devlyn-cli 4.3.20 → 4.3.23

package/config/skills/_shared/task-completion.md

@@ -80,22 +80,88 @@ After remote delivery, fetch first. If the branch can fast-forward to the
 delivered result, recheck the copied edits' current ownership and contents,
 then remove them: `git restore --source=HEAD --staged --worktree -- <paths>`
 for tracked paths holding only your edits, and delete copied untracked files.
-Then use `git merge --ff-only <task branch>` for local delivery, or
-`git merge --ff-only <remote>/<base>` on the base branch after remote delivery;
+Then run `python3 "$DEVLYN_SHARED_DIR/bring-in.py" --repo . --branch <checked-out branch> --target <task branch> --ff-only`
+for local delivery, or the same command with `--target <remote>/<base>` on the base branch after remote delivery;
 a drain's `Bring into` command is its own. Once a local delivery is reconciled,
 remove its worktree and task branch (`git worktree remove <worktree>`,
 `git branch -d <task branch>`). Do not switch branches, create a reconciliation
-merge commit or discard WIP to force this step. If reconciliation is unsafe,
+merge commit, or discard WIP or ignored files to force this step. If reconciliation is unsafe,
 retain and report the edits, delivered result and remaining bring-in action.
 
 Save the returned receipt path under the common Gitdir. `reconciled` reports earlier accepted,
 PR-delivered tasks whose merged resources were cleaned or retained; it is
 informational, so never resume or release a receipt you do not own. Existing
 branches/trees cannot be adopted, even when their names look generated. Nor
-can a receipt that never reached `allocation: owned`: remove its worktree and
-branch if present, delete its receipt directory, then allocate again.
+can an interrupted standalone receipt that never reached `allocation: owned`:
+remove its worktree and branch if present, delete its receipt directory, then allocate again.
 Unreceipted tasks remain owner-managed.
 
+New allocation and warming modes come from enrollment state alone:
+
+| `~/.devlyn/storage-client.json` | recovery marker | unenroll journal | Mode |
+|---|---|---|---|
+| absent | absent | not read | standalone (never enrolled) |
+| valid | any | not read | managed; a fenced authority refuses |
+| invalid or unreadable | any | not read | refuse; repair registration |
+| absent | present | verified `retired: true` | standalone (unenrollment complete) |
+| absent | present | absent, unreadable or incomplete | refuse; Open Devlyn to repair its storage registration |
+
+The journal `storage-client-unenroll.json` is read no-follow only on the last two
+rows. Schema 1, canonical UUIDv7 operation, permanent `storage-client-fence.json`,
+matching operation/root/lock identities and Rust's archive ordering/path
+validation are required. If native root/lock identities or the home path changed,
+completed retirement permits standalone only when `storage`, `control`,
+`harness/state.json` and `storage-client.json` are all absent under the current
+lifecycle root (checked without following links). Live inventory requires repair.
+No repository-wide receipt scan selects mode. Other keys can allocate after
+completed unenrollment; a leftover managed key retains its own recovery command.
+
+Existing operations keep their managed identity. Receipts pin the control
+identity; current enrollment verifies the helper before allocation. Recovery uses
+the current verified `storage-client-recovery/pins.json`, including after uninstall
+or unenrollment, and requires its authority binding to match the receipt. Missing
+or invalid pins retain resources and require repair; saved artifacts are never a
+fallback. Enrolled checkout preserves
+`managed_pending`/`managed_owned` and Rust's `storage-allocation.json` subreceipt.
+After an interrupted reply, use the returned `recover-storage` resume. Never
+delete managed receipts or replace an unfinished operation ID.
+
+Owner `recover-storage --receipt <receipt.json> --operation-id <saved ID>
+--for-removal` fences allocation and reconciles closure and the exact cache set.
+Never-published allocations are abandoned. Accepted LOCAL_ONLY, FAILED, and PRs
+observed CLOSED without merge share custody/recovery-ref verification and fenced
+removal, retaining task branches and a durable terminal delivery. Release writers
+with `complete --writers-stopped` first. A queue-produced FAILED checkout is
+advanced by `read-tree -m -u <source_sha> <publish_sha>` only when HEAD is at the
+attached publish commit and the index and worktree are exactly at source; other
+differences refuse as dirty.
