@zq-silk/yui 0.6.0 → 0.6.2

package/dist/repository/taskWorkspacePreparer.js

@@ -3,14 +3,26 @@ import { isAbsolute, join, relative, resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { retireTaskRoleSessionsForWorkspace } from "../executor/agentExecutor.js";
 import { updateRole } from "../role/role.js";
+import { hasRuntimeCleanupObligation, isRuntimeLaunchReservation, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { attachReviewRoundWorkspace, recordReviewWorkspaceDisposition } from "../review/reviewRound.js";
+import { StorageConflictError } from "../storage/taskStore.js";
 import { bindTaskWorkspaceIdentity } from "../task/task.js";
 import { createCandidateGitSnapshot, createDirectTaskMainSnapshot, workItemExecutionGroupById, recordWorkItemWorkspaceDisposition } from "../workItem/workItem.js";
 import { createManagedWorkspace, managedWorkspaceKey, managedWorktreeName } from "../worktree/managedWorkspace.js";
+import { formatAgentRunReceiptId } from "../task/taskRecordReference.js";
 import { NodeGitWorkspace, worktreeIdentity } from "./gitWorkspace.js";
-import { generateTaskWorkspaceIdentity, isLegacyTaskRef, taskArchiveRef, taskMainBranch, taskWorkspaceRefSegment, taskWorkspaceRefSegmentFromIdentity } from "./taskWorkspaceIdentity.js";
+import { acquireProjectMaintenanceLocks } from "./projectMaintenanceLock.js";
+import { generateTaskWorkspaceIdentity, isLegacyTaskRef, taskArchiveRef, taskMainBranch, taskWorkspaceRefSegment, taskWorkspaceRefSegmentFromIdentity, TASK_WORKSPACE_TOKEN_PATTERN, validateTaskWorkspaceIdentity } from "./taskWorkspaceIdentity.js";
+import { ResourceRegistrar } from "../resources/resourceRegistrar.js";
 const MAIN_WORKTREE = "main";
 const LEADER_ROLE = "leader";
+/**
+ * Bound for prepare attempts after a lost identity race or a storage
+ * revision conflict. Each conflict already discarded the attempt's refs, so
+ * retrying converges with the committed state; the bound stops a persistent
+ * competitor from pinning this caller forever.
+ */
+const TASK_WORKSPACE_PREPARE_MAX_CONFLICT_RETRIES = 3;
 export class WorkspaceCleanupBlockedError extends Error {
     reason;
     resource;
@@ -46,7 +58,85 @@ export class FileTaskWorkspacePreparer {
         this.git = git;
         this.now = now;
     }
+    #resourceRegistrarValue;
+    #resourceRegistrar() {
+        return this.#resourceRegistrarValue ??= new ResourceRegistrar(this.home, this.now);
+    }
+    #registerWorkspace(workspace) {
+        this.#resourceRegistrar().registerManagedWorkspace(workspace);
+    }
     async prepareTaskWorkspace(taskId) {
+        // The per-Project maintenance fence makes prepare mutually exclusive with
+        // migrate/rebuild/archive: a concurrent migration must not switch the
+        // Project catalog to the Home-managed repo while prepare is creating
+        // worktrees from the old external checkout. The fence is acquired on
+        // every conflict retry so the locked set always covers the Task's
+        // current bindings. Gitless Tasks hold no fence. The Controller's
+        // check-then-call probe is kept for scheduling deferral; the fence here
+        // makes the prepare itself safe regardless.
+        for (let attempt = 0;; attempt += 1) {
+            try {
+                const task = requireTask(this.store, taskId);
+                const { release, current } = this.#acquireTaskProjectMaintenanceLocks(task);
+                try {
+                    return await this.#prepareTaskWorkspaceLocked(current.id);
+                }
+                finally {
+                    release();
+                }
+            }
+            catch (error) {
+                if (error instanceof StorageConflictError
+                    && attempt < TASK_WORKSPACE_PREPARE_MAX_CONFLICT_RETRIES) {
+                    continue;
+                }
+                throw error;
+            }
+        }
+    }
+    /**
+     * Acquire the per-Project maintenance fences for every Project bound to a
+     * Task, then re-read the Task under those fences and prove its binding set
+     * is still the one the fences cover. Gitless Tasks hold no fence.
+     *
+     * The returned Task is the fresh under-lock snapshot; callers MUST use it
+     * (not the pre-lock snapshot) for every Project read and Git effect. A
+     * binding-set change rides the StorageConflictError retry channel so the
+     * caller re-reads the Task and re-acquires the correct fence set. The
+     * caller owns `release` and MUST call it on every exit path.
+     */
+    #acquireTaskProjectMaintenanceLocks(task) {
+        const projectIds = task.projectBindings.map(({ projectId }) => projectId);
+        const release = projectIds.length === 0
+            ? () => { }
+            : acquireProjectMaintenanceLocks(this.home, projectIds);
+        try {
+            const current = requireTask(this.store, task.id);
+            const currentIds = current.projectBindings.map(({ projectId }) => projectId).sort();
+            const lockedIds = [...projectIds].sort();
+            if (currentIds.length !== lockedIds.length
+                || currentIds.some((id, index) => id !== lockedIds[index])) {
+                throw new StorageConflictError(`Task Project bindings changed while its workspace fence was acquired: ${task.id}.`);
+            }
+            return { release, current };
+        }
+        catch (error) {
+            release();
+            throw error;
+        }
+    }
+    /**
+     * Acquire the per-Project maintenance fences for a Task's bindings and
+     * return the under-lock Task snapshot plus the release handle. Used by the
+     * dispatch preflight to hold ONE fence across new-Lane preparation and the
+     * command's adoption transaction, so a migrate cannot switch the Project
+     * catalog in that gap. The caller owns `release` and must call it on every
+     * exit path.
+     */
+    acquireTaskProjectMaintenanceLocks(taskId) {
+        return this.#acquireTaskProjectMaintenanceLocks(requireTask(this.store, taskId));
+    }
+    async #prepareTaskWorkspaceLocked(taskId) {
         const task = requireTask(this.store, taskId);
         if (!["draft", "active"].includes(task.status)) {
             throw new Error(`Task is not open for workspace preparation: ${task.id}.`);
@@ -69,6 +159,7 @@ export class FileTaskWorkspacePreparer {
                 root,
                 entries: []
             }, this.now());
+            this.#registerWorkspace(workspace);
             this.store.transaction((tx) => {
                 const latest = requireTask(tx, task.id);
                 if (!['draft', 'active'].includes(latest.status)
@@ -198,6 +289,7 @@ export class FileTaskWorkspacePreparer {
                 root,
                 entries: prepared.map(({ entry }) => entry)
             }, this.now());
+            this.#registerWorkspace(workspace);
             this.store.transaction((tx) => {
                 const latest = requireTask(tx, task.id);
                 if (!["draft", "active"].includes(latest.status)) {
@@ -206,10 +298,36 @@ export class FileTaskWorkspacePreparer {
                 if (!isDeepStrictEqual(latest.projectBindings, task.projectBindings)) {
                     throw new Error(`Task Projects changed while preparing its workspace: ${task.id}.`);
                 }
+                // Revalidate the Project catalog path after acquiring the fence: a
+                // concurrent migration must not leave a persisted worktree whose Git
+                // common dir is the old external checkout. A changed path rides the
+                // StorageConflictError retry channel so the retry re-reads the catalog
+                // and prepares against the current (Home-managed) repository.
+                for (const { project } of prepared) {
+                    const latestProject = requireProject(tx, project.id);
+                    if (latestProject.path !== project.path) {
+                        throw new StorageConflictError(`Project path changed while preparing its workspace: ${project.id}.`);
+                    }
+                }
                 const current = tx.getTaskWorkspace(task.id);
                 if (current !== null && current.owner.type !== "task") {
                     throw new Error(`Task main workspace ownership is invalid: ${task.id}.`);
                 }
+                // Single-writer CAS, mirroring the rebuild guard: this attempt only
+                // commits while the Task is still unbound (or carries the identity it
+                // started with). A concurrent prepare or rebuild that bound a
+                // different identity wins; this attempt discards its refs and retries
+                // through the StorageConflictError channel.
+                if (workspaceIdentity !== undefined
+                    && latest.workspaceIdentity !== undefined
+                    && !isDeepStrictEqual(validateTaskWorkspaceIdentity(latest.workspaceIdentity), workspaceIdentity)) {
+                    throw new StorageConflictError(`Task workspace identity changed while preparing its workspace: ${task.id}.`);
+                }
+                if (current === null
+                    ? existing !== null
+                    : existing === null || !sameManagedWorkspace(current, existing)) {
+                    throw new StorageConflictError(`Task workspace changed while preparing its workspace: ${task.id}.`);
+                }
                 const pinnedBindings = latest.projectBindings.map((binding) => {
                     const baseline = baselines.get(binding.projectId);
                     return baseline?.pinTask === true
@@ -237,15 +355,31 @@ export class FileTaskWorkspacePreparer {
                     // The Role field is only a cwd/snapshot hint.  Preserve the hint for
                     // an active WorkItem assignment; the durable owner is the WorkItem,
                     // not this Role record.  Other Roles use Task main.
-                    const assignedItem = tx.listWorkItems(task.id).find((candidate) => (candidate.assignee === role.name
-                        && !["completed", "failed", "retired"]
-                            .includes(candidate.status)));
+                    // Prefer the active Run's exact WorkItem for this Role; fall back
+                    // to the first queued WorkItem only when no active Run owns the Role.
+                    const activeRoleRun = tx.getActiveAgentRun(task.id, role.name);
+                    const activeRunItem = activeRoleRun !== null
+                        && activeRoleRun.purpose === "execution"
+                        && activeRoleRun.workItemId !== undefined
+                        ? tx.getWorkItem(task.id, activeRoleRun.workItemId)
+                        : null;
+                    const assignedItem = activeRunItem !== null
+                        && activeRunItem.assignee === role.name
+                        && !["completed", "failed", "retired"].includes(activeRunItem.status)
+                        ? activeRunItem
+                        : tx.listWorkItems(task.id).find((candidate) => (candidate.assignee === role.name
+                            && !["completed", "failed", "retired"]
+                                .includes(candidate.status)));
                     const assignedWorkspace = assignedItem === undefined
                         ? null
                         : tx.getWorkItemWorkspace(task.id, assignedItem.id);
                     const target = assignedWorkspace?.root ?? root;
                     if (role.workspace !== target) {
-                        retireWorkspaceBoundSession(tx, task.id, role.name, timestamp);
+                        if (assignedItem === undefined
+                            || assignedWorkspace === null
+                            || !canCorrectActiveWorkItemRoleWorkspaceHint(tx, task.id, role, assignedItem, assignedWorkspace)) {
+                            retireWorkspaceBoundSession(tx, task.id, role.name, timestamp);
+                        }
                         tx.saveRole(task.id, updateRole(role, { workspace: target }, timestamp));
                     }
                 }
@@ -253,10 +387,40 @@ export class FileTaskWorkspacePreparer {
             return { taskId, status: "ready", path: root };
         }
         catch (error) {
-            await this.#discardUnadoptedEntries(task, taskSegment, prepared, MAIN_WORKTREE);
+            // A failed or conflicted preparation owns no durable record: drop the
+            // branches too, so a retry mints a clean identity without half-created
+            // refs behind. Adopted (already catalogued) worktrees are never touched.
