@zq-silk/yui 0.15.8 → 0.15.11

package/dist/message/messageContinuation.js

@@ -8,6 +8,7 @@ import { createTaskEvent } from "../event/taskEvent.js";
 import { validateExactRunReviewRound } from "../lifecycle/exactRunTerminalization.js";
 import { sourceRunContextValue } from "../context/sourceRunContext.js";
 import { requireManagedTaskCaller } from "../runtime/managedCaller.js";
+import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
 export function resolveMessageRecipient(store, taskId, roleName, scope) {
     if (scope.reviewRoundId !== undefined) {
         const round = store.getReviewRound(taskId, scope.reviewRoundId);
@@ -95,12 +96,104 @@ export function messageContinuationBlocker(store, message) {
     }
     return undefined;
 }
+/**
+ * The one gate that decides when a claimed interrupt-then handoff may be
+ * delivered (decision-3 §4). It is keyed on the exact interrupted native Turn —
+ * not on the recipient's owner Assignment and not on a Run's business status —
+ * so the terminal proof is about the Turn that was actually cancelled:
+ * - `ready`   — the native Turn stopped and its cancel outcome is knowable; the
+ *               handoff may deliver.
+ * - `waiting` — the native Turn is still in flight; hold silently until it stops.
+ * - `unknown` — the cancel outcome is unprovable (delivery-unknown); the handoff
+ *               is never released or replayed across that boundary.
+ * - `missing` — the target can never prove its terminal.
+ * A plain queued Message (no claim) is always `ready` here; its own delivery
+ * gates live in messageContinuationBlocker.
+ *
+ * The proof is composite by necessity (message-5 gap C). Native execution
+ * termination is read from the live ProviderTurn, re-verified by attemptId,
+ * because a Run's business status can flip to failed while its native Turn is
+ * still running — the old AgentRun-only gate could release across a Turn that had
+ * not actually stopped. When the live binding no longer holds that exact Turn, the
+ * proof falls back to the durable native terminal observation keyed by the target
+ * attemptId — never to the AgentRun's business status and never to a replacement
+ * Turn's existence, both of which can be true while the target's native execution
+ * has not stopped (decision-3 §4/§8, "requested != stopped"). The cancel's
+ * *outcome* (clean vs delivery-unknown) lives on the owning AgentRun's
+ * failureReason when a Run owns the Turn, because a settled ProviderTurn — or a
+ * durable native terminal — preserves only completed/failed/cancelled and cannot
+ * itself carry delivery-unknown.
+ */
+export function interruptThenTerminalState(store, message) {
+    const claim = message.interruptThen;
+    if (claim === undefined)
+        return "ready";
+    const roleName = claim.targetRoleName;
+    const sessions = store.getTaskRoleSessionSet(message.taskId, roleName);
+    const session = sessions?.sessions[sessions.activeAgentId];
+    const binding = sessions?.providerBinding;
+    if (session?.status !== "active" || session.nativeSessionId !== claim.targetNativeSessionId
+        || session.agentId !== claim.targetAgentId || session.adapterId !== claim.targetAdapterId
+        || binding?.authority.owner !== "controller"
+        || binding.authority.epoch !== claim.targetAuthorityEpoch
+        || binding.authority.holderId !== claim.targetAuthorityHolderId)
+        return "missing";
+    const turn = binding.run;
+    const owner = claim.targetRunId === undefined ? null : store.getRun(message.taskId, claim.targetRunId);
+    if (claim.targetRunId !== undefined && owner === null)
+        return "missing";
+    // Primary proof: the exact interrupted native Turn, identity re-verified by
+    // attemptId. While it is still present — in flight (submitting/accepted) or its
+    // own acceptance unproven (delivery-unknown) — the native execution has not
+    // stopped, so the handoff waits no matter what the Run's status claims.
+    if (turn !== null && turn.attemptId === claim.targetAttemptId) {
+        if (["submitting", "accepted", "delivery-unknown"].includes(turn.status))
+            return "waiting";
+        // The native Turn stopped. Its cancel outcome may still be unprovable; that
+        // is recorded on the owning AgentRun, never on the settled ProviderTurn.
+        return ["completed", "failed", "cancelled"].includes(turn.status)
+            && owner?.result?.failureReason !== "delivery-unknown" ? "ready" : "unknown";
+    }
+    // The live binding no longer holds the target native Turn — a later Turn
+    // occupies it, or the binding's run pointer is gone. decision-3 §4/§8: a
+    // replacement Turn's mere existence is NOT proof the target's native execution
+    // stopped ("requested != stopped"; native quiescence is never inferred from a
+    // new Turn's existence, and never from the owning AgentRun's business status).
+    // The only protocol-proven stop is the durable, immutable native terminal
+    // observation keyed by the exact target attemptId, written when the Provider
