@wjarka/cezarion 0.15.1 → 0.16.0

package/dist/delegation/service.js

@@ -7,20 +7,30 @@ import { prepareWorkerContext, workerContextTask } from './context.js';
 import { acceptedWorkerIdentitySchema, workerContextHash, workerWorkflowHash } from './execution-identity.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { discoveryRequestSchema, conversationSendRequestSchema, conversationInspectRequestSchema, conversationCancelRequestSchema, inboxReceiptRequestSchema, requestWaitRequestSchema, workerSpawnRequestSchema, workerSteerRequestSchema, workerWaitRequestSchema, workerParamsSchema, workerCancelWaitRequestSchema, } from '../contract/index.js';
-import { workerOutcome } from '../runs/delegation-state.js';
-import { QUICK_TASK_WORKFLOW, allowedToolsForStep, stepKind } from '../workflows/types.js';
+import { workerDestroyView, workerOutcome } from '../runs/delegation-state.js';
+import { QUICK_TASK_WORKFLOW, skillTaskSteps, plannedWorkflow, allowedToolsForStep, stepKind } from '../workflows/types.js';
+import { discoverSkills } from '../skills.js';
 import { findWorkflow } from '../workflows/load.js';
 import { isAuthenticatedCaller } from './credentials.js';
 import { parseDelegationEffort } from './effort.js';
 import { authorizeSpawn, authorizeSpawnReplay, authorizeWorker, authorizeCancelWait, authorizeRetainedResult, DelegationPolicyError } from './policy.js';
-import { planOwnedWorkspace, readOwnedDiff, removeOwnedWorkspace, resolveWorkerBaseline } from './workspace.js';
+import { releaseThenRemoveOwnedWorkspace } from '../git-worktree-release.js';
+import { gitCommonDir, planOwnedWorkspace, readOwnedDiff, resolveWorkerBaseline, WorkspaceHeldError } from './workspace.js';
+import { holdersStillHold, observeDestroy, recordHolders } from './destroy-observation.js';
+import { DESTROY_ATTENTION_ATTEMPTS, DESTROY_BACKOFF, retryDelayMs } from './retry-backoff.js';
 /**
  * The catalog definition a spawn runs (#451): the built-in quick-task constant when the request
- * names none — never the catalog's `quick-task` entry, so a repo file cannot change the default
- * path — else the named entry. Every agent step resolves its own runner and account (#452), so a
+ * names neither workflow nor skill — never the catalog's `quick-task` entry, so a repo file cannot change the default
+ * path — else the named workflow or a one-step discovered skill task. Every agent step resolves its own runner and account (#452), so a
  * chain may mix providers; a chain with no agent step has nothing for a worker to run.
  */
 async function resolveSpawnWorkflow(root, request) {
+    if (request.skill !== undefined) {
+        const skills = await discoverSkills(root);
+        if (!skills.some(skill => skill.name === request.skill))
+            throw new DelegationPolicyError('invalid_input', `Unknown skill "${request.skill}"; available: ${skills.map(skill => skill.name).join(', ')}`);
+        return plannedWorkflow(skillTaskSteps(request.skill));
+    }
     if (request.workflow === undefined)
         return QUICK_TASK_WORKFLOW;
     const workflow = await findWorkflow(root, request.workflow);
@@ -119,7 +129,13 @@ export class DelegationService {
     serial = new Map();
     destroyRetryTimers = new Map();
     destroyRetryInFlight = new Map();
-    destroyRetryDelayMs = 60_000;
+    /** What each pending destroy's last full attempt observed (hearsay-tools/cezarion#879). */
+    destroyObservations = new Map();
+    /** Each project's common Git dir, resolved once per registration for the change check. */
+    commonDirs = new Map();
+    // Private and overridable so tests need not wait out production cadence.