+
+Removal-finished receipts with final COMPLETE, LOCAL_ONLY, FAILED or CLOSED
+delivery move under `devlyn-completion/retired/`, regardless of scratch status.
+Retirement moves scratch and its saved cleanup record with the audit and deletes
+nothing. `complete --writers-stopped` saves the writer release there and retries
+pending scratch, including an interrupted cleanup with no saved result; the next
+allocation retries completed deliveries with released writers. `clean-scratch`
+remains available there and never downgrades CLEAN.
+Saved managed `complete`, `recover-storage` and `clean-scratch` resumes carry an
+operation ID validated under the receipt lock. Without an ID, a locator selects
+its active receipt. An ID selects only that operation, including its verified
+retired receipt; a mismatched ID refuses. Retired paths also remain usable.
+A new allocation may reuse a retired key without disturbing its audit.
+
+Retained submodule repositories in the admin directory block removal even when
+the checkout is absent; preserve/publish their source and explicitly resolve
+them. Manual checkout removal is advised only after portable source checks and
+record preservation succeed; changed or new source requires retention. If native
+Windows or unobservable writers then require retention, stop all
+writers, remove the task checkout by hand, keep its branch and receipt, then run
+the returned owner-removal resume. The absent-tree path completes the fenced
+registration removal. Scratch cleanup requires positive allocation closure,
+without a cache-removal fence; actual checkout removal owns that fence, including
+empty cache sets. Missing helpers or uncertain closure retain resources with a
+repair/resume action. Compatible recovery artifacts and Rust's LaunchGate remain
+required while managed obligations exist.
+
 Copy attributable task edits into the allocated worktree as a patch, never a
 stash. Establish attribution from the pre-edit contents and starting Git state,
 including staged, unstaged and untracked work. A path-scoped
@@ -113,6 +179,10 @@ require the affected checks again.
 Keep the original edits through pending or failed delivery; only reconciliation
 removes them. Preserve all other work and report anything left behind.
 
+Managed allocations currently start cold; `build_dirs` retains each returned cache
+and publication lease ID. Managed warming is deferred. Standalone allocations keep
+the warming behavior below.
+
 Build in the task worktree's own default build directory, never in one
 another checkout builds in, even one build at a time: tools such as Cargo take
 one checkout's outputs as fresh for the other. When the shared repository-local
@@ -142,6 +212,7 @@ release build caches when parking or after a failed run, use:
 ```sh
 python3 "$DEVLYN_SHARED_DIR/task-complete.py" clean-scratch \
   --receipt '<returned receipt.json>' --writers-stopped
+# For managed receipts, use the saved resume with --operation-id <saved ID>.
 ```
 
 This empties only the prospectively owned scratch, preserves its directory
@@ -246,7 +317,8 @@ the next allocation or resume after the restart.
 On native Windows, locking and file durability are supported, but the helper cannot prove writer cessation and reports `writer observation unsupported on this platform; retain workspace`. Even `--writers-stopped` cannot authorize deletion without that observation: retain the workspace, its task refs and external receipt/custody, report delivery separately, and preserve the receipt-based resume command. A merged or on-base delivery therefore reports `CLEANUP_PENDING` (delivery `COMPLETE`) with `workspace_cleanup` naming the reason and resume. Do not kill unknown processes or force worktree removal to make completion pass.
 
 The receipt directory holds byte-verified `custody/`, `manifest.json` and a guarded
-`refs/devlyn/completed/<id>` recovery ref. Check evidence is copied there
+`refs/devlyn/completed/<id>` recovery ref (new managed allocations use
+`<id>.<operation>` so branch reuse preserves earlier recovery refs). Check evidence is copied there
 before publication; removal rechecks it, the recovery ref and the merge or accepted commit on base.
