devlyn-cli 4.3.21 → 4.3.24

package/native/claude/skills/_shared/task-completion.md

@@ -80,22 +80,88 @@ After remote delivery, fetch first. If the branch can fast-forward to the
 delivered result, recheck the copied edits' current ownership and contents,
 then remove them: `git restore --source=HEAD --staged --worktree -- <paths>`
 for tracked paths holding only your edits, and delete copied untracked files.
-Then use `git merge --ff-only <task branch>` for local delivery, or
-`git merge --ff-only <remote>/<base>` on the base branch after remote delivery;
+Then run `python3 "$DEVLYN_SHARED_DIR/bring-in.py" --repo . --branch <checked-out branch> --target <task branch> --ff-only`
+for local delivery, or the same command with `--target <remote>/<base>` on the base branch after remote delivery;
 a drain's `Bring into` command is its own. Once a local delivery is reconciled,
 remove its worktree and task branch (`git worktree remove <worktree>`,
 `git branch -d <task branch>`). Do not switch branches, create a reconciliation
-merge commit or discard WIP to force this step. If reconciliation is unsafe,
+merge commit, or discard WIP or ignored files to force this step. If reconciliation is unsafe,
 retain and report the edits, delivered result and remaining bring-in action.
 
 Save the returned receipt path under the common Gitdir. `reconciled` reports earlier accepted,
 PR-delivered tasks whose merged resources were cleaned or retained; it is
 informational, so never resume or release a receipt you do not own. Existing
 branches/trees cannot be adopted, even when their names look generated. Nor
-can a receipt that never reached `allocation: owned`: remove its worktree and
-branch if present, delete its receipt directory, then allocate again.
+can an interrupted standalone receipt that never reached `allocation: owned`:
+remove its worktree and branch if present, delete its receipt directory, then allocate again.
 Unreceipted tasks remain owner-managed.
 
+New allocation and warming modes come from enrollment state alone:
+
+| `~/.devlyn/storage-client.json` | recovery marker | unenroll journal | Mode |
+|---|---|---|---|
+| absent | absent | not read | standalone (never enrolled) |
+| valid | any | not read | managed; a fenced authority refuses |
+| invalid or unreadable | any | not read | refuse; repair registration |
+| absent | present | verified `retired: true` | standalone (unenrollment complete) |
+| absent | present | absent, unreadable or incomplete | refuse; Open Devlyn to repair its storage registration |
+
+The journal `storage-client-unenroll.json` is read no-follow only on the last two
+rows. Schema 1, canonical UUIDv7 operation, permanent `storage-client-fence.json`,
+matching operation/root/lock identities and Rust's archive ordering/path
+validation are required. If native root/lock identities or the home path changed,
+completed retirement permits standalone only when `storage`, `control`,
+`harness/state.json` and `storage-client.json` are all absent under the current
+lifecycle root (checked without following links). Live inventory requires repair.
+No repository-wide receipt scan selects mode. Other keys can allocate after
+completed unenrollment; a leftover managed key retains its own recovery command.
+
+Existing operations keep their managed identity. Receipts pin the control
+identity; current enrollment verifies the helper before allocation. Recovery uses
+the current verified `storage-client-recovery/pins.json`, including after uninstall
+or unenrollment, and requires its authority binding to match the receipt. Missing
+or invalid pins retain resources and require repair; saved artifacts are never a
+fallback. Enrolled checkout preserves
+`managed_pending`/`managed_owned` and Rust's `storage-allocation.json` subreceipt.
+After an interrupted reply, use the returned `recover-storage` resume. Never
+delete managed receipts or replace an unfinished operation ID.
+
+Owner `recover-storage --receipt <receipt.json> --operation-id <saved ID>
+--for-removal` fences allocation and reconciles closure and the exact cache set.
+Never-published allocations are abandoned. Accepted LOCAL_ONLY, FAILED, and PRs
+observed CLOSED without merge share custody/recovery-ref verification and fenced
+removal, retaining task branches and a durable terminal delivery. Release writers
+with `complete --writers-stopped` first. A queue-produced FAILED checkout is
+advanced by `read-tree -m -u <source_sha> <publish_sha>` only when HEAD is at the
+attached publish commit and the index and worktree are exactly at source; other
+differences refuse as dirty.
+
+Removal-finished receipts with final COMPLETE, LOCAL_ONLY, FAILED or CLOSED
+delivery move under `devlyn-completion/retired/`, regardless of scratch status.
+Retirement moves scratch and its saved cleanup record with the audit and deletes
+nothing. `complete --writers-stopped` saves the writer release there and retries
+pending scratch, including an interrupted cleanup with no saved result; the next
+allocation retries completed deliveries with released writers. `clean-scratch`
+remains available there and never downgrades CLEAN.
+Saved managed `complete`, `recover-storage` and `clean-scratch` resumes carry an
+operation ID validated under the receipt lock. Without an ID, a locator selects
+its active receipt. An ID selects only that operation, including its verified
+retired receipt; a mismatched ID refuses. Retired paths also remain usable.
+A new allocation may reuse a retired key without disturbing its audit.
+
+Retained submodule repositories in the admin directory block removal even when
+the checkout is absent; preserve/publish their source and explicitly resolve
+them. Manual checkout removal is advised only after portable source checks and
+record preservation succeed; changed or new source requires retention. If native
+Windows or unobservable writers then require retention, stop all
+writers, remove the task checkout by hand, keep its branch and receipt, then run
+the returned owner-removal resume. The absent-tree path completes the fenced
+registration removal. Scratch cleanup requires positive allocation closure,
+without a cache-removal fence; actual checkout removal owns that fence, including
+empty cache sets. Missing helpers or uncertain closure retain resources with a
+repair/resume action. Compatible recovery artifacts and Rust's LaunchGate remain
+required while managed obligations exist.
+
 Copy attributable task edits into the allocated worktree as a patch, never a
 stash. Establish attribution from the pre-edit contents and starting Git state,
 including staged, unstaged and untracked work. A path-scoped
@@ -113,6 +179,10 @@ require the affected checks again.
 Keep the original edits through pending or failed delivery; only reconciliation
 removes them. Preserve all other work and report anything left behind.
 