+    destroyBackoff = DESTROY_BACKOFF;
+    destroyAttentionAttempts = DESTROY_ATTENTION_ATTEMPTS;
     /** How long destroy waits for proven termination; private and overridable so tests need not wait it out. */
     terminationTimeoutMs = 30_000;
     registerProject(project) {
@@ -127,9 +143,11 @@ export class DelegationService {
         if (existing?.store === project.store && existing.manager === project.manager)
             return () => { };
         this.clearDestroyRetries(project.id);
+        existing?.manager.pauseWorkerCleanup();
         this.projects.set(project.id, project);
         return () => { if (this.projects.get(project.id) === project) {
             this.clearDestroyRetries(project.id);
+            project.manager.pauseWorkerCleanup();
             this.projects.delete(project.id);
         } };
     }
@@ -138,15 +156,22 @@ export class DelegationService {
             clearTimeout(timer);
         this.destroyRetryTimers.delete(projectId);
         this.destroyRetryInFlight.delete(projectId);
+        this.destroyObservations.delete(projectId);
+        this.commonDirs.delete(projectId);
     }
     /** Called only after manager recovery, when persisted destroy intents may be retried. */
     armDestroyRetries(projectId) {
         const project = this.projects.get(projectId);
         if (!project)
             return;
+        project.manager.recoverWorkerCleanup();
+        // A pending destroy keeps its worker in the live set (`isLiveRecord`), so this is every one.
         for (const run of project.store.listRuns())
             this.scheduleDestroyRetry(project, run.id);
     }
+    /** Arms the next automatic attempt of a pending destroy. A retry state written before a restart
+     * resumes where it was; the fast cadence is the floor, and a little over the cap the ceiling, so
+     * a clock that jumped cannot park a destroy for days (hearsay-tools/cezarion#879). */
     scheduleDestroyRetry(project, workerId) {
         if (this.projects.get(project.id) !== project)
             return;
@@ -160,6 +185,9 @@ export class DelegationService {
         }
         if (timers.has(workerId) || this.destroyRetryInFlight.get(project.id)?.has(workerId))
             return;
+        const { fastMs, capMs } = this.destroyBackoff;
+        const nextAt = run.destroyRetry ? Date.parse(run.destroyRetry.nextAt) - Date.now() : 0;
+        const delay = Math.min(Math.max(fastMs, nextAt), capMs * 1.1);
         const timer = setTimeout(() => {
             timers.delete(workerId);
             if (this.projects.get(project.id) !== project)
@@ -170,6 +198,19 @@ export class DelegationService {
                 this.destroyRetryInFlight.set(project.id, inFlight);
             }
             inFlight.add(workerId);
+            void this.destroyTick(project, workerId).catch(() => undefined).finally(() => {
+                inFlight.delete(workerId);
+                this.scheduleDestroyRetry(project, workerId);
+            });
+        }, delay);
+        timer.unref?.();
+        timers.set(workerId, timer);
+    }
+    /** One automatic attempt. It runs in full only when something its last full attempt observed has
+     * changed, or a holder it named has exited; either way it records the attempt and when the next
+     * is due, and from the attention threshold on the cockpit says the cleanup needs attention. */
+    destroyTick(project, workerId) {
+        return this.serialized(`worker:${project.id}:${workerId}`, async () => {
             const check = () => {
                 if (this.projects.get(project.id) !== project)
                     throw new DelegationPolicyError('denied_scope', 'Worker scope denied');
@@ -179,13 +220,48 @@ export class DelegationService {
                 }
                 return current;
             };
-            void this.destroySerialized(project, workerId, check).catch(() => undefined).finally(() => {
-                inFlight.delete(workerId);
-                this.scheduleDestroyRetry(project, workerId);
-            });
-        }, this.destroyRetryDelayMs);
-        timer.unref?.();
-        timers.set(workerId, timer);
+            check();
+            const seen = this.destroyObservations.get(project.id)?.get(workerId);
+            const dataDir = join(project.root, '.ai/cezar');
+            const unchanged = !!seen && holdersStillHold({ store: project.store, dataDir, workerId, holders: seen.holders }) &&
+                seen.key === observeDestroy({ store: project.store, dataDir, commonDir: await this.commonDir(project), workerId });
+            // One automatic full attempt at a time per project: attempts that coincide (every pending destroy after a
+            // restart) would otherwise contend for the worktree mutation lock and come back lock-busy, never skipped.
