner === null) {
+        const metadata = await stat(path).catch(() => null);
+        if (metadata !== null && Date.now() - metadata.mtimeMs < 10_000)
+            return null;
+    }
+    const quarantine = `${path}.${randomUUID()}.abandoned`;
+    try {
+        await rename(path, quarantine);
+        await rm(quarantine, { force: true });
+    }
+    catch {
+        return null;
+    }
+    return await acquireWorkerLease(dataDir, runId);
+}
+async function releaseWorkerLease(dataDir, runId, lease) {
+    const path = resolve(dataDir, WORKER_LEASE_FILENAME);
+    await lease.close().catch(() => { });
+    const owner = await readWorkerLease(path);
+    if (owner?.runId === runId)
+        await rm(path, { force: true });
+}
+async function readWorkerLease(path) {
+    try {
+        const value = JSON.parse(await readFile(path, "utf8"));
+        return {
+            ...(typeof value.runId === "string" ? { runId: value.runId } : {}),
+            ...(typeof value.pid === "number" ? { pid: value.pid } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error instanceof Error && "code" in error && error.code === "EPERM";
+    }
+}
 function parseWorkerHolds(value) {
     if (!value)
         return [];

package/dist/native/darwin-arm64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "darwin",
   "architecture": "arm64",
   "capability": "unsupported",
-  "builtAt": "2026-09-03T16:39:37.425Z",
+  "builtAt": "2026-09-03T18:06:08.893Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "7524bf568992517f50ed53196c861c5edeba0d7275633bb4735ab45bd5963a28",

package/dist/native/linux-x64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "linux",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-03T16:39:27.399Z",
+  "builtAt": "2026-09-03T18:05:58.567Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "ee8a00eaaf79c707459bbbfb52518e9739314967049fbe5fa625f36ce33db9ee",

package/dist/native/win32-x64/manifest.json

@@ -5,10 +5,10 @@
   "platform": "win32",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-03T16:40:47.022Z",
+  "builtAt": "2026-09-03T18:06:42.554Z",
   "artifact": {
     "filename": "process-guardian.exe",
-    "sha256": "2fe463dcdeaedfbc9df817ac61e973f27500e9527d05bd781553da89d6767926",
+    "sha256": "5e8247ce99c85457ecef2f8f0fd56bbd42796613037563a570fa8ad2b2fb2567",
     "size": 177664
   },
   "provenance": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.1.8-dev.224",
+  "version": "0.1.8-dev.226",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "packageManager": "npm@11.13.0",