+            await this.#discardUnadoptedEntries(task, taskSegment, prepared, MAIN_WORKTREE, true);
             throw error;
         }
     }
+    /**
+     * The conflict-retry loop for a Task-main prepare, run with the caller's
+     * fences already held. A lost identity/workspace CAS retries safely under
+     * the same fence set; a binding-set change makes that fence set stale, so
+     * the conflict is rethrown and only the caller (which can re-acquire) may
+     * retry it.
+     */
+    async #prepareTaskWorkspaceWithRetries(taskId, lockedProjectIds) {
+        for (let attempt = 0;; attempt += 1) {
+            try {
+                return await this.#prepareTaskWorkspaceLocked(taskId);
+            }
+            catch (error) {
+                if (!(error instanceof StorageConflictError)
+                    || attempt >= TASK_WORKSPACE_PREPARE_MAX_CONFLICT_RETRIES) {
+                    throw error;
+                }
+                const current = requireTask(this.store, taskId);
+                const currentIds = current.projectBindings.map(({ projectId }) => projectId).sort();
+                const locked = [...lockedProjectIds].sort();
+                if (currentIds.length !== locked.length
+                    || currentIds.some((id, index) => id !== locked[index])) {
+                    throw error;
+                }
+            }
+        }
+    }
     /**
      * Mint the Task's durable workspace identity with create-not-exists
      * semantics: the candidate main branch must not already exist in any bound
@@ -376,148 +540,160 @@ export class FileTaskWorkspacePreparer {
         const item = requireWorkItem(this.store, taskId, workItemId);
         const task = requireTask(this.store, item.taskId);
         assertWorkItemWorkspaceEligible(this.store, task, item);
-        await this.prepareTaskWorkspace(task.id);
-        // prepareTaskWorkspace may have just minted and persisted the workspace
-        // identity; derive the segment from the persisted Task.
-        const taskSegment = this.#taskSegment(requireTask(this.store, task.id));
-        const main = this.store.getTaskWorkspace(task.id);
-        if (main === null || main.owner.type !== "task") {
-            throw new Error(`Task main workspace is not ready: ${task.id}.`);
-        }
-        const existing = this.store.getWorkItemWorkspace(task.id, item.id);
-        if (existing !== null && (existing.owner.type !== "work-item"
-            || existing.owner.workItemId !== item.id)) {
-            throw new Error(`WorkItem workspace owner is invalid: ${task.id}/${item.id}.`);
-        }
-        if (item.assignee !== undefined) {
-            assertWorkspaceSessionsRetirable(this.store, task.id, item.assignee, this.now());
-        }
-        const writeProjects = new Set(item.writeProjectIds);
-        const boundProjects = new Set(task.projectBindings.map(({ projectId }) => projectId));
-        for (const baseRef of item.baseRefs ?? []) {
-            if (!boundProjects.has(baseRef.projectId)) {
-                throw new Error(`WorkItem base-ref Project is not bound to its Task: ${item.id}/${baseRef.projectId}.`);
-            }
-            if (!writeProjects.has(baseRef.projectId)) {
-                throw new Error(`WorkItem base-ref Project is not writable: ${item.id}/${baseRef.projectId}.`);
-            }
-        }
-        const root = this.#workItemWorkspaceRoot(task.id, item.id);
-        const prepared = [];
+        // Hold the per-Project maintenance fence across the ensure-main-prepared
+        // and the WorkItem worktree creation, so a concurrent migrate/rebuild
+        // cannot switch the Project catalog between the two. The under-lock Task
+        // snapshot drives every Project read and Git effect below.
+        const { release, current: lockedTask } = this.#acquireTaskProjectMaintenanceLocks(task);
         try {
-            for (const binding of task.projectBindings) {
-                const project = requireProject(this.store, binding.projectId);
-                const mainEntry = requireWorkspaceEntry(main, project.id);
-                if (!writeProjects.has(project.id)) {
-                    prepared.push({
-                        project,
-                        entry: { ...mainEntry, access: "read" }
-                    });
-                    continue;
-                }
-                const previous = existing?.entries.find(({ projectId }) => projectId === project.id);
-                const head = await this.git.inspect(mainEntry.path, "HEAD");
-                const requestedBaseRef = item.baseRefs?.find(({ projectId }) => (projectId === project.id))?.baseRef;
-                const baseRef = previous?.access === "write"
-                    ? previous.baseCommit
-                    : requestedBaseRef ?? head.baseCommit;
-                const requestedBase = previous?.access === "write" || requestedBaseRef === undefined
-                    ? null
-                    : await this.git.inspect(project.path, requestedBaseRef);
-                const physical = await this.git.ensureWorktree({
-                    repositoryPath: project.path,
-                    container: this.#projectContainer(project.name),
-                    taskSegment,
-                    roleName: item.id,
-                    baseRef
-                });
-                const entry = {
-                    projectId: project.id,
-                    directory: binding.directory,
-                    access: "write",
-                    path: physical.path,
-                    branch: physical.branch,
-                    baseRef: previous?.access === "write" ? previous.baseRef : baseRef,
-                    // The recorded base is the immutable capture boundary. An existing
-                    // worktree reports its current HEAD from ensureWorktree(), which
-                    // may already contain committed Worker changes and must never
-                    // replace that boundary during scope expansion or reconciliation.
-                    baseCommit: previous?.access === "write"
+            const lockedProjectIds = lockedTask.projectBindings.map(({ projectId }) => projectId);
+            await this.#prepareTaskWorkspaceWithRetries(lockedTask.id, lockedProjectIds);
+            // prepareTaskWorkspace may have just minted and persisted the workspace
+            // identity; derive the segment from the persisted Task.
+            const taskSegment = this.#taskSegment(requireTask(this.store, lockedTask.id));
+            const main = this.store.getTaskWorkspace(lockedTask.id);
+            if (main === null || main.owner.type !== "task") {
+                throw new Error(`Task main workspace is not ready: ${lockedTask.id}.`);
+            }
+            const existing = this.store.getWorkItemWorkspace(lockedTask.id, item.id);
+            if (existing !== null && (existing.owner.type !== "work-item"
+                || existing.owner.workItemId !== item.id)) {
+                throw new Error(`WorkItem workspace owner is invalid: ${lockedTask.id}/${item.id}.`);
+            }
+            if (item.assignee !== undefined) {
+                assertWorkspaceSessionsRetirable(this.store, lockedTask.id, item.assignee, this.now());
+            }
+            const writeProjects = new Set(item.writeProjectIds);
+            const boundProjects = new Set(lockedTask.projectBindings.map(({ projectId }) => projectId));
+            for (const baseRef of item.baseRefs ?? []) {
+                if (!boundProjects.has(baseRef.projectId)) {
+                    throw new Error(`WorkItem base-ref Project is not bound to its Task: ${item.id}/${baseRef.projectId}.`);
+                }
+                if (!writeProjects.has(baseRef.projectId)) {
+                    throw new Error(`WorkItem base-ref Project is not writable: ${item.id}/${baseRef.projectId}.`);
+                }
+            }
+            const root = this.#workItemWorkspaceRoot(lockedTask.id, item.id);
+            const prepared = [];
+            try {
+                for (const binding of lockedTask.projectBindings) {
+                    const project = requireProject(this.store, binding.projectId);
+                    const mainEntry = requireWorkspaceEntry(main, project.id);
+                    if (!writeProjects.has(project.id)) {
+                        prepared.push({
+                            project,
+                            entry: { ...mainEntry, access: "read" }
+                        });
+                        continue;
+                    }
+                    const previous = existing?.entries.find(({ projectId }) => projectId === project.id);
+                    const head = await this.git.inspect(mainEntry.path, "HEAD");
+                    const requestedBaseRef = item.baseRefs?.find(({ projectId }) => (projectId === project.id))?.baseRef;
+                    const baseRef = previous?.access === "write"
                         ? previous.baseCommit
-                        : physical.baseCommit
-                };
-                // Track the physical entry before any postcondition check. If a
-                // freshly attached deterministic branch is rejected below, the
-                // catch-path must remove its unadopted worktree even though no
-                // durable ManagedWorkspace has been written yet.
-                prepared.push({ project, entry });
-                if (previous?.access === "write" && (physical.path !== previous.path
-                    || physical.branch !== previous.branch)) {
-                    throw new Error(`Existing WorkItem Project workspace identity changed: ${item.id}/${project.id}.`);
-                }
-                if (previous?.access === "write") {
-                    if (requestedBaseRef === undefined && previous.baseRef !== previous.baseCommit) {
-                        throw new Error(`Existing WorkItem Project base ref record changed: ${item.id}/${project.id}.`);
+                        : requestedBaseRef ?? head.baseCommit;
+                    const requestedBase = previous?.access === "write" || requestedBaseRef === undefined
+                        ? null
+                        : await this.git.inspect(project.path, requestedBaseRef);
+                    const physical = await this.git.ensureWorktree({
+                        repositoryPath: project.path,
+                        container: this.#projectContainer(project.name),
+                        taskSegment,
+                        roleName: item.id,
+                        baseRef
+                    });
+                    const entry = {
+                        projectId: project.id,
+                        directory: binding.directory,
+                        access: "write",
+                        path: physical.path,
+                        branch: physical.branch,
+                        baseRef: previous?.access === "write" ? previous.baseRef : baseRef,
+                        // The recorded base is the immutable capture boundary. An existing
+                        // worktree reports its current HEAD from ensureWorktree(), which
+                        // may already contain committed Worker changes and must never
+                        // replace that boundary during scope expansion or reconciliation.
+                        baseCommit: previous?.access === "write"
+                            ? previous.baseCommit
+                            : physical.baseCommit
+                    };
+                    // Track the physical entry before any postcondition check. If a
+                    // freshly attached deterministic branch is rejected below, the
+                    // catch-path must remove its unadopted worktree even though no
+                    // durable ManagedWorkspace has been written yet.