 Ignored build output and other ignored files are disposable under native
 non-force worktree removal. The tree's `.devlyn/` files are byte/mode-verified

package/config/skills/_shared/warm-build-dirs.py

@@ -526,8 +526,15 @@ def warm_cargo(work, anchor, staging_root, deadline):
     with contextlib.ExitStack() as stack:
         staging = None
         try:
-            if shutil.which("cargo") is None:
-                raise Skip("cargo is not on PATH")
+            # Decide managed cold start before Cargo, destination setup, donors
+            # or any seeding work. Standalone keeps its original path.
+            import runpy
+            storage = runpy.run_path(str(Path(__file__).with_name('storage-client.py')))
+            decision = storage['operation_enrollment']()
+            if decision['mode'] == 'managed':
+                return entry('cargo', 'cold', reason='managed warming deferred; cold start')
+            if shutil.which('cargo') is None:
+                raise Skip('cargo is not on PATH')
             target, relative, parent = destination(work, deadline, stack)
             candidates = donors(work, anchor, relative, deadline)
             if not candidates:
@@ -678,6 +685,11 @@ class WarmTests(unittest.TestCase):
         temporary = tempfile.TemporaryDirectory(prefix="warm-build-dirs-")
         self.addCleanup(temporary.cleanup)
         self.root = Path(temporary.name).resolve()
+        test_home = self.root / "home"
+        test_home.mkdir()
+        home_env = mock.patch.dict(os.environ, {"HOME": str(test_home), "USERPROFILE": str(test_home)})
+        home_env.start()
+        self.addCleanup(home_env.stop)
         (self.root / "sitecustomize.py").write_text(
             "import importlib.machinery, importlib.util, pathlib, sys\n"
             "spec = importlib.machinery.PathFinder.find_spec('sitecustomize', [p for p in sys.path if pathlib.Path(p or '.').resolve() != pathlib.Path(__file__).resolve().parent])\n"
@@ -730,7 +742,7 @@ class WarmTests(unittest.TestCase):
             def copy(source, target, deadline):
                 target.parent.mkdir(parents=True, exist_ok=True)
                 subprocess.run(["cp", "-a", "--", str(source), str(target)], check=True)
-            patch = mock.patch(f"{__name__}.clone", copy)
+            patch = mock.patch.dict(warm_cargo.__globals__, clone=copy)
             patch.start()
             self.addCleanup(patch.stop)
 
@@ -832,6 +844,44 @@ class WarmTests(unittest.TestCase):
         self.assertEqual([], list(self.staging.iterdir()))
         self.assertEqual("", self.git(self.work, "status", "--porcelain", "--untracked-files=all"))
 
+    @unittest.skipIf(os.name == 'nt', 'Windows keeps its existing skip')
+    def test_managed_skip_precedes_donor_traversal_and_reports_cold_start(self):
+        from unittest import mock
+        import runpy
+        real = runpy.run_path
+        def modules(path, *args, **kwargs):
+            if Path(path).name == 'storage-client.py':
+                return {'operation_enrollment': lambda: {'mode': 'managed'}}
+            return real(path, *args, **kwargs)
+        with mock.patch.object(runpy, 'run_path', modules), \
+             mock.patch.dict(warm_cargo.__globals__, donors=mock.Mock(side_effect=AssertionError('donor traversal')),
+                             destination=mock.Mock(side_effect=AssertionError('destination setup')),
+                             clone=mock.Mock(side_effect=AssertionError('seed')), publish=mock.Mock(side_effect=AssertionError('publish'))):
+            result = self.warm()[0]
+        self.assertEqual(result['status'], 'cold')
+        self.assertIn('cold start', result['reason'])
+        self.assertFalse((self.work / 'target').exists())
+        self.assert_nothing_left()
+
+    @unittest.skipIf(os.name == 'nt', 'warming is POSIX-only')
+    def test_standalone_warm_never_registers_destination(self):
+        from unittest import mock
+        import runpy
+        real = runpy.run_path
+        def modules(path, *args, **kwargs):
+            module = real(path, *args, **kwargs)
+            if Path(path).name == 'storage-client.py':
+                module['Client'] = mock.Mock(side_effect=AssertionError('standalone authority call'))
+                module['operation_id'] = mock.Mock(side_effect=AssertionError('standalone operation'))
+            return module
+        common = Path(self.git(self.work, 'rev-parse', '--path-format=absolute', '--git-common-dir').strip())
+        before = sorted(p.name for p in common.iterdir())
+        with mock.patch.object(runpy, 'run_path', modules):
+            result = self.warm()[0]
+        self.assertEqual(result['status'], 'seeded', result)
+        self.assertEqual(sorted(p.name for p in common.iterdir()), before)
+        self.assertFalse((Path(os.environ['HOME']) / '.devlyn').exists())
+
     @unittest.skipIf(os.name == "nt", "warming is POSIX-only")
     def test_local_git_true_seeds_without_cargo_opt_in(self):
         self.write_fixture(workspace_metadata=None)

package/config/skills/devlyn-ideate/SKILL.md

@@ -123,7 +123,7 @@ Execute the devlyn loop task packet {packet}: read its workerPrompt when present
 python3 "$DEVLYN_SKILL_DIR/scripts/queue.py" drain --repo . [--local-only] -- <executor argv>
 ```
 
-A drain can run for hours. Do not end the turn until it exits: run it in the foreground with the longest allowed timeout, or in the background and await its completion notice, because a headless host kills background tasks at its final response.
