@zq-silk/yui 2.1.0 → 2.3.0

package/dist/repository/workspaceCleanupInspection.js

@@ -1,15 +1,19 @@
-import { dirname, isAbsolute, join, relative } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
+import { lstat, readdir, readlink } from "node:fs/promises";
 import { projectTaskRemoteDeliveryFromStore } from "../task/remoteDeliveryService.js";
 import { cleanupCheckFromError } from "../workspace/cleanupInspection.js";
 import { WorkItemChangeSetManager } from "../workspace/workItemChangeSetManager.js";
 import { managedWorkspaceKey, managedWorktreeName } from "../worktree/managedWorkspace.js";
 import { integrationWorktreeIdentity, worktreeIdentity } from "./gitWorkspace.js";
 import { taskWorkspaceRefSegment } from "./taskWorkspaceIdentity.js";
+import { jobCleanupBlocker } from "../job/jobCleanupInspection.js";
+import { defaultIntegrationRuntimeIsolation } from "../runtime/integrationRuntimeIsolation.js";
+import { inspectTaskRuntimeCleanup } from "../runtime/taskRuntimeIsolation.js";
 /** Current owner facts + the same Git inspection used immediately before removal.
  * No preparation, locks, Git refresh, runtime stop, DB writes or repair.
  */
-export async function inspectWorkspaceCleanup(store, git, workspace, disposition, forceArchive = false) {
+export async function inspectWorkspaceCleanup(store, git, workspace, disposition, forceArchive = false, home, integrationRuntime) {
     const owner = workspace.owner;
     const task = store.getTask(owner.taskId);
     if (task === null)
@@ -23,6 +27,18 @@ export async function inspectWorkspaceCleanup(store, git, workspace, disposition
         add("workspace-identity-mismatch", "Current workspace ownership differs from the inspected record.", "same managed workspace", "changed or missing");
         return checks;
     }
+    // Job admission supports these three exact managed owners. Apply the same
+    // physical check before every supported owner's cleanup, not only Integration.
+    for (const job of store.listDurableJobs(task.id).filter(job => (owner.type === "task" && job.owner.kind === "task")
+        || (owner.type === "work-item" && job.owner.kind === "work-item"
+            && job.owner.workItemId === owner.workItemId)
+        || (owner.type === "integration-attempt" && job.owner.kind === "integration-attempt"
+            && job.owner.integrationAttemptId === owner.integrationAttemptId))) {
+        const blocker = jobCleanupBlocker(job, home);
+        if (blocker !== undefined)
+            add("unresolved-execution", blocker, "settled execution", { jobId: job.id, status: job.status });
+    }
+    checks.push(...await inspectWorkspaceContainer(workspace));
     if (task.workspaceIdentity === undefined && workspace.entries.some(e => e.access === "write")) {
         add("workspace-metadata-missing", "Task has no durable workspace identity; do not infer one from paths.", "recorded Task workspace identity", null);
         return checks;
@@ -68,9 +84,24 @@ export async function inspectWorkspaceCleanup(store, git, workspace, disposition
         }
         case "integration-attempt": {
             const attempt = store.getIntegrationAttempt(task.id, owner.integrationAttemptId);
+            const entry = workspace.entries[0];
+            if (workspace.entries.length !== 1 || entry?.access !== "write"
+                || entry.projectId !== attempt?.projectId || entry.path !== workspace.root) {
+                add("workspace-identity-mismatch", "Integration resource does not match its single recorded Project worktree.", "one writable Project at the Integration root", "different or missing entry");
+                return checks;
+            }
             if (attempt === null || ["running", "blocked", "conflicted", "validating"].includes(attempt.status)) {
                 add("owner-unsettled", "IntegrationAttempt must be terminal before cleanup.", "terminal attempt", attempt?.status ?? null);
             }
+            try {
+                if (home === undefined)
+                    throw new Error("Runtime Home unavailable.");
+                const runtime = integrationRuntime ?? defaultIntegrationRuntimeIsolation(home, store.getHomeIdentity().homeId);
+                inspectTaskRuntimeCleanup(runtime.preflight({ workspace, allowExactActive: true }), attempt?.status === "committed" ? "completion" : "failure");
+            }
+            catch {
+                add("runtime-resource-unverified", "Integration runtime ownership or physical quiescence cannot be verified.", "exactly owned inactive runtime and cleanup claims", "unverified");
+            }
             break;
         }
         case "task":
@@ -79,9 +110,9 @@ export async function inspectWorkspaceCleanup(store, git, workspace, disposition
             }
             break;
     }
-    const delivery = owner.type === "task" && (disposition === "integrated" || task.status === "archived" || forceArchive)
+    const delivery = owner.type === "task"
         ? await readArchiveDelivery(store, git, task, forceArchive) : undefined;
-    if (delivery !== undefined && (!delivery.allMerged || !delivery.allVerified)) {
+    if (disposition === "integrated" && delivery !== undefined && (!delivery.allMerged || !delivery.allVerified)) {
