merge: orchestration

.yoi/tickets/00001KX6BPY7M/item.md

@@ -1,8 +1,8 @@
 ---
 title: 'Add Backend Worker/Workdir registry and link model'
-state: 'inprogress'
+state: 'closed'
 created_at: '2026-07-10T15:53:02Z'
-updated_at: '2026-07-10T16:40:17Z'
+updated_at: '2026-07-10T17:38:20Z'
 assignee: null
 queued_by: 'workspace-panel'
 queued_at: '2026-07-10T16:10:57Z'

.yoi/tickets/00001KX6BPY7M/resolution.md

@@ -0,0 +1,35 @@
+Backend Worker/Workdir registry and link model を実装・レビュー・merge・検証した。
+
+実装内容:
+- Backend SQLite schema に `worker_registry`, `workdir_registry`, `worker_workdir_links` を追加。
+- Worker registry / Workdir registry / Worker-Workdir link の typed store API と projection を追加。
+- Backend 経由の Workdir 作成で Runtime materialization 前に Backend-managed pending row を作成。
+- Backend / Runtime scoped Worker creation で Worker registry row、Workdir registry row、Worker-Workdir link を同期。
+- Worker list は Runtime observation を同期したうえで Backend `worker_registry` / link authority から projection。
+- Worker stop は canonical registry row を削除せず、Worker lifecycle と linked Workdir status を同期。
+- Workdir list / launch options は Backend-managed rows を基準にし、`runtime_unmanaged` Workdirs は managed Browser list/options に混ぜず runtime/diagnostic projection で区別可能にした。
+- `pinned` retention が通常 Runtime sync で `normal` に clobber されないよう保護。
+- Browser-facing summaries に safe `management_kind` を追加し、raw Runtime materialized path を Backend registry / Browser response に保存・表示しない方針を維持。
+
+Review:
+- 初回 review は 5 blocker で `request_changes`。
+- `8695089f fix: sync backend worker registry projections` で主要 blocker を修正。
+- 2回目 review は unmanaged Workdir が managed list/options に混ざる blocker で `request_changes`。
+- `239f93b0 fix: keep unmanaged workdirs out of managed lists` で残 blocker を修正。
+- 最終 focused re-review は `approve`。
+
+Merge / validation:
+- Merge commit: `03652f82 merge: worker workdir registry`。
+- Final validation passed:
+  - `git diff --check`
+  - `cargo test -p yoi-workspace-server --lib`
+  - `cargo test -p worker-runtime --features ws-server,fs-store`
+  - `cargo check -p yoi`
+  - `cd web/workspace && deno task check`
+  - `cd web/workspace && deno task test`
+  - `yoi ticket doctor`
+  - `nix build .#yoi --no-link`
+- Validation log: `/run/user/1000/yoi/yoi-orchestrator/bash-output/worker-workdir-final-validation-1783704956.txt`
+
+Non-blocking follow-up noted by reviewer:
+- Some runtime detail/create response paths still return direct Runtime summaries with `management_kind: None`; list/options surfaces required by this Ticket are safe, but a future cleanup can project detail responses through Backend records for more uniform diagnostics。

.yoi/tickets/00001KX6BPY7M/thread.md

@@ -197,3 +197,264 @@ Implementation progress report:
 - External review will be requested via a read-only sibling Reviewer Pod. `StopPod` は使わない。
 