+A drain can run for hours. Do not end the turn until it exits: run it in the foreground with the longest allowed timeout, or in the background and await its completion notice, because reporting the drain's result requires observing its exit.
 
 - `WAITING` on legacy rows: plan and materialize each under the autonomous policy, then drain again; a row whose planning stops on material ambiguity stays pending and its question is reported.
 - Other `WAITING`: report each task’s reason and recovery command. Task-local failures leave dependents and barrier-held siblings waiting while independent work continues; the next drain retries eligible work once. An interrupted executor is observed once per drain and cannot be adopted or respawned until it stops. `BLOCKED` means authoritative queue reconstruction or preflight failed, including a held drain lock. Never edit receipts, refs or queue rows to get past either result.

package/config/skills/devlyn-ideate/references/loop.md

@@ -37,7 +37,7 @@ The host supplies the executor and maps its configured engine to the argv; the l
 
     | Interrupted | Resume |
     |---|---|
-    | During allocation | A receipt without `allocation: owned` is never adopted: its task waits, naming the recovery (remove its worktree and branch if present, delete the receipt directory, drain again), while independent work continues. |
+    | During allocation | Replay `managed_pending` with `recover-storage --receipt`; `managed_owned` is owned. Managed removal uses `recover-storage --receipt --for-removal` and preserves receipts. An interrupted standalone allocation is never adopted: its task waits, naming the recovery (remove its worktree and branch if present, delete the receipt directory, drain again), while independent work continues. |
     | Inputs commit | A branch head equal to the expected inputs tree is adopted; anything else leaves the task waiting for inspection, preserving the unexpected commits. |
     | During execution | Each attempt's start is recorded before its spawn and its exit after it. A start without an exit gets one writer observation per drain. A live writer leaves the task waiting while independent work continues; a later drain adopts the submission or runs the executor again only after cessation is established; where writers cannot be observed (native Windows) the task becomes `[F] interrupted-unobservable` with its workspace retained, its dependents become prerequisite-blocked and independent work continues. Exactly-once execution is not promised. |
     | During checks | Acceptance reruns; incomplete evidence stays unreferenced. |
@@ -49,7 +49,7 @@ The host supplies the executor and maps its configured engine to the argv; the l
 
 Expected task-local operational failures leave the selected task waiting with `<phase> blocked: <detail>` and recovery guidance. It is attempted at most once per drain; dependents, local siblings behind an active task, and siblings behind an undelivered package carrier wait too. Independent work continues and the drain ends `WAITING`. Inputs, acceptance, custody and terminal-attachment failures resume only their missing effects; bound results and accepted work never replay. The controller boundary contains `LoopError` and `OSError`; other programming errors propagate there. The inherited task-complete wrapper and delivery-repository lookup also contain helper `TypeError`, `KeyError` and `ValueError`, converting them to task waits.
