[tmchow]

Summary

A ce-work unit finished through native fallback now gets its git worktree and refs/ce-work transport ref removed when complete-fallback succeeds, the same way an integrated unit does. Before this, those units ended native-completed with cleanup: null. Their worktrees stayed registered indefinitely and showed up in worktree-aware tools as abandoned work.

Fixes #2037

What changed in the controller

• complete-fallback runs the existing cleanup after its completion record is written, so the completion survives a cleanup failure.
• Non-abandon cleanup now accepts a native-completed unit when its completion receipt is valid, and records abandoned: false. Before, it refused anything except committed units. That meant an instruction to "call cleanup after FALLBACK_COMPLETED" could not have worked, because only --abandon got through and it recorded a completed unit as abandoned.
• If cleanup is interrupted, resume finishes it. Run discovery now treats any unit with cleanup still outstanding as unfinished, so a run that already passed plan-wide verification is found again instead of returning NOT_FOUND. This also covers an interrupted artifact prune on an integrated (cleaned) unit, which was already a gap.

Runs that were already affected by #2037 are repaired the next time resume runs on them.

Validation

• New tests in tests/skills/ce-work-unit-workspace-fallback.test.ts drive the issue's path: failed integration, exact restore, claim, native commit, then complete-fallback. They check that the worktree and ref are gone. An interruption case at each of the two crash points (after worktree removal, before artifact pruning) checks that automatic resume finds the verified run and finishes the cleanup. Both failed before the fix. I also confirmed that the artifact-prune case fails when discovery checks only for a missing cleanup record.
• bun run test (4960 pass, 0 fail), typecheck, release:validate, plugin:validate, and test:skill-guards all pass.
• The one-sentence change to references/cross-model-execution.md was evaluated before and after on Claude and Codex, one trial each, with a cell where cleanup was interrupted after completion. Before the change, Claude chose cleanup --abandon --expect-job .... After it, both hosts chose resume.

Security Disclosure

This change runs the controller's existing destructive cleanup (git worktree remove --force on the controller-owned unit workspace and update-ref -d on its transport ref) on a path that previously kept them. The existing safeguards still apply. Cleanup requires a valid native completion receipt, refuses a live worker, removes only the owned workspace path, and deletes the ref only if it still points at the recorded transport commit. Any uncommitted worker output in that workspace is discarded, because the accepted native commit replaces it.

Agent Disclosure

• Model: Claude Code · claude-opus-5-5

---

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T03:03:29.407691Z	b9562dd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.