+    // Host observed the Turn actually terminate.
+    const nativeStopped = store.listEvents(message.taskId)
+        .map(runtimeObservationFromTaskEvent)
+        .some((observation) => observation !== null
+        && (observation.kind === "turn.completed" || observation.kind === "turn.failed"
+            || observation.kind === "turn.cancelled")
+        && observation.fence.roleName === roleName
+        && observation.fence.nativeSessionId === claim.targetNativeSessionId
+        && (claim.targetNativeTurnId === undefined || observation.fence.nativeTurnId === claim.targetNativeTurnId)
+        && observation.fence.receiptId === claim.targetAttemptId);
+    if (nativeStopped) {
+        // Proven stopped. Its cancel outcome (clean vs delivery-unknown) is recorded on
+        // the owning AgentRun, never on the settled native terminal itself — the same
+        // composite the primary path reads once native termination is proven.
+        return owner?.result?.failureReason === "delivery-unknown" ? "unknown" : "ready";
+    }
+    // No durable proof the target native Turn stopped. Hold silently while an owning
+    // Run could still produce that terminal; a later business-terminal or a
+    // replacement Turn must never release it. With nothing owning the Turn and no
+    // durable terminal, its stop is unobservable and the claim can never prove a
+    // safe boundary — never released or replayed either way.
+    return owner !== null ? "waiting" : "missing";
+}
 /** Called in the Controller's ordinary reconciliation transaction. Messages
  * remain the pending authority; Mailbox is only the existing scheduling hint.
  * Reserving inputs and creating the next Run is one atomic effect. */
 export function prepareMessageContinuations(store, taskId, now, roleName) {
     const pending = store.listMessages(taskId).filter((message) => message.recipient?.roleName === roleName && message.recipient.ownerRunId !== undefined
-        && message.continuation?.runId === undefined);
+        && message.continuation?.runId === undefined
+        // A steer targets the exact current native turn, never a queued next Run.
+        // If its live attempt did not submit, the message stays saved for the
+        // Leader to re-choose (§1/§8); Core never silently turns it into a queue.
+        && message.inputControl?.action !== "steer");
     for (const message of pending) {
         const recipient = message.recipient;
         const blocker = messageContinuationBlocker(store, message);
@@ -138,8 +231,38 @@ export function prepareMessageContinuations(store, taskId, now, roleName) {
                 ? "owner-session-unobserved" : "owner-session-changed");
             continue;
         }
-        const batch = pending.filter((entry) => isDeepStrictEqual(entry.recipient, recipient)
-            && messageContinuationBlocker(store, entry) === undefined).slice(0, 16);
+        // decision-3 §4 ordering. Split this recipient's deliverable Messages into
+        // the explicit interrupt-then handoffs and the ordinary queue. A handoff is
+        // released only after its exact interrupted AgentRun reaches a proven
+        // terminal, and the ordinary queue must never preempt a live handoff.
+        const recipientPending = pending.filter((entry) => isDeepStrictEqual(entry.recipient, recipient)
+            && messageContinuationBlocker(store, entry) === undefined);
+        const thenClaims = recipientPending.filter((entry) => entry.interruptThen !== undefined);
+        let handoffWaiting = false;
+        const readyThen = [];
+        for (const claim of thenClaims) {
+            const state = interruptThenTerminalState(store, claim);
+            if (state === "ready")
+                readyThen.push(claim);
+            else if (state === "waiting")
+                handoffWaiting = true;
+            // A claim whose target can never prove its terminal fails visibly and
+            // stops holding the queue; it is never released or replayed.
+            else
+                markNotDelivered(store, claim, state === "unknown"
+                    ? "interrupt-then-target-delivery-unknown" : "interrupt-then-target-missing");
+        }
+        // Hold the entire recipient — including the ordinary queue — while any
+        // handoff still awaits its interrupted Turn's proven terminal.
+        if (handoffWaiting)
+            continue;
+        // A ready handoff delivers in its own round ahead of the ordinary queue, so
+        // the old queue only follows once the handoff has been delivered.
+        const batch = (readyThen.length > 0
+            ? readyThen
+            : recipientPending.filter((entry) => entry.interruptThen === undefined)).slice(0, 16);
+        if (batch.length === 0)
+            continue;
         const previous = store.listRuns(taskId).filter((run) => run.roleName === owner.roleName
             && run.workItemId === owner.workItemId && run.reviewRoundId === owner.reviewRoundId).at(-1);
         const baselineRef = previous.inputs[0]?.input.contextSnapshotRef;