 
-11. **Report** to `<common Gitdir>/devlyn-loops/<loop-id>/drain-report.md` after every drain: per task the product result and reason, receipt, evidence custody and recovery ref, allocation base, accepted (or unaccepted) source, terminal commit, delivery status, PR URL and resume command, assumptions and unresolved questions, the retained worktree and branch, and workspace and scratch cleanup. Include the package's decisions and assumptions once, excluding the manifest and separately from executor assumptions; read the captured package when an add record exists, otherwise use the checkout, and report an unreadable package explicitly. Whole-loop acceptance is reported separately over the manifest's complete task set: every task needs receipt-backed acceptance, including the integration task's assembled-product check on the final frontier; a manifest task missing from the queue is reported as not yet run. `Bring into` names the command that brings the accepted frontier into the branch the loop was added on. For a local loop it is `git merge --ff <final frontier branch>` on that branch, which fast-forwards when it can and merges otherwise, so the commands of several local loops apply in either order. For `auto`/`pr`, once the frontier is delivered, it is `git merge --ff origin/<base>` on `<base>`: the anchor holds no loop commit or copy, so it fast-forwards after merge, squash and rebase delivery alike unless that branch has commits of its own, and merges then.
+11. **Report** to `<common Gitdir>/devlyn-loops/<loop-id>/drain-report.md` after every drain: per task the product result and reason, receipt, evidence custody and recovery ref, allocation base, accepted (or unaccepted) source, terminal commit, delivery status, PR URL and resume command, assumptions and unresolved questions, the retained worktree and branch, and workspace and scratch cleanup. Include the package's decisions and assumptions once, excluding the manifest and separately from executor assumptions; read the captured package when an add record exists, otherwise use the checkout, and report an unreadable package explicitly. Whole-loop acceptance is reported separately over the manifest's complete task set: every task needs receipt-backed acceptance, including the integration task's assembled-product check on the final frontier; a manifest task missing from the queue is reported as not yet run. `Bring into` names the shared `bring-in.py` helper, targeting the local frontier branch or the delivered `<remote>/<base>`. It fast-forwards when it can; otherwise it prepares the merge without touching the checkout and lands it by a protected fast-forward, so several local loops still apply in either order. A file collision, conflict, or unsupported merge setting stops before the branch moves and names the next step.
 
 Package cleanup, parent pruning and report failures appear as diagnostics under `cleanup`, with retained paths and repair guidance; they do not change product acceptance or completed delivery. The next drain retries them.
 

package/config/skills/devlyn-ideate/scripts/queue.py

@@ -47,7 +47,7 @@ FRONTMATTER_KEYS = {"id", "loop_id", "title", "kind", "review_requirements", "co
 KINDS = {"feature", "spike", "prototype"}
 UNSUPPORTED = {"process_evidence": "phase process obligations", "required_risk_probe_requirements": "risk-probe obligations",
                "tier_a_waivers": "benchmark scope waivers", "spec_output_files": "benchmark scope surfaces"}
-SETTLED = {"LOCAL_ONLY", "COMPLETE", "FAILED"}
+SETTLED = {"LOCAL_ONLY", "COMPLETE", "FAILED", "CLOSED"}
 OBLIGATIONS = [
     "Work only in this worktree on its owned branch under the installed methodology; never edit the loop package or docs/specs/queue.md.",
     "Commit any source changes on the owned branch; when none are needed, use inputs_sha without creating an empty commit. Leave no uncommitted or untracked source and remove residue the change created.",
@@ -170,10 +170,10 @@ def lock(common, name, *, blocking):
         yield
 
 
-def harness_call(name, *args):
+def harness_call(name, *args, **kwargs):
     helper = shared("harness-store")
     try:
-        return helper[name](*args)
+        return helper[name](*args, **kwargs)
     except helper["HarnessError"] as exc:
         raise LoopError(str(exc)) from exc
 
@@ -542,7 +542,23 @@ def branch_of(identity):
 
 
 def receipt_path(common, identity):
-    return common / "devlyn-completion" / hashlib.sha256(branch_of(identity).encode()).hexdigest()[:24] / "receipt.json"
+    key = hashlib.sha256(branch_of(identity).encode()).hexdigest()[:24]
+    root = common / 'devlyn-completion'
+    active = root / key / 'receipt.json'
+    if active.exists():
+        return active
+    retired = sorted((root / 'retired').glob(key + '.*/receipt.json'))
+    if len(retired) > 1:
+        delivered = []
+        for path in retired:
+            receipt = read_json(path)
+            require(isinstance(receipt, dict), f'{path}: malformed retired receipt')
+            if receipt.get('delivery') == 'COMPLETE':
+                delivered.append(path)
+        require(len(delivered) <= 1, f'conflicting delivered receipts for {identity}: {delivered}')
+        if delivered:
+            return delivered[0]
+    return retired[-1] if retired else active
 
 
 def added_path(common, loop):
@@ -671,7 +687,9 @@ def task_complete(action, *, exclude_receipts=(), warnings=None, **values):
         return helper[action](argparse.Namespace(**values), **options)
     except (helper["CompletionError"], OSError, KeyError, TypeError, ValueError) as exc:
         # Inherited helper containment includes these three programming-error types; the controller boundary is narrower.
-        raise LoopError(f"task-complete {action}: {exc}") from exc
+        details = getattr(exc, "storage_error", {})
+        context = f"; receipt={details.get('receipt')}; resume={details.get('resume')}" if details else ""
+        raise LoopError(f"task-complete {action}: {exc}{context}") from exc
 
 
 def derive_state(anchor, common, row, claims, rev):
@@ -690,7 +708,7 @@ def derive_state(anchor, common, row, claims, rev):
     require(receipt.get("task") == identity and receipt.get("branch") == branch_of(identity) and path == receipt_path(common, identity)
             and path == path.resolve(),
             f"receipt {path} claims {identity} from branch {receipt.get('branch')!r}; conflicting ownership, inspect it")
-    require(receipt.get("allocation") in ("owned", "allocating"),
+    require(receipt.get("allocation") in ("owned", "allocating", "managed_pending", "managed_owned"),
             f"receipt {path}: missing or malformed allocation checkpoint")
     if receipt["allocation"] == "allocating":
         # Never adopted, and no executor ran: the task waits until the user removes what the allocation left.
@@ -700,9 +718,18 @@ def derive_state(anchor, common, row, claims, rev):
         return state
     require(all(isinstance(receipt.get(key), str) and receipt[key] and "\0" not in receipt[key] for key in
                 ("id", "baseline", "worktree", "common_gitdir", "recovery_ref")), f"receipt {path}: malformed allocation fields")
-    require(receipt["common_gitdir"] == str(common) and receipt["id"] == path.parent.name,
+    archived = path.parent.parent == common / 'devlyn-completion/retired'
+    directory_id = receipt['id'] + '.' + receipt.get('storage', {}).get('request', {}).get('operation_id', '') if archived else receipt['id']
+    require(not archived or receipt.get('storage', {}).get('removal_finished') and (
+        receipt.get('status') == 'ABANDONED' or receipt.get('delivery') in {'COMPLETE', 'LOCAL_ONLY', 'FAILED', 'CLOSED'}),
+        f'{path}: nonterminal retired receipt')
+    require(receipt["common_gitdir"] == str(common) and directory_id == path.parent.name,
             f"receipt {path}: conflicting common Gitdir/id binding")
-    require(receipt["recovery_ref"] == "refs/devlyn/completed/" + receipt["id"], f"receipt {path}: conflicting recovery ref ownership")
+    recovery = "refs/devlyn/completed/" + receipt["id"]
+    allowed = {recovery}
+    if receipt['allocation'] in ('managed_pending', 'managed_owned'):
+        allowed.add(recovery + '.' + receipt.get('storage', {}).get('request', {}).get('operation_id', ''))
+    require(receipt["recovery_ref"] in allowed, f"receipt {path}: conflicting recovery ref ownership")
     for key in ("delivery", "product", "pr_url", "base", "remote"):
         require(key not in receipt or receipt[key] is None or isinstance(receipt[key], str), f"receipt {path}: malformed {key}")
     for key in ("acceptance", "queue", "merge", "workspace_cleanup", "scratch_cleanup"):
@@ -753,7 +780,8 @@ def derive_state(anchor, common, row, claims, rev):
         require(bound["worktree"] == receipt["worktree"] and bound["task"] == identity and bound["branch"] == receipt["branch"]
                 and bound["allocation_base"] == receipt["baseline"],
                 f"{packet}: conflicting packet ownership")
-        for key, expected in (("receipt", path), ("scratch", path.parent / "scratch"), ("submission", path.parent / "submission.json"),
+        original = common / 'devlyn-completion' / receipt['id'] / 'receipt.json' if archived else path
+        for key, expected in (("receipt", original), ("scratch", original.parent / "scratch"), ("submission", original.parent / "submission.json"),
                               ("evidence_dir", Path(receipt["worktree"]) / ".devlyn/loop")):
             require(bound.get(key) == str(expected), f"{packet}: malformed or conflicting {key} path")