         add("delivery-coverage", "Task main has commits without verified remote coverage; cleanup does not establish delivery.", { allMerged: true, allVerified: true }, { allMerged: delivery.allMerged, allVerified: delivery.allVerified });
     }
     for (const entry of workspace.entries.filter(e => e.access === "write")) {
@@ -116,14 +147,20 @@ export async function inspectWorkspaceCleanup(store, git, workspace, disposition
                     ? await git.inspectTaskClone({ path: entry.path, container: workspace.root, directory: entry.directory,
                         taskSegment, branch: entry.branch })
                     : await git.inspectWorktree({ repositoryPath: main.path, container, directory: entry.directory,
-                        taskSegment, roleName, expectedBranch });
+                        taskSegment, roleName,
+                        ...(owner.type === "integration-attempt" ? { expectedBranch } : {}) });
                 if (state === "dirty")
                     check("dirty-worktree", "Uncommitted or untracked changes must be preserved.", "clean", "dirty");
                 if (owner.type === "task" && state !== "missing" && delivery !== undefined) {
                     const covered = delivery.projects.find(p => p.projectId === entry.projectId);
                     const expected = covered?.expectedLocalCommit;
                     const observed = (await git.inspect(entry.path, "HEAD")).baseCommit;
-                    if (expected != null && expected !== observed && covered?.deliveryLocalCommit !== observed) {
+                    const baseline = task.projectBindings.find(binding => binding.projectId === entry.projectId)?.baseCommit;
+                    const unchangedAbandonment = disposition === "abandoned" && baseline !== undefined && observed === baseline;
+                    if (!unchangedAbandonment && disposition === "abandoned" && (!covered?.merged || !covered.verified)) {
+                        check("delivery-coverage", "Abandonment does not discard unverified local commits; only the exact unchanged baseline is disposable.", { baseline: baseline ?? null, verifiedDelivery: true }, observed);
+                    }
+                    else if (!unchangedAbandonment && expected != null && expected !== observed && covered?.deliveryLocalCommit !== observed) {
                         check("head-mismatch", "Task main HEAD differs from the accepted head and its covered publication candidate.", { acceptedCommit: expected, deliveryLocalCommit: covered?.deliveryLocalCommit ?? null }, observed);
                     }
                 }
@@ -136,6 +173,49 @@ export async function inspectWorkspaceCleanup(store, git, workspace, disposition
     }
     return checks;
 }
+/** Inspect the complete logical container before removing any Project. Files
+ * and unrecognized links are evidence, not disposable workspace scaffolding.
+ */
+export async function inspectWorkspaceContainer(workspace) {
+    if (workspace.owner.type === "integration-attempt")
+        return []; // root is the Git worktree itself
+    const resource = managedWorkspaceKey(workspace.owner);
+    const sources = [resource];
+    const actions = workspaceCleanupActions(workspace);
+    try {
+        const root = await lstat(workspace.root).catch(error => {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        });
+        if (root === null)
+            return [];
+        if (!root.isDirectory() || root.isSymbolicLink())
+            return [{
+                    resource, reason: "workspace-identity-mismatch", status: "blocked",
+                    detail: "Logical workspace container is not an owned directory.",
+                    expected: "directory", observed: "different filesystem type", sources, actions
+                }];
+        const unexpected = [];
+        for (const entry of await readdir(workspace.root, { withFileTypes: true })) {
+            const owned = workspace.entries.find(e => e.directory === entry.name);
+            const allowed = owned !== undefined && (owned.access === "write"
+                ? entry.isDirectory() && !entry.isSymbolicLink()
+                : entry.isSymbolicLink() && resolve(workspace.root, await readlink(join(workspace.root, entry.name))) === resolve(owned.path));
+            if (!allowed)
+                unexpected.push(entry.name);
+        }
+        return unexpected.length === 0 ? [] : [{
+                resource, reason: "workspace-material-retained", status: "blocked",
+                detail: "Logical container contains material outside its registered Project entries; no Project removal was started.",
+                expected: "only registered Project directories/links", observed: unexpected,
+                sources, actions
+            }];
+    }
+    catch (error) {
+        return cleanupCheckFromError(error, resource, sources, actions);
+    }
+}
 /** Reuse Publication's projection, supplying live heads only where its existing
  * contract asks for them (active/cancelled). Completed/archived heads stay frozen.
  * Never prepare a workspace or substitute an old binding's commit for a failed read.