+Managed allocations currently start cold; `build_dirs` retains each returned cache
+and publication lease ID. Managed warming is deferred. Standalone allocations keep
+the warming behavior below.
+
 Build in the task worktree's own default build directory, never in one
 another checkout builds in, even one build at a time: tools such as Cargo take
 one checkout's outputs as fresh for the other. When the shared repository-local
@@ -142,6 +212,7 @@ release build caches when parking or after a failed run, use:
 ```sh
 python3 "$DEVLYN_SHARED_DIR/task-complete.py" clean-scratch \
   --receipt '<returned receipt.json>' --writers-stopped
+# For managed receipts, use the saved resume with --operation-id <saved ID>.
 ```
 
 This empties only the prospectively owned scratch, preserves its directory
@@ -246,7 +317,8 @@ the next allocation or resume after the restart.
 On native Windows, locking and file durability are supported, but the helper cannot prove writer cessation and reports `writer observation unsupported on this platform; retain workspace`. Even `--writers-stopped` cannot authorize deletion without that observation: retain the workspace, its task refs and external receipt/custody, report delivery separately, and preserve the receipt-based resume command. A merged or on-base delivery therefore reports `CLEANUP_PENDING` (delivery `COMPLETE`) with `workspace_cleanup` naming the reason and resume. Do not kill unknown processes or force worktree removal to make completion pass.
 
 The receipt directory holds byte-verified `custody/`, `manifest.json` and a guarded
-`refs/devlyn/completed/<id>` recovery ref. Check evidence is copied there
+`refs/devlyn/completed/<id>` recovery ref (new managed allocations use
+`<id>.<operation>` so branch reuse preserves earlier recovery refs). Check evidence is copied there
 before publication; removal rechecks it, the recovery ref and the merge or accepted commit on base.
 Ignored build output and other ignored files are disposable under native
 non-force worktree removal. The tree's `.devlyn/` files are byte/mode-verified

package/native/claude/skills/_shared/warm-build-dirs.py

@@ -526,8 +526,15 @@ def warm_cargo(work, anchor, staging_root, deadline):
     with contextlib.ExitStack() as stack:
         staging = None
         try:
-            if shutil.which("cargo") is None:
-                raise Skip("cargo is not on PATH")
+            # Decide managed cold start before Cargo, destination setup, donors
+            # or any seeding work. Standalone keeps its original path.
+            import runpy
+            storage = runpy.run_path(str(Path(__file__).with_name('storage-client.py')))
+            decision = storage['operation_enrollment']()
+            if decision['mode'] == 'managed':
+                return entry('cargo', 'cold', reason='managed warming deferred; cold start')
+            if shutil.which('cargo') is None:
+                raise Skip('cargo is not on PATH')
             target, relative, parent = destination(work, deadline, stack)
             candidates = donors(work, anchor, relative, deadline)
             if not candidates:
@@ -678,6 +685,11 @@ class WarmTests(unittest.TestCase):
         temporary = tempfile.TemporaryDirectory(prefix="warm-build-dirs-")
         self.addCleanup(temporary.cleanup)
         self.root = Path(temporary.name).resolve()
+        test_home = self.root / "home"
+        test_home.mkdir()
+        home_env = mock.patch.dict(os.environ, {"HOME": str(test_home), "USERPROFILE": str(test_home)})
+        home_env.start()
+        self.addCleanup(home_env.stop)
         (self.root / "sitecustomize.py").write_text(
             "import importlib.machinery, importlib.util, pathlib, sys\n"
             "spec = importlib.machinery.PathFinder.find_spec('sitecustomize', [p for p in sys.path if pathlib.Path(p or '.').resolve() != pathlib.Path(__file__).resolve().parent])\n"
@@ -730,7 +742,7 @@ class WarmTests(unittest.TestCase):
             def copy(source, target, deadline):
                 target.parent.mkdir(parents=True, exist_ok=True)
                 subprocess.run(["cp", "-a", "--", str(source), str(target)], check=True)
-            patch = mock.patch(f"{__name__}.clone", copy)
+            patch = mock.patch.dict(warm_cargo.__globals__, clone=copy)
             patch.start()
             self.addCleanup(patch.stop)
 
