@zq-silk/yui 2.2.0 → 2.3.0

package/dist/repository/taskWorkspaceCoordinator.js

@@ -1,10 +1,10 @@
-import { lstat } from "node:fs/promises";
 import { isDeepStrictEqual } from "node:util";
 import { isArchivePersistenceFailure, recordArchiveCleanup } from "../task/archiveDiagnostics.js";
 import { archiveExecutionChecks, archiveSettlementChecks } from "../task/archivePreflight.js";
-import { projectTaskRemoteDeliveryFromStore } from "../task/remoteDeliveryService.js";
 import { CleanupInspectionError } from "../workspace/cleanupInspection.js";
 import { WorkItemChangeSetManager } from "../workspace/workItemChangeSetManager.js";
+import { withResourceRegistry } from "../resources/resourceRegistryStore.js";
+import { jobCleanupBlocker } from "../job/jobCleanupInspection.js";
 import { hasRuntimeLifecycleWork, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { acquireProjectMaintenanceLocks } from "./projectMaintenanceLock.js";
@@ -97,8 +97,9 @@ export class TaskWorkspaceCoordinator {
             if (state === "dirty")
                 return "dirty";
             this.#assertWorkItemRuntimeQuiescent(item);
-            this.#assertNoActiveWorkItemDurableJobs(item);
+            this.#assertNoActiveWorkItemDurableJobs(item, "before-role-stop");
             await this.#stopLiveRoles(item.taskId, this.#workItemRoleNames(item));
+            this.#assertNoActiveWorkItemDurableJobs(item);
             const laneCleanup = await this.preparer.cleanupExecutionLaneWorkspacesForWorkItem(item.taskId, item.id);
             if (laneCleanup === "dirty")
                 return "dirty";
@@ -162,30 +163,32 @@ export class TaskWorkspaceCoordinator {
             releaseMaintenance();
         }
     }
-    async cleanupTaskForArchive(taskId, disposition) {
-        let releaseMaintenance;
+    /** Business/runtime admission only. Physical workspaces may safely remain;
+     * their removal uses the same foreground cleanup after ordinary or force archive.
+     */
+    async prepareTaskForArchive(taskId) {
+        const task = this.store.getTask(taskId);
+        if (task === null)
+            throw new Error(`Task not found: ${taskId}.`);
+        if (task.status !== "completed" && task.status !== "cancelled") {
+            throw new Error(`Task must be completed or retired before archive: ${task.id}.`);
+        }
+        const settlement = [...archiveSettlementChecks(this.store, task),
+            ...archiveExecutionChecks(this.store, taskId, this.preparer.home, "before-role-stop")];
+        if (settlement.length > 0)
+            throw new CleanupInspectionError(settlement);
+        const managedWorkspaces = [...this.store.listManagedWorkspaces(task.id)]
+            .sort((left, right) => managedWorkspaceKey(left.owner)
+            .localeCompare(managedWorkspaceKey(right.owner)));
+        // Fence Project preparation while stopping exact Task runtimes; do not
+        // mutate Project paths until after the independent archive commit.
+        const projectIds = new Set(task.projectBindings.map(({ projectId }) => projectId));
+        for (const workspace of managedWorkspaces) {
+            for (const entry of workspace.entries)
+                projectIds.add(entry.projectId);
+        }
+        const releaseMaintenance = await acquireProjectMaintenanceLocks(this.preparer.home, projectIds);
         try {
-            const task = this.store.getTask(taskId);
-            if (task === null)
-                throw new Error(`Task not found: ${taskId}.`);
-            if (task.status !== "completed" && task.status !== "cancelled") {
-                throw new Error(`Task must be completed or retired before archive cleanup: ${task.id}.`);
-            }
-            const settlement = [...archiveSettlementChecks(this.store, task), ...archiveExecutionChecks(this.store, taskId)];
-            if (settlement.length > 0)
-                throw new CleanupInspectionError(settlement);
-            const managedWorkspaces = [...this.store.listManagedWorkspaces(task.id)]
-                .sort((left, right) => managedWorkspaceKey(left.owner)
-                .localeCompare(managedWorkspaceKey(right.owner)));
-            // Archive cleanup removes worktrees from every Project the Task uses:
-            // hold each Project's maintenance fence so the Controller defers
-            // preparation and no Project maintenance or Task archive interleaves.