 ---
+
+<!-- event: review author: reviewer at: 2026-07-10T16:52:25Z status: request_changes -->
+
+## Review: request changes
+
+External review result: request_changes
+
+Blockers:
+
+1. Browser Worker list が Backend registry based になっていない。
+   - Ticket は Worker/Workdir lists を Backend-managed registry + Runtime observation merge に基づかせることを要求している。
+   - `workers_response` はまだ `api.runtime.list_workers(limit)` を呼び、live Runtime items を opportunistic に記録したうえで `items: runtime_workers.items` を返している（`crates/workspace-server/src/server.rs:2529-2546`）。
+   - `worker_registry` / `worker_workdir_links` を read していないため、Backend-only / stopped / archive rows を list できず、relation authority が Browser Worker list に使われていない。
+
+2. Runtime Worker creation path が Worker registry / Workdir registry / links を書いていない。
+   - `create_runtime_worker` は `working_directory_request` を解決して `api.runtime.spawn_worker` に forward し、Runtime result を返すだけ（`server.rs:2269-2285`）。
+   - Runtime materialization 前の pending Backend Workdir row、`record_worker_summary`、Worker-Workdir link がない。
+   - Browser `/api/workers` path のみ existing Workdir を record/link-select している（`server.rs:2141-2170`）。
+   - Backend-created/internal Runtime Workers with materialized workdirs が untracked になり、「Backend worker creation writes/updates Worker registry and Worker-Workdir link」 acceptance に違反する。
+
+3. Stopped Worker -> removed/missing Workdir relationship が Backend registry から安定して答えられない。
+   - `stop_runtime_worker` は Runtime stop を forward して返すだけ（`server.rs:2330-2339`）。
+   - Runtime cleanup 後に Worker lifecycle、Workdir materialization status、link state を Backend SQLite に更新しない。
+   - `working_directory_summaries` は `list_managed_workdir_registry` だけを読む（`server.rs:3242-3249`）ため、Runtime stop が bound workdir を remove しても Backend record は stale `present` のままになり得る。
+
+4. Runtime Workdir observation / unmanaged distinction が partial。
+   - runtime-scoped workdir list は raw Runtime summaries を直接返す（`server.rs:1184-1200`）。
+   - workspace-scoped list は Backend-managed rows のみ返す。
+   - `runtime_unmanaged` rows は detail / worker-create paths で opportunistic に作られるだけで、list 時に sync/typed されない。
+   - Browser summaries も management kind を露出していないため、unmanaged/external Runtime Workdirs を Backend-managed Workdirs と区別して visible/diagnosable にする requirement を満たしていない。
+
+5. pinned retention が sync で clobber され得る。
+   - schema は `pinned` を保存できるが、`record_worker_summary` は常に `retention_state: "normal"` を書く（`server.rs:3290-3318`）。
+   - `upsert_worker_registry` は conflict 時に `retention_state = excluded.retention_state` で上書きする（`store.rs:223-242`）。
+   - pinned Worker への後続 Runtime observation / list sync が pinned を normal に downgrade できるため、`pinned` が durable retention metadata として保護されていない。
+
+Non-blocking follow-ups:
+- schema 方向性自体は妥当。`worker_registry`, `workdir_registry`, `worker_workdir_links` は typed checks / FK relations 付きで存在する（`store.rs:488-545`）。
+- Backend workdir creation が Runtime materialization 前に pending Backend row を作る点は良い（`server.rs:1276-1327`）。
+- inspected paths では raw materialized Runtime paths が新 Backend registry records に保存されている箇所は見当たらなかった。
+- tests は schema roundtrip / pinned storage / removed Workdir / link basics を cover しているが、上記 blocker paths（runtime worker spawn with workdir, stop cleanup syncing, Backend-registry Worker list projection, unmanaged list diagnostics, pinned preservation under sync）は不足。
+
+Validation performed:
+- Ticket item/thread including routing decision, IntentPacket, implementation report を確認。
+- implementation commit `3e5546ea` の `git show --name-only` / `git show --check` を確認。
+- implementation worktree 内だけで branch/status を確認。
+- `store.rs`, `server.rs`, `catalog.rs`, `worker_backend.rs`, `working_directory.rs` を review。
+- acceptance blockers が inspection で明確だったため、full test/build matrix は再実行していない。
+
+---
+
+<!-- event: implementation_report author: orchestrator at: 2026-07-10T17:14:02Z -->
+
+## Implementation report
+
+Follow-up implementation progress report after request_changes:
+
+- Coder Pod `yoi-coder-00001KX6BPY7M-worker-workdir` completed the focused fix pass and committed follow-up commit `8695089fba346b8f10d55016b8328337e1c37445 fix: sync backend worker registry projections` on branch `work/00001KX6BPY7M-worker-workdir-registry`。
+- Implementation worktree status was clean at Orchestrator inspection。
+- Orchestrator inspected branch log / commit stats / `git diff --check 86f652a7..HEAD` in the implementation worktree。
+
+Coder-reported fix summary:
+- Browser Worker list now projects from Backend `worker_registry` rows after Runtime observation sync, preserving Backend-only stopped/archive rows。
+- Worker-Workdir relationships are projected from `worker_workdir_links` as authority。
+- Runtime-scoped Worker spawn now writes pending Backend-managed Workdir rows, Worker registry rows, and Worker-Workdir links。
+- Worker stop now updates Backend Worker lifecycle and syncs linked Workdir status to present/removed/missing without deleting canonical rows。
+- Runtime Workdir observation/listing now syncs Runtime observations into Backend registry and projects safe `management_kind` (`backend_managed` / `runtime_unmanaged`)。
+- Existing `pinned` Worker retention is protected from ordinary Runtime sync/upsert clobbering。
+- Tests were added/strengthened for archive/link projection, unmanaged Workdir projection, raw path redaction, removed Workdir preservation, and pinned retention preservation。
+- Frontend type exposure for Workdir `management_kind` was added。
+
+Coder-reported validation passed:
+- `git diff --check`
+- `cargo test -p yoi-workspace-server --lib`
+- `cargo test -p worker-runtime --features ws-server,fs-store`
+- `cargo check -p yoi`
+- `cd web/workspace && deno task check && deno task test`
+- `yoi ticket doctor`
+- `nix build .#yoi --no-link`
+
+Next action:
+- Request focused external re-review against commits `3e5546ea..8695089f` and the whole Ticket acceptance criteria before merge/close decisions。
+
+---
+
+<!-- event: review author: reviewer at: 2026-07-10T17:22:14Z status: request_changes -->
+
+## Review: request changes
+
+Focused re-review result: request_changes
+
+Evidence reviewed:
+- Implementation worktree is on `work/00001KX6BPY7M-worker-workdir-registry` at `8695089fba346b8f10d55016b8328337e1c37445`, clean。
+- Follow-up fixes most prior blockers:
+  - Worker list now syncs Runtime observations, then projects from `worker_registry` / `worker_workdir_links` (`workers_response`, `merge_worker_registry_projection`)。
+  - Runtime Worker create now writes pending Backend Workdir rows, records Worker rows, and links selected/materialized Workdirs。
+  - Stop path now updates Worker lifecycle and attempts linked Workdir status sync。
+  - Store upsert preserves existing `pinned` when a Runtime sync supplies `normal`。
+  - New registry records still do not store raw materialized Runtime paths。
+
+Blocker:
+- Unmanaged Runtime Workdirs are now mixed into normal Backend-managed Browser lists / launch options。
+  - Ticket requires Runtime-direct/unmanaged Workdirs to be distinguishable and “not mixed into managed lists” (`item.md:61`)。
+  - Follow-up syncs unknown Runtime Workdirs as `runtime_unmanaged`, but `working_directory_summaries()` returns all `workdir_registry` rows via `list_workdir_registry()` (`server.rs:3300-3308`)。
+  - This feeds Browser launch options (`server.rs:3278`) and the workspace-scoped Workdirs list。
+  - The worker-new UI select iterates `options.working_directories` without filtering or labeling `management_kind`, so a `runtime_unmanaged` Workdir can appear/select like a normal managed Workdir。
+  - This is not a safe typed UI distinction and does not satisfy the Backend-managed vs unmanaged boundary。
+
+Non-blocking notes:
+- Runtime-scoped Workdir lists being typed from registry is a good direction。
