Limits, recovery, and cleanup

Current status: partial local authority, lifecycle, and offline-shell pieces. Complete recovery, durable-work retention, and deletion gates remain open.

Runtime lifecycle and hard budgets

The required lifecycle covers create, start, attach, pause, checkpoint, resume, stop, destroy, inspect, collect, archive, and delete. Durable leases, heartbeats, idle suspension, retry reconciliation, and orphan cleanup keep failures bounded. Hard budgets cover compute, storage, network, tokens, time, artifacts, logs, and cost. Capability revocation precedes Cell termination. Ephemeral and retained classes keep identical containment and authority boundaries.

Independent retention and verified deletion

Runtime, workspace, continuity, and evidence retention are independently policy-evaluated. Repository objects, candidate deltas, caches, checkpoints, events, provider records, Capsules, and indexes have explicit classes. Ephemeral cleanup must not discard required evidence. Explicit retention seals a checkpoint. Deletion removes private artifacts and derived index entries and emits a receipt.

Failure tests must reach documented safe states without duplicate consequences, lost approved artifacts, orphan authority, surviving post-stop capabilities, or undeleted private data.

Example: ending an ephemeral task destroys its private workspace while retaining required evidence for the configured period.

See lifecycle decisions and durable recovery.