-            const projectIds = new Set(task.projectBindings.map(({ projectId }) => projectId));
-            for (const workspace of managedWorkspaces) {
-                for (const entry of workspace.entries)
-                    projectIds.add(entry.projectId);
-            }
-            releaseMaintenance = await acquireProjectMaintenanceLocks(this.preparer.home, projectIds);
             this.#assertTaskArchiveLifecycle(task);
             const currentWorkspaces = [...this.store.listManagedWorkspaces(task.id)]
                 .sort((left, right) => managedWorkspaceKey(left.owner)
@@ -193,111 +196,43 @@ export class TaskWorkspaceCoordinator {
             if (!isDeepStrictEqual(currentWorkspaces, managedWorkspaces)) {
                 throw new Error(`Task workspaces changed while waiting for archive cleanup: ${taskId}.`);
             }
-            const laneWorkspaces = managedWorkspaces.filter(({ owner }) => owner.type === "execution-lane");
-            const integrationWorkspaces = managedWorkspaces.filter(({ owner }) => owner.type === "integration-attempt");
-            const workspaces = managedWorkspaces
-                .filter(({ owner }) => owner.type === "work-item");
-            const workItems = workspaces.map((workspace) => {
-                const workItemId = workspace.owner.type === "work-item"
-                    ? workspace.owner.workItemId
-                    : "";
-                const item = this.store.getWorkItem(task.id, workItemId);
-                if (item === null)
-                    throw new Error(`Work item not found: ${task.id}/${workItemId}.`);
-                if (item.status !== "accepted" && item.status !== "retired") {
-                    throw new Error(`Work item must be completed or retired before archive cleanup: ${item.id}.`);
-                }
-                return item;
-            });
             const allWorkItems = [...this.store.listWorkItems(task.id)]
                 .sort((left, right) => left.id.localeCompare(right.id));
             const allReviewRounds = [...this.store.listReviewRounds(task.id)]
                 .sort((left, right) => left.id.localeCompare(right.id));
-            const reviewRounds = allReviewRounds.filter((round) => (round.workspace !== undefined && round.workspaceDisposition?.kind !== "removed"));
             const snapshot = {
                 task,
                 managedWorkspaces,
                 workItems: allWorkItems,
                 reviewRounds: allReviewRounds
             };
-            const checks = [];
-            for (const workspace of managedWorkspaces) {
-                const workspaceDisposition = workspace.owner.type === "work-item"
-                    && this.store.getWorkItem(task.id, workspace.owner.workItemId)?.status === "retired" ? "abandoned" : disposition;
-                const inspected = await this.preparer.inspectWorkspaceCleanup(workspace, workspaceDisposition);
-                // Child worktrees are removed first below. Their Git registrations
-                // necessarily exist now; the clone's removal boundary rechecks them
-                // after every child cleanup and never removes an unresolved owner.
-                checks.push(...inspected.filter(c => !(workspace.owner.type === "task"
-                    && c.reason === "git-worktree-registrations")));
-            }
-            if (checks.length > 0)
-                throw new CleanupInspectionError(checks);
             const roleNames = this.store.listRoles(taskId).map(({ name }) => name);
             await this.#stopLiveRoles(taskId, roleNames);
             await this.runtime.releaseTaskTerminals(task.id);
-            this.#assertTaskArchiveSnapshot(snapshot);
-            for (const workspace of laneWorkspaces) {
-                this.#assertTaskArchiveLifecycle(task);
-                if (workspace.owner.type === "execution-lane") {
-                    await this.preparer.cleanupExecutionLaneWorkspace(task.id, workspace.owner.executionGroupId, workspace.owner.executionLaneId);
-                }
-            }
-            for (const workspace of integrationWorkspaces) {
-                this.#assertTaskArchiveLifecycle(task);
-                if (workspace.owner.type === "integration-attempt") {
-                    await this.preparer.cleanupIntegrationWorkspace(task.id, workspace.owner.integrationAttemptId, { preserveChanges: true });
-                }
-            }
-            for (const round of reviewRounds) {
-                this.#assertTaskArchiveLifecycle(task);
-                await this.preparer.cleanupReviewRoundWorkspace(task.id, round.id);
+            if (this.runtime.assertTaskPhysicalResourcesReleased === undefined) {
+                throw new Error("Archive requires exact physical runtime inspection.");