+- Consider ensuring detail/cleanup/create responses also project through `workdir_summary_from_record`; several paths still return Runtime summaries with `management_kind: None`, even after storing a typed Backend record。
+
+---
+
+<!-- event: implementation_report author: orchestrator at: 2026-07-10T17:32:02Z -->
+
+## Implementation report
+
+Second follow-up implementation progress report:
+
+- Coder Pod `yoi-coder-00001KX6BPY7M-worker-workdir` completed the focused unmanaged-workdir fix and committed `239f93b084fdcc2201e17fcdbc23eb0140531f16 fix: keep unmanaged workdirs out of managed lists` on branch `work/00001KX6BPY7M-worker-workdir-registry`。
+- Implementation worktree status was clean at Orchestrator inspection。
+- Orchestrator inspected branch log / commit stats / `git diff --check 86f652a7..HEAD` in the implementation worktree。
+
+Coder-reported fix summary:
+- Workspace-scoped Browser Workdir summaries / launch options now include only `backend_managed` Workdir registry rows。
+- Runtime-direct/unmanaged Workdirs remain visible through runtime-scoped projection with explicit `management_kind: runtime_unmanaged`。
+- Tests prove:
+  - `runtime_unmanaged` rows are excluded from managed Browser Workdir summaries / launch options。
+  - unmanaged rows remain distinguishable in runtime projection。
+  - store-level managed listing excludes unmanaged rows while all-row listing still includes them。
+
+Coder-reported validation passed:
+- `git diff --check`
+- `cargo test -p yoi-workspace-server --lib`
+- `cargo test -p worker-runtime --features ws-server,fs-store`
+- `cargo check -p yoi`
+- `cd web/workspace && deno task check && deno task test`
+- `yoi ticket doctor`
+- `nix build .#yoi --no-link`
+
+Next action:
+- Request focused re-review on remaining unmanaged-list blocker and full acceptance status before merge/close decisions。
+
+---
+
+<!-- event: review author: reviewer at: 2026-07-10T17:35:29Z status: approve -->
+
+## Review: approve
+
+Focused re-review result: approve
+
+Evidence:
+- Follow-up `239f93b084fdcc2201e17fcdbc23eb0140531f16` is present on the requested branch/worktree; worktree was clean during inspection。
+- Remaining blocker is fixed:
+  - Workspace-scoped Browser launch options still use `working_directory_summaries()`, and that now lists only `backend_managed` rows after Runtime observation sync (`server.rs:3279-3308`)。
+  - Store filtering is explicit in `list_managed_workdir_registry()` with `management_kind = 'backend_managed'` (`store.rs:376-392`)。
+  - Runtime-scoped Workdir projection still lists registry rows for the Runtime and preserves explicit `management_kind`, so `runtime_unmanaged` remains diagnosable (`server.rs:3310-3317`, `workdir_summary_from_record`)。
+- Previous blockers sanity-checked:
+  - Worker list syncs Runtime observations then projects from Backend `worker_registry` / link authority (`server.rs:2564-2583`, `merge_worker_registry_projection`)。
+  - Runtime Worker create prepares pending Workdir rows, syncs Worker observations, and links Workdirs (`server.rs:2295-2352`)。
+  - Stop path preserves canonical records and updates Worker/linked Workdir statuses without deleting registry rows (`server.rs:2399-2443`)。
+  - Pinned retention is protected from normal Runtime sync by store upsert `CASE` logic (`store.rs:220-243`)。
+  - New Backend registry structs/schema store ids/status/metadata only; inspected Browser summaries do not expose raw Runtime materialized paths。
+- Focused validation run:
+  - `cargo test -p yoi-workspace-server --lib workdir -- --nocapture` passed 3/3 relevant tests, including managed-list exclusion, unmanaged runtime projection, and pinned/registry roundtrip coverage。
+
+Non-blocking note:
+- Some runtime detail/create response paths still return direct Runtime summaries with `management_kind: None`; list/options surfaces required by this Ticket are now safe, but projecting details through Backend records would make diagnostics more uniformly typed later。
+
+---
+
+<!-- event: implementation_report author: orchestrator at: 2026-07-10T17:38:03Z -->
+
+## Implementation report
+
+Merge / final validation report:
+
+- Reviewer approved the implementation after the final focused fix。
+- Merged branch `work/00001KX6BPY7M-worker-workdir-registry` into orchestration branch with merge commit `03652f82 merge: worker workdir registry`。
+- Ticket record conflicts from child branch were resolved in favor of Orchestrator-authoritative Ticket records; implementation code changes were merged。
+- Final validation was rerun in `/home/hare/Projects/yoi/.worktree/orchestration` after merge。
+
+Validation passed:
+- `git diff --check`
+- `cargo test -p yoi-workspace-server --lib`
+- `cargo test -p worker-runtime --features ws-server,fs-store`
+- `cargo check -p yoi`
+- `cd web/workspace && deno task check`
+- `cd web/workspace && deno task test`
+- `yoi ticket doctor`
+- `nix build .#yoi --no-link`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/worker-workdir-final-validation-1783704956.txt`
+
+Reviewed/merged implementation commits:
+- `3e5546ea feat: add backend worker workdir registry`
+- `8695089f fix: sync backend worker registry projections`
+- `239f93b0 fix: keep unmanaged workdirs out of managed lists`
+
+---
+
+<!-- event: state_changed author: orchestrator at: 2026-07-10T17:38:06Z from: inprogress to: done reason: implementation_validated field: state -->
+
+## State changed
+
+Implementation was reviewed, merged into orchestration branch, and final validation passed. Moving to done before closure.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-07-10T17:38:20Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-07-10T17:38:20Z status: closed -->
+
+## 完了
+
+Backend Worker/Workdir registry and link model を実装・レビュー・merge・検証した。
+
+実装内容:
+- Backend SQLite schema に `worker_registry`, `workdir_registry`, `worker_workdir_links` を追加。
+- Worker registry / Workdir registry / Worker-Workdir link の typed store API と projection を追加。
+- Backend 経由の Workdir 作成で Runtime materialization 前に Backend-managed pending row を作成。
+- Backend / Runtime scoped Worker creation で Worker registry row、Workdir registry row、Worker-Workdir link を同期。
+- Worker list は Runtime observation を同期したうえで Backend `worker_registry` / link authority から projection。
+- Worker stop は canonical registry row を削除せず、Worker lifecycle と linked Workdir status を同期。
+- Workdir list / launch options は Backend-managed rows を基準にし、`runtime_unmanaged` Workdirs は managed Browser list/options に混ぜず runtime/diagnostic projection で区別可能にした。
+- `pinned` retention が通常 Runtime sync で `normal` に clobber されないよう保護。
+- Browser-facing summaries に safe `management_kind` を追加し、raw Runtime materialized path を Backend registry / Browser response に保存・表示しない方針を維持。
+
+Review:
+- 初回 review は 5 blocker で `request_changes`。
+- `8695089f fix: sync backend worker registry projections` で主要 blocker を修正。
+- 2回目 review は unmanaged Workdir が managed list/options に混ざる blocker で `request_changes`。
+- `239f93b0 fix: keep unmanaged workdirs out of managed lists` で残 blocker を修正。
+- 最終 focused re-review は `approve`。
+
+Merge / validation:
+- Merge commit: `03652f82 merge: worker workdir registry`。
+- Final validation passed:
+  - `git diff --check`
+  - `cargo test -p yoi-workspace-server --lib`
+  - `cargo test -p worker-runtime --features ws-server,fs-store`
+  - `cargo check -p yoi`
+  - `cd web/workspace && deno task check`
+  - `cd web/workspace && deno task test`
+  - `yoi ticket doctor`
+  - `nix build .#yoi --no-link`
+- Validation log: `/run/user/1000/yoi/yoi-orchestrator/bash-output/worker-workdir-final-validation-1783704956.txt`
+
+Non-blocking follow-up noted by reviewer:
+- Some runtime detail/create response paths still return direct Runtime summaries with `management_kind: None`; list/options surfaces required by this Ticket are safe, but a future cleanup can project detail responses through Backend records for more uniform diagnostics。
+
+---