package/dist/message/taskInterrupt.js

@@ -0,0 +1,34 @@
+import { createTaskEvent } from "../event/taskEvent.js";
+/** Interrupt attempts are execution evidence, not a second message queue. */
+export function findTaskInterrupt(store, taskId, requestId) {
+    return store.listEvents(taskId).find(event => event.type === "input.interrupt-requested" && event.payload.requestId === requestId);
+}
+export function reserveTaskInterrupt(store, taskId, requestId, fingerprint, target, thenMessageId, now) {
+    const receiptId = `interrupt:${taskId}/${requestId}`;
+    store.saveEvent(taskId, createTaskEvent(store.nextEventId(taskId), taskId, "input.interrupt-requested", {
+        requestId, receiptId, fingerprint, roleName: target.roleName,
+        nativeSessionId: target.nativeSessionId, attemptId: target.attemptId,
+        target: JSON.stringify(target),
+        ...(thenMessageId === undefined ? {} : { thenMessageId })
+    }, now));
+    return receiptId;
+}
+export function recordTaskInterruptResult(store, taskId, receiptId, receipt, now = new Date()) {
+    store.transaction(tx => {
+        const requested = tx.listEvents(taskId).find(event => event.type === "input.interrupt-requested" && event.payload.receiptId === receiptId);
+        if (requested === undefined)
+            throw new Error("Interrupt receipt has no original request.");
+        if (tx.listEvents(taskId).some(event => event.type === "input.interrupt-result" && event.payload.receiptId === receiptId))
+            return;
+        tx.saveEvent(taskId, createTaskEvent(tx.nextEventId(taskId), taskId, "input.interrupt-result", { receiptId, receipt: JSON.stringify(receipt) }, now));
+    });
+}
+export function taskInterruptReceipt(store, taskId, receiptId) {
+    const event = store.listEvents(taskId).find(entry => entry.type === "input.interrupt-result" && entry.payload.receiptId === receiptId);
+    return event === undefined ? { state: "interrupt-unknown", receiptId }
+        : JSON.parse(event.payload.receipt);
+}
+export function taskInterruptWasRejected(store, taskId, receiptId) {
+    const receipt = taskInterruptReceipt(store, taskId, receiptId);
+    return receipt.outcome === "rejected" && receipt.state === "interrupt-unavailable";
+}

package/dist/observability/orchestrationMetrics.js

@@ -135,7 +135,7 @@ function terminalWorkspaceCount(facts) {
     }).length;
 }
 function terminalStatus(status) {
-    return status !== undefined && !["pending", "running", "awaiting_acceptance", "blocked", "validating"].includes(status);
+    return status !== undefined && !["pending", "running", "awaiting_acceptance", "blocked", "conflicted", "validating"].includes(status);
 }
 function counts(values) {
     const result = {};

package/dist/plugins/pluginService.js

@@ -350,9 +350,17 @@ export function createPluginService(store, host, registry) {
             if (previous) {
                 const retired = previous;
                 void host.detach(retired.ref).catch((error) => {
-                    resources.saveArtifact(taskId, { kind: "content", displayName: "Plugin instance cleanup failure",
-                        provenance: `PluginService.dispose ${retired.ref.id}/${retired.ref.generation}`,
-                        content: error instanceof Error ? error.message : String(error) });
+                    // A post-publication detach failure is plugin operational telemetry,
+                    // recorded on the plugin's own failure channel — not a Task product
+                    // artifact (product artifacts are files in the Task's Git repository).
+                    try {
+                        store.recordPluginIntentFailure(taskId, retired.ref.id, intent.revision, {
+                            message: `Plugin instance cleanup failed for ${retired.ref.id}/${retired.ref.generation}: `
+                                + (error instanceof Error ? error.message : String(error)),
+                            occurredAt: new Date().toISOString()
+                        });
+                    }
+                    catch { /* best-effort telemetry; never mask the successful activation */ }
                 });
             }
             return { provider: ref, validationId, digest: pkg.digest, capabilities: entries.map((entry) => entry.name),