+            if (!unchanged)
+                await this.serialized(`destroy-retries:${project.id}`, () => this.destroyAttempt(project, workerId, check, 'scheduled')).catch(() => undefined);
+            if (this.projects.get(project.id) !== project)
+                return;
+            const current = project.store.getRun(workerId);
+            if (current?.delegation?.role !== 'worker' || !current.delegation.destroy || current.delegation.destroy.phase === 'complete')
+                return;
+            const attempts = (current.destroyRetry?.attempts ?? 0) + 1;
+            const retry = { attempts, nextAt: new Date(Date.now() + retryDelayMs(attempts, this.destroyBackoff)).toISOString(),
+                ...(attempts >= this.destroyAttentionAttempts ? { needsAttention: true } : {}) };
+            project.store.commitDestroyRetry(workerId, retry);
+        });
+    }
+    commonDir(project) {
+        let dir = this.commonDirs.get(project.id);
+        if (!dir) {
+            // A failure is not cached: the next attempt asks again, and until then the check is record-only.
+            dir = gitCommonDir(project.root).catch(() => { this.commonDirs.delete(project.id); return undefined; });
+            this.commonDirs.set(project.id, dir);
+        }
+        return dir;
+    }
+    observeAttempt(project, workerId, seen) {
+        if (this.projects.get(project.id) !== project)
+            return;
+        let observations = this.destroyObservations.get(project.id);
+        if (!seen) {
+            observations?.delete(workerId);
+            return;
+        }
+        if (!observations) {
+            observations = new Map();
+            this.destroyObservations.set(project.id, observations);
+        }
+        observations.set(workerId, seen);
     }
     context(caller) {
         if (!delegationEnabled())
@@ -234,7 +310,7 @@ export class DelegationService {
         return { project, sender, recipient, root, worker };
     }
     currentConversation(project, root) {
-        const state = reconcileConversationState(root, project.store.listRuns(), new Date().toISOString(), run => run.delegation?.role === 'worker'
+        const state = reconcileConversationState(root, (id) => project.store.getRun(id), new Date().toISOString(), run => run.delegation?.role === 'worker'
             ? project.store.readWorkerExecution(run.id)?.phase === 'complete' : !project.manager.isActive(run.id));
         if (root.delegation?.role === 'root' && state && state !== root.delegation.conversation)
             project.store.commitConversation(root.id, state);
@@ -482,6 +558,7 @@ export class DelegationService {
                 ...(request.model === undefined ? {} : { model: request.model }),
                 ...(effortPin === undefined ? {} : { effort: effortPin }),
                 ...(request.workflow === undefined ? {} : { workflow: request.workflow }),
+                ...(request.skill === undefined ? {} : { skill: request.skill }),
             })).digest('hex');
             const receipt = parent.delegation.receipts.find(r => r.requestId === request.requestId);
             if (receipt) {
@@ -492,7 +569,7 @@ export class DelegationService {
                     throw new DelegationPolicyError('denied_scope', 'Worker scope denied');
                 return { workerId: worker.id, baselineSha: worker.delegation.workspace.baselineSha };
             }
-            authorizeSpawn(caller, parent, project.id);
+            authorizeSpawn(caller, parent, project.id, id => project.store.getRun(id));
             const catalog = await resolveSpawnWorkflow(project.root, request);
             const resolvedSteps = await resolveSpawnSteps(project.manager, parent.id, request, catalog, (step, settings) => this.validateModels(request, [{ step, settings }]));
             // Run-level fields hold the first agent step (cockpit columns, pre-#452 evidence readers);
@@ -514,7 +591,7 @@ export class DelegationService {
                 const current = this.context(caller);
                 if (current !== project)
                     throw new DelegationPolicyError('denied_scope', 'Worker scope denied');
-                authorizeSpawn(caller, project.store.getRun(parent.id), project.id);
+                authorizeSpawn(caller, project.store.getRun(parent.id), project.id, id => project.store.getRun(id));
                 // The public definition carries what each agent step RESOLVED to — runner, account,
                 // model, effort and the narrowed grants — so the bound `workflowDef` and the private
                 // per-step identity describe the same launch and the manager can hold them against each
@@ -537,8 +614,8 @@ export class DelegationService {
                     steps: workflowDef.steps.map(step => ({ id: step.id, name: step.name ?? step.id, kind: stepKind(step) })),
                 }, parent.id, request.requestId, { role: 'worker', permissions: [], parentRunId: parent.id, workspace, ...(context ? { context } : {}) }, requestHash, {
                     ...identity, ...(context ? { contextHash: workerContextHash(context) } : {}),
-                    // A named catalog chain is bound like the context recipe; the default quick-task leaves the identity as before.