.yoi/tickets/00001KX6CRVBE/artifacts/orchestration-plan.jsonl

@@ -0,0 +1,3 @@
+{"id":"orch-plan-20260710-164538-1","ticket_id":"00001KX6CRVBE","kind":"after","related_ticket":"00001KX6BPY7M","note":"Ticket body explicitly states this is a follow-up to `00001KX6BPY7M`. The prerequisite registry/link model is currently inprogress on branch `work/00001KX6BPY7M-worker-workdir-registry` and under external review. Start this cleanup/delete Ticket only after that branch is approved/merged or an explicit combined-work decision is made.","author":"orchestrator","at":"2026-07-10T16:45:38Z"}
+{"id":"orch-plan-20260710-164549-2","ticket_id":"00001KX6CRVBE","kind":"waiting_capacity_note","note":"Queue review after Dashboard authorization. `00001KX6CRVBE` is otherwise well specified, but it depends on the Backend Worker/Workdir registry/link model from `00001KX6BPY7M`, which is currently inprogress/review. Starting now would duplicate/conflict with store schema, server APIs, and Worker/Workdir projections. Leave queued until `00001KX6BPY7M` is approved/merged; then re-route/start from updated orchestration branch.","author":"orchestrator","at":"2026-07-10T16:45:49Z"}
+{"id":"orch-plan-20260710-173850-3","ticket_id":"00001KX6CRVBE","kind":"accepted_plan","accepted_plan":{"summary":"Implement manual Worker/Workdir delete and cleanup operations on top of the merged Backend Worker/Workdir registry/link model. Keep cleanup manual-first with stale revision/digest checks, pinned protection, running-linked Workdir blocks, dirty discard confirmation, raw path redaction, and Browser plan preview/execution surfaces.","branch":"work/00001KX6CRVBE-manual-cleanup","worktree":"/home/hare/Projects/yoi/.worktree/00001KX6CRVBE-manual-cleanup","role_plan":"Orchestrator accepts queued Ticket after prerequisite `00001KX6BPY7M` was approved, merged, validated, closed, and its implementation worktree/branch cleaned. Use sibling Coder for implementation in a dedicated worktree, then sibling Reviewer for read-only review. Orchestrator retains merge/validation/close authority."},"author":"orchestrator","at":"2026-07-10T17:38:50Z"}