package/dist/release/releaseHandover.js

@@ -121,6 +121,28 @@ async function activateLocked(ports, locked) {
         };
     }
     void beginResult;
+    try {
+        ports.runPreflight(releaseDir, home);
+    }
+    catch (error) {
+        try {
+            await ports.call(home, "controller.rollback-handover", { handoverId });
+        }
+        catch (rollbackError) {
+            return {
+                outcome: "aborted", phase: "preflight",
+                message: `Host compatibility failed: ${messageOf(error)}; rollback failed: ${messageOf(rollbackError)}`,
+                action: "No candidate was started and the release pointer is unchanged. Preserve the fence and inspect the old Controller.",
+                recoverable: true
+            };
+        }
+        return {
+            outcome: "aborted", phase: "preflight",
+            message: `Fenced compatibility preflight failed: ${messageOf(error)}`,
+            action: "The old Controller is serving again; the active release and Home are unchanged.",
+            recoverable: true
+        };
+    }
     // 5) Start the candidate and wait for its identity read-back.
     ports.spawnCandidate(home, releaseDir, handoverId);
     const candidateReady = await waitForCandidateReady(ports, home, manifest, locked.candidateReadyTimeoutMs, locked.pollIntervalMs);

package/dist/release/releaseWorkflowPorts.js

@@ -1,7 +1,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import { chmod, mkdir, mkdtemp, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
+import { releaseWorkflowScratchRoot } from "../storage/homeLayout.js";
 import { runUpdate } from "../cli/updateOrchestrator.js";
 import { activatedControllerEntrypoint } from "../cli/updatePorts.js";
 import { restartFileTaskController, stopFileTaskController } from "../controller/clientRuntime.js";
@@ -581,7 +581,7 @@ export function createReleaseWorkflowPorts(deps) {
                 // publish` read THIS snapshot, so a TOCTOU replacement of the
                 // original path after the integrity check cannot change what is
                 // published. The snapshot is removed once publish completes.
-                const snapshot = await writeVerifiedTarballSnapshot(bytes);
+                const snapshot = await writeVerifiedTarballSnapshot(deps.home, bytes);
                 try {
                     // Inspect the tarball manifest before publishing: the actual
                     // package name/version must match the frozen declaration, not
@@ -727,8 +727,12 @@ export function createReleaseWorkflowPorts(deps) {
                 // P2-2 (rr19): Install in a fresh temp directory with an isolated
                 // npm cache, so npx cannot reuse a local node_modules binary. Then
                 // run the installed binary directly and verify the output matches
-                // the pinned version.
-                const smokeDir = await mkdtemp(join(tmpdir(), "yui-smoke-"));
+                // the pinned version. The smoke directory is a Yui-authored release
+                // artifact, so it lands under the Home release-workflow scratch root,
+                // never a shared system temp root.
+                const scratch = releaseWorkflowScratchRoot(deps.home);
+                await mkdir(scratch, { recursive: true, mode: 0o700 });
+                const smokeDir = await mkdtemp(join(scratch, "yui-smoke-"));
                 const smokeCache = join(smokeDir, "npm-cache");
                 try {
                     const install = await run("npm", [
@@ -1642,10 +1646,14 @@ async function queryControllerLifecycle(run, globalYui, home, expectedVersion) {
  * random name and read-only permissions (P1-3, rr22). The manifest
  * inspection and `npm publish` both read this snapshot, so replacing the
  * original path after the integrity check cannot change what is published.
- * The caller removes the snapshot once publish completes.
+ * The caller removes the snapshot once publish completes. The snapshot is a
+ * Yui-authored release artifact, so it lands under the Home release-workflow
+ * scratch root, never a shared system temp root.
  */
-async function writeVerifiedTarballSnapshot(bytes) {
-    const snapshot = join(tmpdir(), `yui-release-snapshot-${randomBytes(12).toString("hex")}.tgz`);
+async function writeVerifiedTarballSnapshot(home, bytes) {
+    const scratch = releaseWorkflowScratchRoot(home);
+    await mkdir(scratch, { recursive: true, mode: 0o700 });
+    const snapshot = join(scratch, `yui-release-snapshot-${randomBytes(12).toString("hex")}.tgz`);
     // "wx" fails if the random name already exists, so a pre-existing file
     // (or symlink) can never be overwritten or followed.
     await writeFile(snapshot, bytes, { flag: "wx" });