@@ -166,7 +246,8 @@ export async function readArchiveDelivery(store, git, task, forceArchive = false
 export function workspaceCleanupActions(workspace) {
     const owner = workspace.owner;
     switch (owner.type) {
-        case "task": return [`yui task remote-delivery ${owner.taskId}`, `yui task show ${owner.taskId}`];
+        case "task": return [`yui task remote-delivery ${owner.taskId}`, `yui task show ${owner.taskId}`,
+            `yui task archive-cleanup ${owner.taskId}`];
         case "work-item": return [`yui task work show ${owner.taskId}/${owner.workItemId}`,
             `yui task work cleanup ${owner.taskId}/${owner.workItemId} --integrated|--abandon`];
         case "review-round": return [`yui task work review show ${owner.taskId}/${owner.reviewRoundId}`,

package/dist/resources/resourceRegistrar.js

@@ -100,15 +100,17 @@ export class ResourceRegistrar {
             })]);
     }
     markWorkspaceDeleted(workspace) {
-        try {
-            this.markPathsDeleted([
-                workspace.root,
-                ...workspace.entries.map((entry) => entry.path)
-            ]);
-        }
-        catch {
-            // Best-effort receipt; workspace deletion must proceed regardless.
-        }
+        // Callers remove the managed owner only after this succeeds. Losing the
+        // receipt must retain that exact owner so a missing-path retry can finish.
+        this.#markPathsDeleted([
+            workspace.root,
+            ...workspace.entries.filter(entry => entry.access === "write").map(entry => entry.path)
+        ], ownerFromManagedWorkspace(this.#home, workspace.owner));
+    }
+    markTaskRuntimeDeleted(descriptor) {
+        // The validated descriptor and matching registry owner survive deletion.
+        // A missing-root retry may settle this receipt, never a different owner.
+        this.#markPathsDeleted(Object.values(descriptor.roots), ownerFromManagedWorkspace(this.#home, descriptor.workspace.owner));
     }
     markPathsDeleted(paths) {
         try {
@@ -118,7 +120,7 @@ export class ResourceRegistrar {
             // Best-effort receipt; path deletion must proceed regardless.
         }
     }
-    #markPathsDeleted(paths) {
+    #markPathsDeleted(paths, owner) {
         const targets = new Set(paths.map((path) => resolve(path)));
         const store = createResourceRegistryStore(this.#home);
         try {
@@ -128,6 +130,10 @@ export class ResourceRegistrar {
             for (const record of Object.values(state.records)) {
                 if (!targets.has(record.path) || record.disposition === "deleted")
                     continue;
+                if (owner !== undefined && ["home", "taskId", "workItemId", "reviewRoundId", "integrationAttemptId"]
+                    .some(key => record.owner[key] !== owner[key])) {
+                    throw new Error("Resource registration owner changed; deletion receipt retained for inspection.");
+                }
                 next = upsertResourceRecord(next, {
                     ...record,
                     activeRefs: Object.freeze([]),

package/dist/runtime/integrationRuntimeIsolation.js

@@ -0,0 +1,21 @@
+import { resolve } from "node:path";
+import { controllerSocketPath } from "../core/controllerEndpoint.js";
+import { managedIntegrationRuntimeRoot } from "../storage/homeLayout.js";
+import { yuiTmuxServerName } from "../tmux/tmuxManager.js";
+import { FileTaskRuntimeIsolation } from "./taskRuntimeIsolation.js";
+/** One identity/layout for Integration execution and exact-owner cleanup. */
+export function defaultIntegrationRuntimeIsolation(home, homeId) {
+    const controlHome = resolve(home);
+    const runtimeRoot = managedIntegrationRuntimeRoot(controlHome);
+    return new FileTaskRuntimeIsolation({
+        runtimeRoot,
+        pathLayout: "compact",
+        controlPlane: {
+            yuiHome: controlHome,
+            managedRuntimeRoot: runtimeRoot,
+            controllerSocketPath: controllerSocketPath(homeId),
+            tmuxNamespace: yuiTmuxServerName(controlHome),
+            globalInstallPaths: [process.execPath]
+        }
+    });
+}

package/dist/runtime/taskRuntimeIsolation.js

@@ -1,8 +1,9 @@
 import { createHash, randomBytes } from "node:crypto";
-import { lstatSync, mkdirSync, readFileSync, renameSync, rmdirSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmdirSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { validateManagedWorkspace } from "../worktree/managedWorkspace.js";
 import { ResourceRegistrar } from "../resources/resourceRegistrar.js";