-                    ...(request.workflow === undefined ? {} : { workflowHash: workerWorkflowHash(workflowDef) }),
+                    // A named catalog chain or skill is bound like the context recipe; the default quick-task leaves the identity as before.
+                    ...(request.workflow === undefined && request.skill === undefined ? {} : { workflowHash: workerWorkflowHash(workflowDef) }),
                 });
                 accepted = true;
                 project.manager.enqueueOwnedRun(worker.id);
@@ -562,7 +639,7 @@ export class DelegationService {
             ...(worker.delegation.context === undefined ? {} : { inputs: worker.delegation.context.inputs }),
             ...(worker.currentStepId === undefined ? {} : { currentStepId: worker.currentStepId }),
             ...(worker.activity === undefined ? {} : { activity: worker.activity }),
-            ...(wait ? { wait } : {}), ...(worker.delegation.destroy ? { destroy: worker.delegation.destroy } : {}), ...(outcome ? { outcome } : {}) };
+            ...(wait ? { wait } : {}), ...(worker.delegation.destroy ? { destroy: workerDestroyView(worker) } : {}), ...(outcome ? { outcome } : {}) };
     }
     async collect(caller, params) {
         const project = this.context(caller);
@@ -655,36 +732,74 @@ export class DelegationService {
         check();
         return this.destroySerialized(project, workerId, check);
     }
+    /** An explicit destroy (Clean up, `cez worker destroy`): always a full attempt, and it restarts the
+     * backoff, so a timer armed for a later automatic attempt is dropped and re-armed at the fast cadence. */
     destroySerialized(project, workerId, check) {
-        return this.serialized(`worker:${project.id}:${workerId}`, async () => {
-            const assertAttached = () => {
-                if (this.projects.get(project.id) !== project)
-                    throw new DelegationPolicyError('denied_scope', 'Worker scope denied');
-            };
+        return this.serialized(`worker:${project.id}:${workerId}`, () => this.destroyAttempt(project, workerId, check, 'manual')).finally(() => {
+            // A replaced registration owns its own timers under the same project id: leave them alone.
+            if (this.projects.get(project.id) !== project)
+                return;
+            const timers = this.destroyRetryTimers.get(project.id);
+            clearTimeout(timers?.get(workerId));
+            timers?.delete(workerId);
+            this.scheduleDestroyRetry(project, workerId);
+        });
+    }
+    /** One full destroy attempt; the caller holds the worker's serialization key. A manual attempt
+     * clears the run's `destroyRetry`, which resets the backoff; a completed destroy drops it. */
+    async destroyAttempt(project, workerId, check, mode) {
+        const assertAttached = () => {
+            if (this.projects.get(project.id) !== project)
+                throw new DelegationPolicyError('denied_scope', 'Worker scope denied');
+        };
+        assertAttached();
+        let worker = check();
+        if (worker.delegation?.role !== 'worker')
+            throw new DelegationPolicyError('denied_scope', 'Worker scope denied');
+        const parent = project.store.getRun(worker.delegation.parentRunId);
+        if (parent?.delegation?.role === 'root' && parent.delegation.receipts.some(receipt => receipt.workerId === workerId && receipt.deletion)) {
+            throw new DelegationPolicyError('incompatible_state', 'Worker history deletion has begun; retry history deletion');
+        }
+        const commonDir = await this.commonDir(project);
+        assertAttached();
+        worker = check();
+        if (worker.delegation?.role !== 'worker')
+            throw new DelegationPolicyError('denied_scope', 'Worker scope denied');
+        // What this attempt decided on (hearsay-tools/cezarion#879): a later tick that would see the same skips its
+        // work. Retaken where the attempt decides (after termination, at each holder proof), so its own writes up
+        // to there (stopping the worker, the removal's checkpoint) are not a change, and anything later is.