package/dist/repository/gitWorkspace.js

@@ -679,7 +679,10 @@ export class NodeGitWorkspace {
         return this.#ensureManagedWorktree({
             repositoryPath: input.repositoryPath,
             container: input.container,
-            identity: worktreeIdentity(input.taskSegment, input.roleName),
+            identity: {
+                directory: input.directory,
+                branch: worktreeIdentity(input.taskSegment, input.roleName).branch
+            },
             baseRef: input.baseRef
         });
     }
@@ -687,7 +690,10 @@ export class NodeGitWorkspace {
         return this.#ensureManagedWorktree({
             repositoryPath: input.repositoryPath,
             container: input.container,
-            identity: integrationWorktreeIdentity(input.taskSegment, input.integrationId),
+            identity: {
+                directory: input.directory,
+                branch: integrationWorktreeIdentity(input.taskSegment, input.integrationId).branch
+            },
             baseRef: input.baseRef,
             allowRebase: true
         });
@@ -734,19 +740,19 @@ export class NodeGitWorkspace {
         if (state === "dirty")
             return state;
         const container = resolve(input.container);
-        const identity = worktreeIdentity(input.taskSegment, input.roleName);
-        const path = managedPath(container, identity.directory);
+        const branch = worktreeIdentity(input.taskSegment, input.roleName).branch;
+        const path = managedPath(container, input.directory);
         const project = await this.inspect(input.repositoryPath);
         if (state === "missing") {
             if (input.deleteBranch === true) {
-                await git(["-C", project.root, "worktree", "prune"]);
-                await deleteBranchIfPresent(project.root, identity.branch);
+                await removeMissingWorktreeRegistration(project.root, path, branch);
+                await deleteBranchIfPresent(project.root, branch);
             }
             return state;
         }
         await git(["-C", project.root, "worktree", "remove", "--", path]);
         if (input.deleteBranch === true) {
-            await deleteBranchIfPresent(project.root, identity.branch);
+            await deleteBranchIfPresent(project.root, branch);
         }
         return "removed";
     }
@@ -779,6 +785,36 @@ export class NodeGitWorkspace {
         }
         return "removed";
     }
+    async removeTaskClone(input) {
+        const identity = worktreeIdentity(input.taskSegment, "main");
+        const expected = managedPath(resolve(input.container), input.directory);
+        if (resolve(input.path) !== expected || input.branch !== identity.branch) {
+            throw new Error("Task clone does not match its recorded managed identity.");
+        }
+        const kind = await pathKind(expected);
+        if (kind === undefined)
+            return "missing";
+        if (kind === "symlink")
+            throw new Error("Task clone must not be a symbolic link.");
+        await canonicalContainer(input.container, false);
+        if (await realpath(expected) !== expected || await pathKind(join(expected, ".git")) !== "directory") {
+            throw new Error("Task clone is not a standalone owned Git directory.");
+        }
+        const repository = await this.inspect(expected);
+        if (repository.root !== expected || repository.gitDirectory !== join(expected, ".git")) {
+            throw new Error("Task clone Git ownership cannot be established.");
+        }
+        await assertExpectedBranch(expected, input.branch);
+        if (!await this.isClean(expected))
+            return "dirty";
+        const worktrees = (await git(["-C", expected, "worktree", "list", "--porcelain", "-z"]))
+            .split("\0").filter(line => line.startsWith("worktree "));
+        if (worktrees.length !== 1 || worktrees[0] !== `worktree ${expected}`) {
+            throw new Error("Task clone still owns Git worktree registrations; retained.");
+        }
+        await rm(expected, { recursive: true });
+        return "removed";
+    }
     async inspectRecordedWorktree(input) {
         const inspected = await inspectExactRecordedWorktree(input);
         return inspected?.state ?? "missing";
@@ -824,7 +860,7 @@ export class NodeGitWorkspace {