@@ -832,6 +844,44 @@ class WarmTests(unittest.TestCase):
         self.assertEqual([], list(self.staging.iterdir()))
         self.assertEqual("", self.git(self.work, "status", "--porcelain", "--untracked-files=all"))
 
+    @unittest.skipIf(os.name == 'nt', 'Windows keeps its existing skip')
+    def test_managed_skip_precedes_donor_traversal_and_reports_cold_start(self):
+        from unittest import mock
+        import runpy
+        real = runpy.run_path
+        def modules(path, *args, **kwargs):
+            if Path(path).name == 'storage-client.py':
+                return {'operation_enrollment': lambda: {'mode': 'managed'}}
+            return real(path, *args, **kwargs)
+        with mock.patch.object(runpy, 'run_path', modules), \
+             mock.patch.dict(warm_cargo.__globals__, donors=mock.Mock(side_effect=AssertionError('donor traversal')),
+                             destination=mock.Mock(side_effect=AssertionError('destination setup')),
+                             clone=mock.Mock(side_effect=AssertionError('seed')), publish=mock.Mock(side_effect=AssertionError('publish'))):
+            result = self.warm()[0]
+        self.assertEqual(result['status'], 'cold')
+        self.assertIn('cold start', result['reason'])
+        self.assertFalse((self.work / 'target').exists())
+        self.assert_nothing_left()
+
+    @unittest.skipIf(os.name == 'nt', 'warming is POSIX-only')
+    def test_standalone_warm_never_registers_destination(self):
+        from unittest import mock
+        import runpy
+        real = runpy.run_path
+        def modules(path, *args, **kwargs):
+            module = real(path, *args, **kwargs)
+            if Path(path).name == 'storage-client.py':
+                module['Client'] = mock.Mock(side_effect=AssertionError('standalone authority call'))
+                module['operation_id'] = mock.Mock(side_effect=AssertionError('standalone operation'))
+            return module
+        common = Path(self.git(self.work, 'rev-parse', '--path-format=absolute', '--git-common-dir').strip())
+        before = sorted(p.name for p in common.iterdir())
+        with mock.patch.object(runpy, 'run_path', modules):
+            result = self.warm()[0]
+        self.assertEqual(result['status'], 'seeded', result)
+        self.assertEqual(sorted(p.name for p in common.iterdir()), before)
+        self.assertFalse((Path(os.environ['HOME']) / '.devlyn').exists())
+
     @unittest.skipIf(os.name == "nt", "warming is POSIX-only")
     def test_local_git_true_seeds_without_cargo_opt_in(self):
         self.write_fixture(workspace_metadata=None)

package/native/claude/skills/devlyn-ideate/SKILL.md

@@ -116,14 +116,14 @@ Follow [loop.md](references/loop.md). The executor is the configured route, the
 Another engine needs an argv that starts one fresh non-interactive session able, without prompts, to edit, run commands and commit in its task worktree and to write the packet's submission file. `<prompt>` carries the absolute binding values, while `{packet}` stays literal for the drain to fill:
 
 ```text
-Execute the devlyn loop task packet {packet}: read its workerPrompt when present; read methodology.defaults.path when named and apply those verified defaults, with explicit user and native owner/project instructions taking precedence; work only in its owned worktree under the installed instructions; meet its obligations, then write its submission and any review records as "Executor exchange" and "Review records" in <DEVLYN_SKILL_DIR>/references/loop.md specify. Use the literal DEVLYN_SKILL_DIR and DEVLYN_SHARED_DIR bindings in workerPrompt when present; otherwise set DEVLYN_SKILL_DIR=<DEVLYN_SKILL_DIR> and DEVLYN_SHARED_DIR=<DEVLYN_SHARED_DIR> from these literal values. Never use inherited environment values. Never push, open a pull request or merge: the drain delivers.
+Execute the devlyn loop task packet {packet}: read its workerPrompt when present; read methodology.defaults.path when named and apply those verified defaults, with explicit user and native owner/project instructions taking precedence, except a Devlyn managed block (devlyn:instructions markers), which those defaults replace; work only in its owned worktree under the installed instructions; meet its obligations, then write its submission and any review records as "Executor exchange" and "Review records" in <DEVLYN_SKILL_DIR>/references/loop.md specify. Use the literal DEVLYN_SKILL_DIR and DEVLYN_SHARED_DIR bindings in workerPrompt when present; otherwise set DEVLYN_SKILL_DIR=<DEVLYN_SKILL_DIR> and DEVLYN_SHARED_DIR=<DEVLYN_SHARED_DIR> from these literal values. Never use inherited environment values. Never push, open a pull request or merge: the drain delivers.
 ```
 
 ```sh
 python3 "$DEVLYN_SKILL_DIR/scripts/queue.py" drain --repo . [--local-only] -- <executor argv>
 ```
 