.yoi/tickets/00001KX6CRVBE/item.md

@@ -1,8 +1,8 @@
 ---
 title: 'Add manual delete and cleanup operations for Workers and workdirs'
-state: 'queued'
+state: 'closed'
 created_at: '2026-07-10T16:11:33Z'
-updated_at: '2026-07-10T16:45:14Z'
+updated_at: '2026-07-10T18:37:40Z'
 assignee: null
 queued_by: 'workspace-panel'
 queued_at: '2026-07-10T16:45:14Z'

.yoi/tickets/00001KX6CRVBE/resolution.md

@@ -0,0 +1,31 @@
+Manual Worker/Workdir delete and cleanup operations を実装・レビュー・merge・検証した。
+
+実装内容:
+- Backend Worker registry row の pin/unpin API を追加し、Worker list/detail に `pinned` / `retention_state` を返すようにした。
+- Runtime ごとの manual cleanup plan API を追加し、Backend Worker/Workdir/link registry と Runtime observation に基づいて Worker delete / Workdir cleanup/delete candidates を生成するようにした。
+- Plan candidate は action kind、reason/blocking reason、linked Worker/Workdir ids、pinned state、cleanliness/file status、running-link status、safe な reclaim bytes placeholder を含む。
+- Manual cleanup execution API は expected plan revision/digest を要求し、stale plan を拒否する。
+- Pinned Worker/history delete、running-linked Workdir cleanup、dirty/unknown Workdir の confirmation なし discard を拒否する。
+- Removed/missing Workdir registry record delete は安全条件のもとで separate action として扱う。
+- Runtime-observed/materialized Workdirs は trusted clean evidence なしに `clean` とせず、`unknown` として扱い、normal clean cleanup ではなく explicit discard confirmation path に乗せる。
+- Browser UI に Runtime Workdirs cleanup preview/execution と Worker pin/unpin controls を追加した。
+- UI では verified-clean cleanup と dirty/unknown-state discard を区別し、raw Runtime materialized path を表示しない。
+
+Review:
+- 初回 review は dirty Workdir safety の実データ経路が不十分として `request_changes`。
+- `361569a6 fix: require discard confirmation for unknown workdirs` で observed Workdir を `unknown` 扱いにし、unknown/dirty cleanup に explicit confirmation を要求するよう修正。
+- focused re-review は `approve`。
+- `estimated_reclaim_bytes: None` は safe size source が未実装のため許容と判断された。
+
+Merge / validation:
+- Merge commit: `4970a58c merge: manual worker workdir cleanup`。
+- Final validation passed:
+  - `git diff --check`
+  - `cargo test -p yoi-workspace-server --lib`
+  - `cargo test -p worker-runtime --features ws-server,fs-store`
+  - `cargo check -p yoi`
+  - `cd web/workspace && deno task check`
+  - `cd web/workspace && deno task test`
+  - `yoi ticket doctor`
+  - `nix build .#yoi --no-link`
+- Validation log: `/run/user/1000/yoi/yoi-orchestrator/bash-output/manual-cleanup-final-validation-1783708592.txt`

.yoi/tickets/00001KX6CRVBE/thread.md

@@ -78,4 +78,282 @@ Marked ready by `yoi ticket state`.
 Ticket を `workspace-panel` が queued にしました。
 