             }
-            for (const item of workItems) {
-                this.#assertTaskArchiveLifecycle(task);
-                await this.preparer.cleanupWorkItemWorkspace(task.id, item.id, item.status === "accepted" ? disposition : "abandoned");
-            }
-            this.#assertTaskArchiveLifecycle(task);
-            return await this.preparer.cleanupTaskForArchive(taskId, disposition);
-        }
-        catch (error) {
-            const task = this.store.getTask(taskId);
-            return {
-                taskId,
-                status: error instanceof CleanupInspectionError && error.checks.every(c => c.reason === "dirty-worktree")
-                    ? "retained-dirty" : "failed",
-                ...(task?.cwd === undefined ? {} : { path: task.cwd }),
-                error: error instanceof Error ? error.message : String(error),
-                ...(error instanceof CleanupInspectionError
-                    ? { checks: error.checks, reason: error.checks[0]?.reason ?? "cleanup-failed",
-                        resource: error.checks[0]?.resource ?? `task:${taskId}`, retryable: true }
-                    : error instanceof WorkspaceCleanupBlockedError
-                        ? {
-                            reason: error.reason,
-                            resource: error.resource,
-                            retryable: error.retryable
-                        }
-                        : {
-                            reason: "cleanup-failed",
-                            resource: `task:${taskId}`,
-                            retryable: true
-                        })
-            };
+            await this.runtime.assertTaskPhysicalResourcesReleased(task.id);
+            this.#assertTaskArchiveSnapshot(snapshot);
+            const rechecked = [...archiveSettlementChecks(this.store, task), ...archiveExecutionChecks(this.store, taskId, this.preparer.home)];
+            if (rechecked.length > 0)
+                throw new CleanupInspectionError(rechecked);
         }
         finally {
-            releaseMaintenance?.();
+            releaseMaintenance();
         }
     }
-    /** Best-effort cleanup only after explicit force admission has committed.
+    /** Best-effort cleanup only after authorized archive admission has committed.
      * This is one foreground attempt, not a retry worker. Each independent result
      * is durable before continuing, and a failed audit write really fails.
      */
     async cleanupArchivedTask(taskId, disposition) {
         const task = this.store.getTask(taskId);
-        if (task?.status !== "archived"
-            || !this.store.listEvents(taskId).some(e => e.type === "task.archived" && e.payload.force === "true")) {
-            throw new Error(`Force archive must commit before cleanup: ${taskId}.`);
+        if (task?.status !== "archived") {
+            throw new Error(`Archive must commit before cleanup: ${taskId}.`);
         }
+        recordArchiveCleanup(this.store, taskId, { resource: `cleanup-pass:${taskId}`,
+            detail: "Begin one foreground exact-owner cleanup pass." }, "started");
         const attempt = async (diagnostic, action) => {
             recordArchiveCleanup(this.store, taskId, diagnostic, "started");
             let status;
@@ -306,7 +241,7 @@ export class TaskWorkspaceCoordinator {
                 const result = await action();
                 status = result === "dirty" ? "retained" : result;
                 if (result === "dirty")
-                    detail = "Dirty workspace retained; force archive does not discard local changes.";
+                    detail = "Dirty workspace retained; archive does not discard local changes.";
             }
             catch (error) {
                 if (isArchivePersistenceFailure(error))
@@ -321,7 +256,7 @@ export class TaskWorkspaceCoordinator {
         for (const role of this.store.listRoles(taskId)) {
             const released = await attempt({ resource: `role:${taskId}/${role.name}`,
                 detail: "Exact Role runtime stop." }, async () => {
-                const checks = archiveExecutionChecks(this.store, taskId).filter(c => c.resource === `role:${taskId}/${role.name}`);
+                const checks = archiveExecutionChecks(this.store, taskId, this.preparer.home).filter(c => c.resource === `role:${taskId}/${role.name}`);
                 if (checks.length > 0)
                     throw new CleanupInspectionError(checks);
                 await this.#stopLiveRoles(taskId, [role.name]);
@@ -331,12 +266,16 @@ export class TaskWorkspaceCoordinator {
         }
         const physicalReleased = await attempt({ resource: `runtime:${taskId}`,
             detail: "Verify exact physical resource release before workspace deletion." }, async () => {