         require(isinstance(bound["inputs_sha"], str) and SHA_RE.fullmatch(bound["inputs_sha"]), f"{packet}: malformed inputs commit")
@@ -788,7 +816,8 @@ def view(anchor, common, local_only=False, *, pure=False):
     claims, unreadable, damaged = {}, [], {}
     canonical = {receipt_path(common, row["identity"]): row["identity"] for row in rows if row["identity"]}
     branches = {branch_of(identity): identity for identity in canonical.values()}
-    for path in sorted((common / "devlyn-completion").glob("*/receipt.json")):
+    for path in sorted([*(common / "devlyn-completion").glob("*/receipt.json"),
+                        *(path for path in canonical if path.parent.parent.name == "retired")]):
         try:
             receipt = read_json(path)
             require(isinstance(receipt, dict), f"{path}: malformed receipt identity")
@@ -1322,8 +1351,22 @@ def advance(v, row, opts):
     if not path.exists() and (refused := allocate(v, row, opts)):
         return refused
     receipt = read_json(path)
+    if receipt.get('status') == 'ABANDONED':
+        if refused := allocate(v, row, opts):
+            return refused
+        path = receipt_path(v['common'], identity)
+        receipt = read_json(path)
+    accepted = receipt.get('acceptance') or receipt.get('pushed') or receipt.get('pr_number')
+    if receipt.get('allocation') in ('managed_pending', 'managed_owned') and not accepted:
+        require('removal_request' not in receipt.get('storage', {}),
+                'allocation fenced; run ' + shared('task-complete')['receipt_resume'](
+                    'recover-storage', path, receipt, flags=['--for-removal']))
+    if receipt.get('allocation') == 'managed_pending' and not accepted:
+        task_complete('recover_storage', receipt=str(path), for_removal=False,
+                      operation_id=receipt.get('storage', {}).get('request', {}).get('operation_id'))
+        receipt = read_json(path)
     if receipt.get("acceptance") and (path.parent / "packet.json").exists():
-        harness_call("verify_packet", read_json(path.parent / "packet.json"), path.parent / "packet.json", SKILLS)
+        harness_call("verify_packet", read_json(path.parent / "packet.json"), path.parent / "packet.json", SKILLS, accepted_receipt=receipt)
     if not receipt.get("acceptance"):
         state["phase"] = "inputs"
         failure = v["states"][identity].get("inputs_changed")
@@ -1350,6 +1393,7 @@ def advance(v, row, opts):
         packet = read_json(path.parent / "packet.json")
         # The plan's mode seeds the first delivery call; a later per-task --mode persists in the receipt.
         result = task_complete("complete", warnings=opts.warnings, receipt=str(path), acceptance=None,
+                               operation_id=receipt.get("storage", {}).get("request", {}).get("operation_id"),
                                mode=None if local or receipt.get("mode_override") else packet["delivery"], local_only=local, writers_stopped=True)
         progress(identity, f"delivery {result['status']}")
         if result.get("merge_refused"):
@@ -1379,6 +1423,8 @@ def summary(v, row):
                     binding = harness_call("read_binding", v["common"])
                     skills = Path(binding["release"]["root"]) / "config/skills" if binding else SKILLS
                     argv = [sys.executable, str(skills / "_shared/task-complete.py"), "complete", "--receipt", str(state["path"])]
+                    if operation := receipt.get("storage", {}).get("request", {}).get("operation_id"):
+                        argv += ["--operation-id", operation]
                     if receipt.get("writers_released"):
                         argv.append("--writers-stopped")
                     if not receipt.get("local_only") and not receipt.get("mode_override"):
@@ -1438,13 +1484,18 @@ def bring_in(v, loop):
         return None
     receipt = tip["receipt"]
     if receipt.get("local_only"):
-        # It fast-forwards when it can and merges otherwise, so the commands of several local loops apply in any order.