 
+---
+
+<!-- event: decision author: orchestrator at: 2026-07-10T16:46:04Z -->
+
+## Decision
+
+Routing decision: blocked_by_dependency_or_missing_authority
+
+Reason:
+- Ticket is a manual delete / cleanup follow-up that depends on the Backend Worker/Workdir registry and link authority from `00001KX6BPY7M`。
+- `00001KX6BPY7M` is currently `inprogress` on branch `work/00001KX6BPY7M-worker-workdir-registry` and under external review。
+- This Ticket touches the same store schema, server APIs, Worker/Workdir projections, retention/managed-unmanaged semantics, and cleanup safety rules。
+- Starting this Ticket now would create a high-conflict parallel branch and could implement delete/cleanup behavior against an unreviewed registry model。
+- Therefore this routing pass leaves the Ticket queued and does not record `queued -> inprogress`, create a worktree, or spawn role Pods。
+
+Evidence checked:
+- Ticket body / thread / artifacts。
+- `TicketRelationQuery(00001KX6CRVBE)`: 0 typed relations, but Ticket body/order context makes `00001KX6BPY7M` a practical implementation prerequisite。
+- `TicketOrchestrationPlanQuery(00001KX6CRVBE)`: prior record 0 件だったため、今回 `after 00001KX6BPY7M` と waiting-capacity note を記録。
+- `TicketList`: queued はこの Ticket 1件、inprogress は `00001KX6BPY7M` 1件。
+- Orchestrator worktree git status: clean on `orchestration`。
+
+Next action:
+- `00001KX6BPY7M` の implementation/review/merge outcome を待つ。
+- registry/link model が merge されたら、この Ticket を再 routing し、updated orchestration branch から start する。
+
+Escalate if:
+- 人間が `00001KX6BPY7M` とこの Ticket を同一 combined worktree で統合実装する方針に切り替えたい場合。
+
+---
+
+<!-- event: decision author: orchestrator at: 2026-07-10T17:39:00Z -->
+
+## Decision
+
+Routing decision: accept for implementation
+
+Reason:
+- Previously recorded prerequisite `00001KX6BPY7M` has now been reviewed, merged into orchestration branch, final-validated, closed, and its child implementation worktree/branch cleaned up。
+- `TicketRelationQuery(00001KX6CRVBE)` shows no typed blockers。
+- Queue contains this Ticket and there are no other `inprogress` Tickets。
+- Ticket is concrete and well scoped: manual Worker delete / Workdir cleanup plan and execution on top of Backend Worker/Workdir registry/link authority。
+
+Accepted plan:
+- Create dedicated implementation worktree `/home/hare/Projects/yoi/.worktree/00001KX6CRVBE-manual-cleanup` on branch `work/00001KX6CRVBE-manual-cleanup` from current orchestration branch。
+- Route implementation to sibling Coder Pod。
+- Route external review to sibling Reviewer Pod after Coder commit/validation。
+- Orchestrator retains merge, final validation, Ticket close, and cleanup authority。
+
+Design constraints for implementation:
+- Cleanup/delete is manual-first only; no automatic prune policy。
+- Worker lifecycle remains `running -> stopped -> delete`; do not introduce `archived` lifecycle state。
+- `pinned` Worker/history is protected in plan generation and execution。
+- Workdir file cleanup blocks when linked to running Workers。
+- Dirty Workdir discard is explicit and separate from ordinary clean cleanup。
+- Execution must reject stale plan revision/digest。
+- Browser-facing responses/UI must not expose raw Runtime paths。
+- Workdir/Worker canonical records should remain Backend/registry based and safe after execution。
+
+---
+
+<!-- event: state_changed author: orchestrator at: 2026-07-10T17:39:03Z from: queued to: inprogress reason: accepted_for_implementation field: state -->
+
+## State changed
+
+Prerequisite registry/link model is now closed and merged. Accepting queued manual cleanup Ticket for implementation before creating worktree or spawning role Pods.
+
+---
+
+<!-- event: implementation_report author: orchestrator at: 2026-07-10T18:13:40Z -->
+
+## Implementation report
+
+Implementation progress report:
+
+- Coder Pod `yoi-coder-00001KX6CRVBE-manual-cleanup` completed implementation in `/home/hare/Projects/yoi/.worktree/00001KX6CRVBE-manual-cleanup` on branch `work/00001KX6CRVBE-manual-cleanup`。
+- Implementation commit: `ba44391acfdb8076c06ced9324b74d6cc63910ab feat: add manual worker workdir cleanup`。
+- Orchestrator inspected the worktree status, branch log, commit stats, and `git diff --check 5f762a6c..HEAD`; worktree was clean and diff check passed。
+
+Coder-reported implementation summary:
+- Added Backend Worker retention APIs for pin/unpin registry rows; Worker list/detail carries `pinned` / `retention_state`; pin/unpin mutates Backend registry only and does not affect Runtime processes。
+- Added manual Runtime cleanup plan API with separate Worker delete and Workdir cleanup/delete candidates, action kind, reason/blocking reason, linked ids, pinned state, cleanliness/file status, running-link state, and safe reclaim-byte placeholder。
+- Added manual cleanup execution API requiring expected plan revision/digest; rejects stale plans, pinned Worker/history delete, running-linked Workdir cleanup, and dirty cleanup without explicit discard confirmation; allows safe removed/missing Workdir registry deletion。
+- Added Browser UI for manual cleanup preview/execution on Runtime Workdirs page and Backend-only pin/unpin controls on Worker page。