-            const checks = archiveExecutionChecks(this.store, taskId);
+            const checks = archiveExecutionChecks(this.store, taskId, this.preparer.home);
             if (checks.length > 0)
                 throw new CleanupInspectionError(checks);
             if (!runtimeReleased)
                 throw new Error("One or more Role runtimes could not be safely released.");
             await this.runtime.releaseTaskTerminals(taskId);
+            if (this.runtime.assertTaskPhysicalResourcesReleased === undefined) {
+                throw new Error("Exact physical resource release inspection is unavailable.");
+            }
+            await this.runtime.assertTaskPhysicalResourcesReleased(taskId);
             return "released";
         });
         if (physicalReleased) {
@@ -367,31 +306,10 @@ export class TaskWorkspaceCoordinator {
                             case "execution-lane":
                                 return await this.preparer.cleanupExecutionLaneWorkspace(taskId, owner.executionGroupId, owner.executionLaneId);
                             case "integration-attempt":
-                                if (await this.preparer.inspectIntegrationWorkspace(taskId, owner.integrationAttemptId) === "dirty")
-                                    return "dirty";
-                                return await this.preparer.cleanupIntegrationWorkspace(taskId, owner.integrationAttemptId, { preserveChanges: true });
+                                return await this.preparer.cleanupIntegrationWorkspace(taskId, owner.integrationAttemptId);
                             case "task": {
-                                const current = this.store.getTask(taskId);
-                                const delivery = projectTaskRemoteDeliveryFromStore(this.store, current);
-                                if (!delivery.allMerged || !delivery.allVerified) {
-                                    throw new Error("Task main retained: local commits are not covered by verified remote delivery. Force does not discard them.");
-                                }
-                                for (const entry of workspace.entries.filter(e => e.access === "write")) {
-                                    const covered = delivery.projects.find(p => p.projectId === entry.projectId);
-                                    const expected = covered?.expectedLocalCommit;
-                                    const path = await lstat(entry.path).catch(error => {
-                                        if (error.code === "ENOENT")
-                                            return null;
-                                        throw error;
-                                    });
-                                    if (expected !== null && expected !== undefined
-                                        && path !== null) {
-                                        const actual = await this.preparer.git.inspect(entry.path, "HEAD");
-                                        if (actual.baseCommit !== expected && actual.baseCommit !== covered?.deliveryLocalCommit) {
-                                            throw new Error(`Task main HEAD changed: ${entry.path}; retained.`);
-                                        }
-                                    }
-                                }
+                                // The preparer reloads the shared identity, dirt, baseline and
+                                // delivery checks; do not maintain a second post-archive gate.
                                 const result = await this.preparer.cleanupTaskForArchive(taskId, disposition);
                                 if (result.status !== "removed")
                                     throw new Error(result.error ?? "Task main or dependent workspace retained.");
@@ -405,6 +323,17 @@ export class TaskWorkspaceCoordinator {
                 });
             }
         }
+        // The registry remains the authority for scratch/resources not represented
+        // by a current workspace. Do not invent ownership or sweep those paths.
+        // Expose exact unresolved registrations instead of claiming full release.
+        const registered = withResourceRegistry(this.preparer.home, undefined, registry => Object.values(registry.load().records).filter(record => record.owner.taskId === taskId && record.disposition !== "deleted"));
+        for (const record of registered) {
+            recordArchiveCleanup(this.store, taskId, {
+                resource: `resource:${record.id}`, paths: [record.path],
+                detail: `Registered ${record.kind} retained (${record.disposition}); owner=${JSON.stringify(record.owner)}. `
+                    + "No deletion attempted by archive for this remaining registration. Inspect with yui resources gc --dry-run."