+import { scanProcessPathRefs } from "../resources/liveReferences.js";
 export const YUI_TASK_RUNTIME_ISOLATION_DESCRIPTOR = "YUI_TASK_RUNTIME_ISOLATION_DESCRIPTOR";
 export const YUI_TASK_RUNTIME_SERVICE_NAMESPACE = "YUI_TASK_RUNTIME_SERVICE_NAMESPACE";
 const MARKER_FILE = ".yui-task-runtime-owner.json";
@@ -55,6 +56,10 @@ export class FileTaskRuntimeIsolation {
         const { descriptor, fingerprint } = validatePreparation(preparation);
         const root = descriptor.roots.runtime;
         const existing = inspectRuntimeRoot(descriptor, fingerprint);
+        const claim = existing.find(resource => resource.id !== root);
+        if (claim !== undefined) {
+            throw new Error(`Task runtime has an unresolved cleanup claim: ${claim.id}.`);
+        }
         if (existing.length > 0) {
             const [resource] = existing;
             if (resource?.ownership !== "owned"
@@ -97,16 +102,24 @@ export class FileTaskRuntimeIsolation {
     cleanup(preparation, reason) {
         requireCleanupReason(reason);
         const { descriptor, fingerprint } = validatePreparation(preparation);
-        const resources = [
-            ...inspectRuntimeRoot(descriptor, fingerprint),
-            ...(this.#inspectResources?.(descriptor) ?? [])
-        ];
-        if (resources.length === 0)
+        const resources = inspectTaskRuntimeCleanup(preparation, reason, this.#inspectResources?.(descriptor) ?? []);
+        if (resources.length === 0) {
+            this.#resourceRegistrar().markTaskRuntimeDeleted(descriptor);
             return;
-        planTaskRuntimeCleanup(descriptor, reason, resources);
+        }
+        // Claims keep the original descriptor and owner marker. An interrupted
+        // rename is not absence: resume only exact, inactive claims and leave any
+        // partial/unmarked deletion discoverable through the original owner.
+        for (const claimed of runtimeCleanupClaims(descriptor.roots.runtime)) {
+            removeRuntimeClaim(descriptor, fingerprint, claimed);
+        }
         // Re-read the sole durable marker immediately before deletion. A missing,
         // replaced, symlinked, or mismatched runtime is never cleanup authority.
         const current = inspectRuntimeRoot(descriptor, fingerprint);
+        if (current.length === 0) {
+            this.#resourceRegistrar().markTaskRuntimeDeleted(descriptor);
+            return;
+        }
         if (current.length !== 1
             || current[0]?.ownership !== "owned"
             || current[0].descriptorFingerprint !== fingerprint) {
@@ -116,18 +129,7 @@ export class FileTaskRuntimeIsolation {
         const claimed = `${root}.cleanup-${randomBytes(16).toString("hex")}`;
         renameSync(root, claimed);
         try {
-            const marker = parseMarker(readFileSync(join(claimed, MARKER_FILE), "utf8"));
-            if (marker.fingerprint !== fingerprint
-                || JSON.stringify(marker.descriptor) !== JSON.stringify(descriptor)) {
-                throw new Error("Task runtime resources changed during cleanup claim.");
-            }
-            rmSync(claimed, { recursive: true });
-            this.#resourceRegistrar().markPathsDeleted([
-                descriptor.roots.runtime,
-                descriptor.roots.data,
-                descriptor.roots.cache,
-                descriptor.roots.temporary
-            ]);
+            removeRuntimeClaim(descriptor, fingerprint, claimed);
         }
         catch (error) {
             // Preserve a claimed-but-unverified resource. Restore its exact path only
@@ -140,6 +142,13 @@ export class FileTaskRuntimeIsolation {
             }
             throw error;
         }
+        if (inspectRuntimeRoot(descriptor, fingerprint).length !== 0) {
+            throw new Error("Task runtime resources changed during cleanup.");
+        }
+        // Receipt persistence is separate from the filesystem claim. If it fails,
+        // retain the caller's owner and retry using the same validated descriptor;
+        // do not try to restore an already removed directory.
+        this.#resourceRegistrar().markTaskRuntimeDeleted(descriptor);
     }
 }
 export function createTaskRuntimeIsolationDescriptor(input) {
@@ -329,8 +338,69 @@ export function planTaskRuntimeCleanup(descriptor, reason, resources) {
     }
     return Object.freeze([...ids].sort());
 }
+/** Read-only cleanup admission, shared by resource preflight and deletion.
+ * Deletion still repeats ownership/live checks after claiming each directory.