+                    prepared.push({ project, entry });
+                    if (previous?.access === "write" && (physical.path !== previous.path
+                        || physical.branch !== previous.branch)) {
+                        throw new Error(`Existing WorkItem Project workspace identity changed: ${item.id}/${project.id}.`);
                     }
-                    if (requestedBaseRef !== undefined && requestedBaseRef !== previous.baseRef) {
-                        throw new Error(`Existing WorkItem Project base ref changed: ${item.id}/${project.id}.`);
+                    if (previous?.access === "write") {
+                        if (requestedBaseRef === undefined && previous.baseRef !== previous.baseCommit) {
+                            throw new Error(`Existing WorkItem Project base ref record changed: ${item.id}/${project.id}.`);
+                        }
+                        if (requestedBaseRef !== undefined && requestedBaseRef !== previous.baseRef) {
+                            throw new Error(`Existing WorkItem Project base ref changed: ${item.id}/${project.id}.`);
+                        }
+                        if (!await this.git.isAncestor(project.path, previous.baseCommit, physical.baseCommit)) {
+                            throw new Error(`Existing WorkItem Project HEAD does not descend from its frozen base: `
+                                + `${item.id}/${project.id}.`);
+                        }
                     }
-                    if (!await this.git.isAncestor(project.path, previous.baseCommit, physical.baseCommit)) {
-                        throw new Error(`Existing WorkItem Project HEAD does not descend from its frozen base: `
+                    else if (requestedBase !== null && physical.baseCommit !== requestedBase.baseCommit) {
+                        throw new Error(`WorkItem Project workspace did not start at its requested base ref: `
                             + `${item.id}/${project.id}.`);
                     }
                 }
-                else if (requestedBase !== null && physical.baseCommit !== requestedBase.baseCommit) {
-                    throw new Error(`WorkItem Project workspace did not start at its requested base ref: `
-                        + `${item.id}/${project.id}.`);
-                }
-            }
-            await ensureWorkspaceView(root, prepared.map(({ entry }) => entry));
-            const workspace = createManagedWorkspace({
-                owner: { type: "work-item", taskId: task.id, workItemId: item.id },
-                root,
-                entries: prepared.map(({ entry }) => entry)
-            }, this.now());
-            return this.store.transaction((tx) => {
-                const latestTask = requireTask(tx, task.id);
-                const latestItem = tx.getWorkItem(task.id, item.id);
-                if (latestTask.status !== "active" || latestItem === null) {
-                    throw new Error(`Work item changed while preparing its workspace: ${item.id}.`);
-                }
-                if (latestItem.revision !== item.revision
-                    || !isDeepStrictEqual(latestItem.writeProjectIds, item.writeProjectIds)) {
-                    throw new Error(`Work item changed while preparing its workspace: ${item.id}.`);
-                }
-                const activeDevelopRun = tx.listAgentRuns(task.id)
-                    .find((run) => run.status === "active" && run.workItemId === item.id);
-                if (activeDevelopRun !== undefined) {
-                    throw new Error(`Work Item already has an active Develop Run: ${activeDevelopRun.id}.`);
-                }
-                if (latestItem.assignee !== undefined
-                    && tx.getActiveAgentRun(task.id, latestItem.assignee) !== null) {
-                    throw new Error(`Role has an active Run: ${task.id}/${latestItem.assignee}.`);
-                }
-                const current = tx.getWorkItemWorkspace(task.id, item.id);
-                if (current !== null && (current.owner.type !== "work-item"
-                    || current.owner.workItemId !== item.id)) {
-                    throw new Error(`WorkItem workspace changed: ${task.id}/${item.id}.`);
-                }
-                const timestamp = this.now();
-                const stored = preserveWorkspaceCreatedAt(workspace, current);
-                tx.saveManagedWorkspace(stored);
-                if (latestItem.assignee !== undefined) {
-                    const latestRole = tx.getRole(task.id, latestItem.assignee);
-                    if (latestRole !== null && latestRole.workspace !== root) {
-                        retireWorkspaceBoundSession(tx, task.id, latestItem.assignee, timestamp);
-                        tx.saveRole(task.id, updateRole(latestRole, { workspace: root }, timestamp));
+                await ensureWorkspaceView(root, prepared.map(({ entry }) => entry));
+                const workspace = createManagedWorkspace({
+                    owner: { type: "work-item", taskId: lockedTask.id, workItemId: item.id },
+                    root,
+                    entries: prepared.map(({ entry }) => entry)
+                }, this.now());
+                this.#registerWorkspace(workspace);
+                return this.store.transaction((tx) => {
+                    const latestTask = requireTask(tx, lockedTask.id);
+                    const latestItem = tx.getWorkItem(lockedTask.id, item.id);
+                    if (latestTask.status !== "active" || latestItem === null) {
+                        throw new Error(`Work item changed while preparing its workspace: ${item.id}.`);
                     }
-                }
-                return stored;
-            });
+                    if (latestItem.revision !== item.revision
+                        || !isDeepStrictEqual(latestItem.writeProjectIds, item.writeProjectIds)) {
+                        throw new Error(`Work item changed while preparing its workspace: ${item.id}.`);
+                    }
+                    const activeDevelopRun = tx.listAgentRuns(lockedTask.id)
+                        .find((run) => run.status === "active" && run.workItemId === item.id);
+                    if (activeDevelopRun !== undefined) {
+                        throw new Error(`Work Item already has an active Develop Run: ${activeDevelopRun.id}.`);
+                    }
+                    if (latestItem.assignee !== undefined
+                        && tx.getActiveAgentRun(lockedTask.id, latestItem.assignee) !== null) {
+                        throw new Error(`Role has an active Run: ${lockedTask.id}/${latestItem.assignee}.`);
+                    }
+                    const existingWorkspace = tx.getWorkItemWorkspace(lockedTask.id, item.id);
+                    if (existingWorkspace !== null && (existingWorkspace.owner.type !== "work-item"
+                        || existingWorkspace.owner.workItemId !== item.id)) {
+                        throw new Error(`WorkItem workspace changed: ${lockedTask.id}/${item.id}.`);
+                    }
+                    const timestamp = this.now();
+                    const stored = preserveWorkspaceCreatedAt(workspace, existingWorkspace);
+                    tx.saveManagedWorkspace(stored);
+                    if (latestItem.assignee !== undefined) {
+                        const latestRole = tx.getRole(lockedTask.id, latestItem.assignee);
+                        if (latestRole !== null && latestRole.workspace !== root) {
+                            retireWorkspaceBoundSession(tx, lockedTask.id, latestItem.assignee, timestamp);
+                            tx.saveRole(lockedTask.id, updateRole(latestRole, { workspace: root }, timestamp));
+                        }
+                    }
+                    return stored;
+                });
+            }
+            catch (error) {
+                await this.#discardUnadoptedEntries(lockedTask, taskSegment, prepared, item.id);
+                throw error;
+            }
         }
-        catch (error) {
-            await this.#discardUnadoptedEntries(task, taskSegment, prepared, item.id);
-            throw error;
+        finally {
+            release();
         }
     }
     /**
@@ -525,112 +701,128 @@ export class FileTaskWorkspacePreparer {
      * Git identity, ownership, and cleanup are delegated to this preparer; the
      * command layer only consumes the resulting managed record.
      */
-    async prepareExecutionLaneWorkspace(taskId, executionGroupId, executionLaneId, hint) {
+    async prepareExecutionLaneWorkspace(taskId, executionGroupId, executionLaneId, hint, heldFence) {
         const task = requireTask(this.store, taskId);
-        const lineage = executionLaneLineage(this.store, task, executionGroupId, executionLaneId, hint);
-        const source = lineage.purpose === "execution"
-            ? this.store.getWorkItemWorkspace(taskId, lineage.workItemId)
-            : this.store.getReviewRoundWorkspace(taskId, lineage.reviewRoundId);
-        if (source === null) {
-            throw new Error(`Execution Lane source workspace is not ready: ${executionLaneId}.`);
-        }
-        const taskSegment = this.#taskSegment(task);
-        const owner = lineage.purpose === "execution"
-            ? {
-                type: "execution-lane",
-                taskId,
-                executionGroupId,
-                executionLaneId,
-                purpose: "execution",
-                workItemId: lineage.workItemId
-            }
-            : {
-                type: "execution-lane",
-                taskId,
-                executionGroupId,
-                executionLaneId,
-                purpose: "review",
-                reviewRoundId: lineage.reviewRoundId
-            };
-        const existing = this.store.getManagedWorkspace(owner);
-        if (existing !== null) {
-            if (existing.owner.type !== "execution-lane" || existing.root !== this.#executionLaneWorkspaceRoot(taskId, executionGroupId, executionLaneId)) {
-                throw new Error(`Execution Lane managed workspace identity changed: ${taskId}/${executionLaneId}.`);
-            }
-            await ensureWorkspaceView(existing.root, existing.entries);
-            for (const entry of existing.entries.filter(({ access }) => access === "write")) {
-                const project = requireProject(this.store, entry.projectId);
-                const physical = await this.git.ensureWorktree({
-                    repositoryPath: project.path,
-                    container: this.#projectContainer(project.name),
-                    taskSegment,
-                    roleName: managedWorktreeName(owner),
-                    baseRef: entry.baseCommit
-                });
-                if (physical.path !== entry.path || physical.branch !== entry.branch) {
-                    throw new Error(`Execution Lane physical identity changed: ${taskId}/${executionLaneId}/${entry.projectId}.`);
-                }
-            }
-            return existing;
-        }
-        const item = lineage.purpose === "execution"
-            ? this.store.getWorkItem(taskId, lineage.workItemId)
-            : null;
-        const writable = new Set(lineage.purpose === "execution"
-            ? item?.writeProjectIds ?? []
-            : task.projectBindings.map(({ projectId }) => projectId));
-        const prepared = [];
+        // Hold the per-Project maintenance fence across Lane worktree creation
+        // (both the reuse and the fresh-mint paths), so a concurrent
+        // migrate/rebuild cannot switch the Project catalog mid-prepare. A
+        // dispatch preflight that prepares a whole new Group passes the fence it
+        // already holds (one locked boundary across preparation and adoption);
+        // otherwise the fence is acquired here.