+            }, "retained");
+        }
         recordArchiveCleanup(this.store, taskId, { resource: `task:${taskId}`,
             detail: "Foreground cleanup attempt finished; inspect retained resource references and warnings." }, "finished");
     }
@@ -436,24 +365,18 @@ export class TaskWorkspaceCoordinator {
             throw new WorkspaceCleanupBlockedError("active-turn", `work-item:${item.taskId}/${item.id}`, true, `Work item still has an active AgentRun: ${item.taskId}/${item.id}.`);
         }
     }
-    /**
-     * rr5/f4: A WorkItem workspace must not be removed while a DurableJob it
-     * owns could still be using it. Queued, running, and unacknowledged
-     * unknown-needs-attention jobs are unsettled — the runner (or its corpse)
-     * may still hold the worktree. Acknowledged unknown jobs are settled: a
-     * human/Leader has taken responsibility for the outcome.
+    /** Check result/runner before stopping Roles, then physical references before
+     * cleaning any child lanes. The preparer repeats the full check at removal.
      */
-    #assertNoActiveWorkItemDurableJobs(item) {
+    #assertNoActiveWorkItemDurableJobs(item, phase = "before-removal") {
         const jobs = this.store.listDurableJobs(item.taskId);
         const blocking = jobs.filter((job) => (job.owner.kind === "work-item"
             && job.owner.workItemId === item.id
-            && (job.status === "queued"
-                || job.status === "running"
-                || (job.status === "unknown-needs-attention" && job.acknowledgedAt === undefined))));
+            && jobCleanupBlocker(job, this.preparer.home, phase) !== undefined));
         if (blocking.length > 0) {
             throw new WorkspaceCleanupBlockedError("active-durable-job", `work-item:${item.taskId}/${item.id}`, true, `Work item ${item.id} still has ${blocking.length} active DurableJob(s): `
                 + `${blocking.map((job) => `${job.id}/${job.status}`).join(", ")}. `
-                + "Cancel or acknowledge them before cleanup.");
+                + "Settle their outcomes and establish physical exit before cleanup; acknowledgement alone is not stop evidence.");
         }
     }
     #workItemRoleNames(item) {
@@ -470,6 +393,10 @@ export class TaskWorkspaceCoordinator {
     }
     async #stopLiveRoles(taskId, roleNames) {
         const targets = [...new Set(roleNames)];
+        const unresolved = archiveExecutionChecks(this.store, taskId, this.preparer.home, "before-role-stop")
+            .filter(check => targets.some(roleName => check.resource === `role:${taskId}/${roleName}`));
+        if (unresolved.length > 0)
+            throw new CleanupInspectionError(unresolved);
         for (const roleName of targets) {
             if (this.store.getActiveRun(taskId, roleName) !== null) {
                 throw new Error(`Role has an active AgentRun: ${taskId}/${roleName}.`);

package/dist/repository/taskWorkspacePreparer.js

@@ -1,4 +1,4 @@
-import { lstat, mkdir, readdir, readlink, rm, rmdir, symlink, unlink } from "node:fs/promises";
+import { lstat, mkdir, readdir, readlink, rmdir, symlink, unlink } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { recordArchiveCleanup } from "../task/archiveDiagnostics.js";
@@ -25,7 +25,8 @@ import { NodeGitWorkspace, worktreeIdentity } from "./gitWorkspace.js";
 import { acquireProjectMaintenanceLocks, ProjectMaintenanceLockCancelledError, ProjectMaintenanceLockedError } from "./projectMaintenanceLock.js";
 import { captureTaskBaseProvenance, recordTaskBaseProvenanceEvents } from "./taskBaseFreshness.js";
 import { generateTaskWorkspaceIdentity, taskWorkspaceRefSegment, validateTaskWorkspaceIdentity } from "./taskWorkspaceIdentity.js";
-import { inspectWorkspaceCleanup } from "./workspaceCleanupInspection.js";
+import { inspectWorkspaceCleanup, inspectWorkspaceContainer } from "./workspaceCleanupInspection.js";
+import { defaultIntegrationRuntimeIsolation } from "../runtime/integrationRuntimeIsolation.js";
 const MAIN_WORKTREE = "main";
 const LEADER_ROLE = "leader";
 /**
@@ -73,7 +74,7 @@ export class FileTaskWorkspacePreparer {
         this.maintenanceLockOptions = maintenanceLockOptions;
     }
