feat(agent-org): [6/10] separate irreversible Archive from physical Delete

[ShiboSheng]

Effort

Delivery boundary	P50	P90	Substantive files
Archive fence, bounded teardown, and Archived-only Delete	1,900 review lines	3,500 review lines	14–23

Delivery contract

Dependency and single goal

Stack on PR 5 and complete the permanent-close and physical-delete boundaries of Team lifecycle. Archive reuses Pause teardown primitives, PR 3 Turn/runtime identity, and PR 4's narrow SystemArchiveOrRecovery Task transition, but owns a separate irreversible receipt.

State after merge

Once the Archive command commits, the Team is permanently Archived. Every composer, Task mutation, Inbox write/claim, Wake, Resume, and Provider start is rejected. Existing runtimes tear down in parallel and within a bound in the background; failure leaves only a diagnosable receipt and never reopens the Team. Archived history remains readable through pagination. Physical Delete is allowed only after the user confirms again in the danger area and only for an Archived Team that is no longer running.

Implementation steps and authoritative entry points

1. Archive accepts only Idle/Working/Paused/Failed; Starting returns typed team_not_ready. With a stable request/receipt, one transaction writes the Archived fence, generation, and archived_at, and uses PR 4's system actor with structured reasons to cancel every nonterminal formal Task, pending formal/user-directed Turn, Inbox delivery, Plan Approval, and active intervention without creating a continuation.
2. After commit, the teardown owner stops Root, Member, Rust runtime, and Provider in parallel and writes each bounded attempt back to the same receipt. Retry at most three times and no longer than 60 seconds total.
3. Every Wake, callback, recovery path, and Task/Inbox Store rechecks Archived/generation at commit. A late result can only be rejected or audited.
4. Run View, Group, and Task history are read-only for Archived Teams. The UI shows neither Resume nor a composer.
5. Delete is a separate command. It first verifies Archived and no current runtime owner, then deletes Agent Org-owned rows in foreign-key order. Generic Session Delete detects Agent Org ownership, fails closed, and directs the user to Team Delete. Ordinary SDE Sessions and other Teams are outside the deletion scope.

Primary files and entry points

state/commands/session/org_tasks/lifecycle.rs, agent_org_runs/{store,worker}.rs, Task/Inbox Store gates, Archive receipt persistence, Run View/Group projection guards, Overview danger-zone Archive/Delete UI, and Tauri wire.

Scope boundaries

Do not automatically Archive Idle or Failed Teams. Do not allow Unarchive. Delete never performs Archive implicitly. A teardown error never rolls back the durable fence. Archived is not a compatibility alias for old completed/cancelled/abandoned states.

Failure scenarios that must be rejected or remain no-ops

• Wake, Provider, or Resume after Archive.
• A callback commits a formal result after the fence.
• Teardown failure reopens the Team.
• Automatic retries continue beyond three attempts or 60 seconds.
• The same request creates more than one receipt.
• Delete accepts a non-Archived Team.
• Delete silently performs Archive.
• Cascading deletion removes ordinary SDE data.

Acceptance and handoff

Verify Archive/Wake/callback/restart races, fault injection before and after commit, retained-runtime receipts, the three-attempt/60-second fake-clock budget, referential integrity, preservation assertions across Teams and ordinary SDE, and rendered danger-zone UI E2E. After merge, lifecycle and Task/Turn teardown contracts are frozen. Every PR 7–10 entry point must reuse the Paused/Archived hard gates rather than inventing its own terminal test.

Plain-language contract

Dependency

PRs 1–5.

How it works

Archive accepts Idle/Working/Paused/Failed and rejects Starting. One transaction first writes the irreversible Archived fence, cancels open Tasks and pending Turns/Inbox/Approvals, and closes intervention. Only after commit does the system stop Root/Member runtimes in parallel. Teardown attempts at most three times and for at most 60 seconds total. Delete is another command and removes only an Archived Team whose runtimes are quiescent.

State after merge

Archived is permanently read-only. Every send, Task, Inbox, Wake, Resume, or Provider start is rejected. Teardown failure leaves diagnostics and never reopens the Team. Ordinary Session Delete cannot secretly stand in for Archive.

Boundaries

Do not automatically Archive Idle/Failed, support Unarchive, or cascade into ordinary SDE or another Team.

How to test

Verify Archive/Wake/callback/restart races, crashes before and after commit, a three-attempt/60-second fake clock, retained-runtime receipts, Delete referential integrity, and the danger-zone second-confirmation E2E.