+        const { release, current: lockedTask } = heldFence === undefined
+            ? this.#acquireTaskProjectMaintenanceLocks(task)
+            : { release: () => { }, current: heldFence.current };
         try {
-            for (const binding of task.projectBindings) {
-                const project = requireProject(this.store, binding.projectId);
-                const sourceEntry = requireWorkspaceEntry(source, project.id);
-                if (!writable.has(project.id)) {
-                    prepared.push({ project, entry: { ...sourceEntry, access: "read" } });
-                    continue;
+            const lineage = executionLaneLineage(this.store, lockedTask, executionGroupId, executionLaneId, hint);
+            const source = lineage.purpose === "execution"
+                ? this.store.getWorkItemWorkspace(taskId, lineage.workItemId)
+                : this.store.getReviewRoundWorkspace(taskId, lineage.reviewRoundId);
+            if (source === null) {
+                throw new Error(`Execution Lane source workspace is not ready: ${executionLaneId}.`);
+            }
+            const taskSegment = this.#taskSegment(lockedTask);
+            const owner = lineage.purpose === "execution"
+                ? {
+                    type: "execution-lane",
+                    taskId,
+                    executionGroupId,
+                    executionLaneId,
+                    purpose: "execution",
+                    workItemId: lineage.workItemId
                 }
-                const physical = await this.git.ensureWorktree({
-                    repositoryPath: project.path,
-                    container: this.#projectContainer(project.name),
-                    taskSegment,
-                    roleName: managedWorktreeName(owner),
-                    baseRef: sourceEntry.baseCommit
-                });
-                prepared.push({
-                    project,
-                    entry: {
-                        ...sourceEntry,
-                        access: "write",
-                        path: physical.path,
-                        branch: physical.branch,
-                        baseRef: sourceEntry.baseCommit,
-                        baseCommit: sourceEntry.baseCommit
+                : {
+                    type: "execution-lane",
+                    taskId,
+                    executionGroupId,
+                    executionLaneId,
+                    purpose: "review",
+                    reviewRoundId: lineage.reviewRoundId
+                };
+            const existing = this.store.getManagedWorkspace(owner);
+            if (existing !== null) {
+                if (existing.owner.type !== "execution-lane" || existing.root !== this.#executionLaneWorkspaceRoot(taskId, executionGroupId, executionLaneId)) {
+                    throw new Error(`Execution Lane managed workspace identity changed: ${taskId}/${executionLaneId}.`);
+                }
+                await ensureWorkspaceView(existing.root, existing.entries);
+                this.#registerWorkspace(existing);
+                for (const entry of existing.entries.filter(({ access }) => access === "write")) {
+                    const project = requireProject(this.store, entry.projectId);
+                    const physical = await this.git.ensureWorktree({
+                        repositoryPath: project.path,
+                        container: this.#projectContainer(project.name),
+                        taskSegment,
+                        roleName: managedWorktreeName(owner),
+                        baseRef: entry.baseCommit
+                    });
+                    if (physical.path !== entry.path || physical.branch !== entry.branch) {
+                        throw new Error(`Execution Lane physical identity changed: ${taskId}/${executionLaneId}/${entry.projectId}.`);
                     }
-                });
+                }
+                return existing;
             }
-            const root = this.#executionLaneWorkspaceRoot(taskId, executionGroupId, executionLaneId);
-            await ensureWorkspaceView(root, prepared.map(({ entry }) => entry));
-            const workspace = createManagedWorkspace({
-                owner,
-                root,
-                entries: prepared.map(({ entry }) => entry)
-            }, this.now());
-            const durableLane = this.store.listWorkItems(taskId).some((item) => (workItemExecutionGroupById(item, executionGroupId)?.lanes.some(({ id }) => id === executionLaneId))) || this.store.listReviewRounds(taskId).some((round) => (round.executionGroup?.id === executionGroupId
-                && round.executionGroup.lanes.some(({ id }) => id === executionLaneId)));
-            if (durableLane) {
-                return this.store.transaction((tx) => {
-                    const current = tx.getManagedWorkspace(owner);
-                    if (current !== null && !isDeepStrictEqual(current, workspace)) {
-                        throw new Error(`Execution Lane workspace changed before adoption: ${executionLaneId}.`);
+            const item = lineage.purpose === "execution"
+                ? this.store.getWorkItem(taskId, lineage.workItemId)
+                : null;
+            const writable = new Set(lineage.purpose === "execution"
+                ? item?.writeProjectIds ?? []
+                : lockedTask.projectBindings.map(({ projectId }) => projectId));
+            const prepared = [];
+            try {
+                for (const binding of lockedTask.projectBindings) {
+                    const project = requireProject(this.store, binding.projectId);
+                    const sourceEntry = requireWorkspaceEntry(source, project.id);
+                    if (!writable.has(project.id)) {
+                        prepared.push({ project, entry: { ...sourceEntry, access: "read" } });
+                        continue;
                     }
-                    tx.saveManagedWorkspace(current ?? workspace);
-                    return current ?? workspace;
-                });
+                    const physical = await this.git.ensureWorktree({
+                        repositoryPath: project.path,
+                        container: this.#projectContainer(project.name),
+                        taskSegment,
+                        roleName: managedWorktreeName(owner),
+                        baseRef: sourceEntry.baseCommit
+                    });
+                    prepared.push({
+                        project,
+                        entry: {
+                            ...sourceEntry,
+                            access: "write",
+                            path: physical.path,
+                            branch: physical.branch,
+                            baseRef: sourceEntry.baseCommit,
+                            baseCommit: sourceEntry.baseCommit
+                        }
+                    });
+                }
+                const root = this.#executionLaneWorkspaceRoot(taskId, executionGroupId, executionLaneId);
+                await ensureWorkspaceView(root, prepared.map(({ entry }) => entry));
+                const workspace = createManagedWorkspace({
+                    owner,
+                    root,
+                    entries: prepared.map(({ entry }) => entry)
+                }, this.now());
+                this.#registerWorkspace(workspace);
+                const durableLane = this.store.listWorkItems(taskId).some((item) => (workItemExecutionGroupById(item, executionGroupId)?.lanes.some(({ id }) => id === executionLaneId))) || this.store.listReviewRounds(taskId).some((round) => (round.executionGroup?.id === executionGroupId
+                    && round.executionGroup.lanes.some(({ id }) => id === executionLaneId)));
+                if (durableLane) {
+                    return this.store.transaction((tx) => {
+                        const current = tx.getManagedWorkspace(owner);
+                        if (current !== null && !isDeepStrictEqual(current, workspace)) {
+                            throw new Error(`Execution Lane workspace changed before adoption: ${executionLaneId}.`);
+                        }
+                        tx.saveManagedWorkspace(current ?? workspace);
+                        return current ?? workspace;
+                    });
+                }
+                return workspace;
+            }
+            catch (error) {
+                await this.#discardUnadoptedEntries(lockedTask, taskSegment, prepared, managedWorktreeName(owner), true);
+                throw error;
             }
-            return workspace;
         }
-        catch (error) {
-            await this.#discardUnadoptedEntries(task, taskSegment, prepared, managedWorktreeName(owner), true);
-            throw error;
+        finally {
+            release();
         }
     }
     /**
@@ -848,6 +1040,7 @@ export class FileTaskWorkspacePreparer {
             removed ||= result === "removed";
         }
         await removeWorkspaceView(workspace.root);
+        this.#resourceRegistrar().markWorkspaceDeleted(workspace);
         this.store.removeManagedWorkspace(workspace.owner);
         return removed ? "removed" : "missing";
     }
@@ -860,11 +1053,33 @@ export class FileTaskWorkspacePreparer {
             return "missing";
         const task = requireTask(this.store, workspace.owner.taskId);
         const taskSegment = this.#taskSegment(task);
-        const state = await this.#inspectEntries(taskSegment, managedWorktreeName(workspace.owner), workspace.entries.filter(({ access }) => access === "write"));
+        const writable = workspace.entries.filter(({ access }) => access === "write");
+        let state;
+        try {
+            state = await this.#inspectEntries(taskSegment, managedWorktreeName(workspace.owner), writable);
+        }
+        catch (error) {
+            // A `project migrate` between preparation and compensation switches the
+            // catalog, so the worktree's common-dir no longer matches the Project's
+            // current repository. Fall back to removing the stranded worktree
+            // through its own Git identity.
+            if (!(error instanceof Error && error.message.includes("belongs to another project"))) {
+                throw error;
+            }
+            let removed = false;
+            for (const entry of writable) {
+                const result = await this.git.removeStrandedWorktree(entry.path);
+                if (result === "dirty")
+                    return "dirty";
+                removed ||= result === "removed";
+            }
+            await removeWorkspaceView(workspace.root);
+            return removed ? "removed" : "missing";
+        }
         if (state === "dirty")
             return "dirty";
         let removed = false;
-        for (const entry of workspace.entries.filter(({ access }) => access === "write")) {
+        for (const entry of writable) {
             const project = requireProject(this.store, entry.projectId);
             const result = await this.git.removeWorktree({
                 repositoryPath: project.path,
@@ -929,287 +1144,295 @@ export class FileTaskWorkspacePreparer {
      * frozen Develop snapshot.  This record is owned by the ReviewRound; it is
      * never used as a ChangeSet capture source. */
     async prepareReviewRoundWorkspace(taskId, reviewRoundId) {
-        const task = requireTask(this.store, taskId);
-        const taskSegment = this.#taskSegment(task);
-        const round = this.store.getReviewRound(task.id, reviewRoundId);
-        if (round === null)
-            throw new Error(`ReviewRound not found: ${task.id}/${reviewRoundId}.`);
-        if (round.status !== "pending") {
-            throw new Error(`ReviewRound workspace can only prepare while pending: ${round.id}.`);
-        }
-        const item = requireWorkItem(this.store, task.id, round.workItemId);
-        const candidate = item.candidates.find(({ id }) => id === round.candidateId);
-        if (candidate === undefined) {
-            throw new Error(`ReviewRound Candidate not found: ${round.candidateId}.`);
-        }
-        const taskScope = (round.scope ?? "work-item") === "task";
-        // A WorkItem ReviewRound is an immutable snapshot of Develop. A Task
-        // ReviewRound intentionally uses the latest committed Integration heads
-        // instead, while retaining the WorkItem/Candidate anchor for storage and
-        // lifecycle compatibility.
-        const develop = candidate.workspace;
-        if (!taskScope && (develop === undefined || candidate.gitSnapshot === undefined)) {
-            throw new Error(`Candidate has no frozen managed Git snapshot: ${candidate.id}.`);
-        }
-        if (!taskScope && candidate.gitSnapshot.reviewBaseCommit !== round.reviewBaseCommit) {
-            throw new Error(`ReviewRound base no longer matches its Candidate: ${round.id}.`);
-        }
-        const reviewer = this.store.getRole(task.id, round.reviewerRoleName);
-        if (reviewer === null) {
-            throw new Error(`Reviewer Role not found: ${task.id}/${round.reviewerRoleName}.`);
-        }
-        const snapshotCommits = new Map((taskScope
-            ? round.taskCandidate?.projects ?? []
-            : candidate.gitSnapshot.projects).map(({ projectId, commit }) => [projectId, commit]));
-        const frozenEntries = taskScope
-            ? task.projectBindings.map((binding) => {
-                const commit = snapshotCommits.get(binding.projectId);
-                if (commit === undefined) {
-                    throw new Error(`Task Review candidate Project is missing: ${binding.projectId}.`);
-                }
-                const project = requireProject(this.store, binding.projectId);
-                const identity = worktreeIdentity(taskSegment, round.id);
-                return {
-                    projectId: binding.projectId,
-                    directory: binding.directory,
-                    access: "write",
-                    path: join(this.#projectContainer(project.name), identity.directory),
-                    branch: identity.branch,
-                    baseRef: commit,
-                    baseCommit: commit
-                };
-            })
-            : develop.entries.map((entry) => {
-                const commit = snapshotCommits.get(entry.projectId);
-                if (commit === undefined) {
-                    throw new Error(`Candidate snapshot Project is missing: ${entry.projectId}.`);
-                }
-                return { ...entry, baseRef: commit, baseCommit: commit };
-            });
-        if (taskScope && snapshotCommits.size !== task.projectBindings.length) {
-            throw new Error(`Task Review candidate Project scope changed: ${round.id}.`);
-        }
-        const expectedEntries = new Map(frozenEntries.map((entry) => [entry.projectId, entry]));
-        const existing = this.store.getReviewRoundWorkspace(task.id, round.id);
-        const reviewRoot = this.#reviewRoundWorkspaceRoot(task.id, round.id);
-        const retained = new Map();
-        const missing = new Set();
-        const adopted = existing?.root === reviewRoot;
-        if (existing !== null) {
-            if (!adopted) {
-                throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace root changed: ${round.id}.`);
-            }
-            if (round.workspace !== undefined && !isDeepStrictEqual(round.workspace, existing)) {
-                throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace record diverged: ${round.id}.`);
-            }
-            if (existing.entries.length !== expectedEntries.size) {
-                throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace Project scope changed: ${round.id}.`);
-            }
-            for (const entry of existing.entries) {
-                const source = expectedEntries.get(entry.projectId);
-                if (source === undefined) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace Project scope changed: ${round.id}/${entry.projectId}.`);
-                }
-                if (!sameCommit(entry.baseCommit, source.baseCommit)) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace baseCommit record mismatch for ${round.id}/${entry.projectId}: `
-                        + `expected ${source.baseCommit}, recorded ${entry.baseCommit}.`);
-                }
-                if (entry.directory !== source.directory
-                    || entry.access !== "write"
-                    || !sameCommit(entry.baseRef, source.baseCommit)) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace metadata changed for ${round.id}/${entry.projectId}.`);
-                }
-                const project = requireProject(this.store, entry.projectId);
-                const identity = worktreeIdentity(taskSegment, round.id);
-                const expectedPath = join(this.#projectContainer(project.name), identity.directory);
-                if (entry.path !== expectedPath || entry.branch !== identity.branch) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace managed identity mismatch for ${round.id}/${entry.projectId}.`);
+        const taskSnapshot = requireTask(this.store, taskId);
+        const { release, current: task } = this.#acquireTaskProjectMaintenanceLocks(taskSnapshot);
+        try {
+            const taskSegment = this.#taskSegment(task);
+            const round = this.store.getReviewRound(task.id, reviewRoundId);
+            if (round === null)
+                throw new Error(`ReviewRound not found: ${task.id}/${reviewRoundId}.`);
+            if (round.status !== "pending") {
+                throw new Error(`ReviewRound workspace can only prepare while pending: ${round.id}.`);
+            }
+            const item = requireWorkItem(this.store, task.id, round.workItemId);
+            const candidate = item.candidates.find(({ id }) => id === round.candidateId);
+            if (candidate === undefined) {
+                throw new Error(`ReviewRound Candidate not found: ${round.candidateId}.`);
+            }
+            const taskScope = (round.scope ?? "work-item") === "task";
+            // A WorkItem ReviewRound is an immutable snapshot of Develop. A Task
+            // ReviewRound intentionally uses the latest committed Integration heads
+            // instead, while retaining the WorkItem/Candidate anchor for storage and
+            // lifecycle compatibility.