     }
     async inspectWorktree(input) {
         const container = resolve(input.container);
-        const path = managedPath(container, worktreeIdentity(input.taskSegment, input.roleName).directory);
+        const path = managedPath(container, input.directory);
         const kind = await pathKind(path);
         if (kind === undefined)
             return "missing";
@@ -840,7 +876,10 @@ export class NodeGitWorkspace {
         return this.#removeManagedWorktree({
             repositoryPath: input.repositoryPath,
             container: input.container,
-            identity: integrationWorktreeIdentity(input.taskSegment, input.integrationId),
+            identity: {
+                directory: input.directory,
+                branch: integrationWorktreeIdentity(input.taskSegment, input.integrationId).branch
+            },
             discardChanges: input.discardChanges
         });
     }
@@ -851,6 +890,9 @@ export class NodeGitWorkspace {
         if (kind === "symlink")
             throw new Error("Managed worktree path must not be a symbolic link.");
         const repository = await this.inspect(input.repositoryPath);
+        if (kind === undefined) {
+            await removeMissingWorktreeRegistration(repository.root, path, input.identity.branch);
+        }
         if (kind === "directory") {
             const canonicalContainerPath = await canonicalContainer(container, false);
             await assertOwnedWorktree(repository, canonicalContainerPath, path);
@@ -884,6 +926,21 @@ export class NodeGitWorkspace {
         return kind === "directory" ? "removed" : "missing";
     }
 }
+/** Missing paths do not imply missing Git metadata. Never prune another
+ * workspace's registration as a side effect of cleaning this exact owner.
+ */
+async function removeMissingWorktreeRegistration(repositoryRoot, path, branch) {
+    const records = (await git(["-C", repositoryRoot, "worktree", "list", "--porcelain", "-z"])).split("\0\0");
+    const fields = records.map(record => record.split("\0")).find(record => record.includes(`worktree ${path}`));
+    if (fields === undefined)
+        return;
+    if (!fields.includes(`branch refs/heads/${branch}`) || fields.some(field => field.startsWith("locked"))) {
+        throw new Error(`Missing worktree has uncertain or locked Git ownership: ${path}; metadata retained.`);
+    }
+    if (await pathKind(path) !== undefined)
+        throw new Error(`Worktree reappeared before metadata cleanup: ${path}.`);
+    await git(["-C", repositoryRoot, "worktree", "remove", "--force", "--", path]);
+}
 async function deleteBranchIfPresent(repositoryRoot, branch) {
     const branchRef = `refs/heads/${branch}`;
     if (!await gitSucceeds([
@@ -960,9 +1017,9 @@ async function assertOwnedWorktree(project, container, path) {
 }
 async function inspectExactRecordedWorktree(input) {
     const container = resolve(input.container);
-    const identity = worktreeIdentity(input.taskSegment, input.roleName);
-    const expectedPath = managedPath(container, identity.directory);
-    if (resolve(input.path) !== expectedPath || input.branch !== identity.branch) {
+    const expectedBranch = worktreeIdentity(input.taskSegment, input.roleName).branch;
+    const expectedPath = managedPath(container, input.directory);
+    if (resolve(input.path) !== expectedPath || input.branch !== expectedBranch) {
         throw new Error("Recorded managed worktree identity is invalid.");
     }
     const kind = await pathKind(expectedPath);
@@ -1023,9 +1080,9 @@ async function resolveRefCommit(repositoryPath, ref) {
 async function recordedWorktreeWithoutRepository(input, cause) {
     if (await pathKind(input.repositoryPath) !== undefined)
         throw cause;
-    const identity = worktreeIdentity(input.taskSegment, input.roleName);
-    const expectedPath = managedPath(resolve(input.container), identity.directory);
-    if (resolve(input.path) !== expectedPath || input.branch !== identity.branch) {
+    const branch = worktreeIdentity(input.taskSegment, input.roleName).branch;
+    const expectedPath = managedPath(resolve(input.container), input.directory);
+    if (resolve(input.path) !== expectedPath || input.branch !== branch) {
         throw cause;
     }
     if (await pathKind(expectedPath) === undefined)