+        const observe = () => observeDestroy({ store: project.store, dataDir: join(project.root, '.ai/cezar'), commonDir, workerId });
+        let key = observe();
+        const workspace = worker.delegation.workspace;
+        const requestedAt = worker.delegation.destroy?.requestedAt ?? new Date().toISOString();
+        const resources = (worker.delegation.destroy?.remaining ?? ['worktree', 'branch']).filter((resource) => resource !== 'process');
+        const persist = (phase, remaining, error) => {
             assertAttached();
-            let worker = check();
+            worker = project.store.getRun(workerId);
             if (worker.delegation?.role !== 'worker')
                 throw new DelegationPolicyError('denied_scope', 'Worker scope denied');
-            const parent = project.store.getRun(worker.delegation.parentRunId);
-            if (parent?.delegation?.role === 'root' && parent.delegation.receipts.some(receipt => receipt.workerId === workerId && receipt.deletion)) {
-                throw new DelegationPolicyError('incompatible_state', 'Worker history deletion has begun; retry history deletion');
-            }
-            const workspace = worker.delegation.workspace;
-            const requestedAt = worker.delegation.destroy?.requestedAt ?? new Date().toISOString();
-            const resources = (worker.delegation.destroy?.remaining ?? ['worktree', 'branch']).filter((resource) => resource !== 'process');
-            const persist = (phase, remaining, error) => {
-                assertAttached();
-                worker = project.store.getRun(workerId);
-                if (worker.delegation?.role !== 'worker')
-                    throw new DelegationPolicyError('denied_scope', 'Worker scope denied');
-                project.store.commitDelegation([{ id: workerId, delegation: { ...worker.delegation, destroy: { requestedAt, phase, remaining, ...(error ? { error: error.slice(0, 2_000) } : {}) } } }]);
-            };
-            persist('requested', worker.delegation.destroy?.remaining ?? ['process', 'worktree', 'branch']);
+            project.store.commitDelegation([{ id: workerId, delegation: { ...worker.delegation, destroy: { requestedAt, phase, remaining,
+                            ...(error ? { error: error.slice(0, 2_000) } : {}) } } }]);
+            // The retry state lives beside the delegation: an explicit destroy and a completed one both drop it.
+            if (worker.destroyRetry && (phase === 'complete' || (mode === 'manual' && phase === 'requested')))
+                project.store.commitDestroyRetry(workerId, undefined);
+        };
+        /** What the attempt decided on, and the holders it ran into, kept only when that explains the
+         * failure. A complete destroy keeps nothing, and neither does a failure no key input or named
+         * holder accounts for (lock contention, a failed Git step, an unnamed blocker): it can clear
+         * without changing anything a tick could see, so the next tick attempts in full. */
+        const observed = (result, holders, explained) => {
+            this.observeAttempt(project, workerId, result.state === 'complete' || !explained ? undefined : { key, holders: recordHolders(holders) });
+            return result;
+        };
+        persist('requested', worker.delegation.destroy?.remaining ?? ['process', 'worktree', 'branch']);
+        try {
             persist('terminating', ['process', ...resources]);
             project.manager.requestWorkerStop(workerId);
             let result;
             const terminated = await project.manager.awaitRunTermination(workerId, this.terminationTimeoutMs, { reapOrphans: true });
             assertAttached();
+            key = observe();
             if (!terminated) {
                 // #469: name what blocks a crashed generation; other causes keep the generic message.