+            const develop = candidate.workspace;
+            if (!taskScope && (develop === undefined || candidate.gitSnapshot === undefined)) {
+                throw new Error(`Candidate has no frozen managed Git snapshot: ${candidate.id}.`);
+            }
+            if (!taskScope && candidate.gitSnapshot.reviewBaseCommit !== round.reviewBaseCommit) {
+                throw new Error(`ReviewRound base no longer matches its Candidate: ${round.id}.`);
+            }
+            const reviewer = this.store.getRole(task.id, round.reviewerRoleName);
+            if (reviewer === null) {
+                throw new Error(`Reviewer Role not found: ${task.id}/${round.reviewerRoleName}.`);
+            }
+            const snapshotCommits = new Map((taskScope
+                ? round.taskCandidate?.projects ?? []
+                : candidate.gitSnapshot.projects).map(({ projectId, commit }) => [projectId, commit]));
+            const frozenEntries = taskScope
+                ? task.projectBindings.map((binding) => {
+                    const commit = snapshotCommits.get(binding.projectId);
+                    if (commit === undefined) {
+                        throw new Error(`Task Review candidate Project is missing: ${binding.projectId}.`);
+                    }
+                    const project = requireProject(this.store, binding.projectId);
+                    const identity = worktreeIdentity(taskSegment, round.id);
+                    return {
+                        projectId: binding.projectId,
+                        directory: binding.directory,
+                        access: "write",
+                        path: join(this.#projectContainer(project.name), identity.directory),
+                        branch: identity.branch,
+                        baseRef: commit,
+                        baseCommit: commit
+                    };
+                })
+                : develop.entries.map((entry) => {
+                    const commit = snapshotCommits.get(entry.projectId);
+                    if (commit === undefined) {
+                        throw new Error(`Candidate snapshot Project is missing: ${entry.projectId}.`);
+                    }
+                    return { ...entry, baseRef: commit, baseCommit: commit };
+                });
+            if (taskScope && snapshotCommits.size !== task.projectBindings.length) {
+                throw new Error(`Task Review candidate Project scope changed: ${round.id}.`);
+            }
+            const expectedEntries = new Map(frozenEntries.map((entry) => [entry.projectId, entry]));
+            const existing = this.store.getReviewRoundWorkspace(task.id, round.id);
+            const reviewRoot = this.#reviewRoundWorkspaceRoot(task.id, round.id);
+            const retained = new Map();
+            const missing = new Set();
+            const adopted = existing?.root === reviewRoot;
+            if (existing !== null) {
+                if (!adopted) {
+                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace root changed: ${round.id}.`);
+                }
+                if (round.workspace !== undefined && !isDeepStrictEqual(round.workspace, existing)) {
+                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace record diverged: ${round.id}.`);
                 }
-                let physical;
-                try {
-                    physical = await this.git.inspect(entry.path, "HEAD");
+                if (existing.entries.length !== expectedEntries.size) {
+                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace Project scope changed: ${round.id}.`);
                 }
-                catch (error) {
+                for (const entry of existing.entries) {
+                    const source = expectedEntries.get(entry.projectId);
+                    if (source === undefined) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace Project scope changed: ${round.id}/${entry.projectId}.`);
+                    }
+                    if (!sameCommit(entry.baseCommit, source.baseCommit)) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace baseCommit record mismatch for ${round.id}/${entry.projectId}: `
+                            + `expected ${source.baseCommit}, recorded ${entry.baseCommit}.`);
+                    }
+                    if (entry.directory !== source.directory
+                        || entry.access !== "write"
+                        || !sameCommit(entry.baseRef, source.baseCommit)) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace metadata changed for ${round.id}/${entry.projectId}.`);
+                    }
+                    const project = requireProject(this.store, entry.projectId);
+                    const identity = worktreeIdentity(taskSegment, round.id);
+                    const expectedPath = join(this.#projectContainer(project.name), identity.directory);
+                    if (entry.path !== expectedPath || entry.branch !== identity.branch) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace managed identity mismatch for ${round.id}/${entry.projectId}.`);
+                    }
+                    let physical;
                     try {
-                        await lstat(entry.path);
+                        physical = await this.git.inspect(entry.path, "HEAD");
                     }
-                    catch (probeError) {
-                        if (isMissingPath(probeError)) {
-                            missing.add(entry.projectId);
-                            continue;
+                    catch (error) {
+                        try {
+                            await lstat(entry.path);
                         }
+                        catch (probeError) {
+                            if (isMissingPath(probeError)) {
+                                missing.add(entry.projectId);
+                                continue;
+                            }
+                        }
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace cannot be inspected for ${round.id}/${entry.projectId}: `
+                            + `${error instanceof Error ? error.message : String(error)}`);
                     }
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace cannot be inspected for ${round.id}/${entry.projectId}: `
-                        + `${error instanceof Error ? error.message : String(error)}`);
-                }
-                if (physical.root !== entry.path) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace managed path mismatch for ${round.id}/${entry.projectId}.`);
-                }
-                const projectRoot = await this.git.inspect(project.path, "HEAD");
-                if (physical.gitDirectory !== projectRoot.gitDirectory) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace managed Project mismatch for ${round.id}/${entry.projectId}.`);
-                }
-                let branch;
-                try {
-                    branch = await this.git.headRef(entry.path);
-                }
-                catch (error) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace branch cannot be verified for `
-                        + `${round.id}/${entry.projectId}: `
-                        + `${error instanceof Error ? error.message : String(error)}`);
-                }
-                if (branch !== identity.branch) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace managed branch mismatch for ${round.id}/${entry.projectId}: `
-                        + `expected ${identity.branch}, physical ${branch}.`);
-                }
-                let descendsFromBase;
-                try {
-                    descendsFromBase = await this.git.isAncestor(project.path, entry.baseCommit, physical.baseCommit);
-                }
-                catch (error) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace ancestry cannot be verified for `
-                        + `${round.id}/${entry.projectId}: `
-                        + `${error instanceof Error ? error.message : String(error)}`);
-                }
-                if (!descendsFromBase) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace HEAD does not descend from its frozen base for `
-                        + `${round.id}/${entry.projectId}: expected ancestor ${entry.baseCommit}, `
-                        + `physical HEAD ${physical.baseCommit}.`);
-                }
-                retained.set(entry.projectId, { project, entry });
-            }
-            if (adopted && missing.size === 0) {
-                try {
-                    await ensureWorkspaceView(reviewRoot, existing.entries);
-                }
-                catch (error) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace view cannot be reused for ${round.id}: `
-                        + `${error instanceof Error ? error.message : String(error)}`);
-                }
-                if (round.workspace === undefined) {
-                    this.store.saveReviewRound(task.id, attachReviewRoundWorkspace(round, existing));
-                }
-                return existing;
-            }
-            // The durable owner record can outlive a controller crash before the
-            // physical review worktrees were adopted.  Recreate only missing
-            // physical entries; existing reviewer diagnostics remain attached to
-            // their frozen Candidate provenance.
-        }
-        const prepared = [];
-        try {
-            const sources = adopted
-                ? frozenEntries.filter((source) => missing.has(source.projectId))
-                : frozenEntries;
-            for (const source of sources) {
-                const project = requireProject(this.store, source.projectId);
-                const physical = await this.git.ensureWorktree({
-                    repositoryPath: project.path,
-                    container: this.#projectContainer(project.name),
-                    taskSegment,
-                    roleName: round.id,
-                    baseRef: source.baseCommit
-                });
-                const entry = {
-                    ...source,
-                    access: "write",
-                    path: physical.path,
-                    branch: physical.branch,
-                    baseRef: source.baseCommit,
-                    baseCommit: source.baseCommit
-                };
-                prepared.push({ project, entry });
-                if (!sameCommit(physical.baseCommit, source.baseCommit)) {
-                    if (existing === null) {
-                        throw new Error(`ReviewRound workspace baseCommit mismatch for ${round.id}/${source.projectId}: `
-                            + `expected ${source.baseCommit}, physical HEAD ${physical.baseCommit}.`);
+                    if (physical.root !== entry.path) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace managed path mismatch for ${round.id}/${entry.projectId}.`);
+                    }
+                    const projectRoot = await this.git.inspect(project.path, "HEAD");
+                    if (physical.gitDirectory !== projectRoot.gitDirectory) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace managed Project mismatch for ${round.id}/${entry.projectId}.`);
+                    }
+                    let branch;
+                    try {
+                        branch = await this.git.headRef(entry.path);
+                    }
+                    catch (error) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace branch cannot be verified for `
+                            + `${round.id}/${entry.projectId}: `
+                            + `${error instanceof Error ? error.message : String(error)}`);
+                    }
+                    if (branch !== identity.branch) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace managed branch mismatch for ${round.id}/${entry.projectId}: `
+                            + `expected ${identity.branch}, physical ${branch}.`);
                     }
                     let descendsFromBase;
                     try {
-                        descendsFromBase = await this.git.isAncestor(project.path, source.baseCommit, physical.baseCommit);
+                        descendsFromBase = await this.git.isAncestor(project.path, entry.baseCommit, physical.baseCommit);
                     }
                     catch (error) {
                         throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace ancestry cannot be verified for `
-                            + `${round.id}/${source.projectId}: `
+                            + `${round.id}/${entry.projectId}: `
                             + `${error instanceof Error ? error.message : String(error)}`);
                     }
                     if (!descendsFromBase) {
                         throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace HEAD does not descend from its frozen base for `
-                            + `${round.id}/${source.projectId}: expected ancestor ${source.baseCommit}, `
+                            + `${round.id}/${entry.projectId}: expected ancestor ${entry.baseCommit}, `
                             + `physical HEAD ${physical.baseCommit}.`);
                     }
+                    retained.set(entry.projectId, { project, entry });
                 }
-            }
-            const preparedByProject = new Map(prepared.map(({ project, entry }) => [project.id, entry]));
-            const entries = adopted
-                ? frozenEntries.map((source) => {
-                    const retainedEntry = retained.get(source.projectId)?.entry;
-                    if (retainedEntry !== undefined)
-                        return retainedEntry;
-                    const preparedEntry = preparedByProject.get(source.projectId);
-                    if (preparedEntry === undefined) {
-                        throw new Error(`ReviewRound workspace Project could not be reconstructed: `
-                            + `${round.id}/${source.projectId}.`);
+                if (adopted && missing.size === 0) {
+                    try {
+                        await ensureWorkspaceView(reviewRoot, existing.entries);
+                        this.#registerWorkspace(existing);
                     }
-                    return preparedEntry;
-                })
-                : prepared.map(({ entry }) => entry);
+                    catch (error) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace view cannot be reused for ${round.id}: `
+                            + `${error instanceof Error ? error.message : String(error)}`);
+                    }
+                    if (round.workspace === undefined) {
+                        this.store.saveReviewRound(task.id, attachReviewRoundWorkspace(round, existing));
+                    }
+                    return existing;
+                }
+                // The durable owner record can outlive a controller crash before the
+                // physical review worktrees were adopted.  Recreate only missing
+                // physical entries; existing reviewer diagnostics remain attached to
+                // their frozen Candidate provenance.