+ */
+export function inspectTaskRuntimeCleanup(preparation, reason, additionalResources = []) {
+    const { descriptor, fingerprint } = validatePreparation(preparation);
+    const resources = [...inspectRuntimeRoot(descriptor, fingerprint), ...additionalResources];
+    planTaskRuntimeCleanup(descriptor, reason, resources);
+    const paths = resources.filter(resource => resource.kind === "directory").map(resource => resource.id);
+    if (paths.length === 0)
+        return resources;
+    const scan = scanProcessPathRefs(paths);
+    if (scan.diagnostics.some(diagnostic => diagnostic.severity === "error")
+        || [...scan.refs.values()].some(refs => refs.length > 0)) {
+        throw new Error("Task runtime cleanup resources are live or unverified.");
+    }
+    return resources;
+}
 function inspectRuntimeRoot(descriptor, expectedFingerprint) {
-    const root = descriptor.roots.runtime;
+    return [
+        ...inspectRuntimeDirectory(descriptor, expectedFingerprint, descriptor.roots.runtime),
+        ...inspectTaskRuntimeCleanupClaims(descriptor)
+    ];
+}
+/** Read-only inventory shared by execution admission and physical cleanup.
+ * The descriptor remains the original identity after a cleanup rename.
+ */
+export function inspectTaskRuntimeCleanupClaims(descriptor) {
+    const fingerprint = taskRuntimeIsolationFingerprint(descriptor);
+    return runtimeCleanupClaims(descriptor.roots.runtime)
+        .flatMap(root => inspectRuntimeDirectory(descriptor, fingerprint, root));
+}
+function runtimeCleanupClaims(root) {
+    const parent = dirname(root);
+    try {
+        // Names select candidates, never deletion authority. Include malformed or
+        // partially removed claims too so absence cannot produce a false receipt.
+        return readdirSync(parent).filter(name => name.startsWith(`${basename(root)}.cleanup-`))
+            .sort().map(name => join(parent, name));
+    }
+    catch (error) {
+        if (isNodeCode(error, "ENOENT"))
+            return [];
+        throw error;
+    }
+}
+function removeRuntimeClaim(descriptor, fingerprint, claimed) {
+    const current = inspectRuntimeDirectory(descriptor, fingerprint, claimed);
+    if (current.length !== 1 || current[0]?.ownership !== "owned") {
+        throw new Error(`Task runtime cleanup claim is not exactly owned: ${claimed}.`);
+    }
+    // A process cwd/fd follows rename. Inspect the physical claim, not only the
+    // descriptor's original (now missing) runtime path.
+    const scan = scanProcessPathRefs([claimed]);
+    if (scan.diagnostics.some(diagnostic => diagnostic.severity === "error")
+        || [...scan.refs.values()].some(refs => refs.length > 0)) {
+        throw new Error(`Task runtime cleanup claim is live or unverified: ${claimed}.`);
+    }
+    if (inspectRuntimeDirectory(descriptor, fingerprint, claimed)[0]?.ownership !== "owned") {
+        throw new Error(`Task runtime cleanup claim changed during inspection: ${claimed}.`);
+    }
+    rmSync(claimed, { recursive: true });
+}
+function inspectRuntimeDirectory(descriptor, expectedFingerprint, root) {
     let metadata;
     try {
         metadata = lstatSync(root);

package/dist/task/archiveDiagnostics.js

@@ -30,7 +30,8 @@ export function archiveRetainedResources(store, task) {
         resources.push({ resource: `run:${task.id}/${run.id}`,
             detail: `AgentRun remains active (${run.roleName}); archive is not stop evidence.` });
     }
-    for (const job of store.listDurableJobs(task.id).filter(j => ["queued", "running", "unknown-needs-attention"].includes(j.status))) {
+    for (const job of store.listDurableJobs(task.id).filter(j => ["queued", "running"].includes(j.status)
+        || (j.status === "unknown-needs-attention" && j.acknowledgedAt === undefined))) {
         resources.push({ resource: `job:${task.id}/${job.id}`, detail: `DurableJob remains ${job.status}.` });
     }
     for (const attempt of store.listIntegrationAttempts(task.id).filter(a => ["running", "blocked", "conflicted", "validating"].includes(a.status))) {
@@ -110,20 +111,37 @@ export function taskArchiveDiagnostics(store, task) {
             ...(event.payload.paths === undefined ? {} : { paths: JSON.parse(event.payload.paths) }) });
     }
     const forced = archive?.payload.force === "true";
-    const cleanupFinished = !forced || cleanup.some(e => e.payload.status === "finished");
-    if (forced && !cleanupFinished)
+    const last = cleanup.at(-1);
+    const cleanupFinished = last?.payload.status === "finished"
+        || (cleanup.length === 0 && archive !== undefined && archive.payload.cleanup !== "pending" && !forced);
+    if (task.status === "archived" && !cleanupFinished)
         warnings.push({ resource: `task:${task.id}`,
             detail: "Archive committed; cleanup has not finished. Retained references require explicit inspection; archive retry does not replay cleanup." });
+    const retainedResources = archiveRetainedResources(store, task);
+    const passStart = cleanup.map(e => e.payload.resource === `cleanup-pass:${task.id}` && e.payload.status === "started").lastIndexOf(true);
+    const lastPass = cleanup.slice(passStart >= 0 ? passStart
+        : cleanup.map(e => e.payload.status).lastIndexOf("finished", cleanup.length - 2) + 1);
+    // Derived from current references AND a completed physical cleanup attempt;
+    // neither archive nor an empty workspace list alone establishes release.