                 const taken = project.manager.takeWorkerTerminationBlocker(workerId);
@@ -695,41 +810,89 @@ export class DelegationService {
                     project.store.appendEvent(workerId, { type: 'lifecycle', message: `destroy blocked: ${reason}` });
                 result = { workerId, state: 'incomplete', remaining: ['process', ...resources], error: !taken ? 'Worker termination is not proven; retry cleanup later'
                         : taken.blocker.kind === 'unreadable' ? reason : `Worker termination is not proven: ${reason}; retry cleanup later` };
+                persist(result.state, result.remaining, result.error);
+                return observed(result, taken?.blocker.kind === 'processes' ? taken.blocker.pids : taken?.blocker.kind === 'controller' ? [taken.blocker.pid] : [], !!taken);
             }
-            else {
-                persist('cleaning', resources);
-                const snapshot = structuredClone(check());
-                const proof = project.store.readWorkerExecution(workerId);
-                const evidence = await collectWorkerEvidence(project.root, project.store, snapshot);
+            persist('cleaning', resources);
+            const snapshot = structuredClone(check());
+            const proof = project.store.readWorkerExecution(workerId);
+            const evidence = await collectWorkerEvidence(project.root, project.store, snapshot);
+            assertAttached();
+            const current = check();
+            if (proof?.phase !== 'complete' || project.store.readWorkerExecution(workerId)?.generation !== proof.generation ||
+                project.store.readWorkerExecution(workerId)?.phase !== 'complete' || current.status !== snapshot.status ||
+                JSON.stringify(current.delegation) !== JSON.stringify(snapshot.delegation))
+                throw new Error('Worker changed before cleanup checkpoint');
+            // This immutable parent payload must be durable before the first destructive operation. A
+            // payload already on disk is durable, whatever cleanup phase it names (hearsay-tools/cezarion#879).
+            project.store.commitWorkerResult(evidence.result.parentRunId, evidence.result, evidence.diffSnapshot, { ignoreCleanup: true });
+            assertAttached();
+            check();
+            const release = project.manager.claimWorkerCleanup(workerId);
+            const assertCurrent = () => {
                 assertAttached();
                 const current = check();
-                if (proof?.phase !== 'complete' || project.store.readWorkerExecution(workerId)?.generation !== proof.generation ||
-                    project.store.readWorkerExecution(workerId)?.phase !== 'complete' || current.status !== snapshot.status ||
-                    JSON.stringify(current.delegation) !== JSON.stringify(snapshot.delegation))
-                    throw new Error('Worker changed before cleanup checkpoint');
-                // This immutable parent payload must be durable before the first destructive operation.
-                project.store.commitWorkerResult(evidence.result.parentRunId, evidence.result, evidence.diffSnapshot);
-                assertAttached();
-                check();
-                result = await removeOwnedWorkspace(project.root, workspace, project.manager.getWorkerNoMaterializationProof(workerId), assertAttached);
-                // An already-started checked Git operation may finish after detach. Its
-                // checkpoint makes a new controller's retry safe; the old store must not
-                // publish a result after ownership of the project has moved.
-                assertAttached();
-                persist(result.state, result.remaining, result.error);
-                // Preserve the captured bytes even if Git removal was only partially successful.