+- Added focused tests for plan generation, stale rejection, pinned protection, running-linked Workdir blocking, dirty confirmation, removed/missing record delete, and raw path redaction。
+
+Coder-reported validation passed:
+- `git diff --check`
+- `cargo test -p yoi-workspace-server --lib`
+- `cargo test -p worker-runtime --features ws-server,fs-store`
+- `cargo check -p yoi`
+- `cd web/workspace && deno task check && deno task test`
+- `yoi ticket doctor`
+- `nix build .#yoi --no-link`
+
+Next action:
+- Route to external Reviewer Pod before merge/close decisions。
+
+---
+
+<!-- event: review author: reviewer at: 2026-07-10T18:19:11Z status: request_changes -->
+
+## Review: request changes
+
+External review result: request_changes
+
+Blocker:
+- Dirty Workdir safety is not implemented against real Runtime/filesystem state。
+- Cleanup plan decides `WorkdirDirtyDiscard` solely from `WorkdirRegistryRecord.cleanliness` (`crates/workspace-server/src/server.rs:1689-1695`)。
+- Runtime observation sync always writes `cleanliness: "clean"` for observed Workdirs (`server.rs:4179-4199`) and there is no code outside tests that records `"dirty"` (`rg "cleanliness.*dirty|dirty.*cleanliness"` only finds plan/test use)。
+- Execution then treats such targets as `WorkdirCleanCleanup` and calls Runtime cleanup without dirty confirmation (`server.rs:1851-1852`)。
+- Runtime cleanup uses forced removal (`crates/worker-runtime/src/working_directory.rs:505-508`)。
+- This violates acceptance items requiring safe dirty/clean status representation and explicit confirmation before dirty discard。
+
+Test gap:
+- The dirty confirmation test seeds a synthetic registry row with `cleanliness = "dirty"` (`server.rs:5436-5449`, `5551-5580`), so it does not catch the real path where Runtime/workdir sync overwrites or fails to detect dirty files。
+
+Positive evidence:
+- pin/unpin API/routes and retention projection exist (`server.rs:1544-1584`, `2032-2072`, `4008-4022`)。
+- plan/execution endpoints include digest/revision stale checks and pinned/running-link blocking (`server.rs:1766-1840`)。
+- UI preview/execution and pin controls are present without raw path fields。
+
+Non-blocking note:
+- `estimated_reclaim_bytes` is present but always `None`; confirm whether “when safe” requires actual byte estimation before approval。
+
+---
+
+<!-- event: implementation_report author: orchestrator at: 2026-07-10T18:30:52Z -->
+
+## Implementation report
+
+Follow-up implementation progress report after request_changes:
+
+- Coder Pod `yoi-coder-00001KX6CRVBE-manual-cleanup` completed the dirty/unknown Workdir safety fix and committed `361569a69efcba929b59b9c48113add5499d5068 fix: require discard confirmation for unknown workdirs`。
+- Orchestrator inspected the implementation worktree status, branch log, commit stats, and `git diff --check 5f762a6c..HEAD`; worktree was clean and diff check passed。
+
+Coder-reported fix summary:
+- Runtime-observed/materialized Workdirs are no longer marked `clean` without trusted clean evidence。
+- Observed Workdirs now sync as `cleanliness: "unknown"`。
+- Cleanup plan downgrades stale `clean` registry rows to `unknown` when real Runtime observation exists。
+- Present Workdirs with `cleanliness: "unknown"` or `dirty` are classified as discard-confirmation targets, not normal clean cleanup。
+- Direct Workdir cleanup rejects unknown/dirty Workdirs and requires the cleanup execution API with explicit discard confirmation。
+- Browser UI labels distinguish verified-clean cleanup from dirty/unknown-state discard。
+- `estimated_reclaim_bytes` remains intentionally `None` unless a safe estimate is available。
+
+Regression tests added/updated:
+- Real observed Workdir without verified clean evidence is classified as `unknown` and `WorkdirDirtyDiscard`。
+- Normal/direct cleanup is rejected for unknown Workdir state。
+- Dirty/unknown discard requires explicit confirmation。
+- Stale `clean` registry state is downgraded when Runtime observation exists。
+- Existing path-safe cleanup test uses explicit cleanup execution confirmation。
+
+Coder-reported validation passed:
+- `git diff --check`
+- `cargo test -p yoi-workspace-server --lib`
+- `cargo test -p worker-runtime --features ws-server,fs-store`
+- `cargo check -p yoi`
+- `cd web/workspace && deno task check && deno task test`
+- `yoi ticket doctor`
+- `nix build .#yoi --no-link`
+
+Next action:
+- Request focused re-review on the dirty/unknown Workdir blocker and overall acceptance status before merge/close decisions。
+
+---
+
+<!-- event: review author: reviewer at: 2026-07-10T18:36:11Z status: approve -->
+
+## Review: approve
+
+Focused re-review result: approve
+
+Evidence:
+- Dirty/unknown blocker is fixed。
+- Runtime/materialized Workdirs now sync as `cleanliness: "unknown"` (`crates/workspace-server/src/server.rs:4208`; pending create also around `1400`)。
+- Cleanup planning downgrades any live-observed non-dirty row to unknown before action selection (`server.rs:1689-1701`)。
+- Unknown/dirty present Workdirs become `WorkdirDirtyDiscard` with explicit-confirmation reasons (`server.rs:1721-1725`)。
+- Direct Workdir DELETE rejects that path before calling Runtime cleanup (`server.rs:1491-1509`)。