package/dist/repository/taskWorkspaceCoordinator.js

@@ -1,4 +1,8 @@
 import { isDeepStrictEqual } from "node:util";
+import { lstat } from "node:fs/promises";
+import { isArchivePersistenceFailure, recordArchiveCleanup } from "../task/archiveDiagnostics.js";
+import { projectTaskRemoteDeliveryFromStore } from "../commands/taskRemoteDeliveryCommand.js";
+import { WorkItemChangeSetManager } from "../workspace/workItemChangeSetManager.js";
 import { hasRuntimeLifecycleWork, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { acquireProjectMaintenanceLocks } from "./projectMaintenanceLock.js";
@@ -247,6 +251,7 @@ export class TaskWorkspaceCoordinator {
                 if (attempt === null
                     || attempt.status === "running"
                     || attempt.status === "blocked"
+                    || attempt.status === "conflicted"
                     || attempt.status === "validating") {
                     throw new Error(`IntegrationAttempt must be terminal before archive cleanup: ${workspace.owner.integrationAttemptId}.`);
                 }
@@ -330,6 +335,135 @@ export class TaskWorkspaceCoordinator {
             releaseMaintenance?.();
         }
     }
+    /** Best-effort cleanup only after explicit force admission has committed.
+     * This is one foreground attempt, not a retry worker. Each independent result
+     * is durable before continuing, and a failed audit write really fails.
+     */
+    async cleanupArchivedTask(taskId, disposition) {
+        const task = this.store.getTask(taskId);
+        if (task?.status !== "archived"
+            || !this.store.listEvents(taskId).some(e => e.type === "task.archived" && e.payload.force === "true")) {
+            throw new Error(`Force archive must commit before cleanup: ${taskId}.`);
+        }
+        const attempt = async (diagnostic, action) => {
+            recordArchiveCleanup(this.store, taskId, diagnostic, "started");
+            let status;
+            let detail = diagnostic.detail;
+            try {
+                const result = await action();
+                status = result === "dirty" ? "retained" : result;
+                if (result === "dirty")
+                    detail = "Dirty workspace retained; force archive does not discard local changes.";
+            }
+            catch (error) {
+                if (isArchivePersistenceFailure(error))
+                    throw error;
+                status = "retained";
+                detail = error instanceof Error ? error.message : String(error);
+            }
+            recordArchiveCleanup(this.store, taskId, { ...diagnostic, detail }, status);
+            return status !== "retained";
+        };
+        let runtimeReleased = true;
+        for (const role of this.store.listRoles(taskId)) {
+            const released = await attempt({ resource: `role:${taskId}/${role.name}`,
+                detail: "Exact Role runtime stop." }, async () => {
+                const provider = this.store.getTaskRoleSessionSet(taskId, role.name)?.providerBinding;
+                const mailbox = this.store.getWorkMailbox({ kind: "role", taskId, roleName: role.name });
+                if (mailbox?.processing != null && (provider?.run == null
+                    || !["completed", "failed", "cancelled"].includes(provider.run.status))) {
+                    throw new Error(`Original mailbox claim ${mailbox.processing.batchId} retained; execution outcome is not known.`);
+                }
+                if (provider?.run != null && !["completed", "failed", "cancelled"].includes(provider.run.status)) {
+                    throw new Error(`Provider input ${provider.run.attemptId}/${provider.run.status} retained; establish exact quiescence before resolving it.`);
+                }
+                await this.#stopLiveRoles(taskId, [role.name]);
+                return "released";
+            });
+            runtimeReleased &&= released;
+        }
+        const physicalReleased = await attempt({ resource: `runtime:${taskId}`,
+            detail: "Verify exact physical resource release before workspace deletion." }, async () => {
+            const activeRun = this.store.listRuns(taskId).find(r => r.status === "active");
+            const job = this.store.listDurableJobs(taskId).find(j => ["queued", "running", "unknown-needs-attention"].includes(j.status));
+            if (activeRun !== undefined || job !== undefined) {
+                throw new Error(`Execution resources retained: ${activeRun?.id ?? job?.id}; archive is not proof of quiescence.`);
+            }
+            if (!runtimeReleased)
+                throw new Error("One or more Role runtimes could not be safely released.");
+            if (this.runtime.assertTaskPhysicalResourcesReleased === undefined) {
+                throw new Error("Physical resource release inspection is unavailable; workspace references retained.");
+            }
+            await this.runtime.assertTaskPhysicalResourcesReleased(taskId);
+            return "released";
+        });