     inspectWorkspaceCleanup(workspace, disposition, forceArchive = false) {
-        return inspectWorkspaceCleanup(this.store, this.git, workspace, disposition, forceArchive);
+        return inspectWorkspaceCleanup(this.store, this.git, workspace, disposition, forceArchive, this.home);
     }
     async #assertWorkspaceCleanup(workspace, disposition) {
         const checks = await this.inspectWorkspaceCleanup(workspace, disposition);
@@ -1296,7 +1297,7 @@ export class FileTaskWorkspacePreparer {
             this.#recordArchivePathRemoval(task, entry.path, result);
             removed ||= result === "removed";
         }
-        await removeWorkspaceView(workspace.root);
+        await removeWorkspaceView(workspace.root, workspace);
         this.#resourceRegistrar().markWorkspaceDeleted(workspace);
         this.store.removeManagedWorkspace(workspace.owner);
         return removed ? "removed" : "missing";
@@ -1907,7 +1908,7 @@ export class FileTaskWorkspacePreparer {
             this.#recordArchivePathRemoval(task, entry.path, result);
             removed ||= result === "removed";
         }
-        await removeWorkspaceView(workspace.root);
+        await removeWorkspaceView(workspace.root, workspace);
         this.#resourceRegistrar().markWorkspaceDeleted(workspace);
         this.store.transaction((tx) => {
             const currentRound = tx.getReviewRound(task.id, round.id);
@@ -1976,7 +1977,7 @@ export class FileTaskWorkspacePreparer {
             this.#recordArchivePathRemoval(task, entry.path, result);
             removed ||= result === "removed";
         }
-        await removeWorkspaceView(workspace.root);
+        await removeWorkspaceView(workspace.root, workspace);
         this.#resourceRegistrar().markWorkspaceDeleted(workspace);
         try {
             this.#recordWorkspaceRemoval(task, workspace, this.#fallbackWorkspace(), {
@@ -2027,39 +2028,36 @@ export class FileTaskWorkspacePreparer {
             throw new Error(`IntegrationAttempt must be terminal before cleanup: ${attempt.id}.`);
         }
         const workspace = this.store.getIntegrationWorkspace(task.id, attempt.id);
-        // A failed Integration's explicitly disposable conflict tree retains its
-        // existing cleanup contract outside archive. Archive never discards dirt.
-        if (workspace !== null && (options.preserveChanges || task.status === "archived" || attempt.status !== "failed")) {
-            await this.#assertWorkspaceCleanup(workspace, "abandoned");
-        }
+        if (workspace === null)
+            return "missing"; // no current resource ownership to delete
+        // Terminal history does not authorize discarding conflict resolutions or
+        // diagnostics. All entry points use the same exact-owner inspection.
+        const runtime = options.runtimeIsolation ?? defaultIntegrationRuntimeIsolation(this.home, this.store.getHomeIdentity().homeId);
+        const checks = await inspectWorkspaceCleanup(this.store, this.git, workspace, "abandoned", false, this.home, runtime);
+        if (checks.length > 0)
+            throw new CleanupInspectionError(checks);
+        runtime.cleanup(runtime.preflight({ workspace, allowExactActive: true }), attempt.status === "committed" ? "completion" : "failure");
         const project = requireProject(this.store, attempt.projectId);
-        // The recorded entry pins the exact on-disk worktree path; reconstruct the
-        // owner root from it so removal targets the real Git worktree regardless of
-        // how the layout helper derives it. Absent a recorded workspace, fall back
-        // to the deterministic integration owner root + bound directory.
-        const recorded = workspace?.entries[0];
-        const directory = recorded?.directory
-            ?? task.projectBindings.find(({ projectId }) => projectId === attempt.projectId)?.directory;
-        if (directory === undefined) {
-            throw new Error(`Integration Project binding is unavailable: ${task.id}/${project.id}.`);
+        // Only the recorded entry grants resource ownership; no history-derived
+        // path reconstruction after the current resource record has been removed.