-A drain can run for hours. Do not end the turn until it exits: run it in the foreground with the longest allowed timeout, or in the background and await its completion notice, because a headless host kills background tasks at its final response.
+A drain can run for hours. Do not end the turn until it exits: run it in the foreground with the longest allowed timeout, or in the background and await its completion notice, because reporting the drain's result requires observing its exit.
 
 - `WAITING` on legacy rows: plan and materialize each under the autonomous policy, then drain again; a row whose planning stops on material ambiguity stays pending and its question is reported.
 - Other `WAITING`: report each task’s reason and recovery command. Task-local failures leave dependents and barrier-held siblings waiting while independent work continues; the next drain retries eligible work once. An interrupted executor is observed once per drain and cannot be adopted or respawned until it stops. `BLOCKED` means authoritative queue reconstruction or preflight failed, including a held drain lock. Never edit receipts, refs or queue rows to get past either result.

package/native/claude/skills/devlyn-ideate/references/loop.md

@@ -37,7 +37,7 @@ The host supplies the executor and maps its configured engine to the argv; the l
 
     | Interrupted | Resume |
     |---|---|
-    | During allocation | A receipt without `allocation: owned` is never adopted: its task waits, naming the recovery (remove its worktree and branch if present, delete the receipt directory, drain again), while independent work continues. |
+    | During allocation | Replay `managed_pending` with `recover-storage --receipt`; `managed_owned` is owned. Managed removal uses `recover-storage --receipt --for-removal` and preserves receipts. An interrupted standalone allocation is never adopted: its task waits, naming the recovery (remove its worktree and branch if present, delete the receipt directory, drain again), while independent work continues. |
     | Inputs commit | A branch head equal to the expected inputs tree is adopted; anything else leaves the task waiting for inspection, preserving the unexpected commits. |
     | During execution | Each attempt's start is recorded before its spawn and its exit after it. A start without an exit gets one writer observation per drain. A live writer leaves the task waiting while independent work continues; a later drain adopts the submission or runs the executor again only after cessation is established; where writers cannot be observed (native Windows) the task becomes `[F] interrupted-unobservable` with its workspace retained, its dependents become prerequisite-blocked and independent work continues. Exactly-once execution is not promised. |
     | During checks | Acceptance reruns; incomplete evidence stays unreferenced. |
@@ -49,7 +49,7 @@ The host supplies the executor and maps its configured engine to the argv; the l
 
 Expected task-local operational failures leave the selected task waiting with `<phase> blocked: <detail>` and recovery guidance. It is attempted at most once per drain; dependents, local siblings behind an active task, and siblings behind an undelivered package carrier wait too. Independent work continues and the drain ends `WAITING`. Inputs, acceptance, custody and terminal-attachment failures resume only their missing effects; bound results and accepted work never replay. The controller boundary contains `LoopError` and `OSError`; other programming errors propagate there. The inherited task-complete wrapper and delivery-repository lookup also contain helper `TypeError`, `KeyError` and `ValueError`, converting them to task waits.
 