+    const allResourcesReleased = task.status === "archived" && cleanupFinished
+        && retainedResources.length === 0
+        && lastPass.some(e => e.payload.resource === `runtime:${task.id}` && e.payload.status === "released")
+        && !lastPass.some(e => e.payload.status === "retained");
     return { archived: task.status === "archived", forced,
         disposition: archive?.payload.workspaceDisposition ?? null,
-        cleanupFinished, warnings, retainedResources: archiveRetainedResources(store, task),
-        cleanupEvents: cleanup };
+        cleanupFinished, allResourcesReleased,
+        warnings: warnings.slice(-32), retainedResources: retainedResources.slice(0, 32),
+        counts: { warnings: warnings.length, retainedResources: retainedResources.length, cleanupEvents: cleanup.length },
+        cleanupEvents: cleanup.slice(-32),
+        actions: [`yui task archive-preflight ${task.id} --${archive?.payload.workspaceDisposition === "abandoned" ? "abandon" : "integrated"}`,
+            `yui task archive-cleanup ${task.id}`, `yui task event list ${task.id}`] };
 }
 export function renderArchiveDiagnostics(data) {
     return [
-        `Archived: ${data.archived}; forced: ${data.forced}; cleanup finished: ${data.cleanupFinished}`,
-        `Retained references: ${data.retainedResources.length}; a finished cleanup attempt is not physical resource release evidence.`,
+        `Archived: ${data.archived}; forced: ${data.forced}; cleanup finished: ${data.cleanupFinished}; all resources released: ${data.allResourcesReleased}`,
+        `Retained references: ${data.counts.retainedResources}; a finished cleanup attempt is not physical resource release evidence.`,
         ...data.warnings.map(w => `Warning [${w.resource}]: ${w.detail}`),
-        ...data.retainedResources.map(r => `Retained [${r.resource}]: ${r.detail}${r.paths ? ` (${r.paths.join(", ")})` : ""}`)
+        ...data.retainedResources.map(r => `Retained [${r.resource}]: ${r.detail}${r.paths ? ` (${r.paths.join(", ")})` : ""}`),
+        `Inspect/retry: ${data.actions.join("; ")}`
     ].join("\n") + "\n";
 }

package/dist/task/archivePreflight.js

@@ -3,6 +3,7 @@ import { WorkspaceCleanupBlockedError } from "../repository/taskWorkspacePrepare
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { hasRuntimeLifecycleWork, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { cleanupCheckFromError, renderCleanupCheck } from "../workspace/cleanupInspection.js";
+import { jobCleanupBlocker } from "../job/jobCleanupInspection.js";
 /** Semantic admission facts. Cleanup still has its own resource boundary. */
 export function archiveSettlementChecks(store, task) {
     const checks = [];
@@ -13,6 +14,9 @@ export function archiveSettlementChecks(store, task) {
     for (const item of store.listWorkItems(task.id).filter(i => i.status === "open")) {
         add(`work-item:${task.id}/${item.id}`, "owner-unsettled", "WorkItem must be accepted or explicitly retired before archive.", ["accepted", "retired"], item.status, `yui task work show ${task.id}/${item.id}`);
     }
+    for (const round of store.listReviewRounds(task.id).filter(r => ["pending", "running"].includes(r.status))) {
+        add(`review-round:${task.id}/${round.id}`, "owner-unsettled", "ReviewRound must be terminal before ordinary archive.", ["completed", "failed"], round.status, `yui task context list ${task.id} --store review-round`);
+    }
     for (const attempt of store.listIntegrationAttempts(task.id).filter(a => ["running", "blocked", "conflicted", "validating"].includes(a.status))) {
         add(`integration-attempt:${task.id}/${attempt.id}`, "unresolved-integration", "Task has an unresolved Integration Attempt.", "terminal attempt", attempt.status, `yui task integration show ${task.id}/${attempt.id}`);
     }
@@ -24,15 +28,17 @@ export function archiveSettlementChecks(store, task) {
 /** Unknown execution is never permission to remove workspaces, even after
  * force admission. These facts are reloaded in the actual force cleanup path.