+- Execution still checks expected revision + digest for staleness (`server.rs:1780-1788`), blocks pinned/running-linked Workdirs (`server.rs:1703-1707`, `1834-1839`), and requires `confirm_dirty_discard_target_ids` before forced Runtime cleanup for dirty/unknown targets (`server.rs:1842-1850`)。
+- Normal clean cleanup is only reachable for `clean` candidates (`server.rs:1698-1699`, `1860-1861`)。
+
+No observed regressions in reviewed acceptance points:
+- Pinned Worker deletion remains blocked (`server.rs:1811-1816`)。
+- Workdir record delete remains separate for removed/missing (`server.rs:1696-1697`, `1869-1879`)。
+- Plan responses expose ids/status/reasons/links/retention but not raw paths (`server.rs:620-633`)。
+- UI labels dirty/unknown discard distinctly from verified-clean cleanup with a separate confirm checkbox (`web/workspace/.../workdirs/+page.svelte`)。
+- `estimated_reclaim_bytes: None` is acceptable here because no safe size source is implemented/exposed; the optional field is present and avoids raw-path traversal/leakage。
+
+Validation performed by reviewer:
+- `cargo test -p yoi-workspace-server cleanup --lib` passed。
+- Targeted regression tests `observed_workdir_without_verified_clean_evidence_requires_discard_confirmation` and `stale_clean_registry_row_is_downgraded_by_real_observation_before_cleanup` passed。
+- `git diff --check HEAD^..HEAD` passed。
+
+---
+
+<!-- event: implementation_report author: orchestrator at: 2026-07-10T18:37:23Z -->
+
+## Implementation report
+
+Merge / final validation report:
+
+- Reviewer approved the implementation after the dirty/unknown Workdir safety fix。
+- Merged branch `work/00001KX6CRVBE-manual-cleanup` into orchestration branch with merge commit `4970a58c merge: manual worker workdir cleanup`。
+- Ticket record conflicts from child branch were resolved in favor of Orchestrator-authoritative Ticket records; implementation code changes were merged。
+- Final validation was rerun in `/home/hare/Projects/yoi/.worktree/orchestration` after merge。
+
+Validation passed:
+- `git diff --check`
+- `cargo test -p yoi-workspace-server --lib`
+- `cargo test -p worker-runtime --features ws-server,fs-store`
+- `cargo check -p yoi`
+- `cd web/workspace && deno task check`
+- `cd web/workspace && deno task test`
+- `yoi ticket doctor`
+- `nix build .#yoi --no-link`
+
+Validation log:
+- `/run/user/1000/yoi/yoi-orchestrator/bash-output/manual-cleanup-final-validation-1783708592.txt`
+
+Reviewed/merged implementation commits:
+- `ba44391a feat: add manual worker workdir cleanup`
+- `361569a6 fix: require discard confirmation for unknown workdirs`
+
+---
+
+<!-- event: state_changed author: orchestrator at: 2026-07-10T18:37:27Z from: inprogress to: done reason: implementation_validated field: state -->
+
+## State changed
+
+Implementation was reviewed, merged into orchestration branch, and final validation passed. Moving to done before closure.
+
+---
+
+<!-- event: state_changed author: hare at: 2026-07-10T18:37:40Z from: done to: closed reason: closed field: state -->
+
+## State changed
+
+Ticket を closed にしました。
+
+
+---
+
+<!-- event: close author: hare at: 2026-07-10T18:37:40Z status: closed -->
+
+## 完了
+
+Manual Worker/Workdir delete and cleanup operations を実装・レビュー・merge・検証した。
+
+実装内容:
+- Backend Worker registry row の pin/unpin API を追加し、Worker list/detail に `pinned` / `retention_state` を返すようにした。
+- Runtime ごとの manual cleanup plan API を追加し、Backend Worker/Workdir/link registry と Runtime observation に基づいて Worker delete / Workdir cleanup/delete candidates を生成するようにした。
+- Plan candidate は action kind、reason/blocking reason、linked Worker/Workdir ids、pinned state、cleanliness/file status、running-link status、safe な reclaim bytes placeholder を含む。
+- Manual cleanup execution API は expected plan revision/digest を要求し、stale plan を拒否する。
+- Pinned Worker/history delete、running-linked Workdir cleanup、dirty/unknown Workdir の confirmation なし discard を拒否する。
+- Removed/missing Workdir registry record delete は安全条件のもとで separate action として扱う。
+- Runtime-observed/materialized Workdirs は trusted clean evidence なしに `clean` とせず、`unknown` として扱い、normal clean cleanup ではなく explicit discard confirmation path に乗せる。
+- Browser UI に Runtime Workdirs cleanup preview/execution と Worker pin/unpin controls を追加した。
+- UI では verified-clean cleanup と dirty/unknown-state discard を区別し、raw Runtime materialized path を表示しない。
+
+Review:
+- 初回 review は dirty Workdir safety の実データ経路が不十分として `request_changes`。
+- `361569a6 fix: require discard confirmation for unknown workdirs` で observed Workdir を `unknown` 扱いにし、unknown/dirty cleanup に explicit confirmation を要求するよう修正。
+- focused re-review は `approve`。
+- `estimated_reclaim_bytes: None` は safe size source が未実装のため許容と判断された。
+
+Merge / validation:
+- Merge commit: `4970a58c merge: manual worker workdir cleanup`。
+- Final validation passed:
+  - `git diff --check`
+  - `cargo test -p yoi-workspace-server --lib`
+  - `cargo test -p worker-runtime --features ws-server,fs-store`
+  - `cargo check -p yoi`
+  - `cd web/workspace && deno task check`
+  - `cd web/workspace && deno task test`
+  - `yoi ticket doctor`
+  - `nix build .#yoi --no-link`
+- Validation log: `/run/user/1000/yoi/yoi-orchestrator/bash-output/manual-cleanup-final-validation-1783708592.txt`
+
 ---