+            }
+            const prepared = [];
             try {
-                await ensureWorkspaceView(reviewRoot, entries);
+                const sources = adopted
+                    ? frozenEntries.filter((source) => missing.has(source.projectId))
+                    : frozenEntries;
+                for (const source of sources) {
+                    const project = requireProject(this.store, source.projectId);
+                    const physical = await this.git.ensureWorktree({
+                        repositoryPath: project.path,
+                        container: this.#projectContainer(project.name),
+                        taskSegment,
+                        roleName: round.id,
+                        baseRef: source.baseCommit
+                    });
+                    const entry = {
+                        ...source,
+                        access: "write",
+                        path: physical.path,
+                        branch: physical.branch,
+                        baseRef: source.baseCommit,
+                        baseCommit: source.baseCommit
+                    };
+                    prepared.push({ project, entry });
+                    if (!sameCommit(physical.baseCommit, source.baseCommit)) {
+                        if (existing === null) {
+                            throw new Error(`ReviewRound workspace baseCommit mismatch for ${round.id}/${source.projectId}: `
+                                + `expected ${source.baseCommit}, physical HEAD ${physical.baseCommit}.`);
+                        }
+                        let descendsFromBase;
+                        try {
+                            descendsFromBase = await this.git.isAncestor(project.path, source.baseCommit, physical.baseCommit);
+                        }
+                        catch (error) {
+                            throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace ancestry cannot be verified for `
+                                + `${round.id}/${source.projectId}: `
+                                + `${error instanceof Error ? error.message : String(error)}`);
+                        }
+                        if (!descendsFromBase) {
+                            throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace HEAD does not descend from its frozen base for `
+                                + `${round.id}/${source.projectId}: expected ancestor ${source.baseCommit}, `
+                                + `physical HEAD ${physical.baseCommit}.`);
+                        }
+                    }
+                }
+                const preparedByProject = new Map(prepared.map(({ project, entry }) => [project.id, entry]));
+                const entries = adopted
+                    ? frozenEntries.map((source) => {
+                        const retainedEntry = retained.get(source.projectId)?.entry;
+                        if (retainedEntry !== undefined)
+                            return retainedEntry;
+                        const preparedEntry = preparedByProject.get(source.projectId);
+                        if (preparedEntry === undefined) {
+                            throw new Error(`ReviewRound workspace Project could not be reconstructed: `
+                                + `${round.id}/${source.projectId}.`);
+                        }
+                        return preparedEntry;
+                    })
+                    : prepared.map(({ entry }) => entry);
+                try {
+                    await ensureWorkspaceView(reviewRoot, entries);
+                }
+                catch (error) {
+                    if (existing !== null) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace view cannot be reused for ${round.id}: `
+                            + `${error instanceof Error ? error.message : String(error)}`);
+                    }
+                    throw error;
+                }
+                const stored = existing ?? createManagedWorkspace({
+                    owner: { type: "review-round", taskId: task.id, reviewRoundId: round.id },
+                    root: reviewRoot,
+                    entries
+                }, this.now());
+                this.#registerWorkspace(stored);
+                return this.store.transaction((tx) => {
+                    const currentRound = tx.getReviewRound(task.id, round.id);
+                    const currentItem = tx.getWorkItem(task.id, item.id);
+                    if (currentRound === null || currentRound.status !== "pending"
+                        || currentItem === null
+                        || !isDeepStrictEqual(currentItem.candidates.find(({ id }) => id === candidate.id), candidate)) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound changed while preparing its workspace: ${round.id}.`);
+                    }
+                    if (tx.getActiveAgentRun(task.id, reviewer.name) !== null) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`Reviewer Role has an active Run: ${task.id}/${reviewer.name}.`);
+                    }
+                    const currentWorkspace = tx.getReviewRoundWorkspace(task.id, round.id);
+                    if (existing !== null
+                        ? currentWorkspace === null || !sameManagedWorkspace(currentWorkspace, existing)
+                        : currentWorkspace !== null && !sameManagedWorkspace(currentWorkspace, stored)) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace changed: ${task.id}/${round.id}.`);
+                    }
+                    const latestReviewer = tx.getRole(task.id, reviewer.name);
+                    if (latestReviewer === null) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`Reviewer Role not found: ${task.id}/${reviewer.name}.`);
+                    }
+                    if (currentRound.workspace !== undefined
+                        && !sameManagedWorkspace(currentRound.workspace, stored)) {
+                        throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace record diverged: ${round.id}.`);
+                    }
+                    const timestamp = this.now();
+                    if (currentWorkspace === null)
+                        tx.saveManagedWorkspace(stored);
+                    if (currentRound.workspace === undefined) {
+                        tx.saveReviewRound(task.id, attachReviewRoundWorkspace(currentRound, stored));
+                    }
+                    if (latestReviewer.workspace !== stored.root) {
+                        retireWorkspaceBoundSession(tx, task.id, latestReviewer.name, timestamp);
+                        tx.saveRole(task.id, updateRole(latestReviewer, { workspace: stored.root }, timestamp));
+                    }
+                    return stored;
+                });
             }
             catch (error) {
-                if (existing !== null) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace view cannot be reused for ${round.id}: `
-                        + `${error instanceof Error ? error.message : String(error)}`);
-                }
+                await this.#discardUnadoptedEntries(task, taskSegment, prepared, round.id, existing === null, new Set([...retained.values()].map(({ entry }) => entry.path)));
                 throw error;
             }
-            const stored = existing ?? createManagedWorkspace({
-                owner: { type: "review-round", taskId: task.id, reviewRoundId: round.id },
-                root: reviewRoot,
-                entries
-            }, this.now());
-            return this.store.transaction((tx) => {
-                const currentRound = tx.getReviewRound(task.id, round.id);
-                const currentItem = tx.getWorkItem(task.id, item.id);
-                if (currentRound === null || currentRound.status !== "pending"
-                    || currentItem === null
-                    || !isDeepStrictEqual(currentItem.candidates.find(({ id }) => id === candidate.id), candidate)) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound changed while preparing its workspace: ${round.id}.`);
-                }
-                if (tx.getActiveAgentRun(task.id, reviewer.name) !== null) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`Reviewer Role has an active Run: ${task.id}/${reviewer.name}.`);
-                }
-                const currentWorkspace = tx.getReviewRoundWorkspace(task.id, round.id);
-                if (existing !== null
-                    ? currentWorkspace === null || !sameManagedWorkspace(currentWorkspace, existing)
-                    : currentWorkspace !== null && !sameManagedWorkspace(currentWorkspace, stored)) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace changed: ${task.id}/${round.id}.`);
-                }
-                const latestReviewer = tx.getRole(task.id, reviewer.name);
-                if (latestReviewer === null) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`Reviewer Role not found: ${task.id}/${reviewer.name}.`);
-                }
-                if (currentRound.workspace !== undefined
-                    && !sameManagedWorkspace(currentRound.workspace, stored)) {
-                    throw new ReviewRoundWorkspaceEvidenceError(`ReviewRound workspace record diverged: ${round.id}.`);
-                }
-                const timestamp = this.now();
-                if (currentWorkspace === null)
-                    tx.saveManagedWorkspace(stored);
-                if (currentRound.workspace === undefined) {
-                    tx.saveReviewRound(task.id, attachReviewRoundWorkspace(currentRound, stored));
-                }
-                if (latestReviewer.workspace !== stored.root) {
-                    retireWorkspaceBoundSession(tx, task.id, latestReviewer.name, timestamp);
-                    tx.saveRole(task.id, updateRole(latestReviewer, { workspace: stored.root }, timestamp));
-                }
-                return stored;
-            });
         }
-        catch (error) {
-            await this.#discardUnadoptedEntries(task, taskSegment, prepared, round.id, existing === null, new Set([...retained.values()].map(({ entry }) => entry.path)));
-            throw error;
+        finally {
+            release();
         }
     }
     async inspectReviewRoundWorkspace(taskId, reviewRoundId) {
@@ -1238,7 +1461,7 @@ export class FileTaskWorkspacePreparer {
         if (round.workspace === undefined || !isDeepStrictEqual(round.workspace, workspace)) {
             throw new Error(`ReviewRound workspace record diverged: ${round.id}.`);
         }
-        return this.#snapshotReviewWorkspaceEntries(round.id, workspace);
+        return this.#snapshotReviewWorkspaceEntries(round.id, workspace, round.reviewBaseCommit);
     }
     /**
      * Snapshot the exact workspace recorded on one Reviewer Run.  Panel Lanes
@@ -1267,7 +1490,7 @@ export class FileTaskWorkspacePreparer {
                 || !isDeepStrictEqual(round.workspace, run.workspace)) {
                 throw new Error(`Review Run workspace owner does not match its ReviewRound: ${run.id}.`);
             }
-            return this.#snapshotReviewWorkspaceEntries(round.id, run.workspace);
+            return this.#snapshotReviewWorkspaceEntries(round.id, run.workspace, round.reviewBaseCommit);
         }
         if (run.workspace.owner.type !== "execution-lane"
             || run.workspace.owner.taskId !== taskId
@@ -1292,7 +1515,7 @@ export class FileTaskWorkspacePreparer {
             || run.workspace.entries.some(({ access }) => access !== "write")) {
             throw new Error(`Review Run Lane workspace lineage is not exact: ${run.id}.`);
         }
-        return this.#snapshotReviewWorkspaceEntries(round.id, run.workspace);
+        return this.#snapshotReviewWorkspaceEntries(round.id, run.workspace, round.reviewBaseCommit);
     }
     async inspectExecutionLaneWorkspace(taskId, executionGroupId, executionLaneId) {
         const task = requireTask(this.store, taskId);
@@ -1343,6 +1566,7 @@ export class FileTaskWorkspacePreparer {
             removed ||= result === "removed";
         }
         await removeWorkspaceView(workspace.root);
+        this.#resourceRegistrar().markWorkspaceDeleted(workspace);
         this.store.transaction((tx) => {
             const currentRound = tx.getReviewRound(task.id, round.id);
             const currentWorkspace = tx.getReviewRoundWorkspace(task.id, round.id);
@@ -1408,6 +1632,7 @@ export class FileTaskWorkspacePreparer {
             removed ||= result === "removed";
         }
         await removeWorkspaceView(workspace.root);
+        this.#resourceRegistrar().markWorkspaceDeleted(workspace);
         try {
             this.#recordWorkspaceRemoval(task, workspace, this.#fallbackWorkspace(), {
                 workItemId: item.id,
@@ -1469,6 +1694,7 @@ export class FileTaskWorkspacePreparer {
             }
             assertTaskArchiveState(requireTask(this.store, task.id), task);
             await removeWorkspaceView(main.root);
+            this.#resourceRegistrar().markWorkspaceDeleted(main);
             assertTaskArchiveState(requireTask(this.store, task.id), task);
             this.#recordWorkspaceRemoval(task, main, this.#fallbackWorkspace());
         }
@@ -1490,6 +1716,28 @@ export class FileTaskWorkspacePreparer {
         if (!["draft", "active"].includes(task.status)) {
             throw new Error(`Only a draft or active Task can be rebuilt in place: ${task.id}/${task.status}.`);
         }
+        // The rebuild holds every touched Project's maintenance fence for its
+        // whole duration, so the Controller defers preparation and no other
+        // maintenance interleaves. The resume path may clean up legacy
+        // worktrees/refs in any Project; the fresh path touches its bound
+        // Projects plus any still holding the Task's legacy refs.