-                const removed = !result.remaining.includes('worktree');
-                project.store.commitWorkerResult(evidence.result.parentRunId, { ...evidence.result, observedAt: new Date().toISOString(),
-                    cleanup: result.state, outcome: result.state === 'complete' ? 'destroyed' : evidence.result.lastExecutionOutcome,
-                    workspace: { ...workspace, state: removed ? 'deleted' : evidence.result.workspace.state },
-                    head: removed ? { state: 'deleted', reason: 'missing', ...('sha' in evidence.result.head ? { sha: evidence.result.head.sha } : {}) } : evidence.result.head,
-                    diff: evidence.result.diff.state === 'available' ? { ...evidence.result.diff, snapshotId: randomUUID() } : evidence.result.diff,
-                }, evidence.diffSnapshot);
-                return result;
+                if (!release || current.delegation?.role !== 'worker' ||
+                    JSON.stringify(current.delegation.workspace) !== JSON.stringify(workspace) ||
+                    project.store.readWorkerExecution(workerId)?.generation !== proof.generation ||
+                    project.store.readWorkerExecution(workerId)?.phase !== 'complete') {
+                    throw new Error('Worker resource ownership changed');
+                }
+            };
+            const assertSafe = () => {
+                assertCurrent();
+                key = observe();
+                const holders = project.store.workerResourceHolders(workerId, proof.generation, workspace.resourceId);
+                if (holders === 'safe')
+                    return;
+                throw holders.length ? new WorkspaceHeldError(holders) : new Error('Worker resources may still be held; cleanup will retry');
+            };
+            // The removal turns being held into an incomplete result; it reports the holders either of its
+            // checks named, or that it stopped for a reason no key input explains, an unnamed holder
+            // included (hearsay-tools/cezarion#879).
+            let holders = [];
+            let explained = true;
+            try {
+                assertCurrent();
+                // #781: release preview before the final fresh proof immediately preceding removal.
+                result = await releaseThenRemoveOwnedWorkspace({ previewHost: project.manager.previewHost }, project.root, workspace, assertCurrent, assertSafe, { held: pids => { holders = pids; }, unexplained: () => { explained = false; } });
             }
+            catch {
+                explained = false;
+                result = { workerId, state: 'incomplete', remaining: resources, error: 'Worker resources may still be held; cleanup will retry' };
+            }
+            finally {
+                release?.();
+            }
+            // An already-started checked Git operation may finish after detach. Its
+            // checkpoint makes a new controller's retry safe; the old store must not
+            // publish a result after ownership of the project has moved.
+            assertAttached();
             persist(result.state, result.remaining, result.error);
-            return result;
-        }).finally(() => this.scheduleDestroyRetry(project, workerId));
+            // Preserve the captured bytes even if Git removal was only partially successful.
+            const removed = !result.remaining.includes('worktree');
+            project.store.commitWorkerResult(evidence.result.parentRunId, { ...evidence.result, observedAt: new Date().toISOString(),
+                cleanup: result.state, outcome: result.state === 'complete' ? 'destroyed' : evidence.result.lastExecutionOutcome,
+                workspace: { ...workspace, state: removed ? 'deleted' : evidence.result.workspace.state },
+                head: removed ? { state: 'deleted', reason: 'missing', ...('sha' in evidence.result.head ? { sha: evidence.result.head.sha } : {}) } : evidence.result.head,
+                diff: evidence.result.diff.state === 'available' ? { ...evidence.result.diff, snapshotId: randomUUID() } : evidence.result.diff,
+            }, evidence.diffSnapshot);
+            return observed(result, holders, explained);
+        }
+        catch (error) {
+            // hearsay-tools/cezarion#879: an attempt that throws says why, instead of leaving an
+            // in-progress phase with no error, as long as this is still the same pending destroy. A
+            // throw explains nothing a tick could see clear, so the next tick attempts in full.
+            this.observeAttempt(project, workerId, undefined);
+            try {
+                const current = this.projects.get(project.id) === project ? project.store.getRun(workerId) : undefined;
+                if (current?.delegation?.role === 'worker' && current.delegation.destroy?.requestedAt === requestedAt && current.delegation.destroy.phase !== 'complete') {
+                    persist('incomplete', current.delegation.destroy.remaining, error instanceof Error ? error.message : String(error));
+                }
+            }
+            catch { /* the attempt's own error is the one to report */ }
+            throw error;
+        }
     }
 }
 //# sourceMappingURL=service.js.map