-11. **Report** to `<common Gitdir>/devlyn-loops/<loop-id>/drain-report.md` after every drain: per task the product result and reason, receipt, evidence custody and recovery ref, allocation base, accepted (or unaccepted) source, terminal commit, delivery status, PR URL and resume command, assumptions and unresolved questions, the retained worktree and branch, and workspace and scratch cleanup. Include the package's decisions and assumptions once, excluding the manifest and separately from executor assumptions; read the captured package when an add record exists, otherwise use the checkout, and report an unreadable package explicitly. Whole-loop acceptance is reported separately over the manifest's complete task set: every task needs receipt-backed acceptance, including the integration task's assembled-product check on the final frontier; a manifest task missing from the queue is reported as not yet run. `Bring into` names the command that brings the accepted frontier into the branch the loop was added on. For a local loop it is `git merge --ff <final frontier branch>` on that branch, which fast-forwards when it can and merges otherwise, so the commands of several local loops apply in either order. For `auto`/`pr`, once the frontier is delivered, it is `git merge --ff origin/<base>` on `<base>`: the anchor holds no loop commit or copy, so it fast-forwards after merge, squash and rebase delivery alike unless that branch has commits of its own, and merges then.
+11. **Report** to `<common Gitdir>/devlyn-loops/<loop-id>/drain-report.md` after every drain: per task the product result and reason, receipt, evidence custody and recovery ref, allocation base, accepted (or unaccepted) source, terminal commit, delivery status, PR URL and resume command, assumptions and unresolved questions, the retained worktree and branch, and workspace and scratch cleanup. Include the package's decisions and assumptions once, excluding the manifest and separately from executor assumptions; read the captured package when an add record exists, otherwise use the checkout, and report an unreadable package explicitly. Whole-loop acceptance is reported separately over the manifest's complete task set: every task needs receipt-backed acceptance, including the integration task's assembled-product check on the final frontier; a manifest task missing from the queue is reported as not yet run. `Bring into` names the shared `bring-in.py` helper, targeting the local frontier branch or the delivered `<remote>/<base>`. It fast-forwards when it can; otherwise it prepares the merge without touching the checkout and lands it by a protected fast-forward, so several local loops still apply in either order. A file collision, conflict, or unsupported merge setting stops before the branch moves and names the next step.
 
 Package cleanup, parent pruning and report failures appear as diagnostics under `cleanup`, with retained paths and repair guidance; they do not change product acceptance or completed delivery. The next drain retries them.
 
@@ -59,7 +59,7 @@ Package cleanup, parent pruning and report failures appear as diagnostics under
 
 `queue.py inspect --repo <dir> --json` reads without cleanup, locks or writes. It returns the status summary plus `binding` (null for legacy) and `compatibility`: `compatible`, `legacy`, `reasons`, `recoveryArgv`, `taskPacket` ranges and `queueBinding` ranges. Incompatible or unreadable state is reported, never migrated. Apps should use this reader instead of `status`, which still reconciles cleanup. For a mismatch, `recoveryArgv` names the bound queue’s inspect invocation; use the same bound queue entry point for authorized add/drain operations.
 
-Codex projection writers place `.devlyn-harness-projection.json` at the copied plugin root, beside `skills` and `.codex-plugin`: `{schemaVersion: 1, release: <ReleaseRef>, source: "native/codex/plugins/devlyn"}`. The reader verifies the named release and every projected file’s bytes/mode against that subtree (excluding only the marker). Symlinked skill invocations resolve through their real path. Standalone installs and existing unfinished unbound queues retain legacy behavior; new legacy packets use v2 with a null release, and their `defaults` name the invoking installation's own `_shared/runtime-principles.md` (`source: "skill"`). No engine applicability is inferred from instruction filenames: bound queues use verified release defaults with native instructions taking precedence. Worker and runner paths point to the bound release, independent of a projection cache’s lifetime.
+Codex projection writers place `.devlyn-harness-projection.json` at the copied plugin root, beside `skills` and `.codex-plugin`: `{schemaVersion: 1, release: <ReleaseRef>, source: "native/codex/plugins/devlyn"}`. The reader verifies the named release and every projected file’s bytes/mode against that subtree (excluding only the marker). Symlinked skill invocations resolve through their real path. Standalone installs and existing unfinished unbound queues retain legacy behavior; new legacy packets use v2 with a null release, and their `defaults` name the invoking installation's own `_shared/runtime-principles.md` (`source: "skill"`). No engine applicability is inferred from instruction filenames: bound queues use verified release defaults with native instructions taking precedence, except a Devlyn managed block, which the defaults replace. Worker and runner paths point to the bound release, independent of a projection cache’s lifetime.
 