+        const projectIds = task.workspaceIdentity !== undefined
+            ? this.store.listProjects().map(({ id }) => id)
+            : [
+                ...new Set([
+                    ...task.projectBindings.map(({ projectId }) => projectId),
+                    ...(await this.listLegacyTaskRefs(task.id)).map(({ projectId }) => projectId)
+                ])
+            ];
+        const releaseMaintenance = acquireProjectMaintenanceLocks(this.home, projectIds);
+        try {
+            return await this.#rebuildTaskWorkspaceLocked(task, options);
+        }
+        finally {
+            releaseMaintenance();
+        }
+    }
+    async #rebuildTaskWorkspaceLocked(task, options) {
         if (task.workspaceIdentity !== undefined) {
             const current = this.store.getTaskWorkspace(task.id);
             if (current !== null && current.owner.type === "task") {
@@ -1500,6 +1748,9 @@ export class FileTaskWorkspacePreparer {
             // ("dirty") status and can no longer be removed cleanly.
             await this.#removeLegacyWorktrees(task, this.store.listProjects().map((project) => project.id));
             const archived = await this.#archiveLegacyRefs(task);
+            // Reclaim token worktrees/branches a crashed prepare or rebuild left
+            // behind without a catalog record, so they do not accumulate.
+            await this.#reclaimOrphanedTaskWorktrees(task);
             return { task: requireTask(this.store, task.id), archived, resumed: true };
         }
         assertTaskHasNoEvidence(this.store, task.id);
@@ -1511,6 +1762,12 @@ export class FileTaskWorkspacePreparer {
             && await this.#inspectLegacyTaskEntries(task, existing.entries) === "dirty") {
             throw new Error(`Task workspace is dirty and blocks the rebuild: ${task.id}.`);
         }
+        // Reclaim token worktrees/branches a crashed prepare or rebuild left
+        // behind without a catalog record, before minting a new identity. A hard
+        // crash after `ensureWorktree` but before the Task/catalog transaction
+        // leaves the Task unbound; without this reaping the fresh path would
+        // report success and leave the orphaned token worktree/branch behind.
+        await this.#reclaimOrphanedTaskWorktrees(task);
         // Resolve verified remote SHAs before any Git side effect, mirroring the
         // first-prepare pinning: a remote default Project is fetched and its
         // exact advertised SHA is pinned; a local or explicit ref is validated.
@@ -1579,6 +1836,7 @@ export class FileTaskWorkspacePreparer {
                 root,
                 entries: prepared.map(({ entry }) => entry)
             }, this.now());
+            this.#registerWorkspace(workspace);
             // Switch the durable record only now that every new ref/worktree exists.
             this.store.transaction((tx) => {
                 const latest = requireTask(tx, task.id);
@@ -1635,7 +1893,16 @@ export class FileTaskWorkspacePreparer {
     async listLegacyTaskRefs(taskId) {
         const found = [];
         for (const project of this.store.listProjects()) {
-            const refs = await this.git.listRefs(project.path, "refs/heads/yui/");
+            let refs;
+            try {
+                refs = await this.git.listRefs(project.path, "refs/heads/yui/");
+            }
+            catch (error) {
+                // A deleted external checkout has no refs to scan; skip it.
+                if (isMissingPath(error))
+                    continue;
+                throw error;
+            }
             for (const ref of refs) {
                 if (!isLegacyTaskRef(ref))
                     continue;
@@ -1653,26 +1920,66 @@ export class FileTaskWorkspacePreparer {
      * Task are refused: their worktrees may still be live. Terminal and
      * unknown-owner refs are archived; an already-archived or missing ref is
      * simply absent on retry.
+     *
+     * Every registered worktree on a to-be-archived ref is preflighted before
+     * the first side effect: a dirty or unidentifiable one fails the whole
+     * archive with nothing created, deleted, or removed. A same-repo worktree
+     * this Home does not manage that still has the ref checked out fails the
+     * archive closed as well, so deleting the ref cannot strand it.
      */
     async archiveLegacyTaskRefs(taskId) {
         const home = this.store.getHomeIdentity();
         const refused = [];
         const archived = [];
-        for (const entry of await this.listLegacyTaskRefs(taskId)) {
-            const owner = this.store.getTask(entry.taskId);
-            if (owner !== null && ["draft", "active"].includes(owner.status)) {
-                refused.push(`${entry.projectId}:${entry.ref}`);
-                continue;
+        // The pre-lock scan discovers ONLY the sorted Project lock set. The pending
+        // set is rebuilt under the fence (below) by re-listing refs and
+        // re-classifying their owners, so a Task that transitions terminal ->
+        // active between the scan and the lock is refused rather than archived.
+        const scanned = await this.listLegacyTaskRefs(taskId);
+        const projectIds = [...new Set(scanned.map(({ projectId }) => projectId))].sort();
+        // The fence covers preflight and archive alike: a concurrent rebuild
+        // must not remove a worktree between its inspection and its ref's
+        // archival.
+        const releaseMaintenance = projectIds.length === 0
+            ? () => { }
+            : acquireProjectMaintenanceLocks(this.home, projectIds);
+        try {
+            const locked = new Set(projectIds);
+            const pending = [];
+            for (const entry of await this.listLegacyTaskRefs(taskId)) {
+                if (!locked.has(entry.projectId))
+                    continue; // added after the pre-lock scan; not fenced.
+                const owner = this.store.getTask(entry.taskId);
+                if (owner !== null && ["draft", "active"].includes(owner.status)) {
+                    refused.push(`${entry.projectId}:${entry.ref}`);
+                    continue;
+                }
+                pending.push({
+                    project: requireProject(this.store, entry.projectId),
+                    taskId: entry.taskId,
+                    ref: entry.ref,
+                    archiveRef: taskArchiveRef(home.homeId, entry.ref)
+                });
             }
-            const project = requireProject(this.store, entry.projectId);
-            await this.git.archiveRef({
-                repositoryPath: project.path,
-                sourceRef: entry.ref,
-                archiveRef: taskArchiveRef(home.homeId, entry.ref)
-            });
-            archived.push(`${entry.projectId}:${entry.ref}`);
+            for (const target of pending) {
+                await this.#assertLegacyRefWorktreeArchivable(target);
+            }
+            for (const target of pending) {
+                // Re-validate under the fence: a Task reopened after classification
+                // but before this point must not have its ref deleted.
+                const current = this.store.getTask(target.taskId);
+                if (current !== null && ["draft", "active"].includes(current.status)) {
+                    refused.push(`${target.project.id}:${target.ref}`);
+                    continue;
+                }
+                await this.#archiveLegacyRef(target);
+                archived.push(`${target.project.id}:${target.ref}`);
+            }
+            return { archived, refused };
+        }
+        finally {
+            releaseMaintenance();
         }
-        return { archived, refused };
     }
     async #inspectEntries(taskSegment, roleName, entries) {
         if (entries.length === 0)
@@ -1692,8 +1999,9 @@ export class FileTaskWorkspacePreparer {
         }
         return found ? "clean" : "missing";
     }
-    async #snapshotReviewWorkspaceEntries(reviewRoundId, workspace) {
+    async #snapshotReviewWorkspaceEntries(reviewRoundId, workspace, reviewBaseCommit) {
         const changed = [];
+        let dirty = false;
         for (const entry of workspace.entries) {
             if (await this.git.headRef(entry.path) !== entry.branch) {
                 throw new Error(`Review Project workspace left its managed branch: ${reviewRoundId}/${entry.projectId}.`);
@@ -1707,11 +2015,22 @@ export class FileTaskWorkspacePreparer {
             }
             if (head !== entry.baseCommit)
                 changed.push(head);
+            if (!await this.git.isClean(entry.path))
+                dirty = true;
         }
         if (changed.length > 1) {
             throw new Error(`Review workspace has diagnostic commits in multiple Projects; preserve it for Leader routing: ${reviewRoundId}.`);
         }
-        return changed.length === 0 ? {} : { evidenceCommit: changed[0] };
+        // A dirty worktree has uncommitted diagnostics: no single commit captures
+        // the tree the checks ran on, so no evidenceCommit can attest it and the
+        // queue must re-run the gate.  A clean worktree attests that checks ran on
+        // the recorded tree: the frozen base when the reviewer made no commits, or
+        // the reviewer's single diagnostic commit otherwise.
+        if (dirty)
+            return {};
+        return changed.length === 0
+            ? { evidenceCommit: reviewBaseCommit }
+            : { evidenceCommit: changed[0] };
     }
     #projectContainer(projectName) {
         return join(resolveWorktreeRoot(this.home, this.store.getConfig().defaultWorkspace), safePathSegment(projectName));
@@ -1753,6 +2072,7 @@ export class FileTaskWorkspacePreparer {
             if (removal === "dirty") {
                 throw new Error(`Unadopted managed worktree is dirty and was retained at ${entry.path}; inspect it and retry.`);
             }
+            this.#resourceRegistrar().markPathsDeleted([entry.path]);
         }
     }
     /**
@@ -1769,7 +2089,16 @@ export class FileTaskWorkspacePreparer {
         const seen = new Set();
         const archived = [];
         for (const project of projects) {
-            const refs = await this.git.listRefs(project.path, `refs/heads/yui/${task.id}/`);
+            let refs;
+            try {
+                refs = await this.git.listRefs(project.path, `refs/heads/yui/${task.id}/`);
+            }
+            catch (error) {
+                // A deleted external checkout has no refs to archive; skip it.
+                if (isMissingPath(error))
+                    continue;
+                throw error;
+            }
             for (const ref of refs) {
                 const ownerTaskId = ref.slice("refs/heads/yui/".length).split("/")[0];
                 if (ownerTaskId !== task.id || !isLegacyTaskRef(ref))
@@ -1778,9 +2107,10 @@ export class FileTaskWorkspacePreparer {
                 if (seen.has(key))
                     continue;
                 seen.add(key);
-                await this.git.archiveRef({
-                    repositoryPath: project.path,
-                    sourceRef: ref,
+                await this.#archiveLegacyRef({
+                    project,
+                    taskId: task.id,
+                    ref,
                     archiveRef: taskArchiveRef(home.homeId, ref)
                 });
                 archived.push(key);
@@ -1788,6 +2118,77 @@ export class FileTaskWorkspacePreparer {
         }
         return archived;
     }
+    /**
+     * The recorded worktree of a legacy Task ref, when the ref is the Task's
+     * main branch. The legacy layout registers exactly one worktree per Task
+     * and Project (`<taskId>/main` on `yui/<taskId>/main`); every other legacy
+     * ref has no registered worktree and is archived directly.