+        if (physicalReleased) {
+            // Task main owns the Git objects of its dependent worktrees, so it is
+            // always last and remains when any dependent cleanup is unresolved.
+            const workspaces = this.store.listManagedWorkspaces(taskId).sort((a, b) => Number(a.owner.type === "task") - Number(b.owner.type === "task"));
+            for (const workspace of workspaces) {
+                await attempt({ resource: managedWorkspaceKey(workspace.owner),
+                    detail: "Remove only clean, exactly owned workspace resources.",
+                    paths: [workspace.root, ...workspace.entries.filter(e => e.access === "write").map(e => e.path)]
+                }, async () => {
+                    const release = acquireProjectMaintenanceLocks(this.preparer.home, workspace.entries.map(e => e.projectId));
+                    try {
+                        if (!isDeepStrictEqual(this.store.getManagedWorkspace(workspace.owner), workspace)) {
+                            throw new Error("Workspace ownership changed; retained.");
+                        }
+                        const owner = workspace.owner;
+                        switch (owner.type) {
+                            case "work-item": {
+                                const item = this.store.getWorkItem(taskId, owner.workItemId);
+                                if (item?.status === "accepted" && disposition === "integrated") {
+                                    await new WorkItemChangeSetManager(this.store).assertIntegrated(taskId, item.id);
+                                }
+                                return this.preparer.cleanupWorkItemWorkspace(taskId, owner.workItemId, item?.status === "retired" ? "abandoned" : disposition);
+                            }
+                            case "review-round":
+                                return this.preparer.cleanupReviewRoundWorkspace(taskId, owner.reviewRoundId);
+                            case "execution-lane":
+                                return this.preparer.cleanupExecutionLaneWorkspace(taskId, owner.executionGroupId, owner.executionLaneId);
+                            case "integration-attempt":
+                                if (await this.preparer.inspectIntegrationWorkspace(taskId, owner.integrationAttemptId) === "dirty")
+                                    return "dirty";
+                                return this.preparer.cleanupIntegrationWorkspace(taskId, owner.integrationAttemptId);
+                            case "task": {
+                                const current = this.store.getTask(taskId);
+                                const delivery = projectTaskRemoteDeliveryFromStore(this.store, current);
+                                if (!delivery.allMerged || !delivery.allVerified) {
+                                    throw new Error("Task main retained: local commits are not covered by verified remote delivery. Force does not discard them.");
+                                }
+                                for (const entry of workspace.entries.filter(e => e.access === "write")) {
+                                    const expected = delivery.projects.find(p => p.projectId === entry.projectId)?.expectedLocalCommit;
+                                    const path = await lstat(entry.path).catch(error => {
+                                        if (error.code === "ENOENT")
+                                            return null;
+                                        throw error;
+                                    });
+                                    if (expected !== null && expected !== undefined
+                                        && path !== null) {
+                                        const actual = await this.preparer.git.inspect(entry.path, "HEAD");
+                                        if (actual.baseCommit !== expected)
+                                            throw new Error(`Task main HEAD changed: ${entry.path}; retained.`);
+                                    }
+                                }
+                                const result = await this.preparer.cleanupTaskForArchive(taskId);
+                                if (result.status !== "removed")
+                                    throw new Error(result.error ?? "Task main or dependent workspace retained.");
+                                return "removed";
+                            }
+                        }
+                    }
+                    finally {
+                        release();
+                    }
+                });
+            }
+        }
+        recordArchiveCleanup(this.store, taskId, { resource: `task:${taskId}`,
+            detail: "Foreground cleanup attempt finished; inspect retained resource references and warnings." }, "finished");
+    }
     #assertTaskArchiveSnapshot(snapshot) {
         this.#assertTaskArchiveLifecycle(snapshot.task);
         const managedWorkspaces = [...this.store.listManagedWorkspaces(snapshot.task.id)]