 ## Executor exchange
 
@@ -75,7 +75,7 @@ The packet (`<receipt dir>/packet.json`) carries everything a fresh executor nee
 | `shared_constraints` | The meta-prompt's `Constraints and exclusions`. |
 | `dependencies` | `{task, receipt, source_sha}` of each accepted prerequisite. |
 | `schema_version`, `harness` | New packets use version 2 and the bound release reference, or null for legacy unbound queues. Existing v1 packets execute unchanged. |
-| `methodology` | `projectInstructions`: `{path, sha256}` of instruction bytes at the inputs commit. `defaults`: `{source: "release", path, sha256}` from the verified binding; for an unbound queue `{source: "skill", path, sha256}` of the installation's own `_shared/runtime-principles.md`. A task whose executor would get no principles at all (no defaults and no committed CLAUDE.md/AGENTS.md) waits with that reason instead of running. Read the named defaults; explicit user and native owner/project instructions take precedence. No native engine applicability is inferred from filenames. |
+| `methodology` | `projectInstructions`: `{path, sha256}` of instruction bytes at the inputs commit. `defaults`: `{source: "release", path, sha256}` from the verified binding; for an unbound queue `{source: "skill", path, sha256}` of the installation's own `_shared/runtime-principles.md`. A task whose executor would get no principles at all (no defaults and no committed CLAUDE.md/AGENTS.md) waits with that reason instead of running. Read the named defaults; explicit user and native owner/project instructions take precedence, except a Devlyn managed block (devlyn:instructions markers), which the defaults replace. No native engine applicability is inferred from filenames. |
 | `workerPrompt` | `{path, sha256}` of the task’s worker instructions, or null for legacy unbound queues. Read it before working. |
 | `delivery` | `local-only`, `auto` or `pr`. |
 | `evidence_dir`, `runner` | Where loop evidence lives (`<worktree>/.devlyn/loop`, ignored by Git) and the runner argv. |

package/native/claude/skills/devlyn-ideate/scripts/queue.py

@@ -47,7 +47,7 @@ FRONTMATTER_KEYS = {"id", "loop_id", "title", "kind", "review_requirements", "co
 KINDS = {"feature", "spike", "prototype"}
 UNSUPPORTED = {"process_evidence": "phase process obligations", "required_risk_probe_requirements": "risk-probe obligations",
                "tier_a_waivers": "benchmark scope waivers", "spec_output_files": "benchmark scope surfaces"}
-SETTLED = {"LOCAL_ONLY", "COMPLETE", "FAILED"}
+SETTLED = {"LOCAL_ONLY", "COMPLETE", "FAILED", "CLOSED"}
 OBLIGATIONS = [
     "Work only in this worktree on its owned branch under the installed methodology; never edit the loop package or docs/specs/queue.md.",
     "Commit any source changes on the owned branch; when none are needed, use inputs_sha without creating an empty commit. Leave no uncommitted or untracked source and remove residue the change created.",
@@ -170,10 +170,10 @@ def lock(common, name, *, blocking):
         yield
 
 
-def harness_call(name, *args):
+def harness_call(name, *args, **kwargs):
     helper = shared("harness-store")
     try:
-        return helper[name](*args)
+        return helper[name](*args, **kwargs)
     except helper["HarnessError"] as exc:
         raise LoopError(str(exc)) from exc
 
@@ -542,7 +542,23 @@ def branch_of(identity):
 
 
 def receipt_path(common, identity):
-    return common / "devlyn-completion" / hashlib.sha256(branch_of(identity).encode()).hexdigest()[:24] / "receipt.json"
+    key = hashlib.sha256(branch_of(identity).encode()).hexdigest()[:24]
+    root = common / 'devlyn-completion'
+    active = root / key / 'receipt.json'
+    if active.exists():
+        return active
+    retired = sorted((root / 'retired').glob(key + '.*/receipt.json'))
+    if len(retired) > 1:
+        delivered = []
+        for path in retired:
+            receipt = read_json(path)
+            require(isinstance(receipt, dict), f'{path}: malformed retired receipt')
+            if receipt.get('delivery') == 'COMPLETE':
+                delivered.append(path)
+        require(len(delivered) <= 1, f'conflicting delivered receipts for {identity}: {delivered}')
+        if delivered:
+            return delivered[0]
+    return retired[-1] if retired else active
 
 
 def added_path(common, loop):
@@ -671,7 +687,9 @@ def task_complete(action, *, exclude_receipts=(), warnings=None, **values):
         return helper[action](argparse.Namespace(**values), **options)
     except (helper["CompletionError"], OSError, KeyError, TypeError, ValueError) as exc:
         # Inherited helper containment includes these three programming-error types; the controller boundary is narrower.
-        raise LoopError(f"task-complete {action}: {exc}") from exc
+        details = getattr(exc, "storage_error", {})
+        context = f"; receipt={details.get('receipt')}; resume={details.get('resume')}" if details else ""
+        raise LoopError(f"task-complete {action}: {exc}{context}") from exc
 