-        return f"{v['records'][loop]['branch']}: git merge --ff {receipt['branch']}" if loop in v["records"] else None
-    if not delivered(receipt):
-        return None
-    # The anchor holds no loop commit, so after merge, squash or rebase delivery this fast-forwards unless the branch has commits
-    # of its own, and merges then; like the local form, the commands of several loops apply in any order.
-    return f"{receipt['base']}: git merge --ff {receipt['remote']}/{receipt['base']}"
+        if loop not in v["records"]:
+            return None
+        branch, target = v["records"][loop]["branch"], receipt["branch"]
+    else:
+        if not delivered(receipt):
+            return None
+        branch, target = receipt["base"], f"{receipt['remote']}/{receipt['base']}"
+    # Prepare any merge without touching the anchor, then land by protected fast-forward.
+    # Several loops still apply in either order, including after merge, squash or rebase delivery.
+    command = shlex.join(["python3", str(SKILLS / "_shared" / "bring-in.py"), "--repo", str(v["anchor"]),
+                          "--branch", branch, "--target", target])
+    return f"{branch}: {command}"
 
 
 def write_reports(v, status, reason, warnings):

package/config/storage-client-contract.json

@@ -0,0 +1,7 @@
+{
+  "schema": 1,
+  "storage_protocol": 1,
+  "checkout_adapter": 1,
+  "managed_receipt_states": ["managed_pending", "managed_owned"],
+  "recovery_removal": 1
+}

package/harness/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- devlyn:instructions:begin sha256=019ab670237e90f2e40ea0dbff216bbf2b523a04419ca9c5f5f403482cf55874 -->
+<!-- devlyn:instructions:begin sha256=25ed8e19648642bab459f945a6608ea1d7fe217497c29840d49d3d65a6de1092 -->
 Project-specific instructions outside this managed block take precedence over these defaults.
 
 # Project Instructions
@@ -14,9 +14,9 @@ This contract serves one goal: any capable engine — Claude, GPT/Codex, or a fu
 Seven rules govern every change. Cite them by name when a decision touches one.
 
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
-2. **No overengineering** — smallest change that closes the goal. New abstractions require an observed failure mode they prevent. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
+2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
-4. **Worldclass** — code that survives review at a non-trivial codebase. Zero CRITICAL, zero HIGH security/design findings on the shippable path.
+4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
 6. **Optimized** — use efficient code and avoid unnecessary work without sacrificing correctness or the user's requirements.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.

package/harness/CLAUDE.md

@@ -1,4 +1,4 @@
-<!-- devlyn:instructions:begin sha256=019ab670237e90f2e40ea0dbff216bbf2b523a04419ca9c5f5f403482cf55874 -->
+<!-- devlyn:instructions:begin sha256=25ed8e19648642bab459f945a6608ea1d7fe217497c29840d49d3d65a6de1092 -->
 Project-specific instructions outside this managed block take precedence over these defaults.
 
 # Project Instructions
@@ -14,9 +14,9 @@ This contract serves one goal: any capable engine — Claude, GPT/Codex, or a fu
 Seven rules govern every change. Cite them by name when a decision touches one.
 
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
-2. **No overengineering** — smallest change that closes the goal. New abstractions require an observed failure mode they prevent. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
+2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
-4. **Worldclass** — code that survives review at a non-trivial codebase. Zero CRITICAL, zero HIGH security/design findings on the shippable path.
+4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
 6. **Optimized** — use efficient code and avoid unnecessary work without sacrificing correctness or the user's requirements.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.

package/native/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn",
-  "version": "4.3.20",
+  "version": "4.3.23",
   "description": "Devlyn harness skills",
   "skills": "./skills/"
 }