  */
-export function archiveExecutionChecks(store, taskId) {
+export function archiveExecutionChecks(store, taskId, home, phase = "before-removal") {
     const checks = [];
     const add = (resource, reason, detail, observed, action) => checks.push({ resource, reason, status: "unknown", detail, expected: "settled execution",
         observed, sources: [resource], actions: [action] });
     for (const run of store.listRuns(taskId).filter(r => r.status === "active")) {
         add(`run:${taskId}/${run.id}`, "active-turn", "AgentRun remains active; archive is not stop evidence.", run.status, `yui task run show ${taskId}/${run.id}`);
     }
-    for (const job of store.listDurableJobs(taskId).filter(j => ["queued", "running", "unknown-needs-attention"].includes(j.status))) {
-        add(`job:${taskId}/${job.id}`, "unresolved-execution", "DurableJob may still hold resources; acknowledgement is not physical exit evidence.", job.status, `yui job get --task ${taskId} --job ${job.id}`);
+    for (const job of store.listDurableJobs(taskId)) {
+        const blocker = jobCleanupBlocker(job, home, phase);
+        if (blocker !== undefined)
+            add(`job:${taskId}/${job.id}`, "unresolved-execution", blocker, job.status, `yui job get --task ${taskId} --job ${job.id}`);
     }
     for (const role of store.listRoles(taskId)) {
         const resource = `role:${taskId}/${role.name}`;
@@ -65,7 +71,7 @@ export async function inspectTaskArchive(coordinator, request) {
         observed: { coverage: p.coverage, merged: p.merged, verified: p.verified, localCommit: p.publication?.localCommit ?? null },
         sources: [`task:${task.id}`, ...(p.publication === null ? [] : [`publication:${task.id}/${p.publication.id}`])],
         actions: [`yui task remote-delivery ${task.id}`] }));
-    const execution = archiveExecutionChecks(store, task.id);
+    const execution = archiveExecutionChecks(store, task.id, preparer.home);
     const runtimeResource = `runtime:${task.id}`;
     if (runtime.assertTaskPhysicalResourcesReleased === undefined) {
         execution.push(...cleanupCheckFromError(null, runtimeResource, [`task:${task.id}`], [`yui task role status ${task.id}`]));
@@ -100,25 +106,36 @@ export async function inspectTaskArchive(coordinator, request) {
             checks });
     }
     const eligible = ["completed", "cancelled", "archived"].includes(task.status);
+    const limit = 32;
+    const boundedExecution = execution.slice(0, limit);
     return { taskId: task.id, observedAt: new Date().toISOString(), disposition: request.disposition, force: request.force,
         readOnly: true, authorizesCleanup: false,
         archive: { status: task.status, eligible, alreadyArchived: task.status === "archived",
-            settlement, delivery: deliveryChecks, forceBypassesSettlement: request.force,
+            settlement: settlement.slice(0, limit), delivery: deliveryChecks.slice(0, limit), forceBypassesSettlement: request.force,
+            execution: boundedExecution, physicalRetentionBlocksArchive: false,
             requiresIndependentAuthorization: true },
-        cleanup: { execution, resources },
-        note: "Current observations only. Execution reloads the checks. Force commits archive first and retains unsafe resources; a finished attempt does not prove resource release." };
+        cleanup: { execution: boundedExecution, resources: resources.slice(0, limit).map(resource => ({
+                ...resource, checkCount: resource.checks.length, checks: resource.checks.slice(0, limit)
+            })) },
+        counts: { settlement: settlement.length, delivery: deliveryChecks.length,
+            execution: execution.length, resources: resources.length },
+        actions: [`yui task context list ${task.id} --store managed-workspace`,
+            `yui task remote-delivery ${task.id}`, `yui task event list ${task.id}`],
+        note: "Current observations only. Ordinary archive requires settled business, exact delivery and stopped execution; safe physical retention is separate. Cleanup reloads these checks after archive commits. A finished attempt does not prove resource release." };
 }
 export function renderTaskArchivePreflight(data) {
     return [
         `Archive preflight: ${data.taskId} (${data.disposition}${data.force ? ", force" : ""}); read-only, not authorization`,
         `Task: ${data.archive.status}; terminal eligibility: ${data.archive.eligible}`,
+        `Checks/resources (showing at most 32 per list): settlement=${data.counts.settlement}; delivery=${data.counts.delivery}; execution=${data.counts.execution}; resources=${data.counts.resources}`,
         ...data.archive.settlement.map(c => `Admission${data.force ? " (force preserves)" : ""}: ${renderCleanupCheck(c)}`),
         ...data.archive.delivery.map(c => `Delivery${data.force || data.disposition === "abandoned" ? " (advisory for admission)" : ""}: ${renderCleanupCheck(c)}`),
         ...data.cleanup.execution.map(c => `Cleanup: ${renderCleanupCheck(c)}`),
         ...data.cleanup.resources.flatMap(r => [
-            `Workspace [${r.resource}]: ${r.status}`,
+            `Workspace [${r.resource}]: ${r.status}; checks=${r.checkCount}`,
             ...r.checks.map(c => `  ${renderCleanupCheck(c)}`)
         ]),
-        data.note
+        data.note,
+        `Inspect full evidence: ${data.actions.join("; ")}`
     ].join("\n") + "\n";
 }

package/dist/task/leaderArchive.js

@@ -5,6 +5,7 @@ import { archiveExecutionChecks, archiveSettlementChecks } from "./archivePrefli
 import { admitLeaderArchive, assertLeaderArchiveAdmission } from "./leaderArchiveAuthority.js";
 import { assertTaskRemoteDeliveryIntegrated, createTaskRemoteDeliveryProof } from "./remoteDeliveryService.js";
 import { selectNewTaskRoleSession } from "../executor/agentExecutor.js";
+import { taskArchiveDiagnostics } from "./archiveDiagnostics.js";
 /** A single foreground Controller operation survives stopping its requesting
  * Session. It has no retry worker: uncertain receipts are inspected, not
  * replayed. All existing settlement, delivery and cleanup checks remain. */
@@ -28,7 +29,7 @@ export async function archiveLeaderTask(store, coordinator, taskId, environment,
     // Only the requesting no-Run Leader may be stopped as part of this action.