 
 def derive_state(anchor, common, row, claims, rev):
@@ -690,7 +708,7 @@ def derive_state(anchor, common, row, claims, rev):
     require(receipt.get("task") == identity and receipt.get("branch") == branch_of(identity) and path == receipt_path(common, identity)
             and path == path.resolve(),
             f"receipt {path} claims {identity} from branch {receipt.get('branch')!r}; conflicting ownership, inspect it")
-    require(receipt.get("allocation") in ("owned", "allocating"),
+    require(receipt.get("allocation") in ("owned", "allocating", "managed_pending", "managed_owned"),
             f"receipt {path}: missing or malformed allocation checkpoint")
     if receipt["allocation"] == "allocating":
         # Never adopted, and no executor ran: the task waits until the user removes what the allocation left.
@@ -700,9 +718,18 @@ def derive_state(anchor, common, row, claims, rev):
         return state
     require(all(isinstance(receipt.get(key), str) and receipt[key] and "\0" not in receipt[key] for key in
                 ("id", "baseline", "worktree", "common_gitdir", "recovery_ref")), f"receipt {path}: malformed allocation fields")
-    require(receipt["common_gitdir"] == str(common) and receipt["id"] == path.parent.name,
+    archived = path.parent.parent == common / 'devlyn-completion/retired'
+    directory_id = receipt['id'] + '.' + receipt.get('storage', {}).get('request', {}).get('operation_id', '') if archived else receipt['id']
+    require(not archived or receipt.get('storage', {}).get('removal_finished') and (
+        receipt.get('status') == 'ABANDONED' or receipt.get('delivery') in {'COMPLETE', 'LOCAL_ONLY', 'FAILED', 'CLOSED'}),
+        f'{path}: nonterminal retired receipt')
+    require(receipt["common_gitdir"] == str(common) and directory_id == path.parent.name,
             f"receipt {path}: conflicting common Gitdir/id binding")
-    require(receipt["recovery_ref"] == "refs/devlyn/completed/" + receipt["id"], f"receipt {path}: conflicting recovery ref ownership")
+    recovery = "refs/devlyn/completed/" + receipt["id"]
+    allowed = {recovery}
+    if receipt['allocation'] in ('managed_pending', 'managed_owned'):
+        allowed.add(recovery + '.' + receipt.get('storage', {}).get('request', {}).get('operation_id', ''))
+    require(receipt["recovery_ref"] in allowed, f"receipt {path}: conflicting recovery ref ownership")
     for key in ("delivery", "product", "pr_url", "base", "remote"):
         require(key not in receipt or receipt[key] is None or isinstance(receipt[key], str), f"receipt {path}: malformed {key}")
     for key in ("acceptance", "queue", "merge", "workspace_cleanup", "scratch_cleanup"):
@@ -753,7 +780,8 @@ def derive_state(anchor, common, row, claims, rev):
         require(bound["worktree"] == receipt["worktree"] and bound["task"] == identity and bound["branch"] == receipt["branch"]
                 and bound["allocation_base"] == receipt["baseline"],
                 f"{packet}: conflicting packet ownership")
-        for key, expected in (("receipt", path), ("scratch", path.parent / "scratch"), ("submission", path.parent / "submission.json"),
+        original = common / 'devlyn-completion' / receipt['id'] / 'receipt.json' if archived else path
+        for key, expected in (("receipt", original), ("scratch", original.parent / "scratch"), ("submission", original.parent / "submission.json"),
                               ("evidence_dir", Path(receipt["worktree"]) / ".devlyn/loop")):
             require(bound.get(key) == str(expected), f"{packet}: malformed or conflicting {key} path")
         require(isinstance(bound["inputs_sha"], str) and SHA_RE.fullmatch(bound["inputs_sha"]), f"{packet}: malformed inputs commit")
@@ -788,7 +816,8 @@ def view(anchor, common, local_only=False, *, pure=False):
     claims, unreadable, damaged = {}, [], {}
     canonical = {receipt_path(common, row["identity"]): row["identity"] for row in rows if row["identity"]}
     branches = {branch_of(identity): identity for identity in canonical.values()}
-    for path in sorted((common / "devlyn-completion").glob("*/receipt.json")):
+    for path in sorted([*(common / "devlyn-completion").glob("*/receipt.json"),
+                        *(path for path in canonical if path.parent.parent.name == "retired")]):
         try:
             receipt = read_json(path)
             require(isinstance(receipt, dict), f"{path}: malformed receipt identity")
@@ -1186,7 +1215,7 @@ def ensure_packet(v, row, path, receipt):
         packet["runner"][1] = str(bound_skills / "devlyn-ideate/scripts/acceptance.py")
         prompt = path.parent / "worker-prompt.md"
         body = (f"Execute task packet {packet_path}. Work only in {worktree} on its owned branch.\n"
-                f"Read {binding['defaults']['path']} and apply it as defaults; explicit user and native owner/project instructions win.\n"
+                f"Read {binding['defaults']['path']} and apply it as defaults; explicit user and native owner/project instructions win, except a Devlyn managed block (devlyn:instructions markers), which these defaults replace.\n"
                 f"Set DEVLYN_SKILL_DIR={bound_skills / 'devlyn-ideate'} and DEVLYN_SHARED_DIR={bound_skills / '_shared'}.\n"