+        const recorded = workspace.entries[0];
+        if (recorded === undefined || recorded.projectId !== project.id || workspace.entries.length !== 1) {
+            throw new Error(`Integration workspace Project identity is unavailable: ${task.id}/${project.id}.`);
         }
         const result = await this.git.removeIntegrationWorktree({
             repositoryPath: this.#taskRepositoryPath(task.id, project.id),
-            container: recorded !== undefined
-                ? dirname(recorded.path)
-                : this.#integrationWorkspaceRoot(task.id, attempt.id),
-            directory,
+            container: dirname(recorded.path),
+            directory: recorded.directory,
             taskSegment: this.#taskSegment(task),
             integrationId: attempt.id,
-            discardChanges: options.preserveChanges !== true && task.status !== "archived" && attempt.status === "failed"
+            discardChanges: false
         });
         if (result !== "dirty") {
-            for (const entry of workspace?.entries ?? []) {
+            for (const entry of workspace.entries) {
                 this.#recordArchivePathRemoval(task, entry.path, result);
             }
-            if (workspace !== null)
-                this.#resourceRegistrar().markWorkspaceDeleted(workspace);
-            await rm(join(this.home, "artifacts", "integration-checks", task.id, attempt.id), { recursive: true, force: true });
+            this.#resourceRegistrar().markWorkspaceDeleted(workspace);
+            // Check logs are stable historical evidence, not worktree scratch.
             this.store.removeManagedWorkspace({
                 type: "integration-attempt",
                 taskId: task.id,
@@ -2097,15 +2095,9 @@ export class FileTaskWorkspacePreparer {
         if (main !== null) {
             await this.#assertWorkspaceCleanup(main, disposition);
             assertTaskArchiveState(requireTask(this.store, task.id), task);
-            // Scratch-only workspaces have no Git entries or Git workspace identity.
-            if (main.entries.length > 0 && await this.#inspectEntries(task.id, this.#taskSegment(task), MAIN_WORKTREE, main.entries) === "dirty") {
-                return {
-                    taskId,
-                    status: "retained-dirty",
-                    ...(task.cwd === undefined ? {} : { path: task.cwd })
-                };
-            }
-            for (const entry of main.entries) {
+            // The shared preflight and removeTaskClone both inspect clone identity.
+            // Do not re-enter linked-worktree inspection against a missing clone.
+            for (const entry of main.entries.filter(e => e.access === "write")) {
                 assertTaskArchiveState(requireTask(this.store, task.id), task);
                 const result = await this.git.removeTaskClone({
                     path: entry.path, container: main.root, directory: entry.directory,
@@ -2117,7 +2109,7 @@ export class FileTaskWorkspacePreparer {
                 this.#recordArchivePathRemoval(task, entry.path, result);
             }
             assertTaskArchiveState(requireTask(this.store, task.id), task);
-            await removeWorkspaceView(main.root);
+            await removeWorkspaceView(main.root, main);
             this.#resourceRegistrar().markWorkspaceDeleted(main);
             assertTaskArchiveState(requireTask(this.store, task.id), task);
             this.#recordWorkspaceRemoval(task, main, this.#fallbackWorkspace());
@@ -2175,9 +2167,6 @@ export class FileTaskWorkspacePreparer {
     #reviewRoundWorkspaceRoot(taskId, round) {
         return join(resolveTaskRoot(this.home), safePathSegment(taskId), "reviews", safePathSegment(this.#reviewWorktreeName(round)));
     }
-    #integrationWorkspaceRoot(taskId, integrationId) {
-        return integrationWorkspaceRoot(this.home, taskId, integrationId);
-    }
     #reviewWorktreeName(round) {
         return round.scope === "task"
             ? `reviewer-${round.reviewerRoleName}`
@@ -2570,7 +2559,12 @@ async function ensureWorkspaceView(root, entries) {
         await symlink(target, join(root, directory), "dir");
     }
 }
-async function removeWorkspaceView(root) {
+async function removeWorkspaceView(root, workspace) {
+    if (workspace !== undefined) {
+        const checks = await inspectWorkspaceContainer(workspace);
+        if (checks.length > 0)
+            throw new CleanupInspectionError(checks);
+    }
     let entries;
     try {
         entries = await readdir(root, { withFileTypes: true });
@@ -2584,6 +2578,8 @@ async function removeWorkspaceView(root) {
         if (!entry.isSymbolicLink()) {
             throw new Error(`Managed workspace contains an unexpected entry: ${join(root, entry.name)}.`);
         }
+    }
+    for (const entry of entries) {
         await unlink(join(root, entry.name));
     }
     await rmdir(root);