     // Another Run, Job, unknown input, or then handoff is not archive authority.
     const ownResources = `role:${taskId}/leader`;
-    const execution = archiveExecutionChecks(store, taskId).filter(check => !(check.resource === ownResources
+    const execution = archiveExecutionChecks(store, taskId, coordinator.preparer.home, "before-role-stop").filter(check => !(check.resource === ownResources
         && ownInput?.runId === undefined && ownInput?.status === "accepted"
         && ["unresolved-provider-input", "unresolved-mailbox"].includes(check.reason)));
     if (execution.length)
@@ -39,7 +40,7 @@ export async function archiveLeaderTask(store, coordinator, taskId, environment,
     }
     let candidate = null;
     const workspace = store.getTaskWorkspace(taskId);
-    if (task.projectBindings.length && workspace) {
+    if (task.status === "cancelled" && task.projectBindings.length && workspace) {
         const snapshot = await coordinator.preparer.snapshotDirectTaskMain(workspace, task.projectBindings.map(binding => binding.projectId));
         candidate = { schemaVersion: 1, projects: snapshot.projects.map(project => ({
                 projectId: project.projectId, commit: project.headCommit
@@ -47,14 +48,6 @@ export async function archiveLeaderTask(store, coordinator, taskId, environment,
     }
     const proof = createTaskRemoteDeliveryProof(store, task, candidate);
     assertTaskRemoteDeliveryIntegrated(proof.delivery);
-    for (const owned of store.listManagedWorkspaces(taskId)) {
-        const disposition = owned.owner.type === "work-item"
-            && store.getWorkItem(taskId, owned.owner.workItemId)?.status === "retired" ? "abandoned" : "integrated";
-        const checks = await coordinator.preparer.inspectWorkspaceCleanup(owned, disposition);
-        if (checks.some(check => !(owned.owner.type === "task" && check.reason === "git-worktree-registrations"))) {
-            throw new Error(`Archive workspace is not clean/removable: ${JSON.stringify(checks)}`);
-        }
-    }
     // Reauthenticate after asynchronous inspection, before the first effect.
     admitLeaderArchive(store, taskId, environment, request.sourceMessage, request.purpose);
     assertLeaderArchiveAdmission(store, taskId, admission);
@@ -94,14 +87,15 @@ export async function archiveLeaderTask(store, coordinator, taskId, environment,
             // the first verified stop already released its physical owner records.
             tx.saveTaskRoleSessionSet(selectNewTaskRoleSession(stopped, stopped.activeAgentId, new Date()));
         });
-        const cleanup = await coordinator.cleanupTaskForArchive(taskId, "integrated");
-        if (cleanup.status !== "removed")
-            throw new Error(cleanup.error ?? `Archive cleanup ${cleanup.status}.`);
+        await coordinator.prepareTaskForArchive(taskId);
         runTaskCommand(["archive", taskId, "--integrated"], store, {
-            environment, archiveLeaderAdmission: admission, archiveRemoteDeliveryProof: proof
+            environment, yuiHome: coordinator.preparer.home,
+            archiveLeaderAdmission: admission, archiveRemoteDeliveryProof: proof
         });
+        await coordinator.cleanupArchivedTask(taskId, "integrated");
         record("task.leader-archive-result", { status: "archived" });
-        return { taskId, requestId: request.requestId, status: "archived" };
+        return { taskId, requestId: request.requestId, status: "archived",
+            ...taskArchiveDiagnostics(store, store.getTask(taskId)) };
     }
     catch (error) {
         record("task.leader-archive-result", { status: store.getTask(taskId)?.status === "archived" ? "archived" : "failed",