                 f"Follow Executor exchange and Review records in {bound_skills / 'devlyn-ideate/references/loop.md'}.\n"
                 f"Meet the packet obligations, run its runner and write {packet['submission']}. Never push, open a pull request or merge.\n")
@@ -1322,8 +1351,22 @@ def advance(v, row, opts):
     if not path.exists() and (refused := allocate(v, row, opts)):
         return refused
     receipt = read_json(path)
+    if receipt.get('status') == 'ABANDONED':
+        if refused := allocate(v, row, opts):
+            return refused
+        path = receipt_path(v['common'], identity)
+        receipt = read_json(path)
+    accepted = receipt.get('acceptance') or receipt.get('pushed') or receipt.get('pr_number')
+    if receipt.get('allocation') in ('managed_pending', 'managed_owned') and not accepted:
+        require('removal_request' not in receipt.get('storage', {}),
+                'allocation fenced; run ' + shared('task-complete')['receipt_resume'](
+                    'recover-storage', path, receipt, flags=['--for-removal']))
+    if receipt.get('allocation') == 'managed_pending' and not accepted:
+        task_complete('recover_storage', receipt=str(path), for_removal=False,
+                      operation_id=receipt.get('storage', {}).get('request', {}).get('operation_id'))
+        receipt = read_json(path)
     if receipt.get("acceptance") and (path.parent / "packet.json").exists():
-        harness_call("verify_packet", read_json(path.parent / "packet.json"), path.parent / "packet.json", SKILLS)
+        harness_call("verify_packet", read_json(path.parent / "packet.json"), path.parent / "packet.json", SKILLS, accepted_receipt=receipt)
     if not receipt.get("acceptance"):
         state["phase"] = "inputs"
         failure = v["states"][identity].get("inputs_changed")
@@ -1350,6 +1393,7 @@ def advance(v, row, opts):
         packet = read_json(path.parent / "packet.json")
         # The plan's mode seeds the first delivery call; a later per-task --mode persists in the receipt.
         result = task_complete("complete", warnings=opts.warnings, receipt=str(path), acceptance=None,
+                               operation_id=receipt.get("storage", {}).get("request", {}).get("operation_id"),
                                mode=None if local or receipt.get("mode_override") else packet["delivery"], local_only=local, writers_stopped=True)
         progress(identity, f"delivery {result['status']}")
         if result.get("merge_refused"):
@@ -1379,6 +1423,8 @@ def summary(v, row):
                     binding = harness_call("read_binding", v["common"])
                     skills = Path(binding["release"]["root"]) / "config/skills" if binding else SKILLS
                     argv = [sys.executable, str(skills / "_shared/task-complete.py"), "complete", "--receipt", str(state["path"])]
+                    if operation := receipt.get("storage", {}).get("request", {}).get("operation_id"):
+                        argv += ["--operation-id", operation]
                     if receipt.get("writers_released"):
                         argv.append("--writers-stopped")
                     if not receipt.get("local_only") and not receipt.get("mode_override"):
@@ -1438,13 +1484,18 @@ def bring_in(v, loop):
         return None
     receipt = tip["receipt"]
     if receipt.get("local_only"):
-        # It fast-forwards when it can and merges otherwise, so the commands of several local loops apply in any order.
-        return f"{v['records'][loop]['branch']}: git merge --ff {receipt['branch']}" if loop in v["records"] else None
-    if not delivered(receipt):
-        return None
-    # The anchor holds no loop commit, so after merge, squash or rebase delivery this fast-forwards unless the branch has commits
-    # of its own, and merges then; like the local form, the commands of several loops apply in any order.
-    return f"{receipt['base']}: git merge --ff {receipt['remote']}/{receipt['base']}"
+        if loop not in v["records"]:
+            return None
+        branch, target = v["records"][loop]["branch"], receipt["branch"]
+    else:
+        if not delivered(receipt):
+            return None
+        branch, target = receipt["base"], f"{receipt['remote']}/{receipt['base']}"
+    # Prepare any merge without touching the anchor, then land by protected fast-forward.
+    # Several loops still apply in either order, including after merge, squash or rebase delivery.
+    command = shlex.join(["python3", str(SKILLS / "_shared" / "bring-in.py"), "--repo", str(v["anchor"]),
+                          "--branch", branch, "--target", target])
+    return f"{branch}: {command}"
 
 
 def write_reports(v, status, reason, warnings):

package/native/codex/.agents/plugins/marketplace.json

@@ -1,5 +1,5 @@
 {
-  "name": "devlyn-harness-v4-3-21",
+  "name": "devlyn-harness-v4-3-24",
   "plugins": [
     {
       "name": "devlyn",

package/native/codex/plugins/devlyn/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn",
-  "version": "4.3.21",
+  "version": "4.3.24",
   "description": "Devlyn harness skills",
   "skills": "./skills/"
 }