+     */
+    #legacyRefWorktree(target) {
+        const identity = worktreeIdentity(target.taskId, MAIN_WORKTREE);
+        if (target.ref !== `refs/heads/${identity.branch}`)
+            return undefined;
+        const container = this.#projectContainer(target.project.name);
+        return {
+            repositoryPath: target.project.path,
+            container,
+            path: join(container, target.taskId, MAIN_WORKTREE),
+            branch: identity.branch,
+            taskSegment: target.taskId,
+            roleName: MAIN_WORKTREE
+        };
+    }
+    /**
+     * Preflight the worktree of a to-be-archived ref: a registered worktree
+     * must be clean (or absent) before the archive may touch any ref. An
+     * unidentifiable worktree makes `inspectRecordedWorktree` throw, which
+     * likewise fails the archive closed.
+     */
+    async #assertLegacyRefWorktreeArchivable(target) {
+        const worktree = this.#legacyRefWorktree(target);
+        if (worktree === undefined)
+            return;
+        const state = await this.git.inspectRecordedWorktree(worktree);
+        if (state === "dirty") {
+            throw new Error(`Legacy Task worktree is dirty and blocks the archive: ${target.taskId}/${target.project.id}.`);
+        }
+    }
+    /**
+     * Archive one legacy ref after removing its registered worktree. The
+     * worktree leaves first (its commit retained in the archive ref), then the
+     * active ref is deleted; a dirty worktree fails the ref closed. Each step
+     * is resumable: a same-commit archive ref resumes, a missing worktree and
+     * an already-deleted source are no-ops.
+     *
+     * Before any mutation, a same-repo worktree this Home does not manage that
+     * still has the ref checked out fails the archive closed: `archiveRef`
+     * deletes the ref with `update-ref -d`, which bypasses git's
+     * worktree-occupancy check and would strand that worktree with an unborn
+     * HEAD. The recorded worktree removed below is excluded from the check.
+     */
+    async #archiveLegacyRef(target) {
+        const worktree = this.#legacyRefWorktree(target);
+        await this.git.assertNoForeignWorktreeOnRef({
+            repositoryPath: target.project.path,
+            ref: target.ref,
+            excludeWorktreePath: worktree?.path
+        });
+        if (worktree !== undefined) {
+            const removal = await this.git.removeRecordedWorktree({
+                ...worktree,
+                retainedRef: target.archiveRef
+            });
+            if (removal === "dirty") {
+                throw new Error(`Legacy Task worktree is dirty and blocks the archive: ${target.taskId}/${target.project.id}.`);
+            }
+            this.#resourceRegistrar().markPathsDeleted([worktree.path]);
+        }
+        await this.git.archiveRef({
+            repositoryPath: target.project.path,
+            sourceRef: target.ref,
+            archiveRef: target.archiveRef
+        });
+    }
     /**
      * Remove the legacy worktrees of a Task (the bare `<taskId>/main` layout).
      * A missing worktree is expected on retry and ignored; a dirty one blocks.
@@ -1809,6 +2210,70 @@ export class FileTaskWorkspacePreparer {
             if (removal === "dirty") {
                 throw new Error(`Legacy Task worktree is dirty and blocks the rebuild: ${task.id}/${project.id}.`);
             }
+            this.#resourceRegistrar().markPathsDeleted([join(container, task.id, MAIN_WORKTREE)]);
+        }
+    }
+    /**
+     * Reclaim token worktrees of this Task that no catalog record owns. A
+     * crashed prepare or rebuild (SIGKILL before the catalog transaction) leaves
+     * a token-bearing worktree and branch behind; a retry mints a fresh token,
+     * so the old one is orphaned. The resume path scans this Home's project
+     * containers for `task-N-<token>` directories and removes any the catalog
+     * no longer owns, reusing the recorded-worktree mechanism: prove the exact
+     * identity, retain the commit in the Home archive, remove the worktree, then
+     * archive and delete its now-unchecked-out branch.
+     *
+     * Only this Home's project containers are scanned, and every candidate must
+     * pass the exact recorded-worktree proof (its branch retained in this
+     * Home's Project repository) before it is removed. A deleted external
+     * checkout orphans the worktree directory, which `removeRecordedWorktree`
+     * removes outright; its branch is gone with the repository and needs no
+     * further action.
+     */
+    async #reclaimOrphanedTaskWorktrees(task) {
+        const cataloged = new Set(this.store.listManagedWorkspaces(task.id)
+            .flatMap((workspace) => workspace.entries.map(({ path }) => path)));
+        const homeId = this.store.getHomeIdentity().homeId;
+        for (const project of this.store.listProjects()) {
+            const container = this.#projectContainer(project.name);
+            for (const segment of await listTaskTokenSegments(container, task.id)) {
+                const worktreePath = join(container, segment, MAIN_WORKTREE);
+                if (cataloged.has(worktreePath))
+                    continue;
+                const branch = worktreeIdentity(segment, MAIN_WORKTREE).branch;
+                const archiveRef = taskArchiveRef(homeId, `refs/heads/${branch}`);
+                const removal = await this.git.removeRecordedWorktree({
+                    repositoryPath: project.path,
+                    container,
+                    path: worktreePath,
+                    branch,
+                    retainedRef: archiveRef,
+                    taskSegment: segment,
+                    roleName: MAIN_WORKTREE
+                });
+                if (removal === "dirty") {
+                    throw new Error(`Orphaned Task worktree is dirty and blocks the rebuild: ${task.id}/${project.id}.`);
+                }
+                this.#resourceRegistrar().markPathsDeleted([worktreePath]);
+                // The worktree is gone; archive+delete its now-unchecked-out branch.
+                // A deleted external checkout takes the branch with it, so a missing
+                // repository or an already-absent branch is a no-op.
+                let branchExists = false;
+                try {
+                    branchExists = await this.git.refExists(project.path, `refs/heads/${branch}`);
+                }
+                catch (error) {
+                    if (!isMissingPath(error))
+                        throw error;
+                }
+                if (branchExists) {
+                    await this.git.archiveRef({
+                        repositoryPath: project.path,
+                        sourceRef: `refs/heads/${branch}`,
+                        archiveRef
+                    });
+                }
+            }
         }
     }
     async #inspectLegacyTaskEntries(task, entries) {
@@ -1932,6 +2397,17 @@ function executionLaneLineage(store, task, executionGroupId, executionLaneId, hi
             throw new Error(`ReviewRound not found: ${hint.reviewRoundId}.`);
         return { purpose: "review", workItemId: round.workItemId, reviewRoundId: round.id };
     }
+    // Prefer the active Run's exact WorkItem for this Lane; fall back to the
+    // first queued WorkItem only when no active Run owns the Lane.
+    const activeLaneRun = store.listAgentRuns(task.id)
+        .find((run) => run.status === "active"
+        && run.purpose === "execution"
+        && run.executionGroupId === executionGroupId
+        && run.executionLaneId === executionLaneId
+        && run.workItemId !== undefined);
+    if (activeLaneRun?.workItemId !== undefined) {
+        return { purpose: "execution", workItemId: activeLaneRun.workItemId, reviewRoundId: "" };
+    }
     for (const item of store.listWorkItems(task.id)) {
         if (workItemExecutionGroupById(item, executionGroupId)?.lanes.some(({ id }) => id === executionLaneId)) {
             return { purpose: "execution", workItemId: item.id, reviewRoundId: "" };
@@ -1993,6 +2469,76 @@ function retireWorkspaceBoundSession(store, taskId, roleName, now) {
         store.saveTaskRoleSessionSet(retireTaskRoleSessionsForWorkspace(sessions, now));
     }
 }
+function canCorrectActiveWorkItemRoleWorkspaceHint(store, taskId, role, item, workspace) {
+    if (role.taskId !== taskId
+        || role.status !== "running"
+        || item.taskId !== taskId
+        || item.assignee !== role.name
+        || ["completed", "failed", "retired"].includes(item.status)
+        || workspace.owner.type !== "work-item"
+        || workspace.owner.taskId !== taskId
+        || workspace.owner.workItemId !== item.id)
+        return false;
+    const writableProjects = workspace.entries
+        .filter(({ access }) => access === "write")
+        .map(({ projectId }) => projectId)
+        .sort();
+    if (!isDeepStrictEqual(writableProjects, [...item.writeProjectIds].sort()))
+        return false;
+    const run = store.getActiveAgentRun(taskId, role.name);
+    if (run === null
+        || run.status !== "active"
+        || run.purpose !== "execution"
+        || run.workItemId !== item.id
+        || run.workspace === undefined
+        || !sameManagedWorkspaceIdentity(run.workspace, workspace)
+        || run.effective.agentId !== role.activeAgentId
+        || !sameEffectiveWorkspace(run.effective.workspace, workspace))
+        return false;
+    const sessions = store.getTaskRoleSessionSet(taskId, role.name);
+    const session = sessions?.sessions[sessions.activeAgentId];
+    if (sessions === null
+        || sessions.owner.scope !== "task"
+        || sessions.owner.taskId !== taskId
+        || sessions.owner.roleName !== role.name
+        || sessions.activeAgentId !== role.activeAgentId
+        || sessions.inFlight === null
+        || sessions.inFlight.agentId !== role.activeAgentId
+        || sessions.inFlight.runId !== run.id
+        || sessions.inFlight.receiptId !== formatAgentRunReceiptId(taskId, run.id)
+        || session === undefined
+        || session.agentId !== role.activeAgentId
+        || session.adapterId !== run.effective.adapterId
+        || session.launchId === undefined
+        || session.nativeSessionId === undefined
+        || !["ready", "running"].includes(session.status)
+        || !isDeepStrictEqual(session.effective, run.effective)
+        || !sameEffectiveWorkspace(session.effective.workspace, workspace))
+        return false;
+    const lifecycleMailbox = store.getWorkMailbox(runtimeLifecycleTarget({
+        scope: "task",
+        taskId,
+        roleName: role.name
+    }));
+    if (hasRuntimeCleanupObligation(lifecycleMailbox))
+        return false;
+    const lifecycle = lifecycleMailbox?.processing;
+    if (lifecycle !== null
+        && lifecycle !== undefined
+        && isRuntimeLaunchReservation(lifecycle)) {
+        const executionRef = lifecycle.executionRef;
+        if (!isRuntimeLaunchReservation(lifecycle, session.launchId)
+            || executionRef?.type !== "run"
+            || executionRef.taskId !== taskId
+            || executionRef.id !== run.id)
+            return false;
+    }
+    return true;
+}
+function sameEffectiveWorkspace(effective, workspace) {
+    return effective.root === workspace.root
+        && isDeepStrictEqual(effective.entries, workspace.entries);
+}
 function sameManagedWorkspace(left, right) {
     return isDeepStrictEqual(left, right);
 }
@@ -2003,6 +2549,34 @@ function isMissingPath(error) {
     return typeof error === "object" && error !== null && "code" in error
         && error.code === "ENOENT";
 }
+/**
+ * The token-bearing ref segments (`task-N-<8hex>`) under a Project's worktree
+ * container for one Task. A missing container yields no segments; legacy
+ * (`task-N`) and foreign-Task directories are ignored.
+ */
+async function listTaskTokenSegments(container, taskId) {
+    let entries;
+    try {
+        entries = await readdir(container, { withFileTypes: true });
+    }
+    catch (error) {
+        if (isMissingPath(error))
+            return [];
+        throw error;
+    }
+    const prefix = `${taskId}-`;
+    const segments = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        if (!entry.name.startsWith(prefix))
+            continue;
+        if (!TASK_WORKSPACE_TOKEN_PATTERN.test(entry.name.slice(prefix.length)))
+            continue;
+        segments.push(entry.name);
+    }
+    return segments.sort();
+}
 function recordWorkspaceDisposition(store, taskId, workItem, now) {
     const item = store.getWorkItem(taskId, workItem.workItemId);
     if (item === null)